1
// SPDX-License-Identifier: GPL-2.0-only
2
/*
3
 * Copyright (C) 2010 IBM Corporation
4
 * Copyright (C) 2010 Politecnico di Torino, Italy
5
 *                    TORSEC group -- https://security.polito.it
6
 *
7
 * Authors:
8
 * Mimi Zohar <[email protected]>
9
 * Roberto Sassu <[email protected]>
10
 *
11
 * See Documentation/security/keys/trusted-encrypted.rst
12
 */
13

14
#include <linux/uaccess.h>
15
#include <linux/module.h>
16
#include <linux/init.h>
17
#include <linux/slab.h>
18
#include <linux/parser.h>
19
#include <linux/string.h>
20
#include <linux/err.h>
21
#include <keys/user-type.h>
22
#include <keys/trusted-type.h>
23
#include <keys/encrypted-type.h>
24
#include <linux/key-type.h>
25
#include <linux/random.h>
26
#include <linux/rcupdate.h>
27
#include <linux/scatterlist.h>
28
#include <linux/ctype.h>
29
#include <crypto/aes.h>
30
#include <crypto/sha2.h>
31
#include <crypto/skcipher.h>
32
#include <crypto/utils.h>
33

34
#include "encrypted.h"
35
#include "ecryptfs_format.h"
36

37
static const char KEY_TRUSTED_PREFIX[] = "trusted:";
38
static const char KEY_USER_PREFIX[] = "user:";
39
static const char blkcipher_alg[] = "cbc(aes)";
40
static const char key_format_default[] = "default";
41
static const char key_format_ecryptfs[] = "ecryptfs";
42
static const char key_format_enc32[] = "enc32";
43
static unsigned int ivsize;
44
static int blksize;
45

46
#define KEY_TRUSTED_PREFIX_LEN (sizeof (KEY_TRUSTED_PREFIX) - 1)
47
#define KEY_USER_PREFIX_LEN (sizeof (KEY_USER_PREFIX) - 1)
48
#define KEY_ECRYPTFS_DESC_LEN 16
49
#define HASH_SIZE SHA256_DIGEST_SIZE
50
#define MAX_DATA_SIZE 4096
51
#define MIN_DATA_SIZE  20
52
#define KEY_ENC32_PAYLOAD_LEN 32
53

54
enum {
55
	Opt_new, Opt_load, Opt_update, Opt_err
56
};
57

58
enum {
59
	Opt_default, Opt_ecryptfs, Opt_enc32, Opt_error
60
};
61

62
static const match_table_t key_format_tokens = {
63
	{Opt_default, "default"},
64
	{Opt_ecryptfs, "ecryptfs"},
65
	{Opt_enc32, "enc32"},
66
	{Opt_error, NULL}
67
};
68

69
static const match_table_t key_tokens = {
70
	{Opt_new, "new"},
71
	{Opt_load, "load"},
72
	{Opt_update, "update"},
73
	{Opt_err, NULL}
74
};
75

76
static bool user_decrypted_data = IS_ENABLED(CONFIG_USER_DECRYPTED_DATA);
77
module_param(user_decrypted_data, bool, 0);
78
MODULE_PARM_DESC(user_decrypted_data,
79
	"Allow instantiation of encrypted keys using provided decrypted data");
80

81
static int aes_get_sizes(void)
82
{
83
	struct crypto_skcipher *tfm;
84

85
	tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
86
	if (IS_ERR(tfm)) {
87
		pr_err("encrypted_key: failed to alloc_cipher (%ld)\n",
88
		       PTR_ERR(tfm));
89
		return PTR_ERR(tfm);
90
	}
91
	ivsize = crypto_skcipher_ivsize(tfm);
92
	blksize = crypto_skcipher_blocksize(tfm);
93
	crypto_free_skcipher(tfm);
94
	return 0;
95
}
96

97
/*
98
 * valid_ecryptfs_desc - verify the description of a new/loaded encrypted key
99
 *
100
 * The description of a encrypted key with format 'ecryptfs' must contain
101
 * exactly 16 hexadecimal characters.
102
 *
103
 */
104
static int valid_ecryptfs_desc(const char *ecryptfs_desc)
105
{
106
	int i;
107

108
	if (strlen(ecryptfs_desc) != KEY_ECRYPTFS_DESC_LEN) {
109
		pr_err("encrypted_key: key description must be %d hexadecimal "
110
		       "characters long\n", KEY_ECRYPTFS_DESC_LEN);
111
		return -EINVAL;
112
	}
113

