1// SPDX-License-Identifier: GPL-2.0
  2/*
  3 * This contains functions for filename crypto management
  4 *
  5 * Copyright (C) 2015, Google, Inc.
  6 * Copyright (C) 2015, Motorola Mobility
  7 *
  8 * Written by Uday Savagaonkar, 2014.
  9 * Modified by Jaegeuk Kim, 2015.
 10 *
 11 * This has not yet undergone a rigorous security audit.
 12 */
 13
 14#include <linux/scatterlist.h>
 15#include <linux/ratelimit.h>
 16#include <crypto/skcipher.h>
 17#include "fscrypt_private.h"
 18
 19static inline bool fscrypt_is_dot_dotdot(const struct qstr *str)
 20{
 21	if (str->len == 1 && str->name[0] == '.')
 22		return true;
 23
 24	if (str->len == 2 && str->name[0] == '.' && str->name[1] == '.')
 25		return true;
 26
 27	return false;
 28}
 29
 30/**
 31 * fname_encrypt() - encrypt a filename
 32 *
 33 * The output buffer must be at least as large as the input buffer.
 34 * Any extra space is filled with NUL padding before encryption.
 35 *
 36 * Return: 0 on success, -errno on failure
 37 */
 38int fname_encrypt(struct inode *inode, const struct qstr *iname,
 39		  u8 *out, unsigned int olen)
 40{
 41	struct skcipher_request *req = NULL;
 42	DECLARE_CRYPTO_WAIT(wait);
 43	struct crypto_skcipher *tfm = inode->i_crypt_info->ci_ctfm;
 44	int res = 0;
 45	char iv[FS_CRYPTO_BLOCK_SIZE];
 46	struct scatterlist sg;
 47
 48	/*
 49	 * Copy the filename to the output buffer for encrypting in-place and
 50	 * pad it with the needed number of NUL bytes.
 51	 */
 52	if (WARN_ON(olen < iname->len))
 53		return -ENOBUFS;
 54	memcpy(out, iname->name, iname->len);
 55	memset(out + iname->len, 0, olen - iname->len);
 56
 57	/* Initialize the IV */
 58	memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);
 59
 60	/* Set up the encryption request */
 61	req = skcipher_request_alloc(tfm, GFP_NOFS);
 62	if (!req) {
 63		printk_ratelimited(KERN_ERR
 64			"%s: skcipher_request_alloc() failed\n", __func__);
 65		return -ENOMEM;
 66	}
 67	skcipher_request_set_callback(req,
 68			CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
 69			crypto_req_done, &wait);
 70	sg_init_one(&sg, out, olen);
 71	skcipher_request_set_crypt(req, &sg, &sg, olen, iv);
 72
 73	/* Do the encryption */
 74	res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
 75	skcipher_request_free(req);
 76	if (res < 0) {
 77		printk_ratelimited(KERN_ERR
 78				"%s: Error (error code %d)\n", __func__, res);
 79		return res;
 80	}
 81
 82	return 0;
 83}
 84
 85/**
 86 * fname_decrypt() - decrypt a filename
 87 *
 88 * The caller must have allocated sufficient memory for the @oname string.
 89 *
 90 * Return: 0 on success, -errno on failure
 91 */
 92static int fname_decrypt(struct inode *inode,
 93				const struct fscrypt_str *iname,
 94				struct fscrypt_str *oname)
 95{
 96	struct skcipher_request *req = NULL;
 97	DECLARE_CRYPTO_WAIT(wait);
 98	struct scatterlist src_sg, dst_sg;
 99	struct fscrypt_info *ci = inode->i_crypt_info;
100	struct crypto_skcipher *tfm = ci->ci_ctfm;
101	int res = 0;
102	char iv[FS_CRYPTO_BLOCK_SIZE];
103	unsigned lim;
104
105	lim = inode->i_sb->s_cop->max_namelen(inode);
106	if (iname->len <= 0 || iname->len > lim)
107		return -EIO;
108
109	/* Allocate request */
110	req = skcipher_request_alloc(tfm, GFP_NOFS);
111	if (!req) {
112		printk_ratelimited(KERN_ERR
113			"%s: crypto_request_alloc() failed\n",  __func__);
114		return -ENOMEM;
115	}
116	skcipher_request_set_callback(req,
117		CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
118		crypto_req_done, &wait);
119
120	/* Initialize IV */
121	memset(iv, 0, FS_CRYPTO_BLOCK_SIZE);
122
123	/* Create decryption request */
124	sg_init_one(&src_sg, iname->name, iname->len);
125	sg_init_one(&dst_sg, oname->name, oname->len);
126	skcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv);
127	res = crypto_wait_req(crypto_skcipher_decrypt(req), &wait);
128	skcipher_request_free(req);
129	if (res < 0) {
130		printk_ratelimited(KERN_ERR
131				"%s: Error (error code %d)\n", __func__, res);
132		return res;
133	}
134
135	oname->len = strnlen(oname->name, iname->len);
136	return 0;
137}
138
139static const char *lookup_table =
140	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+,";
141
142#define BASE64_CHARS(nbytes)	DIV_ROUND_UP((nbytes) * 4, 3)
143
144/**
145 * digest_encode() -
146 *
147 * Encodes the input digest using characters from the set [a-zA-Z0-9_+].
