1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * This contains functions for filename crypto management 4 * 5 * Copyright (C) 2015, Google, Inc. 6 * Copyright (C) 2015, Motorola Mobility 7 * 8 * Written by Uday Savagaonkar, 2014. 9 * Modified by Jaegeuk Kim, 2015. 10 * 11 * This has not yet undergone a rigorous security audit. 12 */ 13 14 #include <linux/namei.h> 15 #include <linux/scatterlist.h> 16 #include <crypto/hash.h> 17 #include <crypto/sha2.h> 18 #include <crypto/skcipher.h> 19 #include "fscrypt_private.h" 20 21 /* 22 * struct fscrypt_nokey_name - identifier for directory entry when key is absent 23 * 24 * When userspace lists an encrypted directory without access to the key, the 25 * filesystem must present a unique "no-key name" for each filename that allows 26 * it to find the directory entry again if requested. Naively, that would just 27 * mean using the ciphertext filenames. However, since the ciphertext filenames 28 * can contain illegal characters ('\0' and '/'), they must be encoded in some 29 * way. We use base64. But that can cause names to exceed NAME_MAX (255 30 * bytes), so we also need to use a strong hash to abbreviate long names. 31 * 32 * The filesystem may also need another kind of hash, the "dirhash", to quickly 33 * find the directory entry. Since filesystems normally compute the dirhash 34 * over the on-disk filename (i.e. the ciphertext), it's not computable from 35 * no-key names that abbreviate the ciphertext using the strong hash to fit in 36 * NAME_MAX. It's also not computable if it's a keyed hash taken over the 37 * plaintext (but it may still be available in the on-disk directory entry); 38 * casefolded directories use this type of dirhash. At least in these cases, 39 * each no-key name must include the name's dirhash too. 40 * 41 * To meet all these requirements, we base64-encode the following 42 * variable-length structure. It contains the dirhash, or 0's if the filesystem 43 * didn't provide one; up to 149 bytes of the ciphertext name; and for 44 * ciphertexts longer than 149 bytes, also the SHA-256 of the remaining bytes. 45 * 46 * This ensures that each no-key name contains everything needed to find the 47 * directory entry again, contains only legal characters, doesn't exceed 48 * NAME_MAX, is unambiguous unless there's a SHA-256 collision, and that we only 49 * take the performance hit of SHA-256 on very long filenames (which are rare). 50 */ 51 struct fscrypt_nokey_name { 52 u32 dirhash[2]; 53 u8 bytes[149]; 54 u8 sha256[SHA256_DIGEST_SIZE]; 55 }; /* 189 bytes => 252 bytes base64-encoded, which is <= NAME_MAX (255) */ 56 57 /* 58 * Decoded size of max-size nokey name, i.e. a name that was abbreviated using 59 * the strong hash and thus includes the 'sha256' field. This isn't simply 60 * sizeof(struct fscrypt_nokey_name), as the padding at the end isn't included. 61 */ 62 #define FSCRYPT_NOKEY_NAME_MAX offsetofend(struct fscrypt_nokey_name, sha256) 63 64 static inline bool fscrypt_is_dot_dotdot(const struct qstr *str) 65 { 66 if (str->len == 1 && str->name[0] == '.') 67 return true; 68 69 if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.') 70 return true; 71 72 return false; 73 } 74 75 /** 76 * fscrypt_fname_encrypt() - encrypt a filename 77 * @inode: inode of the parent directory (for regular filenames) 78 * or of the symlink (for symlink targets) 79 * @iname: the filename to encrypt 80 * @out: (output) the encrypted filename 81 * @olen: size of the encrypted filename. It must be at least @iname->len. 82 * Any extra space is filled with NUL padding before encryption. 