Merge tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt

- The st_size of an encrypted symlink will not necessarily give the

  length of the symlink target as required by POSIX.  It will actually

  give the length of the ciphertext, which may be slightly longer than

  the plaintext due to the NUL-padding.

  give the length of the ciphertext, which will be slightly longer

  than the plaintext due to NUL-padding and an extra 2-byte overhead.

- The maximum length of an encrypted symlink is 2 bytes shorter than

  the maximum length of an unencrypted symlink.  For example, on an

  EXT4 filesystem with a 4K block size, unencrypted symlinks can be up

  to 4095 bytes long, while encrypted symlinks can only be up to 4093

  bytes long (both lengths excluding the terminating null).

Note that mmap *is* supported.  This is possible because the pagecache

for an encrypted file contains the plaintext, not the ciphertext.

#include <linux/dcache.h>

#include <linux/namei.h>

#include <crypto/aes.h>

#include <crypto/skcipher.h>

#include "fscrypt_private.h"

static unsigned int num_prealloc_crypto_pages = 32;

#include <linux/scatterlist.h>

#include <linux/ratelimit.h>

#include <crypto/skcipher.h>

#include "fscrypt_private.h"

static inline bool fscrypt_is_dot_dotdot(const struct qstr *str)

{

	if (str->len == 1 && str->name[0] == '.')

		return true;

	if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.')

		return true;

	return false;

}

/**

 * fname_encrypt() - encrypt a filename

 *

 * The caller must have allocated sufficient memory for the @oname string.

 * The output buffer must be at least as large as the input buffer.

 * Any extra space is filled with NUL padding before encryption.

 *

 * Return: 0 on success, -errno on failure

 */

static int fname_encrypt(struct inode *inode,

			const struct qstr *iname, struct fscrypt_str *oname)

int fname_encrypt(struct inode *inode, const struct qstr *iname,

		  u8 *out, unsigned int olen)

{

	struct skcipher_request *req = NULL;

	DECLARE_CRYPTO_WAIT(wait);

	struct fscrypt_info *ci = inode->i_crypt_info;

	struct crypto_skcipher *tfm = ci->ci_ctfm;

	struct crypto_skcipher *tfm = inode->i_crypt_info->ci_ctfm;

	int res = 0;

	char iv[FS_CRYPTO_BLOCK_SIZE];

	struct scatterlist sg;

	int padding = 4 << (ci->ci_flags & FS_POLICY_FLAGS_PAD_MASK);

	unsigned int lim;

	unsigned int cryptlen;

	lim = inode->i_sb->s_cop->max_namelen(inode);

	if (iname->len <= 0 || iname->len > lim)

		return -EIO;

	/*

	 * Copy the filename to the output buffer for encrypting in-place and

	 * pad it with the needed number of NUL bytes.

	 */

	cryptlen = max_t(unsigned int, iname->len, FS_CRYPTO_BLOCK_SIZE);

	cryptlen = round_up(cryptlen, padding);

	cryptlen = min(cryptlen, lim);

	memcpy(oname->name, iname->name, iname->len);

	memset(oname->name + iname->len, 0, cryptlen - iname->len);

	if (WARN_ON(olen < iname->len))

		return -ENOBUFS;

	memcpy(out, iname->name, iname->len);

	memset(out + iname->len, 0, olen - iname->len);

	/* Initialize the IV */

	memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);

	skcipher_request_set_callback(req,

			CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,

			crypto_req_done, &wait);

	sg_init_one(&sg, oname->name, cryptlen);

	skcipher_request_set_crypt(req, &sg, &sg, cryptlen, iv);

	sg_init_one(&sg, out, olen);

	skcipher_request_set_crypt(req, &sg, &sg, olen, iv);

	/* Do the encryption */

	res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);

		return res;

	}

	oname->len = cryptlen;

	return 0;

}

	return cp - dst;

}

u32 fscrypt_fname_encrypted_size(const struct inode *inode, u32 ilen)

bool fscrypt_fname_encrypted_size(const struct inode *inode, u32 orig_len,

				  u32 max_len, u32 *encrypted_len_ret)

