keys/encrypted-keys/encrypted.c

276 static char *datablob_format(struct encrypted_key_payload *epayload,
280 	u8 *iv = epayload->iv;
291 	len = sprintf(ascii_buf, "%s %s %s ", epayload->format,
292 		      epayload->master_desc, epayload->datalen);
416 static struct key *request_master_key(struct encrypted_key_payload *epayload,
421 	if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
423 		mkey = request_trusted_key(epayload->master_desc +
426 	} else if (!strncmp(epayload->master_desc, KEY_USER_PREFIX,
428 		mkey = request_user_key(epayload->master_desc +
439 				epayload->master_desc);
442 				epayload->master_desc);
452 static int derived_key_encrypt(struct encrypted_key_payload *epayload,
464 	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
470 	dump_decrypted_data(epayload);
473 	sg_set_buf(&sg_in[0], epayload->decrypted_data,
474 		   epayload->decrypted_datalen);
478 	sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
480 	memcpy(iv, epayload->iv, sizeof(iv));
489 		dump_encrypted_data(epayload, encrypted_datalen);
494 static int datablob_hmac_append(struct encrypted_key_payload *epayload,
505 	digest = epayload->format + epayload->datablob_len;
507 			epayload->format, epayload->datablob_len);
516 static int datablob_hmac_verify(struct encrypted_key_payload *epayload,
530 	len = epayload->datablob_len;
532 		p = epayload->master_desc;
533 		len -= strlen(epayload->format) + 1;
535 		p = epayload->format;
540 	ret = crypto_memneq(digest, epayload->format + epayload->datablob_len,
545 			  epayload->format + epayload->datablob_len,
554 static int derived_key_decrypt(struct encrypted_key_payload *epayload,
572 	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
577 	dump_encrypted_data(epayload, encrypted_datalen);
581 	sg_set_buf(sg_in, epayload->encrypted_data, encrypted_datalen);
582 	sg_set_buf(&sg_out[0], epayload->decrypted_data,
583 		   epayload->decrypted_datalen);
586 	memcpy(iv, epayload->iv, sizeof(iv));
594 	dump_decrypted_data(epayload);
607 	struct encrypted_key_payload *epayload = NULL;
670 	epayload = kzalloc(sizeof(*epayload) + payload_datalen +
672 	if (!epayload)
675 	epayload->payload_datalen = payload_datalen;
676 	epayload->decrypted_datalen = decrypted_datalen;
677 	epayload->datablob_len = datablob_len;
678 	return epayload;
681 static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
694 	encrypted_datalen = roundup(epayload->decrypted_datalen, blksize);
700 	ret = hex2bin(epayload->iv, hex_encoded_iv, ivsize);
703 	ret = hex2bin(epayload->encrypted_data, hex_encoded_data,
708 	hmac = epayload->format + epayload->datablob_len;
714 	mkey = request_master_key(epayload, &master_key, &master_keylen);
718 	ret = datablob_hmac_verify(epayload, format, master_key, master_keylen);
728 	ret = derived_key_decrypt(epayload, derived_key, sizeof derived_key);
738 static void __ekey_init(struct encrypted_key_payload *epayload,
745 	epayload->format = epayload->payload_data + epayload->payload_datalen;
746 	epayload->master_desc = epayload->format + format_len + 1;
747 	epayload->datalen = epayload->master_desc + strlen(master_desc) + 1;
748 	epayload->iv = epayload->datalen + strlen(datalen) + 1;
749 	epayload->encrypted_data = epayload->iv + ivsize + 1;
750 	epayload->decrypted_data = epayload->payload_data;
753 		memcpy(epayload->format, key_format_default, format_len);
756 			epayload->decrypted_data =
757 				ecryptfs_get_auth_tok_key((struct ecryptfs_auth_tok *)epayload->payload_data);
759 		memcpy(epayload->format, format, format_len);
762 	memcpy(epayload->master_desc, master_desc, strlen(master_desc));
763 	memcpy(epayload->datalen, datalen, strlen(datalen));
773 static int encrypted_init(struct encrypted_key_payload *epayload,
785 		ecryptfs_fill_auth_tok((struct ecryptfs_auth_tok *)epayload->payload_data,
789 	__ekey_init(epayload, format, master_desc, datalen);
791 		ret = encrypted_key_decrypt(epayload, format, hex_encoded_iv);
793 		get_random_bytes(epayload->iv, ivsize);
794 		ret = hex2bin(epayload->decrypted_data, decrypted_data,
795 			      epayload->decrypted_datalen);
797 		get_random_bytes(epayload->iv, ivsize);
798 		get_random_bytes(epayload->decrypted_data, epayload->decrypted_datalen);
816 	struct encrypted_key_payload *epayload = NULL;
839 	epayload = encrypted_key_alloc(key, format, master_desc,
841 	if (IS_ERR(epayload)) {
842 		ret = PTR_ERR(epayload);
845 	ret = encrypted_init(epayload, key->description, format, master_desc,
848 		kfree_sensitive(epayload);
852 	rcu_assign_keypointer(key, epayload);
860 	struct encrypted_key_payload *epayload;
862 	epayload = container_of(rcu, struct encrypted_key_payload, rcu);
863 	kfree_sensitive(epayload);
877 	struct encrypted_key_payload *epayload = key->payload.data[0];
900 	ret = valid_master_desc(new_master_desc, epayload->master_desc);
904 	new_epayload = encrypted_key_alloc(key, epayload->format,
905 					   new_master_desc, epayload->datalen, NULL);
911 	__ekey_init(new_epayload, epayload->format, new_master_desc,
912 		    epayload->datalen);
914 	memcpy(new_epayload->iv, epayload->iv, ivsize);
915 	memcpy(new_epayload->payload_data, epayload->payload_data,
916 	       epayload->payload_datalen);
919 	call_rcu(&epayload->rcu, encrypted_rcu_free);
936 	struct encrypted_key_payload *epayload;
945 	epayload = dereference_key_locked(key);
948 	asciiblob_len = epayload->datablob_len + ivsize + 1
949 	    + roundup(epayload->decrypted_datalen, blksize)
955 	mkey = request_master_key(epayload, &master_key, &master_keylen);
963 	ret = derived_key_encrypt(epayload, derived_key, sizeof derived_key);
967 	ret = datablob_hmac_append(epayload, master_key, master_keylen);
971 	ascii_buf = datablob_format(epayload, asciiblob_len);