net/ceph/crypto.c

   1
   2 #include <linux/ceph/ceph_debug.h>
   3
   4 #include <linux/err.h>
   5 #include <linux/scatterlist.h>
   6 #include <linux/slab.h>
   7 #include <crypto/aes.h>
   8 #include <crypto/skcipher.h>
   9 #include <linux/key-type.h>
  10
  11 #include <keys/ceph-type.h>
  12 #include <keys/user-type.h>
  13 #include <linux/ceph/decode.h>
  14 #include "crypto.h"
  15
  16 int ceph_crypto_key_clone(struct ceph_crypto_key *dst,
  17                           const struct ceph_crypto_key *src)
  18 {
  19         memcpy(dst, src, sizeof(struct ceph_crypto_key));
  20         dst->key = kmemdup(src->key, src->len, GFP_NOFS);
  21         if (!dst->key)
  22                 return -ENOMEM;
  23         return 0;
  24 }
  25
  26 int ceph_crypto_key_encode(struct ceph_crypto_key *key, void **p, void *end)
  27 {
  28         if (*p + sizeof(u16) + sizeof(key->created) +
  29             sizeof(u16) + key->len > end)
  30                 return -ERANGE;
  31         ceph_encode_16(p, key->type);
  32         ceph_encode_copy(p, &key->created, sizeof(key->created));
  33         ceph_encode_16(p, key->len);
  34         ceph_encode_copy(p, key->key, key->len);
  35         return 0;
  36 }
  37
  38 int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
  39 {
  40         ceph_decode_need(p, end, 2*sizeof(u16) + sizeof(key->created), bad);
  41         key->type = ceph_decode_16(p);
  42         ceph_decode_copy(p, &key->created, sizeof(key->created));
  43         key->len = ceph_decode_16(p);
  44         ceph_decode_need(p, end, key->len, bad);
  45         key->key = kmalloc(key->len, GFP_NOFS);
  46         if (!key->key)
  47                 return -ENOMEM;
  48         ceph_decode_copy(p, key->key, key->len);
  49         return 0;
  50
  51 bad:
  52         dout("failed to decode crypto key\n");
  53         return -EINVAL;
  54 }
  55
  56 int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *inkey)
  57 {
  58         int inlen = strlen(inkey);
  59         int blen = inlen * 3 / 4;
  60         void *buf, *p;
  61         int ret;
  62
  63         dout("crypto_key_unarmor %s\n", inkey);
  64         buf = kmalloc(blen, GFP_NOFS);
  65         if (!buf)
  66                 return -ENOMEM;
  67         blen = ceph_unarmor(buf, inkey, inkey+inlen);
  68         if (blen < 0) {
  69                 kfree(buf);
  70                 return blen;
  71         }
  72
  73         p = buf;
  74         ret = ceph_crypto_key_decode(key, &p, p + blen);
  75         kfree(buf);
  76         if (ret)
  77                 return ret;
  78         dout("crypto_key_unarmor key %p type %d len %d\n", key,
  79              key->type, key->len);
  80         return 0;
  81 }
  82
  83 static struct crypto_skcipher *ceph_crypto_alloc_cipher(void)
  84 {
  85         return crypto_alloc_skcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
  86 }
  87
  88 static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
  89
  90 /*
  91  * Should be used for buffers allocated with ceph_kvmalloc().
  92  * Currently these are encrypt out-buffer (ceph_buffer) and decrypt
  93  * in-buffer (msg front).
  94  *
  95  * Dispose of @sgt with teardown_sgtable().
  96  *
  97  * @prealloc_sg is to avoid memory allocation inside sg_alloc_table()
  98  * in cases where a single sg is sufficient.  No attempt to reduce the
  99  * number of sgs by squeezing physically contiguous pages together is
 100  * made though, for simplicity.