114
	for (i = 0; i < KEY_ECRYPTFS_DESC_LEN; i++) {
115
		if (!isxdigit(ecryptfs_desc[i])) {
116
			pr_err("encrypted_key: key description must contain "
117
			       "only hexadecimal characters\n");
118
			return -EINVAL;
119
		}
120
	}
121

122
	return 0;
123
}
124

125
/*
126
 * valid_master_desc - verify the 'key-type:desc' of a new/updated master-key
127
 *
128
 * key-type:= "trusted:" | "user:"
129
 * desc:= master-key description
130
 *
131
 * Verify that 'key-type' is valid and that 'desc' exists. On key update,
132
 * only the master key description is permitted to change, not the key-type.
133
 * The key-type remains constant.
134
 *
135
 * On success returns 0, otherwise -EINVAL.
136
 */
137
static int valid_master_desc(const char *new_desc, const char *orig_desc)
138
{
139
	int prefix_len;
140

141
	if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
142
		prefix_len = KEY_TRUSTED_PREFIX_LEN;
143
	else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
144
		prefix_len = KEY_USER_PREFIX_LEN;
145
	else
146
		return -EINVAL;
147

148
	if (!new_desc[prefix_len])
149
		return -EINVAL;
150

151
	if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
152
		return -EINVAL;
153

154
	return 0;
155
}
156

157
/*
158
 * datablob_parse - parse the keyctl data
159
 *
160
 * datablob format:
161
 * new [<format>] <master-key name> <decrypted data length> [<decrypted data>]
162
 * load [<format>] <master-key name> <decrypted data length>
163
 *     <encrypted iv + data>
164
 * update <new-master-key name>
165
 *
166
 * Tokenizes a copy of the keyctl data, returning a pointer to each token,
167
 * which is null terminated.
168
 *
169
 * On success returns 0, otherwise -EINVAL.
170
 */
171
static int datablob_parse(char *datablob, const char **format,
172
			  char **master_desc, char **decrypted_datalen,
173
			  char **hex_encoded_iv, char **decrypted_data)
174
{
175
	substring_t args[MAX_OPT_ARGS];
176
	int ret = -EINVAL;
177
	int key_cmd;
178
	int key_format;
179
	char *p, *keyword;
180

181
	keyword = strsep(&datablob, " \t");
182
	if (!keyword) {
183
		pr_info("encrypted_key: insufficient parameters specified\n");
184
		return ret;
185
	}
186
	key_cmd = match_token(keyword, key_tokens, args);
187

188
	/* Get optional format: default | ecryptfs */
189
	p = strsep(&datablob, " \t");
190
	if (!p) {
191
		pr_err("encrypted_key: insufficient parameters specified\n");
192
		return ret;
193
	}
194

195
	key_format = match_token(p, key_format_tokens, args);
196
	switch (key_format) {
197
	case Opt_ecryptfs:
198
	case Opt_enc32:
199
	case Opt_default:
200
		*format = p;
201
		*master_desc = strsep(&datablob, " \t");
202
		break;
203
	case Opt_error:
204
		*master_desc = p;
205
		break;
206
	}
207

208
	if (!*master_desc) {
209
		pr_info("encrypted_key: master key parameter is missing\n");
210
		goto out;
211
	}
212

213
	if (valid_master_desc(*master_desc, NULL) < 0) {
214
		pr_info("encrypted_key: master key parameter \'%s\' "
215
			"is invalid\n", *master_desc);
216
		goto out;
217
	}
218

219
	if (decrypted_datalen) {
220
		*decrypted_datalen = strsep(&datablob, " \t");
221
		if (!*decrypted_datalen) {
222
			pr_info("encrypted_key: keylen parameter is missing\n");
223
			goto out;
224
		}
225
	}
226

227
	switch (key_cmd) {
228
	case Opt_new:
229
		if (!decrypted_datalen) {
230
			pr_info("encrypted_key: keyword \'%s\' not allowed "
231
				"when called from .update method\n", keyword);
232
			break;
233
		}
234
		*decrypted_data = strsep(&datablob, " \t");
235
		ret = 0;
236
		break;
237
	case Opt_load:
238
		if (!decrypted_datalen) {
239
			pr_info("encrypted_key: keyword \'%s\' not allowed "
240
				"when called from .update method\n", keyword);
241
			break;
242
		}
243
		*hex_encoded_iv = strsep(&datablob, " \t");
244
		if (!*hex_encoded_iv) {
245
			pr_info("encrypted_key: hex blob is missing\n");
246
			break;
247
		}
248
		ret = 0;
249
		break;
250
	case Opt_update:
251
		if (decrypted_datalen) {
252
			pr_info("encrypted_key: keyword \'%s\' not allowed "
253
				"when called from .instantiate method\n",
254
				keyword);
255
			break;
256
		}
257
		ret = 0;
258
		break;
259
	case Opt_err:
260
		pr_info("encrypted_key: keyword \'%s\' not recognized\n",
261
			keyword);
262
		break;
263
	}
264
out:
265
	return ret;
266
}
267