148 * The encoded string is roughly 4/3 times the size of the input string.
149 */
150static int digest_encode(const char *src, int len, char *dst)
151{
152	int i = 0, bits = 0, ac = 0;
153	char *cp = dst;
154
155	while (i < len) {
156		ac += (((unsigned char) src[i]) << bits);
157		bits += 8;
158		do {
159			*cp++ = lookup_table[ac & 0x3f];
160			ac >>= 6;
161			bits -= 6;
162		} while (bits >= 6);
163		i++;
164	}
165	if (bits)
166		*cp++ = lookup_table[ac & 0x3f];
167	return cp - dst;
168}
169
170static int digest_decode(const char *src, int len, char *dst)
171{
172	int i = 0, bits = 0, ac = 0;
173	const char *p;
174	char *cp = dst;
175
176	while (i < len) {
177		p = strchr(lookup_table, src[i]);
178		if (p == NULL || src[i] == 0)
179			return -2;
180		ac += (p - lookup_table) << bits;
181		bits += 6;
182		if (bits >= 8) {
183			*cp++ = ac & 0xff;
184			ac >>= 8;
185			bits -= 8;
186		}
187		i++;
188	}
189	if (ac)
190		return -1;
191	return cp - dst;
192}
193
194bool fscrypt_fname_encrypted_size(const struct inode *inode, u32 orig_len,
195				  u32 max_len, u32 *encrypted_len_ret)
196{
197	int padding = 4 << (inode->i_crypt_info->ci_flags &
198			    FS_POLICY_FLAGS_PAD_MASK);
199	u32 encrypted_len;
200
201	if (orig_len > max_len)
202		return false;
203	encrypted_len = max(orig_len, (u32)FS_CRYPTO_BLOCK_SIZE);
204	encrypted_len = round_up(encrypted_len, padding);
205	*encrypted_len_ret = min(encrypted_len, max_len);
206	return true;
207}
208
209/**
210 * fscrypt_fname_alloc_buffer - allocate a buffer for presented filenames
211 *
212 * Allocate a buffer that is large enough to hold any decrypted or encoded
213 * filename (null-terminated), for the given maximum encrypted filename length.
214 *
215 * Return: 0 on success, -errno on failure
216 */
217int fscrypt_fname_alloc_buffer(const struct inode *inode,
218			       u32 max_encrypted_len,
219			       struct fscrypt_str *crypto_str)
220{
221	const u32 max_encoded_len =
222		max_t(u32, BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE),
223		      1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name)));
224	u32 max_presented_len;
225
226	max_presented_len = max(max_encoded_len, max_encrypted_len);
227
228	crypto_str->name = kmalloc(max_presented_len + 1, GFP_NOFS);
229	if (!crypto_str->name)
230		return -ENOMEM;
231	crypto_str->len = max_presented_len;
232	return 0;
233}
234EXPORT_SYMBOL(fscrypt_fname_alloc_buffer);
235
236/**
237 * fscrypt_fname_free_buffer - free the buffer for presented filenames
238 *
239 * Free the buffer allocated by fscrypt_fname_alloc_buffer().
240 */
241void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)
242{
243	if (!crypto_str)
244		return;
245	kfree(crypto_str->name);
246	crypto_str->name = NULL;
247}
248EXPORT_SYMBOL(fscrypt_fname_free_buffer);
249
250/**
251 * fscrypt_fname_disk_to_usr() - converts a filename from disk space to user
252 * space
253 *
254 * The caller must have allocated sufficient memory for the @oname string.
255 *
256 * If the key is available, we'll decrypt the disk name; otherwise, we'll encode
257 * it for presentation.  Short names are directly base64-encoded, while long
258 * names are encoded in fscrypt_digested_name format.