{

	int padding = 32;

	struct fscrypt_info *ci = inode->i_crypt_info;

	if (ci)

		padding = 4 << (ci->ci_flags & FS_POLICY_FLAGS_PAD_MASK);

	ilen = max(ilen, (u32)FS_CRYPTO_BLOCK_SIZE);

	return round_up(ilen, padding);

	int padding = 4 << (inode->i_crypt_info->ci_flags &

			    FS_POLICY_FLAGS_PAD_MASK);

	u32 encrypted_len;

	if (orig_len > max_len)

		return false;

	encrypted_len = max(orig_len, (u32)FS_CRYPTO_BLOCK_SIZE);

	encrypted_len = round_up(encrypted_len, padding);

	*encrypted_len_ret = min(encrypted_len, max_len);

	return true;

}

EXPORT_SYMBOL(fscrypt_fname_encrypted_size);

/**

 * fscrypt_fname_crypto_alloc_obuff() -

 * fscrypt_fname_alloc_buffer - allocate a buffer for presented filenames

 *

 * Allocates an output buffer that is sufficient for the crypto operation

 * specified by the context and the direction.

 * Allocate a buffer that is large enough to hold any decrypted or encoded

 * filename (null-terminated), for the given maximum encrypted filename length.

 *

 * Return: 0 on success, -errno on failure

 */

int fscrypt_fname_alloc_buffer(const struct inode *inode,

				u32 ilen, struct fscrypt_str *crypto_str)

			       u32 max_encrypted_len,

			       struct fscrypt_str *crypto_str)

{

	u32 olen = fscrypt_fname_encrypted_size(inode, ilen);

	const u32 max_encoded_len =

		max_t(u32, BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE),

		      1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name)));

	u32 max_presented_len;

	crypto_str->len = olen;

	olen = max(olen, max_encoded_len);

	max_presented_len = max(max_encoded_len, max_encrypted_len);

	/*

	 * Allocated buffer can hold one more character to null-terminate the

	 * string

	 */

	crypto_str->name = kmalloc(olen + 1, GFP_NOFS);

	if (!(crypto_str->name))

	crypto_str->name = kmalloc(max_presented_len + 1, GFP_NOFS);

	if (!crypto_str->name)

		return -ENOMEM;

	crypto_str->len = max_presented_len;

	return 0;

}

EXPORT_SYMBOL(fscrypt_fname_alloc_buffer);

/**

 * fscrypt_fname_crypto_free_buffer() -

 * fscrypt_fname_free_buffer - free the buffer for presented filenames

 *

 * Frees the buffer allocated for crypto operation.

 * Free the buffer allocated by fscrypt_fname_alloc_buffer().

 */

void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)

{

}

EXPORT_SYMBOL(fscrypt_fname_disk_to_usr);

/**

 * fscrypt_fname_usr_to_disk() - converts a filename from user space to disk

 * space

 *

 * The caller must have allocated sufficient memory for the @oname string.

 *

 * Return: 0 on success, -errno on failure

 */

int fscrypt_fname_usr_to_disk(struct inode *inode,

			const struct qstr *iname,

			struct fscrypt_str *oname)

{

	if (fscrypt_is_dot_dotdot(iname)) {

		oname->name[0] = '.';

		oname->name[iname->len - 1] = '.';

		oname->len = iname->len;

		return 0;

	}

	if (inode->i_crypt_info)

		return fname_encrypt(inode, iname, oname);

	/*

	 * Without a proper key, a user is not allowed to modify the filenames

	 * in a directory. Consequently, a user space name cannot be mapped to

	 * a disk-space name

	 */

	return -ENOKEY;

}

EXPORT_SYMBOL(fscrypt_fname_usr_to_disk);