83 * 84 * Return: 0 on success, -errno on failure 85 */ 86 int fscrypt_fname_encrypt(const struct inode *inode, const struct qstr *iname, 87 u8 *out, unsigned int olen) 88 { 89 struct skcipher_request *req = NULL; 90 DECLARE_CRYPTO_WAIT(wait); 91 const struct fscrypt_info *ci = inode->i_crypt_info; 92 struct crypto_skcipher *tfm = ci->ci_enc_key.tfm; 93 union fscrypt_iv iv; 94 struct scatterlist sg; 95 int res; 96 97 /* 98 * Copy the filename to the output buffer for encrypting in-place and 99 * pad it with the needed number of NUL bytes. 100 */ 101 if (WARN_ON(olen < iname->len)) 102 return -ENOBUFS; 103 memcpy(out, iname->name, iname->len); 104 memset(out + iname->len, 0, olen - iname->len); 105 106 /* Initialize the IV */ 107 fscrypt_generate_iv(&iv, 0, ci); 108 109 /* Set up the encryption request */ 110 req = skcipher_request_alloc(tfm, GFP_NOFS); 111 if (!req) 112 return -ENOMEM; 113 skcipher_request_set_callback(req, 114 CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, 115 crypto_req_done, &wait); 116 sg_init_one(&sg, out, olen); 117 skcipher_request_set_crypt(req, &sg, &sg, olen, &iv); 118 119 /* Do the encryption */ 120 res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); 121 skcipher_request_free(req); 122 if (res < 0) { 123 fscrypt_err(inode, "Filename encryption failed: %d", res); 124 return res; 125 } 126 127 return 0; 128 } 129 130 /** 131 * fname_decrypt() - decrypt a filename 132 * @inode: inode of the parent directory (for regular filenames) 133 * or of the symlink (for symlink targets) 134 * @iname: the encrypted filename to decrypt 135 * @oname: (output) the decrypted filename. The caller must have allocated 136 * enough space for this, e.g. using fscrypt_fname_alloc_buffer(). 137 * 138 * Return: 0 on success, -errno on failure 139 */ 140 static int fname_decrypt(const struct inode *inode, 141 const struct fscrypt_str *iname, 142 struct fscrypt_str *oname) 143 { 144 struct skcipher_request *req = NULL; 145 DECLARE_CRYPTO_WAIT(wait); 146 struct scatterlist src_sg, dst_sg; 147 const struct fscrypt_info *ci = inode->i_crypt_info; 148 struct crypto_skcipher *tfm = ci->ci_enc_key.tfm; 149 union fscrypt_iv iv; 150 int res; 151 152 /* Allocate request */ 153 req = skcipher_request_alloc(tfm, GFP_NOFS); 154 if (!req) 155 return -ENOMEM; 156 skcipher_request_set_callback(req, 157 CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, 158 crypto_req_done, &wait); 159 160 /* Initialize IV */ 161 fscrypt_generate_iv(&iv, 0, ci); 162 163 /* Create decryption request */ 164 sg_init_one(&src_sg, iname->name, iname->len); 165 sg_init_one(&dst_sg, oname->name, oname->len); 166 skcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, &iv); 167 res = crypto_wait_req(crypto_skcipher_decrypt(req), &wait); 168 skcipher_request_free(req); 169 if (res < 0) { 170 fscrypt_err(inode, "Filename decryption failed: %d", res); 171 return res; 172 } 173 174 oname->len = strnlen(oname->name, iname->len); 175 return 0; 176 } 177 178 static const char lookup_table[65] = 179 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,"; 180 181 #define BASE64_CHARS(nbytes) DIV_ROUND_UP((nbytes) * 4, 3) 182 183 /** 184 * base64_encode() - base64-encode some bytes 185 * @src: the bytes to encode 186 * @len: number of bytes to encode 187 * @dst: (output) the base64-encoded string. Not NUL-terminated. 