268
/*
269
 * datablob_format - format as an ascii string, before copying to userspace
270
 */
271
static char *datablob_format(struct encrypted_key_payload *epayload,
272
			     size_t asciiblob_len)
273
{
274
	char *ascii_buf, *bufp;
275
	u8 *iv = epayload->iv;
276
	int len;
277
	int i;
278

279
	ascii_buf = kmalloc(asciiblob_len + 1, GFP_KERNEL);
280
	if (!ascii_buf)
281
		goto out;
282

283
	ascii_buf[asciiblob_len] = '\0';
284

285
	/* copy datablob master_desc and datalen strings */
286
	len = sprintf(ascii_buf, "%s %s %s ", epayload->format,
287
		      epayload->master_desc, epayload->datalen);
288

289
	/* convert the hex encoded iv, encrypted-data and HMAC to ascii */
290
	bufp = &ascii_buf[len];
291
	for (i = 0; i < (asciiblob_len - len) / 2; i++)
292
		bufp = hex_byte_pack(bufp, iv[i]);
293
out:
294
	return ascii_buf;
295
}
296

297
/*
298
 * request_user_key - request the user key
299
 *
300
 * Use a user provided key to encrypt/decrypt an encrypted-key.
301
 */
302
static struct key *request_user_key(const char *master_desc, const u8 **master_key,
303
				    size_t *master_keylen)
304
{
305
	const struct user_key_payload *upayload;
306
	struct key *ukey;
307

308
	ukey = request_key(&key_type_user, master_desc, NULL);
309
	if (IS_ERR(ukey))
310
		goto error;
311

312
	down_read(&ukey->sem);
313
	upayload = user_key_payload_locked(ukey);
314
	if (!upayload) {
315
		/* key was revoked before we acquired its semaphore */
316
		up_read(&ukey->sem);
317
		key_put(ukey);
318
		ukey = ERR_PTR(-EKEYREVOKED);
319
		goto error;
320
	}
321
	*master_key = upayload->data;
322
	*master_keylen = upayload->datalen;
323
error:
324
	return ukey;
325
}
326

327
enum derived_key_type { ENC_KEY, AUTH_KEY };
328

329
/* Derive authentication/encryption key from trusted key */
330
static int get_derived_key(u8 *derived_key, enum derived_key_type key_type,
331
			   const u8 *master_key, size_t master_keylen)
332
{
333
	u8 *derived_buf;
334
	unsigned int derived_buf_len;
335

336
	derived_buf_len = strlen("AUTH_KEY") + 1 + master_keylen;
337
	if (derived_buf_len < HASH_SIZE)
338
		derived_buf_len = HASH_SIZE;
339

340
	derived_buf = kzalloc(derived_buf_len, GFP_KERNEL);
341
	if (!derived_buf)
342
		return -ENOMEM;
343

344
	if (key_type)
345
		strcpy(derived_buf, "AUTH_KEY");
346
	else
347
		strcpy(derived_buf, "ENC_KEY");
348

349
	memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
350
	       master_keylen);
351
	sha256(derived_buf, derived_buf_len, derived_key);
352
	kfree_sensitive(derived_buf);
353
	return 0;
354
}
355

356
static struct skcipher_request *init_skcipher_req(const u8 *key,
357
						  unsigned int key_len)
358
{
359
	struct skcipher_request *req;
360
	struct crypto_skcipher *tfm;
361
	int ret;
362

363
	tfm = crypto_alloc_skcipher(blkcipher_alg, 0, CRYPTO_ALG_ASYNC);
364
	if (IS_ERR(tfm)) {
365
		pr_err("encrypted_key: failed to load %s transform (%ld)\n",
366
		       blkcipher_alg, PTR_ERR(tfm));
367
		return ERR_CAST(tfm);
368
	}
369

370
	ret = crypto_skcipher_setkey(tfm, key, key_len);
371
	if (ret < 0) {
372
		pr_err("encrypted_key: failed to setkey (%d)\n", ret);
373
		crypto_free_skcipher(tfm);
374
		return ERR_PTR(ret);
375
	}
376

377
	req = skcipher_request_alloc(tfm, GFP_KERNEL);
378
	if (!req) {
379
		pr_err("encrypted_key: failed to allocate request for %s\n",
380
		       blkcipher_alg);
381
		crypto_free_skcipher(tfm);
382
		return ERR_PTR(-ENOMEM);
383
	}
384