 101  */
 102 static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg,
 103                          const void *buf, unsigned int buf_len)
 104 {
 105         struct scatterlist *sg;
 106         const bool is_vmalloc = is_vmalloc_addr(buf);
 107         unsigned int off = offset_in_page(buf);
 108         unsigned int chunk_cnt = 1;
 109         unsigned int chunk_len = PAGE_ALIGN(off + buf_len);
 110         int i;
 111         int ret;
 112
 113         if (buf_len == 0) {
 114                 memset(sgt, 0, sizeof(*sgt));
 115                 return -EINVAL;
 116         }
 117
 118         if (is_vmalloc) {
 119                 chunk_cnt = chunk_len >> PAGE_SHIFT;
 120                 chunk_len = PAGE_SIZE;
 121         }
 122
 123         if (chunk_cnt > 1) {
 124                 ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS);
 125                 if (ret)
 126                         return ret;
 127         } else {
 128                 WARN_ON(chunk_cnt != 1);
 129                 sg_init_table(prealloc_sg, 1);
 130                 sgt->sgl = prealloc_sg;
 131                 sgt->nents = sgt->orig_nents = 1;
 132         }
 133
 134         for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) {
 135                 struct page *page;
 136                 unsigned int len = min(chunk_len - off, buf_len);
 137
 138                 if (is_vmalloc)
 139                         page = vmalloc_to_page(buf);
 140                 else
 141                         page = virt_to_page(buf);
 142
 143                 sg_set_page(sg, page, len, off);
 144
 145                 off = 0;
 146                 buf += len;
 147                 buf_len -= len;
 148         }
 149         WARN_ON(buf_len != 0);
 150
 151         return 0;
 152 }
 153
 154 static void teardown_sgtable(struct sg_table *sgt)
 155 {
 156         if (sgt->orig_nents > 1)
 157                 sg_free_table(sgt);
 158 }
 159
 160 static int ceph_aes_encrypt(const void *key, int key_len,
 161                             void *dst, size_t *dst_len,
 162                             const void *src, size_t src_len)
 163 {
 164         struct scatterlist sg_in[2], prealloc_sg;
 165         struct sg_table sg_out;
 166         struct crypto_skcipher *tfm = ceph_crypto_alloc_cipher();
 167         SKCIPHER_REQUEST_ON_STACK(req, tfm);
 168         int ret;
 169         int ivsize = AES_BLOCK_SIZE;
 170         char iv[ivsize];
 171         size_t zero_padding = (0x10 - (src_len & 0x0f));
 172         char pad[16];
 173
 174         if (IS_ERR(tfm))
 175                 return PTR_ERR(tfm);
 176
 177         memset(pad, zero_padding, zero_padding);
 178
 179         *dst_len = src_len + zero_padding;
 180
 181         sg_init_table(sg_in, 2);
 182         sg_set_buf(&sg_in[0], src, src_len);
 183         sg_set_buf(&sg_in[1], pad, zero_padding);
 184         ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
 185         if (ret)
 186                 goto out_tfm;
 187
 188         crypto_skcipher_setkey((void *)tfm, key, key_len);
 189         memcpy(iv, aes_iv, ivsize);
 190
 191         skcipher_request_set_tfm(req, tfm);
 192         skcipher_request_set_callback(req, 0, NULL, NULL);
 193         skcipher_request_set_crypt(req, sg_in, sg_out.sgl,
 194                                    src_len + zero_padding, iv);
 195
 196         /*
 197         print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
 198                        key, key_len, 1);
 199         print_hex_dump(KERN_ERR, "enc src: ", DUMP_PREFIX_NONE, 16, 1,
 200                         src, src_len, 1);
 201         print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
 202                         pad, zero_padding, 1);
 203         */
 204         ret = crypto_skcipher_encrypt(req);
 205         skcipher_request_zero(req);
 206         if (ret < 0) {
 207                 pr_err("ceph_aes_crypt failed %d\n", ret);
 208                 goto out_sg;
 209         }
 210         /*
 211         print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
 212                        dst, *dst_len, 1);
 213         */
 214
 215 out_sg:
 216         teardown_sgtable(&sg_out);
 217 out_tfm:
 218         crypto_free_skcipher(tfm);
 219         return ret;
 220 }
 221
 222 static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
 223                              size_t *dst_len,
 224                              const void *src1, size_t src1_len,
 225                              const void *src2, size_t src2_len)
 226 {