259 *
260 * Return: 0 on success, -errno on failure
261 */
262int fscrypt_fname_disk_to_usr(struct inode *inode,
263			u32 hash, u32 minor_hash,
264			const struct fscrypt_str *iname,
265			struct fscrypt_str *oname)
266{
267	const struct qstr qname = FSTR_TO_QSTR(iname);
268	struct fscrypt_digested_name digested_name;
269
270	if (fscrypt_is_dot_dotdot(&qname)) {
271		oname->name[0] = '.';
272		oname->name[iname->len - 1] = '.';
273		oname->len = iname->len;
274		return 0;
275	}
276
277	if (iname->len < FS_CRYPTO_BLOCK_SIZE)
278		return -EUCLEAN;
279
280	if (inode->i_crypt_info)
281		return fname_decrypt(inode, iname, oname);
282
283	if (iname->len <= FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE) {
284		oname->len = digest_encode(iname->name, iname->len,
285					   oname->name);
286		return 0;
287	}
288	if (hash) {
289		digested_name.hash = hash;
290		digested_name.minor_hash = minor_hash;
291	} else {
292		digested_name.hash = 0;
293		digested_name.minor_hash = 0;
294	}
295	memcpy(digested_name.digest,
296	       FSCRYPT_FNAME_DIGEST(iname->name, iname->len),
297	       FSCRYPT_FNAME_DIGEST_SIZE);
298	oname->name[0] = '_';
299	oname->len = 1 + digest_encode((const char *)&digested_name,
300				       sizeof(digested_name), oname->name + 1);
301	return 0;
302}
303EXPORT_SYMBOL(fscrypt_fname_disk_to_usr);
304
305/**
306 * fscrypt_setup_filename() - prepare to search a possibly encrypted directory
307 * @dir: the directory that will be searched
308 * @iname: the user-provided filename being searched for
309 * @lookup: 1 if we're allowed to proceed without the key because it's
310 *	->lookup() or we're finding the dir_entry for deletion; 0 if we cannot
311 *	proceed without the key because we're going to create the dir_entry.
312 * @fname: the filename information to be filled in
313 *
314 * Given a user-provided filename @iname, this function sets @fname->disk_name
315 * to the name that would be stored in the on-disk directory entry, if possible.
316 * If the directory is unencrypted this is simply @iname.  Else, if we have the
317 * directory's encryption key, then @iname is the plaintext, so we encrypt it to
318 * get the disk_name.
319 *
320 * Else, for keyless @lookup operations, @iname is the presented ciphertext, so
321 * we decode it to get either the ciphertext disk_name (for short names) or the
322 * fscrypt_digested_name (for long names).  Non-@lookup operations will be
323 * impossible in this case, so we fail them with ENOKEY.
324 *
325 * If successful, fscrypt_free_filename() must be called later to clean up.
326 *
327 * Return: 0 on success, -errno on failure
328 */
329int fscrypt_setup_filename(struct inode *dir, const struct qstr *iname,
330			      int lookup, struct fscrypt_name *fname)
331{
332	int ret;
333	int digested;
334
335	memset(fname, 0, sizeof(struct fscrypt_name));
336	fname->usr_fname = iname;
337
338	if (!IS_ENCRYPTED(dir) || fscrypt_is_dot_dotdot(iname)) {
339		fname->disk_name.name = (unsigned char *)iname->name;
340		fname->disk_name.len = iname->len;
341		return 0;
342	}
343	ret = fscrypt_get_encryption_info(dir);
344	if (ret && ret != -EOPNOTSUPP)
345		return ret;
346
347	if (dir->i_crypt_info) {
348		if (!fscrypt_fname_encrypted_size(dir, iname->len,
349						  dir->i_sb->s_cop->max_namelen(dir),
350						  &fname->crypto_buf.len))
351			return -ENAMETOOLONG;
352		fname->crypto_buf.name = kmalloc(fname->crypto_buf.len,
353						 GFP_NOFS);
354		if (!fname->crypto_buf.name)
355			return -ENOMEM;
356
357		ret = fname_encrypt(dir, iname, fname->crypto_buf.name,
358				    fname->crypto_buf.len);
359		if (ret)
360			goto errout;
361		fname->disk_name.name = fname->crypto_buf.name;
362		fname->disk_name.len = fname->crypto_buf.len;
363		return 0;
364	}
365	if (!lookup)
366		return -ENOKEY;
367
368	/*
369	 * We don't have the key and we are doing a lookup; decode the
370	 * user-supplied name
371	 */
372	if (iname->name[0] == '_') {
373		if (iname->len !=
374		    1 + BASE64_CHARS(sizeof(struct fscrypt_digested_name)))
375			return -ENOENT;
376		digested = 1;
377	} else {
378		if (iname->len >
379		    BASE64_CHARS(FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE))
380			return -ENOENT;
381		digested = 0;
382	}
383
384	fname->crypto_buf.name =
385		kmalloc(max_t(size_t, FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE,
386			      sizeof(struct fscrypt_digested_name)),
387			GFP_KERNEL);
388	if (fname->crypto_buf.name == NULL)
389		return -ENOMEM;
390
391	ret = digest_decode(iname->name + digested, iname->len - digested,
392				fname->crypto_buf.name);
393	if (ret < 0) {
394		ret = -ENOENT;
395		goto errout;
396	}
397	fname->crypto_buf.len = ret;
398	if (digested) {
399		const struct fscrypt_digested_name *n =
400			(const void *)fname->crypto_buf.name;
401		fname->hash = n->hash;
402		fname->minor_hash = n->minor_hash;
403	} else {
404		fname->disk_name.name = fname->crypto_buf.name;
405		fname->disk_name.len = fname->crypto_buf.len;
406	}
407	return 0;
408
409errout:
410	kfree(fname->crypto_buf.name);
411	return ret;
412}
413EXPORT_SYMBOL(fscrypt_setup_filename);