/**

 * fscrypt_setup_filename() - prepare to search a possibly encrypted directory

 * @dir: the directory that will be searched

		return ret;

	if (dir->i_crypt_info) {

		ret = fscrypt_fname_alloc_buffer(dir, iname->len,

							&fname->crypto_buf);

		if (ret)

			return ret;

		ret = fname_encrypt(dir, iname, &fname->crypto_buf);

		if (!fscrypt_fname_encrypted_size(dir, iname->len,

						  dir->i_sb->s_cop->max_namelen(dir),

						  &fname->crypto_buf.len))

			return -ENAMETOOLONG;

		fname->crypto_buf.name = kmalloc(fname->crypto_buf.len,

						 GFP_NOFS);

		if (!fname->crypto_buf.name)

			return -ENOMEM;

		ret = fname_encrypt(dir, iname, fname->crypto_buf.name,

				    fname->crypto_buf.len);

		if (ret)

			goto errout;

		fname->disk_name.name = fname->crypto_buf.name;

	return 0;

errout:

	fscrypt_fname_free_buffer(&fname->crypto_buf);

	kfree(fname->crypto_buf.name);

	return ret;

}

EXPORT_SYMBOL(fscrypt_setup_filename);

#define FS_ENCRYPTION_CONTEXT_FORMAT_V1		1

/**

 * For encrypted symlinks, the ciphertext length is stored at the beginning

 * of the string in little-endian format.

 */

struct fscrypt_symlink_data {

	__le16 len;

	char encrypted_path[1];

} __packed;

/*

 * A pointer to this structure is stored in the file system's in-core

 * representation of an inode.

#define FS_CTX_REQUIRES_FREE_ENCRYPT_FL		0x00000001

#define FS_CTX_HAS_BOUNCE_BUFFER_FL		0x00000002

static inline bool fscrypt_valid_enc_modes(u32 contents_mode,

					   u32 filenames_mode)

{

	if (contents_mode == FS_ENCRYPTION_MODE_AES_128_CBC &&

	    filenames_mode == FS_ENCRYPTION_MODE_AES_128_CTS)

		return true;

	if (contents_mode == FS_ENCRYPTION_MODE_AES_256_XTS &&

	    filenames_mode == FS_ENCRYPTION_MODE_AES_256_CTS)

		return true;

	return false;

}

/* crypto.c */

extern struct kmem_cache *fscrypt_info_cachep;

extern int fscrypt_initialize(unsigned int cop_flags);

extern struct workqueue_struct *fscrypt_read_workqueue;

extern int fscrypt_do_page_crypto(const struct inode *inode,

extern struct page *fscrypt_alloc_bounce_page(struct fscrypt_ctx *ctx,

					      gfp_t gfp_flags);

/* fname.c */

extern int fname_encrypt(struct inode *inode, const struct qstr *iname,

			 u8 *out, unsigned int olen);

extern bool fscrypt_fname_encrypted_size(const struct inode *inode,

					 u32 orig_len, u32 max_len,

					 u32 *encrypted_len_ret);

/* keyinfo.c */

extern void __exit fscrypt_essiv_cleanup(void);

	return 0;

}

EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);

int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,

			      unsigned int max_len,

			      struct fscrypt_str *disk_link)

{

	int err;

	/*

	 * To calculate the size of the encrypted symlink target we need to know

	 * the amount of NUL padding, which is determined by the flags set in

	 * the encryption policy which will be inherited from the directory.

	 * The easiest way to get access to this is to just load the directory's

	 * fscrypt_info, since we'll need it to create the dir_entry anyway.

	 *

	 * Note: in test_dummy_encryption mode, @dir may be unencrypted.

	 */

	err = fscrypt_get_encryption_info(dir);

	if (err)

		return err;

	if (!fscrypt_has_encryption_key(dir))

		return -ENOKEY;

	/*

	 * Calculate the size of the encrypted symlink and verify it won't

	 * exceed max_len.  Note that for historical reasons, encrypted symlink

	 * targets are prefixed with the ciphertext length, despite this

	 * actually being redundant with i_size.  This decreases by 2 bytes the

	 * longest symlink target we can accept.

	 *

	 * We could recover 1 byte by not counting a null terminator, but

	 * counting it (even though it is meaningless for ciphertext) is simpler

	 * for now since filesystems will assume it is there and subtract it.