385
	skcipher_request_set_callback(req, 0, NULL, NULL);
386
	return req;
387
}
388

389
static struct key *request_master_key(struct encrypted_key_payload *epayload,
390
				      const u8 **master_key, size_t *master_keylen)
391
{
392
	struct key *mkey = ERR_PTR(-EINVAL);
393

394
	if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
395
		     KEY_TRUSTED_PREFIX_LEN)) {
396
		mkey = request_trusted_key(epayload->master_desc +
397
					   KEY_TRUSTED_PREFIX_LEN,
398
					   master_key, master_keylen);
399
	} else if (!strncmp(epayload->master_desc, KEY_USER_PREFIX,
400
			    KEY_USER_PREFIX_LEN)) {
401
		mkey = request_user_key(epayload->master_desc +
402
					KEY_USER_PREFIX_LEN,
403
					master_key, master_keylen);
404
	} else
405
		goto out;
406

407
	if (IS_ERR(mkey)) {
408
		int ret = PTR_ERR(mkey);
409

410
		if (ret == -ENOTSUPP)
411
			pr_info("encrypted_key: key %s not supported",
412
				epayload->master_desc);
413
		else
414
			pr_info("encrypted_key: key %s not found",
415
				epayload->master_desc);
416
		goto out;
417
	}
418

419
	dump_master_key(*master_key, *master_keylen);
420
out:
421
	return mkey;
422
}
423

424
/* Before returning data to userspace, encrypt decrypted data. */
425
static int derived_key_encrypt(struct encrypted_key_payload *epayload,
426
			       const u8 *derived_key,
427
			       unsigned int derived_keylen)
428
{
429
	struct scatterlist sg_in[2];
430
	struct scatterlist sg_out[1];
431
	struct crypto_skcipher *tfm;
432
	struct skcipher_request *req;
433
	unsigned int encrypted_datalen;
434
	u8 iv[AES_BLOCK_SIZE];
435
	int ret;
436

437
	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
438

439
	req = init_skcipher_req(derived_key, derived_keylen);
440
	ret = PTR_ERR(req);
441
	if (IS_ERR(req))
442
		goto out;
443
	dump_decrypted_data(epayload);
444

445
	sg_init_table(sg_in, 2);
446
	sg_set_buf(&sg_in[0], epayload->decrypted_data,
447
		   epayload->decrypted_datalen);
448
	sg_set_page(&sg_in[1], ZERO_PAGE(0), AES_BLOCK_SIZE, 0);
449

450
	sg_init_table(sg_out, 1);
451
	sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
452

453
	memcpy(iv, epayload->iv, sizeof(iv));
454
	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
455
	ret = crypto_skcipher_encrypt(req);
456
	tfm = crypto_skcipher_reqtfm(req);
457
	skcipher_request_free(req);
458
	crypto_free_skcipher(tfm);
459
	if (ret < 0)
460
		pr_err("encrypted_key: failed to encrypt (%d)\n", ret);
461
	else
462
		dump_encrypted_data(epayload, encrypted_datalen);
463
out:
464
	return ret;
465
}
466

467
static int datablob_hmac_append(struct encrypted_key_payload *epayload,
468
				const u8 *master_key, size_t master_keylen)
469
{
470
	u8 derived_key[HASH_SIZE];
471
	u8 *digest;
472
	int ret;
473

474
	ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
475
	if (ret < 0)
476
		goto out;
477

478
	digest = epayload->format + epayload->datablob_len;
479
	hmac_sha256_usingrawkey(derived_key, sizeof(derived_key),
480
				epayload->format, epayload->datablob_len,
481
				digest);
482
	dump_hmac(NULL, digest, HASH_SIZE);
483
out:
484
	memzero_explicit(derived_key, sizeof(derived_key));
485
	return ret;
486
}
487

488
/* verify HMAC before decrypting encrypted key */
489
static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
490
				const u8 *format, const u8 *master_key,
491
				size_t master_keylen)
492
{
493
	u8 derived_key[HASH_SIZE];
494
	u8 digest[HASH_SIZE];
495
	int ret;
496
	char *p;
497
	unsigned short len;
498

499
	ret = get_derived_key(derived_key, AUTH_KEY, master_key, master_keylen);
500
	if (ret < 0)
501
		goto out;
502

503
	len = epayload->datablob_len;
504
	if (!format) {
505
		p = epayload->master_desc;
506
		len -= strlen(epayload->format) + 1;
507
	} else
508
		p = epayload->format;
509