188 * 189 * Encodes the input string using characters from the set [A-Za-z0-9+,]. 190 * The encoded string is roughly 4/3 times the size of the input string. 191 * 192 * Return: length of the encoded string 193 */ 194 static int base64_encode(const u8 *src, int len, char *dst) 195 { 196 int i, bits = 0, ac = 0; 197 char *cp = dst; 198 199 for (i = 0; i < len; i++) { 200 ac += src[i] << bits; 201 bits += 8; 202 do { 203 *cp++ = lookup_table[ac & 0x3f]; 204 ac >>= 6; 205 bits -= 6; 206 } while (bits >= 6); 207 } 208 if (bits) 209 *cp++ = lookup_table[ac & 0x3f]; 210 return cp - dst; 211 } 212 213 static int base64_decode(const char *src, int len, u8 *dst) 214 { 215 int i, bits = 0, ac = 0; 216 const char *p; 217 u8 *cp = dst; 218 219 for (i = 0; i < len; i++) { 220 p = strchr(lookup_table, src[i]); 221 if (p == NULL || src[i] == 0) 222 return -2; 223 ac += (p - lookup_table) << bits; 224 bits += 6; 225 if (bits >= 8) { 226 *cp++ = ac & 0xff; 227 ac >>= 8; 228 bits -= 8; 229 } 230 } 231 if (ac) 232 return -1; 233 return cp - dst; 234 } 235 236 bool fscrypt_fname_encrypted_size(const union fscrypt_policy *policy, 237 u32 orig_len, u32 max_len, 238 u32 *encrypted_len_ret) 239 { 240 int padding = 4 << (fscrypt_policy_flags(policy) & 241 FSCRYPT_POLICY_FLAGS_PAD_MASK); 242 u32 encrypted_len; 243 244 if (orig_len > max_len) 245 return false; 246 encrypted_len = max(orig_len, (u32)FS_CRYPTO_BLOCK_SIZE); 247 encrypted_len = round_up(encrypted_len, padding); 248 *encrypted_len_ret = min(encrypted_len, max_len); 249 return true; 250 } 251 252 /** 253 * fscrypt_fname_alloc_buffer() - allocate a buffer for presented filenames 254 * @max_encrypted_len: maximum length of encrypted filenames the buffer will be 255 * used to present 256 * @crypto_str: (output) buffer to allocate 257 * 258 * Allocate a buffer that is large enough to hold any decrypted or encoded 259 * filename (null-terminated), for the given maximum encrypted filename length. 260 * 261 * Return: 0 on success, -errno on failure 262 */ 263 int fscrypt_fname_alloc_buffer(u32 max_encrypted_len, 264 struct fscrypt_str *crypto_str) 265 { 266 const u32 max_encoded_len = BASE64_CHARS(FSCRYPT_NOKEY_NAME_MAX); 267 u32 max_presented_len; 268 269 max_presented_len = max(max_encoded_len, max_encrypted_len); 270 271 crypto_str->name = kmalloc(max_presented_len + 1, GFP_NOFS); 272 if (!crypto_str->name) 273 return -ENOMEM; 274 crypto_str->len = max_presented_len; 275 return 0; 276 } 277 EXPORT_SYMBOL(fscrypt_fname_alloc_buffer); 278 279 /** 280 * fscrypt_fname_free_buffer() - free a buffer for presented filenames 281 * @crypto_str: the buffer to free 282 * 283 * Free a buffer that was allocated by fscrypt_fname_alloc_buffer(). 284 */ 285 void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str) 286 { 287 if (!crypto_str) 288 return; 289 kfree(crypto_str->name); 290 crypto_str->name = NULL; 291 } 292 EXPORT_SYMBOL(fscrypt_fname_free_buffer); 293 294 /** 295 * fscrypt_fname_disk_to_usr() - convert an encrypted filename to 296 * user-presentable form 297 * @inode: inode of the parent directory (for regular filenames) 298 * or of the symlink (for symlink targets) 299 * @hash: first part of the name's dirhash, if applicable. This only needs to 300 * be provided if the filename is located in an indexed directory whose 301 * encryption key may be unavailable. Not needed for symlink targets. 