1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * This contains functions for filename crypto management 4 * 5 * Copyright (C) 2015, Google, Inc. 6 * Copyright (C) 2015, Motorola Mobility 7 * 8 * Written by Uday Savagaonkar, 2014. 9 * Modified by Jaegeuk Kim, 2015. 10 * 11 * This has not yet undergone a rigorous security audit. 12 */ 13 14 #include <linux/scatterlist.h> 15 #include <crypto/skcipher.h> 16 #include "fscrypt_private.h" 17 18 static inline bool fscrypt_is_dot_dotdot(const struct qstr *str) 19 { 20 if (str->len == 1 && str->name[0] == '.') 21 return true; 22 23 if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.') 24 return true; 25 26 return false; 27 } 28 29 /** 30 * fname_encrypt() - encrypt a filename 31 * 32 * The output buffer must be at least as large as the input buffer. 33 * Any extra space is filled with NUL padding before encryption. 34 * 35 * Return: 0 on success, -errno on failure 36 */ 37 int fname_encrypt(struct inode *inode, const struct qstr *iname, 38 u8 *out, unsigned int olen) 39 { 40 struct skcipher_request *req = NULL; 41 DECLARE_CRYPTO_WAIT(wait); 42 struct fscrypt_info *ci = inode->i_crypt_info; 43 struct crypto_skcipher *tfm = ci->ci_ctfm; 44 union fscrypt_iv iv; 45 struct scatterlist sg; 46 int res; 47 48 /* 49 * Copy the filename to the output buffer for encrypting in-place and 50 * pad it with the needed number of NUL bytes. 51 */ 52 if (WARN_ON(olen < iname->len)) 53 return -ENOBUFS; 54 memcpy(out, iname->name, iname->len); 55 memset(out + iname->len, 0, olen - iname->len); 56 57 /* Initialize the IV */ 58 fscrypt_generate_iv(&iv, 0, ci); 59 60 /* Set up the encryption request */ 61 req = skcipher_request_alloc(tfm, GFP_NOFS); 62 if (!req) 63 return -ENOMEM; 64 skcipher_request_set_callback(req, 65 CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, 66 crypto_req_done, &wait); 67 sg_init_one(&sg, out, olen); 68 skcipher_request_set_crypt(req, &sg, &sg, olen, &iv); 69 70 /* Do the encryption */ 71 res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); 72 skcipher_request_free(req); 73 if (res < 0) { 74 fscrypt_err(inode->i_sb, 75 "Filename encryption failed for inode %lu: %d", 76 inode->i_ino, res); 77 return res; 78 } 79 80 return 0; 81 } 82 83 /** 84 * fname_decrypt() - decrypt a filename 85 * 86 * The caller must have allocated sufficient memory for the @oname string. 87 * 88 * Return: 0 on success, -errno on failure 89 */ 90 static int fname_decrypt(struct inode *inode, 91 const struct fscrypt_str *iname, 92 struct fscrypt_str *oname) 93 { 94 struct skcipher_request *req = NULL; 95 DECLARE_CRYPTO_WAIT(wait); 96 struct scatterlist src_sg, dst_sg; 97 struct fscrypt_info *ci = inode->i_crypt_info; 98 struct crypto_skcipher *tfm = ci->ci_ctfm; 99 union fscrypt_iv iv; 100 int res; 101 102 /* Allocate request */ 103 req = skcipher_request_alloc(tfm, GFP_NOFS); 104 if (!req) 105 return -ENOMEM; 106 skcipher_request_set_callback(req, 107 CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, 108 crypto_req_done, &wait); 109 110 /* Initialize IV */ 111 fscrypt_generate_iv(&iv, 0, ci); 112 113 /* Create decryption request */ 114 sg_init_one(&src_sg, iname->name, iname->len); 115 sg_init_one(&dst_sg, oname->name, oname->len); 116 skcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, &iv); 117 res = crypto_wait_req(crypto_skcipher_decrypt(req), &wait); 118 skcipher_request_free(req); 119 if (res < 0) { 120 fscrypt_err(inode->i_sb, 121 "Filename decryption failed for inode %lu: %d", 122 inode->i_ino, res); 123 return res; 124 } 125 126 oname->len = strnlen(oname->name, iname->len); 127 return 0; 128 } 129 130 static const char *lookup_table = 131 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,"; 132 133 #define BASE64_CHARS(nbytes) DIV_ROUND_UP((nbytes) * 4, 3) 134 135 /** 136 * digest_encode() - 137 * 138 * Encodes the input digest using characters from the set [a-zA-Z0-9_+]. 139 * The encoded string is roughly 4/3 times the size of the input string. 