510
	hmac_sha256_usingrawkey(derived_key, sizeof(derived_key), p, len,
511
				digest);
512
	ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
513
			    sizeof(digest));
514
	if (ret) {
515
		ret = -EINVAL;
516
		dump_hmac("datablob",
517
			  epayload->format + epayload->datablob_len,
518
			  HASH_SIZE);
519
		dump_hmac("calc", digest, HASH_SIZE);
520
	}
521
out:
522
	memzero_explicit(derived_key, sizeof(derived_key));
523
	return ret;
524
}
525

526
static int derived_key_decrypt(struct encrypted_key_payload *epayload,
527
			       const u8 *derived_key,
528
			       unsigned int derived_keylen)
529
{
530
	struct scatterlist sg_in[1];
531
	struct scatterlist sg_out[2];
532
	struct crypto_skcipher *tfm;
533
	struct skcipher_request *req;
534
	unsigned int encrypted_datalen;
535
	u8 iv[AES_BLOCK_SIZE];
536
	u8 *pad;
537
	int ret;
538

539
	/* Throwaway buffer to hold the unused zero padding at the end */
540
	pad = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL);
541
	if (!pad)
542
		return -ENOMEM;
543

544
	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
545
	req = init_skcipher_req(derived_key, derived_keylen);
546
	ret = PTR_ERR(req);
547
	if (IS_ERR(req))
548
		goto out;
549
	dump_encrypted_data(epayload, encrypted_datalen);
550

551
	sg_init_table(sg_in, 1);
552
	sg_init_table(sg_out, 2);
553
	sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
554
	sg_set_buf(&sg_out[0], epayload->decrypted_data,
555
		   epayload->decrypted_datalen);
556
	sg_set_buf(&sg_out[1], pad, AES_BLOCK_SIZE);
557

558
	memcpy(iv, epayload->iv, sizeof(iv));
559
	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
560
	ret = crypto_skcipher_decrypt(req);
561
	tfm = crypto_skcipher_reqtfm(req);
562
	skcipher_request_free(req);
563
	crypto_free_skcipher(tfm);
564
	if (ret < 0)
565
		goto out;
566
	dump_decrypted_data(epayload);
567
out:
568
	kfree(pad);
569
	return ret;
570
}
571

572
/* Allocate memory for decrypted key and datablob. */
573
static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
574
							 const char *format,
575
							 const char *master_desc,
576
							 const char *datalen,
577
							 const char *decrypted_data)
578
{
579
	struct encrypted_key_payload *epayload = NULL;
580
	unsigned short datablob_len;
581
	unsigned short decrypted_datalen;
582
	unsigned short payload_datalen;
583
	unsigned int encrypted_datalen;
584
	unsigned int format_len;
585
	long dlen;
586
	int i;
587
	int ret;
588

589
	ret = kstrtol(datalen, 10, &dlen);
590
	if (ret < 0 || dlen < MIN_DATA_SIZE || dlen > MAX_DATA_SIZE)
591
		return ERR_PTR(-EINVAL);
592

593
	format_len = (!format) ? strlen(key_format_default) : strlen(format);
594
	decrypted_datalen = dlen;
595
	payload_datalen = decrypted_datalen;
596

597
	if (decrypted_data) {
598
		if (!user_decrypted_data) {
599
			pr_err("encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false\n");
600
			return ERR_PTR(-EINVAL);
601
		}
602
		if (strlen(decrypted_data) != decrypted_datalen * 2) {
603
			pr_err("encrypted key: decrypted data provided does not match decrypted data length provided\n");
604
			return ERR_PTR(-EINVAL);
605
		}
606
		for (i = 0; i < strlen(decrypted_data); i++) {
607
			if (!isxdigit(decrypted_data[i])) {
608
				pr_err("encrypted key: decrypted data provided must contain only hexadecimal characters\n");
609
				return ERR_PTR(-EINVAL);
610
			}
611
		}
612
	}
613

614
	if (format) {
615
		if (!strcmp(format, key_format_ecryptfs)) {
616
			if (dlen != ECRYPTFS_MAX_KEY_BYTES) {
617
				pr_err("encrypted_key: keylen for the ecryptfs format must be equal to %d bytes\n",
618
					ECRYPTFS_MAX_KEY_BYTES);
619
				return ERR_PTR(-EINVAL);
620
			}
621
			decrypted_datalen = ECRYPTFS_MAX_KEY_BYTES;
622
			payload_datalen = sizeof(struct ecryptfs_auth_tok);
623
		} else if (!strcmp(format, key_format_enc32)) {
624
			if (decrypted_datalen != KEY_ENC32_PAYLOAD_LEN) {
625
				pr_err("encrypted_key: enc32 key payload incorrect length: %d\n",
626
						decrypted_datalen);
627
				return ERR_PTR(-EINVAL);
628
			}
629
		}
630
	}
631