 227         struct scatterlist sg_in[3], prealloc_sg;
 228         struct sg_table sg_out;
 229         struct crypto_skcipher *tfm = ceph_crypto_alloc_cipher();
 230         SKCIPHER_REQUEST_ON_STACK(req, tfm);
 231         int ret;
 232         int ivsize = AES_BLOCK_SIZE;
 233         char iv[ivsize];
 234         size_t zero_padding = (0x10 - ((src1_len + src2_len) & 0x0f));
 235         char pad[16];
 236
 237         if (IS_ERR(tfm))
 238                 return PTR_ERR(tfm);
 239
 240         memset(pad, zero_padding, zero_padding);
 241
 242         *dst_len = src1_len + src2_len + zero_padding;
 243
 244         sg_init_table(sg_in, 3);
 245         sg_set_buf(&sg_in[0], src1, src1_len);
 246         sg_set_buf(&sg_in[1], src2, src2_len);
 247         sg_set_buf(&sg_in[2], pad, zero_padding);
 248         ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
 249         if (ret)
 250                 goto out_tfm;
 251
 252         crypto_skcipher_setkey((void *)tfm, key, key_len);
 253         memcpy(iv, aes_iv, ivsize);
 254
 255         skcipher_request_set_tfm(req, tfm);
 256         skcipher_request_set_callback(req, 0, NULL, NULL);
 257         skcipher_request_set_crypt(req, sg_in, sg_out.sgl,
 258                                    src1_len + src2_len + zero_padding, iv);
 259
 260         /*
 261         print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
 262                        key, key_len, 1);
 263         print_hex_dump(KERN_ERR, "enc src1: ", DUMP_PREFIX_NONE, 16, 1,
 264                         src1, src1_len, 1);
 265         print_hex_dump(KERN_ERR, "enc src2: ", DUMP_PREFIX_NONE, 16, 1,
 266                         src2, src2_len, 1);
 267         print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
 268                         pad, zero_padding, 1);
 269         */
 270         ret = crypto_skcipher_encrypt(req);
 271         skcipher_request_zero(req);
 272         if (ret < 0) {
 273                 pr_err("ceph_aes_crypt2 failed %d\n", ret);
 274                 goto out_sg;
 275         }
 276         /*
 277         print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
 278                        dst, *dst_len, 1);
 279         */
 280
 281 out_sg:
 282         teardown_sgtable(&sg_out);
 283 out_tfm:
 284         crypto_free_skcipher(tfm);
 285         return ret;
 286 }
 287
 288 static int ceph_aes_decrypt(const void *key, int key_len,
 289                             void *dst, size_t *dst_len,
 290                             const void *src, size_t src_len)
 291 {
 292         struct sg_table sg_in;
 293         struct scatterlist sg_out[2], prealloc_sg;
 294         struct crypto_skcipher *tfm = ceph_crypto_alloc_cipher();
 295         SKCIPHER_REQUEST_ON_STACK(req, tfm);
 296         char pad[16];
 297         int ivsize = AES_BLOCK_SIZE;
 298         char iv[16];
 299         int ret;
 300         int last_byte;
 301
 302         if (IS_ERR(tfm))
 303                 return PTR_ERR(tfm);
 304
 305         sg_init_table(sg_out, 2);
 306         sg_set_buf(&sg_out[0], dst, *dst_len);
 307         sg_set_buf(&sg_out[1], pad, sizeof(pad));
 308         ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
 309         if (ret)
 310                 goto out_tfm;
 311
 312         crypto_skcipher_setkey((void *)tfm, key, key_len);
 313         memcpy(iv, aes_iv, ivsize);
 314
 315         skcipher_request_set_tfm(req, tfm);
 316         skcipher_request_set_callback(req, 0, NULL, NULL);
 317         skcipher_request_set_crypt(req, sg_in.sgl, sg_out,
 318                                    src_len, iv);
 319
 320         /*
 321         print_hex_dump(KERN_ERR, "dec key: ", DUMP_PREFIX_NONE, 16, 1,
 322                        key, key_len, 1);
 323         print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
 324                        src, src_len, 1);
 325         */
 326         ret = crypto_skcipher_decrypt(req);
 327         skcipher_request_zero(req);
 328         if (ret < 0) {
 329                 pr_err("ceph_aes_decrypt failed %d\n", ret);
 330                 goto out_sg;
 331         }
 332
 333         if (src_len <= *dst_len)
 334                 last_byte = ((char *)dst)[src_len - 1];
 335         else
 336                 last_byte = pad[src_len - *dst_len - 1];
 337         if (last_byte <= 16 && src_len >= last_byte) {
 338                 *dst_len = src_len - last_byte;
 339         } else {
 340                 pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
 341                        last_byte, (int)src_len);