302 * @minor_hash: second part of the name's dirhash, if applicable 303 * @iname: encrypted filename to convert. May also be "." or "..", which 304 * aren't actually encrypted. 305 * @oname: output buffer for the user-presentable filename. The caller must 306 * have allocated enough space for this, e.g. using 307 * fscrypt_fname_alloc_buffer(). 308 * 309 * If the key is available, we'll decrypt the disk name. Otherwise, we'll 310 * encode it for presentation in fscrypt_nokey_name format. 311 * See struct fscrypt_nokey_name for details. 312 * 313 * Return: 0 on success, -errno on failure 314 */ 315 int fscrypt_fname_disk_to_usr(const struct inode *inode, 316 u32 hash, u32 minor_hash, 317 const struct fscrypt_str *iname, 318 struct fscrypt_str *oname) 319 { 320 const struct qstr qname = FSTR_TO_QSTR(iname); 321 struct fscrypt_nokey_name nokey_name; 322 u32 size; /* size of the unencoded no-key name */ 323 324 if (fscrypt_is_dot_dotdot(&qname)) { 325 oname->name[0] = '.'; 326 oname->name[iname->len - 1] = '.'; 327 oname->len = iname->len; 328 return 0; 329 } 330 331 if (iname->len < FS_CRYPTO_BLOCK_SIZE) 332 return -EUCLEAN; 333 334 if (fscrypt_has_encryption_key(inode)) 335 return fname_decrypt(inode, iname, oname); 336 337 /* 338 * Sanity check that struct fscrypt_nokey_name doesn't have padding 339 * between fields and that its encoded size never exceeds NAME_MAX. 340 */ 341 BUILD_BUG_ON(offsetofend(struct fscrypt_nokey_name, dirhash) != 342 offsetof(struct fscrypt_nokey_name, bytes)); 343 BUILD_BUG_ON(offsetofend(struct fscrypt_nokey_name, bytes) != 344 offsetof(struct fscrypt_nokey_name, sha256)); 345 BUILD_BUG_ON(BASE64_CHARS(FSCRYPT_NOKEY_NAME_MAX) > NAME_MAX); 346 347 if (hash) { 348 nokey_name.dirhash[0] = hash; 349 nokey_name.dirhash[1] = minor_hash; 350 } else { 351 nokey_name.dirhash[0] = 0; 352 nokey_name.dirhash[1] = 0; 353 } 354 if (iname->len <= sizeof(nokey_name.bytes)) { 355 memcpy(nokey_name.bytes, iname->name, iname->len); 356 size = offsetof(struct fscrypt_nokey_name, bytes[iname->len]); 357 } else { 358 memcpy(nokey_name.bytes, iname->name, sizeof(nokey_name.bytes)); 359 /* Compute strong hash of remaining part of name. */ 360 sha256(&iname->name[sizeof(nokey_name.bytes)], 361 iname->len - sizeof(nokey_name.bytes), 362 nokey_name.sha256); 363 size = FSCRYPT_NOKEY_NAME_MAX; 364 } 365 oname->len = base64_encode((const u8 *)&nokey_name, size, oname->name); 366 return 0; 367 } 368 EXPORT_SYMBOL(fscrypt_fname_disk_to_usr); 369 370 /** 371 * fscrypt_setup_filename() - prepare to search a possibly encrypted directory 372 * @dir: the directory that will be searched 373 * @iname: the user-provided filename being searched for 374 * @lookup: 1 if we're allowed to proceed without the key because it's 375 * ->lookup() or we're finding the dir_entry for deletion; 0 if we cannot 376 * proceed without the key because we're going to create the dir_entry. 377 * @fname: the filename information to be filled in 378 * 379 * Given a user-provided filename @iname, this function sets @fname->disk_name 380 * to the name that would be stored in the on-disk directory entry, if possible. 