632
	encrypted_datalen = roundup(decrypted_datalen, blksize);
633

634
	datablob_len = format_len + 1 + strlen(master_desc) + 1
635
	    + strlen(datalen) + 1 + ivsize + 1 + encrypted_datalen;
636

637
	ret = key_payload_reserve(key, payload_datalen + datablob_len
638
				  + HASH_SIZE + 1);
639
	if (ret < 0)
640
		return ERR_PTR(ret);
641

642
	epayload = kzalloc(sizeof(*epayload) + payload_datalen +
643
			   datablob_len + HASH_SIZE + 1, GFP_KERNEL);
644
	if (!epayload)
645
		return ERR_PTR(-ENOMEM);
646

647
	epayload->payload_datalen = payload_datalen;
648
	epayload->decrypted_datalen = decrypted_datalen;
649
	epayload->datablob_len = datablob_len;
650
	return epayload;
651
}
652

653
static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
654
				 const char *format, const char *hex_encoded_iv)
655
{
656
	struct key *mkey;
657
	u8 derived_key[HASH_SIZE];
658
	const u8 *master_key;
659
	u8 *hmac;
660
	const char *hex_encoded_data;
661
	unsigned int encrypted_datalen;
662
	size_t master_keylen;
663
	size_t asciilen;
664
	int ret;
665

666
	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
667
	asciilen = (ivsize + 1 + encrypted_datalen + HASH_SIZE) * 2;
668
	if (strlen(hex_encoded_iv) != asciilen)
669
		return -EINVAL;
670

671
	hex_encoded_data = hex_encoded_iv + (2 * ivsize) + 2;
672
	ret = hex2bin(epayload->iv, hex_encoded_iv, ivsize);
673
	if (ret < 0)
674
		return -EINVAL;
675
	ret = hex2bin(epayload->encrypted_data, hex_encoded_data,
676
		      encrypted_datalen);
677
	if (ret < 0)
678
		return -EINVAL;
679

680
	hmac = epayload->format + epayload->datablob_len;
681
	ret = hex2bin(hmac, hex_encoded_data + (encrypted_datalen * 2),
682
		      HASH_SIZE);
683
	if (ret < 0)
684
		return -EINVAL;
685

686
	mkey = request_master_key(epayload, &master_key, &master_keylen);
687
	if (IS_ERR(mkey))
688
		return PTR_ERR(mkey);
689

690
	ret = datablob_hmac_verify(epayload, format, master_key, master_keylen);
691
	if (ret < 0) {
692
		pr_err("encrypted_key: bad hmac (%d)\n", ret);
693
		goto out;
694
	}
695

696
	ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
697
	if (ret < 0)
698
		goto out;
699

700
	ret = derived_key_decrypt(epayload, derived_key, sizeof derived_key);
701
	if (ret < 0)
702
		pr_err("encrypted_key: failed to decrypt key (%d)\n", ret);
703
out:
704
	up_read(&mkey->sem);
705
	key_put(mkey);
706
	memzero_explicit(derived_key, sizeof(derived_key));
707
	return ret;
708
}
709

710
static void __ekey_init(struct encrypted_key_payload *epayload,
711
			const char *format, const char *master_desc,
712
			const char *datalen)
713
{
714
	unsigned int format_len;
715

716
	format_len = (!format) ? strlen(key_format_default) : strlen(format);
717
	epayload->format = epayload->payload_data + epayload->payload_datalen;
718
	epayload->master_desc = epayload->format + format_len + 1;
719
	epayload->datalen = epayload->master_desc + strlen(master_desc) + 1;
720
	epayload->iv = epayload->datalen + strlen(datalen) + 1;
721
	epayload->encrypted_data = epayload->iv + ivsize + 1;
722
	epayload->decrypted_data = epayload->payload_data;
723

724
	if (!format)
725
		memcpy(epayload->format, key_format_default, format_len);
726
	else {
727
		if (!strcmp(format, key_format_ecryptfs))
728
			epayload->decrypted_data =
729
				ecryptfs_get_auth_tok_key((struct ecryptfs_auth_tok *)epayload->payload_data);
730

731
		memcpy(epayload->format, format, format_len);
732
	}
733

734
	memcpy(epayload->master_desc, master_desc, strlen(master_desc));
735
	memcpy(epayload->datalen, datalen, strlen(datalen));
736
}
737

738
/*
739
 * encrypted_init - initialize an encrypted key
740
 *
741
 * For a new key, use either a random number or user-provided decrypted data in
742
 * case it is provided. A random number is used for the iv in both cases. For
743
 * an old key, decrypt the hex encoded data.
744
 */
745
static int encrypted_init(struct encrypted_key_payload *epayload,
746
			  const char *key_desc, const char *format,
747
			  const char *master_desc, const char *datalen,
748
			  const char *hex_encoded_iv, const char *decrypted_data)
749
{
750
	int ret = 0;
751