	 */

	if (!fscrypt_fname_encrypted_size(dir, len,

					  max_len - sizeof(struct fscrypt_symlink_data),

					  &disk_link->len))

		return -ENAMETOOLONG;

	disk_link->len += sizeof(struct fscrypt_symlink_data);

	disk_link->name = NULL;

	return 0;

}

EXPORT_SYMBOL_GPL(__fscrypt_prepare_symlink);

int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,

			      unsigned int len, struct fscrypt_str *disk_link)

{

	int err;

	struct qstr iname = QSTR_INIT(target, len);

	struct fscrypt_symlink_data *sd;

	unsigned int ciphertext_len;

	err = fscrypt_require_key(inode);

	if (err)

		return err;

	if (disk_link->name) {

		/* filesystem-provided buffer */

		sd = (struct fscrypt_symlink_data *)disk_link->name;

	} else {

		sd = kmalloc(disk_link->len, GFP_NOFS);

		if (!sd)

			return -ENOMEM;

	}

	ciphertext_len = disk_link->len - sizeof(*sd);

	sd->len = cpu_to_le16(ciphertext_len);

	err = fname_encrypt(inode, &iname, sd->encrypted_path, ciphertext_len);

	if (err) {

		if (!disk_link->name)

			kfree(sd);

		return err;

	}

	/*

	 * Null-terminating the ciphertext doesn't make sense, but we still

	 * count the null terminator in the length, so we might as well

	 * initialize it just in case the filesystem writes it out.

	 */

	sd->encrypted_path[ciphertext_len] = '\0';

	if (!disk_link->name)

		disk_link->name = (unsigned char *)sd;

	return 0;

}

EXPORT_SYMBOL_GPL(__fscrypt_encrypt_symlink);

/**

 * fscrypt_get_symlink - get the target of an encrypted symlink

 * @inode: the symlink inode

 * @caddr: the on-disk contents of the symlink

 * @max_size: size of @caddr buffer

 * @done: if successful, will be set up to free the returned target

 *

 * If the symlink's encryption key is available, we decrypt its target.

 * Otherwise, we encode its target for presentation.

 *

 * This may sleep, so the filesystem must have dropped out of RCU mode already.

 *

 * Return: the presentable symlink target or an ERR_PTR()

 */

const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,

				unsigned int max_size,

				struct delayed_call *done)

{

	const struct fscrypt_symlink_data *sd;

	struct fscrypt_str cstr, pstr;

	int err;

	/* This is for encrypted symlinks only */

	if (WARN_ON(!IS_ENCRYPTED(inode)))

		return ERR_PTR(-EINVAL);

	/*

	 * Try to set up the symlink's encryption key, but we can continue

	 * regardless of whether the key is available or not.

	 */

	err = fscrypt_get_encryption_info(inode);

	if (err)

		return ERR_PTR(err);

	/*

	 * For historical reasons, encrypted symlink targets are prefixed with

	 * the ciphertext length, even though this is redundant with i_size.

	 */

	if (max_size < sizeof(*sd))

		return ERR_PTR(-EUCLEAN);

	sd = caddr;

	cstr.name = (unsigned char *)sd->encrypted_path;

	cstr.len = le16_to_cpu(sd->len);

	if (cstr.len == 0)

		return ERR_PTR(-EUCLEAN);

	if (cstr.len + sizeof(*sd) - 1 > max_size)

		return ERR_PTR(-EUCLEAN);

	err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);

	if (err)

		return ERR_PTR(err);

	err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);

	if (err)

		goto err_kfree;

	err = -EUCLEAN;

	if (pstr.name[0] == '\0')

		goto err_kfree;

	pstr.name[pstr.len] = '\0';

	set_delayed_call(done, kfree_link, pstr.name);

	return pstr.name;

err_kfree:

	kfree(pstr.name);

	return ERR_PTR(err);

}

EXPORT_SYMBOL_GPL(fscrypt_get_symlink);