1 /* SPDX-License-Identifier: GPL-2.0 */
18 #include <linux/blk-crypto.h>
20 #define CONST_STRLEN(str)	(sizeof(str) - 1)
26  * if ciphers with a 256-bit security strength are used.  This is just the
27  * absolute minimum, which applies when only 128-bit encryption is used.
34 /* Maximum size of a hardware-wrapped fscrypt master key */
43  * hardware-wrapped keys has made it misleading as it's only for raw keys.
44  * Don't use it in kernel code; use one of the above constants instead.
50  * to prevent fscrypt from using the Crypto API drivers for non-inline crypto
54  * drivers can be over 50 times slower than the CPU-based code for fscrypt's
59  * Note that fscrypt also supports inline crypto engines.  Those don't use the
60  * Crypto API and work much better than the old-style (non-inline) engines.
93  * fscrypt_context - the encryption context of an inode
95  * This is the on-disk equivalent of an fscrypt_policy, stored alongside each
114 	switch (ctx->version) {  in fscrypt_context_size()
115 	case FSCRYPT_CONTEXT_V1:  in fscrypt_context_size()
116 		BUILD_BUG_ON(sizeof(ctx->v1) != 28);  in fscrypt_context_size()
117 		return sizeof(ctx->v1);  in fscrypt_context_size()
118 	case FSCRYPT_CONTEXT_V2:  in fscrypt_context_size()
119 		BUILD_BUG_ON(sizeof(ctx->v2) != 40);  in fscrypt_context_size()
120 		return sizeof(ctx->v2);  in fscrypt_context_size()
135 	switch (ctx->version) {  in fscrypt_context_nonce()
136 	case FSCRYPT_CONTEXT_V1:  in fscrypt_context_nonce()
137 		return ctx->v1.nonce;  in fscrypt_context_nonce()
138 	case FSCRYPT_CONTEXT_V2:  in fscrypt_context_nonce()
139 		return ctx->v2.nonce;  in fscrypt_context_nonce()
157 	switch (policy->version) {  in fscrypt_policy_size()
158 	case FSCRYPT_POLICY_V1:  in fscrypt_policy_size()
159 		return sizeof(policy->v1);  in fscrypt_policy_size()
160 	case FSCRYPT_POLICY_V2:  in fscrypt_policy_size()
161 		return sizeof(policy->v2);  in fscrypt_policy_size()
170 	switch (policy->version) {  in fscrypt_policy_contents_mode()
171 	case FSCRYPT_POLICY_V1:  in fscrypt_policy_contents_mode()
172 		return policy->v1.contents_encryption_mode;  in fscrypt_policy_contents_mode()
173 	case FSCRYPT_POLICY_V2:  in fscrypt_policy_contents_mode()
174 		return policy->v2.contents_encryption_mode;  in fscrypt_policy_contents_mode()
183 	switch (policy->version) {  in fscrypt_policy_fnames_mode()
184 	case FSCRYPT_POLICY_V1:  in fscrypt_policy_fnames_mode()
185 		return policy->v1.filenames_encryption_mode;  in fscrypt_policy_fnames_mode()
186 	case FSCRYPT_POLICY_V2:  in fscrypt_policy_fnames_mode()
187 		return policy->v2.filenames_encryption_mode;  in fscrypt_policy_fnames_mode()
196 	switch (policy->version) {  in fscrypt_policy_flags()
197 	case FSCRYPT_POLICY_V1:  in fscrypt_policy_flags()
198 		return policy->v1.flags;  in fscrypt_policy_flags()
199 	case FSCRYPT_POLICY_V2:  in fscrypt_policy_flags()
200 		return policy->v2.flags;  in fscrypt_policy_flags()
209 	return policy->log2_data_unit_size ?: inode->i_blkbits;  in fscrypt_policy_v2_du_bits()
216 	switch (policy->version) {  in fscrypt_policy_du_bits()
217 	case FSCRYPT_POLICY_V1:  in fscrypt_policy_du_bits()
218 		return inode->i_blkbits;  in fscrypt_policy_du_bits()
219 	case FSCRYPT_POLICY_V2:  in fscrypt_policy_du_bits()
220 		return fscrypt_policy_v2_du_bits(&policy->v2, inode);  in fscrypt_policy_du_bits()
227  * of the string in little-endian format.
235  * struct fscrypt_prepared_key - a key prepared for actual encryption/decryption
237  * @blk_key: key for blk-crypto
239  * Normally only one of the fields will be non-NULL.
249  * fscrypt_inode_info - the "encryption key" for an inode
252  * allocated and a pointer to it is stored in the file's in-memory inode.  Once
265 	 * True if this inode will use inline encryption (blk-crypto) instead of
266 	 * the traditional filesystem-layer encryption.
293 	/* Back-pointer to the inode */
298 	 * will be NULL if the master key was found in a process-subscribed
299 	 * keyring rather than in the filesystem-level keyring.
305 	 * Only used when ->ci_master_key is set.