752
	if (format && !strcmp(format, key_format_ecryptfs)) {
753
		ret = valid_ecryptfs_desc(key_desc);
754
		if (ret < 0)
755
			return ret;
756

757
		ecryptfs_fill_auth_tok((struct ecryptfs_auth_tok *)epayload->payload_data,
758
				       key_desc);
759
	}
760

761
	__ekey_init(epayload, format, master_desc, datalen);
762
	if (hex_encoded_iv) {
763
		ret = encrypted_key_decrypt(epayload, format, hex_encoded_iv);
764
	} else if (decrypted_data) {
765
		get_random_bytes(epayload->iv, ivsize);
766
		ret = hex2bin(epayload->decrypted_data, decrypted_data,
767
			      epayload->decrypted_datalen);
768
	} else {
769
		get_random_bytes(epayload->iv, ivsize);
770
		get_random_bytes(epayload->decrypted_data, epayload->decrypted_datalen);
771
	}
772
	return ret;
773
}
774

775
/*
776
 * encrypted_instantiate - instantiate an encrypted key
777
 *
778
 * Instantiates the key:
779
 * - by decrypting an existing encrypted datablob, or
780
 * - by creating a new encrypted key based on a kernel random number, or
781
 * - using provided decrypted data.
782
 *
783
 * On success, return 0. Otherwise return errno.
784
 */
785
static int encrypted_instantiate(struct key *key,
786
				 struct key_preparsed_payload *prep)
787
{
788
	struct encrypted_key_payload *epayload = NULL;
789
	char *datablob = NULL;
790
	const char *format = NULL;
791
	char *master_desc = NULL;
792
	char *decrypted_datalen = NULL;
793
	char *hex_encoded_iv = NULL;
794
	char *decrypted_data = NULL;
795
	size_t datalen = prep->datalen;
796
	int ret;
797

798
	if (datalen <= 0 || datalen > 32767 || !prep->data)
799
		return -EINVAL;
800

801
	datablob = kmalloc(datalen + 1, GFP_KERNEL);
802
	if (!datablob)
803
		return -ENOMEM;
804
	datablob[datalen] = 0;
805
	memcpy(datablob, prep->data, datalen);
806
	ret = datablob_parse(datablob, &format, &master_desc,
807
			     &decrypted_datalen, &hex_encoded_iv, &decrypted_data);
808
	if (ret < 0)
809
		goto out;
810

811
	epayload = encrypted_key_alloc(key, format, master_desc,
812
				       decrypted_datalen, decrypted_data);
813
	if (IS_ERR(epayload)) {
814
		ret = PTR_ERR(epayload);
815
		goto out;
816
	}
817
	ret = encrypted_init(epayload, key->description, format, master_desc,
818
			     decrypted_datalen, hex_encoded_iv, decrypted_data);
819
	if (ret < 0) {
820
		kfree_sensitive(epayload);
821
		goto out;
822
	}
823

824
	rcu_assign_keypointer(key, epayload);
825
out:
826
	kfree_sensitive(datablob);
827
	return ret;
828
}
829

830
static void encrypted_rcu_free(struct rcu_head *rcu)
831
{
832
	struct encrypted_key_payload *epayload;
833

834
	epayload = container_of(rcu, struct encrypted_key_payload, rcu);
835
	kfree_sensitive(epayload);
836
}
837

838
/*
839
 * encrypted_update - update the master key description
840
 *
841
 * Change the master key description for an existing encrypted key.
842
 * The next read will return an encrypted datablob using the new
843
 * master key description.
844
 *
845
 * On success, return 0. Otherwise return errno.
846
 */
847
static int encrypted_update(struct key *key, struct key_preparsed_payload *prep)
848
{
849
	struct encrypted_key_payload *epayload = key->payload.data[0];
850
	struct encrypted_key_payload *new_epayload;
851
	char *buf;
852
	char *new_master_desc = NULL;
853
	const char *format = NULL;
854
	size_t datalen = prep->datalen;
855
	int ret = 0;
856

857
	if (key_is_negative(key))
858
		return -ENOKEY;
859
	if (datalen <= 0 || datalen > 32767 || !prep->data)
860
		return -EINVAL;
861

862
	buf = kmalloc(datalen + 1, GFP_KERNEL);
863
	if (!buf)
864
		return -ENOMEM;
865