381 * If the directory is unencrypted this is simply @iname. Else, if we have the 382 * directory's encryption key, then @iname is the plaintext, so we encrypt it to 383 * get the disk_name. 384 * 385 * Else, for keyless @lookup operations, @iname should be a no-key name, so we 386 * decode it to get the struct fscrypt_nokey_name. Non-@lookup operations will 387 * be impossible in this case, so we fail them with ENOKEY. 388 * 389 * If successful, fscrypt_free_filename() must be called later to clean up. 390 * 391 * Return: 0 on success, -errno on failure 392 */ 393 int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname, 394 int lookup, struct fscrypt_name *fname) 395 { 396 struct fscrypt_nokey_name *nokey_name; 397 int ret; 398 399 memset(fname, 0, sizeof(struct fscrypt_name)); 400 fname->usr_fname = iname; 401 402 if (!IS_ENCRYPTED(dir) || fscrypt_is_dot_dotdot(iname)) { 403 fname->disk_name.name = (unsigned char *)iname->name; 404 fname->disk_name.len = iname->len; 405 return 0; 406 } 407 ret = fscrypt_get_encryption_info(dir, lookup); 408 if (ret) 409 return ret; 410 411 if (fscrypt_has_encryption_key(dir)) { 412 if (!fscrypt_fname_encrypted_size(&dir->i_crypt_info->ci_policy, 413 iname->len, 414 dir->i_sb->s_cop->max_namelen, 415 &fname->crypto_buf.len)) 416 return -ENAMETOOLONG; 417 fname->crypto_buf.name = kmalloc(fname->crypto_buf.len, 418 GFP_NOFS); 419 if (!fname->crypto_buf.name) 420 return -ENOMEM; 421 422 ret = fscrypt_fname_encrypt(dir, iname, fname->crypto_buf.name, 423 fname->crypto_buf.len); 424 if (ret) 425 goto errout; 426 fname->disk_name.name = fname->crypto_buf.name; 427 fname->disk_name.len = fname->crypto_buf.len; 428 return 0; 429 } 430 if (!lookup) 431 return -ENOKEY; 432 fname->is_nokey_name = true; 433 434 /* 435 * We don't have the key and we are doing a lookup; decode the 436 * user-supplied name 437 */ 438 439 if (iname->len > BASE64_CHARS(FSCRYPT_NOKEY_NAME_MAX)) 440 return -ENOENT; 441 442 fname->crypto_buf.name = kmalloc(FSCRYPT_NOKEY_NAME_MAX, GFP_KERNEL); 443 if (fname->crypto_buf.name == NULL) 444 return -ENOMEM; 445 446 ret = base64_decode(iname->name, iname->len, fname->crypto_buf.name); 447 if (ret < (int)offsetof(struct fscrypt_nokey_name, bytes[1]) || 448 (ret > offsetof(struct fscrypt_nokey_name, sha256) && 449 ret != FSCRYPT_NOKEY_NAME_MAX)) { 450 ret = -ENOENT; 451 goto errout; 452 } 453 fname->crypto_buf.len = ret; 454 455 nokey_name = (void *)fname->crypto_buf.name; 456 fname->hash = nokey_name->dirhash[0]; 457 fname->minor_hash = nokey_name->dirhash[1]; 458 if (ret != FSCRYPT_NOKEY_NAME_MAX) { 459 /* The full ciphertext filename is available. */ 460 fname->disk_name.name = nokey_name->bytes; 461 fname->disk_name.len = 462 ret - offsetof(struct fscrypt_nokey_name, bytes); 463 } 464 return 0; 465 466 errout: 467 kfree(fname->crypto_buf.name); 468 return ret; 469 } 470 EXPORT_SYMBOL(fscrypt_setup_filename); 471 472 /** 473 * fscrypt_match_name() - test whether the given name matches a directory entry 474 * @fname: the name being searched for 475 * @de_name: the name from the directory entry 476 * @de_name_len: the length of @de_name in bytes 477 * 478 * Normally @fname->disk_name will be set, and in that case we simply compare 479 * that to the name stored in the directory entry. The only exception is that 480 * if we don't have the key for an encrypted directory and the name we're 481 * looking for is very long, then we won't have the full disk_name and instead 482 * we'll need to match against a fscrypt_nokey_name that includes a strong hash. 483 * 484 * Return: %true if the name matches, otherwise %false. 