140 */ 141 static int digest_encode(const char *src, int len, char *dst) 142 { 143 int i = 0, bits = 0, ac = 0; 144 char *cp = dst; 145 146 while (i < len) { 147 ac += (((unsigned char) src[i]) << bits); 148 bits += 8; 149 do { 150 *cp++ = lookup_table[ac & 0x3f]; 151 ac >>= 6; 152 bits -= 6; 153 } while (bits >= 6); 154 i++; 155 } 156 if (bits) 157 *cp++ = lookup_table[ac & 0x3f]; 158 return cp - dst; 159 } 160 161 static int digest_decode(const char *src, int len, char *dst) 162 { 163 int i = 0, bits = 0, ac = 0; 164 const char *p; 165 char *cp = dst; 166 167 while (i < len) { 168 p = strchr(lookup_table, src[i]); 169 if (p == NULL || src[i] == 0) 170 return -2; 171 ac += (p - lookup_table) << bits; 172 bits += 6; 173 if (bits >= 8) { 174 *cp++ = ac & 0xff; 175 ac >>= 8; 176 bits -= 8; 177 } 178 i++; 179 } 180 if (ac) 181 return -1; 182 return cp - dst; 183 } 184 185 bool fscrypt_fname_encrypted_size(const struct inode *inode, u32 orig_len, 186 u32 max_len, u32 *encrypted_len_ret) 187 { 188 int padding = 4 << (inode->i_crypt_info->ci_flags & 189 FS_POLICY_FLAGS_PAD_MASK); 190 u32 encrypted_len; 191 192 if (orig_len > max_len) 193 return false; 194 encrypted_len = max(orig_len, (u32)FS_CRYPTO_BLOCK_SIZE); 195 encrypted_len = round_up(encrypted_len, padding); 196 *encrypted_len_ret = min(encrypted_len, max_len); 197 return true; 198 } 199 200 /** 201 * fscrypt_fname_alloc_buffer - allocate a buffer for presented filenames 202 * 203 * Allocate a buffer that is large enough to hold any decrypted or encoded 204 * filename (null-terminated), for the given maximum encrypted filename length. 205 * 206 * Return: 0 on success, -errno on failure 207 */ 208 int fscrypt_fname_alloc_buffer(const struct inode *inode, 209 u32 max_encrypted_len, 210 struct fscrypt_str *crypto_str) 211 { 212 const u32 max_encoded_len = 213 max_t(u32, BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE), 214 1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name))); 215 u32 max_presented_len; 216 217 max_presented_len = max(max_encoded_len, max_encrypted_len); 218 219 crypto_str->name = kmalloc(max_presented_len + 1, GFP_NOFS); 220 if (!crypto_str->name) 221 return -ENOMEM; 222 crypto_str->len = max_presented_len; 223 return 0; 224 } 225 EXPORT_SYMBOL(fscrypt_fname_alloc_buffer); 226 227 /** 228 * fscrypt_fname_free_buffer - free the buffer for presented filenames 229 * 230 * Free the buffer allocated by fscrypt_fname_alloc_buffer(). 231 */ 232 void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str) 233 { 234 if (!crypto_str) 235 return; 236 kfree(crypto_str->name); 237 crypto_str->name = NULL; 238 } 239 EXPORT_SYMBOL(fscrypt_fname_free_buffer); 240 241 /** 242 * fscrypt_fname_disk_to_usr() - converts a filename from disk space to user 243 * space 244 * 245 * The caller must have allocated sufficient memory for the @oname string. 246 * 247 * If the key is available, we'll decrypt the disk name; otherwise, we'll encode 248 * it for presentation. Short names are directly base64-encoded, while long 249 * names are encoded in fscrypt_digested_name format. 250 * 251 * Return: 0 on success, -errno on failure 252 */ 253 int fscrypt_fname_disk_to_usr(struct inode *inode, 254 u32 hash, u32 minor_hash, 255 const struct fscrypt_str *iname, 256 struct fscrypt_str *oname) 257 { 258 const struct qstr qname = FSTR_TO_QSTR(iname); 259 struct fscrypt_digested_name digested_name; 260 261 if (fscrypt_is_dot_dotdot(&qname)) { 262 oname->name[0] = '.'; 263 oname->name[iname->len - 1] = '.'; 264 oname->len = iname->len; 265 return 0; 266 } 267 268 if (iname->len < FS_CRYPTO_BLOCK_SIZE) 269 return -EUCLEAN; 270 271 if (fscrypt_has_encryption_key(inode)) 272 return fname_decrypt(inode, iname, oname); 273 274 if (iname->len <= FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE) { 275 oname->len = digest_encode(iname->name, iname->len, 276 oname->name); 277 return 0; 278 } 279 if (hash) { 280 digested_name.hash = hash; 281 digested_name.minor_hash = minor_hash; 282 } else { 283 digested_name.hash = 0; 284 digested_name.minor_hash = 0; 285 } 286 memcpy(digested_name.digest, 287 FSCRYPT_FNAME_DIGEST(iname->name, iname->len), 288 FSCRYPT_FNAME_DIGEST_SIZE); 289 oname->name[0] = '_'; 290 oname->len = 1 + digest_encode((const char *)&digested_name, 291 sizeof(digested_name), oname->name + 1); 292 return 0; 293 } 294 EXPORT_SYMBOL(fscrypt_fname_disk_to_usr); 295 296 /** 297 * fscrypt_setup_filename() - prepare to search a possibly encrypted directory 298 * @dir: the directory that will be searched 299 * @iname: the user-provided filename being searched for 300 * @lookup: 1 if we're allowed to proceed without the key because it's 301 * ->lookup() or we're finding the dir_entry for deletion; 0 if we cannot 302 * proceed without the key because we're going to create the dir_entry. 303 * @fname: the filename information to be filled in 304 * 305 * Given a user-provided filename @iname, this function sets @fname->disk_name 306 * to the name that would be stored in the on-disk directory entry, if possible. 307 * If the directory is unencrypted this is simply @iname. Else, if we have the 308 * directory's encryption key, then @iname is the plaintext, so we encrypt it to 309 * get the disk_name. 310 * 311 * Else, for keyless @lookup operations, @iname is the presented ciphertext, so 312 * we decode it to get either the ciphertext disk_name (for short names) or the 313 * fscrypt_digested_name (for long names). Non-@lookup operations will be 314 * impossible in this case, so we fail them with ENOKEY. 315 * 316 * If successful, fscrypt_free_filename() must be called later to clean up. 317 * 318 * Return: 0 on success, -errno on failure 319 */ 320 int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname, 321 int lookup, struct fscrypt_name *fname) 322 { 323 int ret; 324 int digested; 325 326 memset(fname, 0, sizeof(struct fscrypt_name)); 327 fname->usr_fname = iname; 328 329 if (!IS_ENCRYPTED(dir) || fscrypt_is_dot_dotdot(iname)) { 330 fname->disk_name.name = (unsigned char *)iname->name; 331 fname->disk_name.len = iname->len; 332 return 0; 333 } 334 ret = fscrypt_get_encryption_info(dir); 335 if (ret) 336 return ret; 337 338 if (fscrypt_has_encryption_key(dir)) { 339 if (!fscrypt_fname_encrypted_size(dir, iname->len, 340 dir->i_sb->s_cop->max_namelen, 341 &fname->crypto_buf.len)) 342 return -ENAMETOOLONG; 343 fname->crypto_buf.name = kmalloc(fname->crypto_buf.len, 344 GFP_NOFS); 345 if (!fname->crypto_buf.name) 346 return -ENOMEM; 347 348 ret = fname_encrypt(dir, iname, fname->crypto_buf.name, 349 fname->crypto_buf.len); 350 if (ret) 351 goto errout; 352 fname->disk_name.name = fname->crypto_buf.name; 353 fname->disk_name.len = fname->crypto_buf.len; 354 return 0; 355 } 356 if (!lookup) 357 return -ENOKEY; 358 fname->is_ciphertext_name = true; 359 360 /* 361 * We don't have the key and we are doing a lookup; decode the 362 * user-supplied name 363 */ 364 if (iname->name[0] == '_') { 365 if (iname->len != 366 1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name))) 367 return -ENOENT; 368 digested = 1; 369 } else { 370 if (iname->len > 371 BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE)) 372 return -ENOENT; 373 digested = 0; 374 } 375 376 fname->crypto_buf.name = 377 kmalloc(max_t(size_t, FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE, 378 sizeof(struct fscrypt_digested_name)), 379 GFP_KERNEL); 380 if (fname->crypto_buf.name == NULL) 381 return -ENOMEM; 382 383 ret = digest_decode(iname->name + digested, iname->len - digested, 384 fname->crypto_buf.name); 385 if (ret < 0) { 386 ret = -ENOENT; 387 goto errout; 388 } 389 fname->crypto_buf.len = ret; 390 if (digested) { 391 const struct fscrypt_digested_name *n = 392 (const void *)fname->crypto_buf.name; 393 fname->hash = n->hash; 394 fname->minor_hash = n->minor_hash; 395 } else { 396 fname->disk_name.name = fname->crypto_buf.name; 397 fname->disk_name.len = fname->crypto_buf.len; 398 } 399 return 0; 400 401 errout: 402 kfree(fname->crypto_buf.name); 403 return ret; 404 } 405 EXPORT_SYMBOL(fscrypt_setup_filename); 406