866
	buf[datalen] = 0;
867
	memcpy(buf, prep->data, datalen);
868
	ret = datablob_parse(buf, &format, &new_master_desc, NULL, NULL, NULL);
869
	if (ret < 0)
870
		goto out;
871

872
	ret = valid_master_desc(new_master_desc, epayload->master_desc);
873
	if (ret < 0)
874
		goto out;
875

876
	new_epayload = encrypted_key_alloc(key, epayload->format,
877
					   new_master_desc, epayload->datalen, NULL);
878
	if (IS_ERR(new_epayload)) {
879
		ret = PTR_ERR(new_epayload);
880
		goto out;
881
	}
882

883
	__ekey_init(new_epayload, epayload->format, new_master_desc,
884
		    epayload->datalen);
885

886
	memcpy(new_epayload->iv, epayload->iv, ivsize);
887
	memcpy(new_epayload->payload_data, epayload->payload_data,
888
	       epayload->payload_datalen);
889

890
	rcu_assign_keypointer(key, new_epayload);
891
	call_rcu(&epayload->rcu, encrypted_rcu_free);
892
out:
893
	kfree_sensitive(buf);
894
	return ret;
895
}
896

897
/*
898
 * encrypted_read - format and copy out the encrypted data
899
 *
900
 * The resulting datablob format is:
901
 * <master-key name> <decrypted data length> <encrypted iv> <encrypted data>
902
 *
903
 * On success, return to userspace the encrypted key datablob size.
904
 */
905
static long encrypted_read(const struct key *key, char *buffer,
906
			   size_t buflen)
907
{
908
	struct encrypted_key_payload *epayload;
909
	struct key *mkey;
910
	const u8 *master_key;
911
	size_t master_keylen;
912
	char derived_key[HASH_SIZE];
913
	char *ascii_buf;
914
	size_t asciiblob_len;
915
	int ret;
916

917
	epayload = dereference_key_locked(key);
918

919
	/* returns the hex encoded iv, encrypted-data, and hmac as ascii */
920
	asciiblob_len = epayload->datablob_len + ivsize + 1
921
	    + roundup(epayload->decrypted_datalen, blksize)
922
	    + (HASH_SIZE * 2);
923

924
	if (!buffer || buflen < asciiblob_len)
925
		return asciiblob_len;
926

927
	mkey = request_master_key(epayload, &master_key, &master_keylen);
928
	if (IS_ERR(mkey))
929
		return PTR_ERR(mkey);
930

931
	ret = get_derived_key(derived_key, ENC_KEY, master_key, master_keylen);
932
	if (ret < 0)
933
		goto out;
934

935
	ret = derived_key_encrypt(epayload, derived_key, sizeof derived_key);
936
	if (ret < 0)
937
		goto out;
938

939
	ret = datablob_hmac_append(epayload, master_key, master_keylen);
940
	if (ret < 0)
941
		goto out;
942

943
	ascii_buf = datablob_format(epayload, asciiblob_len);
944
	if (!ascii_buf) {
945
		ret = -ENOMEM;
946
		goto out;
947
	}
948

949
	up_read(&mkey->sem);
950
	key_put(mkey);
951
	memzero_explicit(derived_key, sizeof(derived_key));
952

953
	memcpy(buffer, ascii_buf, asciiblob_len);
954
	kfree_sensitive(ascii_buf);
955

956
	return asciiblob_len;
957
out:
958
	up_read(&mkey->sem);
959
	key_put(mkey);
960
	memzero_explicit(derived_key, sizeof(derived_key));
961
	return ret;
962
}
963

964
/*
965
 * encrypted_destroy - clear and free the key's payload
966
 */
967
static void encrypted_destroy(struct key *key)
968
{
969
	kfree_sensitive(key->payload.data[0]);
970
}
971

972
struct key_type key_type_encrypted = {
973
	.name = "encrypted",
974
	.instantiate = encrypted_instantiate,
975
	.update = encrypted_update,
976
	.destroy = encrypted_destroy,
977
	.describe = user_describe,
978
	.read = encrypted_read,
979
};
980
EXPORT_SYMBOL_GPL(key_type_encrypted);
981

982
static int __init init_encrypted(void)
983
{
984
	int ret;
985

986
	ret = aes_get_sizes();
987
	if (ret < 0)
988
		return ret;
989
	return register_key_type(&key_type_encrypted);
990
}
991

992
static void __exit cleanup_encrypted(void)
993
{
994
	unregister_key_type(&key_type_encrypted);
995
}
996

997
late_initcall(init_encrypted);
998
module_exit(cleanup_encrypted);
999

1000
MODULE_DESCRIPTION("Encrypted key type");
1001
MODULE_LICENSE("GPL");
1002

1003