485 */ 486 bool fscrypt_match_name(const struct fscrypt_name *fname, 487 const u8 *de_name, u32 de_name_len) 488 { 489 const struct fscrypt_nokey_name *nokey_name = 490 (const void *)fname->crypto_buf.name; 491 u8 digest[SHA256_DIGEST_SIZE]; 492 493 if (likely(fname->disk_name.name)) { 494 if (de_name_len != fname->disk_name.len) 495 return false; 496 return !memcmp(de_name, fname->disk_name.name, de_name_len); 497 } 498 if (de_name_len <= sizeof(nokey_name->bytes)) 499 return false; 500 if (memcmp(de_name, nokey_name->bytes, sizeof(nokey_name->bytes))) 501 return false; 502 sha256(&de_name[sizeof(nokey_name->bytes)], 503 de_name_len - sizeof(nokey_name->bytes), digest); 504 return !memcmp(digest, nokey_name->sha256, sizeof(digest)); 505 } 506 EXPORT_SYMBOL_GPL(fscrypt_match_name); 507 508 /** 509 * fscrypt_fname_siphash() - calculate the SipHash of a filename 510 * @dir: the parent directory 511 * @name: the filename to calculate the SipHash of 512 * 513 * Given a plaintext filename @name and a directory @dir which uses SipHash as 514 * its dirhash method and has had its fscrypt key set up, this function 515 * calculates the SipHash of that name using the directory's secret dirhash key. 516 * 517 * Return: the SipHash of @name using the hash key of @dir 518 */ 519 u64 fscrypt_fname_siphash(const struct inode *dir, const struct qstr *name) 520 { 521 const struct fscrypt_info *ci = dir->i_crypt_info; 522 523 WARN_ON(!ci->ci_dirhash_key_initialized); 524 525 return siphash(name->name, name->len, &ci->ci_dirhash_key); 526 } 527 EXPORT_SYMBOL_GPL(fscrypt_fname_siphash); 528 529 /* 530 * Validate dentries in encrypted directories to make sure we aren't potentially 531 * caching stale dentries after a key has been added. 532 */ 533 int fscrypt_d_revalidate(struct dentry *dentry, unsigned int flags) 534 { 535 struct dentry *dir; 536 int err; 537 int valid; 538 539 /* 540 * Plaintext names are always valid, since fscrypt doesn't support 541 * reverting to no-key names without evicting the directory's inode 542 * -- which implies eviction of the dentries in the directory. 543 */ 544 if (!(dentry->d_flags & DCACHE_NOKEY_NAME)) 545 return 1; 546 547 /* 548 * No-key name; valid if the directory's key is still unavailable. 549 * 550 * Although fscrypt forbids rename() on no-key names, we still must use 551 * dget_parent() here rather than use ->d_parent directly. That's 552 * because a corrupted fs image may contain directory hard links, which 553 * the VFS handles by moving the directory's dentry tree in the dcache 554 * each time ->lookup() finds the directory and it already has a dentry 555 * elsewhere. Thus ->d_parent can be changing, and we must safely grab 556 * a reference to some ->d_parent to prevent it from being freed. 557 */ 558 559 if (flags & LOOKUP_RCU) 560 return -ECHILD; 561 562 dir = dget_parent(dentry); 563 /* 564 * Pass allow_unsupported=true, so that files with an unsupported 565 * encryption policy can be deleted. 566 */ 567 err = fscrypt_get_encryption_info(d_inode(dir), true); 568 valid = !fscrypt_has_encryption_key(d_inode(dir)); 569 dput(dir); 570 571 if (err < 0) 572 return err; 573 574 return valid; 575 } 576 EXPORT_SYMBOL_GPL(fscrypt_d_revalidate); 577