310 	 * If non-NULL, then encryption is done using the master key directly
311 	 * and ci_enc_key will equal ci_direct_key->dk_key.
316 	 * This inode's hash key for filenames.  This is a 128-bit SipHash-2-4
317 	 * key.  This is only set for directories that use a keyed dirhash over
318 	 * the plaintext filenames -- currently just casefolded directories.
355 		/* zero-based index of data unit within the file */
358 		/* per-file nonce; only set in DIRECT_KEY mode */
375 	return fls64(sb->s_maxbytes - 1) - du_bits;  in fscrypt_max_file_dun_bits()
389  * the first byte of the HKDF application-specific info string to guarantee that
416 	return ci->ci_inlinecrypt;  in fscrypt_using_inline_encryption()
432  * Check whether the crypto transform or blk-crypto key has been allocated in
433  * @prep_key, depending on which encryption implementation the file will use.
442 	 * I.e., in some cases (namely, if this prep_key is a per-mode  in fscrypt_is_key_prepared()
444 	 * executing a RELEASE barrier.  We need to use smp_load_acquire() here  in fscrypt_is_key_prepared()
448 		return smp_load_acquire(&prep_key->blk_key) != NULL;  in fscrypt_is_key_prepared()
449 	return smp_load_acquire(&prep_key->tfm) != NULL;  in fscrypt_is_key_prepared()
473 	return -EOPNOTSUPP;  in fscrypt_prepare_inline_crypt_key()
487 	fscrypt_warn(NULL, "kernel doesn't support hardware-wrapped keys");  in fscrypt_derive_sw_secret()
488 	return -EOPNOTSUPP;  in fscrypt_derive_sw_secret()
495 	return smp_load_acquire(&prep_key->tfm) != NULL;  in fscrypt_is_key_prepared()
502  * fscrypt_master_key_secret - secret key material of an in-use master key
511 	 * ->is_hw_wrapped=false, or by the "software secret" that hardware
512 	 * derived from this master key if ->is_hw_wrapped=true.
517 	 * True if this key is a hardware-wrapped key; false if this key is a
520 	 * support newer functionality such as hardware-wrapped keys.
525 	 * Size of the key in bytes.  This remains set even if ->bytes was
533 	 * key or a hardware-wrapped key, as indicated by ->is_hw_wrapped.  In
534 	 * the case of a raw, v2 policy key, there is no need to remember the
535 	 * actual key separately from ->hkdf so this field will be zeroized as
536 	 * soon as ->hkdf is initialized.
543  * fscrypt_master_key - an in-use master key
546  * filesystem.  There are three high-level states that a key can be in:
550  *	with it (this includes being able to create new inodes).  ->mk_present
551  *	indicates whether the key is in this state.  ->mk_secret exists, the key
552  *	is in the keyring, and ->mk_active_refs > 0 due to ->mk_present.
556  *	unlocked with it are still in-use.  Like ABSENT, ->mk_secret is wiped,
558  *	key is still in the keyring; ->mk_decrypted_inodes is nonempty; and
559  *	->mk_active_refs > 0, being equal to the size of ->mk_decrypted_inodes.
561  *	This state transitions to ABSENT if ->mk_decrypted_inodes becomes empty,
566  *	->mk_decrypted_inodes is empty, ->mk_active_refs == 0, ->mk_secret is
572 	 * Link in ->s_master_keys->key_hashtable.
573 	 * Only valid if ->mk_active_refs > 0.
577 	/* Semaphore that protects ->mk_secret, ->mk_users, and ->mk_present */
583 	 * ->s_master_keys, and that any embedded subkeys (e.g.
584 	 * ->mk_direct_keys) that have been prepared continue to exist.
587 	 * There is one active ref associated with ->mk_present being true, and
588 	 * one active ref for each inode in ->mk_decrypted_inodes.
603 	 * Locking: protected by ->mk_sem.
609 	 * userspace (->descriptor).
611 	 * For v2 policy keys: a cryptographic hash of this key (->identifier).
619 	 * that case we need to keep track of those users so that one user can't
624 	 * Locking: protected by ->mk_sem.  (We don't just rely on the keyrings
625 	 * subsystem semaphore ->mk_users->sem, as we need support for atomic
638 	 * Per-mode encryption keys for the various types of encryption policies
639 	 * that use them.  Allocated and derived on-demand.
653 	 * Locking: protected by ->mk_sem, but can be read locklessly using
654 	 * READ_ONCE().  Writers must use WRITE_ONCE() when concurrent readers
664 	switch (spec->type) {  in master_key_spec_type()
665 	case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR:  in master_key_spec_type()
667 	case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER:  in master_key_spec_type()
675 	switch (spec->type) {  in master_key_spec_len()
676 	case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR:  in master_key_spec_len()
678 	case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER:  in master_key_spec_len()
738  * fscrypt_require_key() - require an inode's encryption key
742  * Then require that the key be present and return -ENOKEY otherwise.
744  * No locks are needed, and the key will live as long as the struct inode --- so
747  * Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
758 			return -ENOKEY;  in fscrypt_require_key()