 342                 return -EPERM;  /* bad padding */
 343         }
 344         /*
 345         print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
 346                        dst, *dst_len, 1);
 347         */
 348
 349 out_sg:
 350         teardown_sgtable(&sg_in);
 351 out_tfm:
 352         crypto_free_skcipher(tfm);
 353         return ret;
 354 }
 355
 356 static int ceph_aes_decrypt2(const void *key, int key_len,
 357                              void *dst1, size_t *dst1_len,
 358                              void *dst2, size_t *dst2_len,
 359                              const void *src, size_t src_len)
 360 {
 361         struct sg_table sg_in;
 362         struct scatterlist sg_out[3], prealloc_sg;
 363         struct crypto_skcipher *tfm = ceph_crypto_alloc_cipher();
 364         SKCIPHER_REQUEST_ON_STACK(req, tfm);
 365         char pad[16];
 366         int ivsize = AES_BLOCK_SIZE;
 367         char iv[ivsize];
 368         int ret;
 369         int last_byte;
 370
 371         if (IS_ERR(tfm))
 372                 return PTR_ERR(tfm);
 373
 374         sg_init_table(sg_out, 3);
 375         sg_set_buf(&sg_out[0], dst1, *dst1_len);
 376         sg_set_buf(&sg_out[1], dst2, *dst2_len);
 377         sg_set_buf(&sg_out[2], pad, sizeof(pad));
 378         ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
 379         if (ret)
 380                 goto out_tfm;
 381
 382         crypto_skcipher_setkey((void *)tfm, key, key_len);
 383         memcpy(iv, aes_iv, ivsize);
 384
 385         skcipher_request_set_tfm(req, tfm);
 386         skcipher_request_set_callback(req, 0, NULL, NULL);
 387         skcipher_request_set_crypt(req, sg_in.sgl, sg_out,
 388                                    src_len, iv);
 389
 390         /*
 391         print_hex_dump(KERN_ERR, "dec  key: ", DUMP_PREFIX_NONE, 16, 1,
 392                        key, key_len, 1);
 393         print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
 394                        src, src_len, 1);
 395         */
 396         ret = crypto_skcipher_decrypt(req);
 397         skcipher_request_zero(req);
 398         if (ret < 0) {
 399                 pr_err("ceph_aes_decrypt failed %d\n", ret);
 400                 goto out_sg;
 401         }
 402
 403         if (src_len <= *dst1_len)
 404                 last_byte = ((char *)dst1)[src_len - 1];
 405         else if (src_len <= *dst1_len + *dst2_len)
 406                 last_byte = ((char *)dst2)[src_len - *dst1_len - 1];
 407         else
 408                 last_byte = pad[src_len - *dst1_len - *dst2_len - 1];
 409         if (last_byte <= 16 && src_len >= last_byte) {
 410                 src_len -= last_byte;
 411         } else {
 412                 pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
 413                        last_byte, (int)src_len);
 414                 return -EPERM;  /* bad padding */
 415         }
 416
 417         if (src_len < *dst1_len) {
 418                 *dst1_len = src_len;
 419                 *dst2_len = 0;
 420         } else {
 421                 *dst2_len = src_len - *dst1_len;
 422         }
 423         /*
 424         print_hex_dump(KERN_ERR, "dec  out1: ", DUMP_PREFIX_NONE, 16, 1,
 425                        dst1, *dst1_len, 1);
 426         print_hex_dump(KERN_ERR, "dec  out2: ", DUMP_PREFIX_NONE, 16, 1,
 427                        dst2, *dst2_len, 1);
 428         */
 429
 430 out_sg:
 431         teardown_sgtable(&sg_in);
 432 out_tfm:
 433         crypto_free_skcipher(tfm);
 434         return ret;
 435 }
 436
 437
 438 int ceph_decrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
 439                  const void *src, size_t src_len)
 440 {
 441         switch (secret->type) {
 442         case CEPH_CRYPTO_NONE:
 443                 if (*dst_len < src_len)
 444                         return -ERANGE;
 445                 memcpy(dst, src, src_len);
 446                 *dst_len = src_len;
 447                 return 0;
 448
 449         case CEPH_CRYPTO_AES:
 450                 return ceph_aes_decrypt(secret->key, secret->len, dst,
 451                                         dst_len, src, src_len);
 452
 453         default:
 454                 return -EINVAL;
 455         }
 456 }
 457
 458 int ceph_decrypt2(struct ceph_crypto_key *secret,
 459                         void *dst1, size_t *dst1_len,
 460                         void *dst2, size_t *dst2_len,
 461                         const void *src, size_t src_len)
 462 {
 463         size_t t;
 464
 465         switch (secret->type) {
 466         case CEPH_CRYPTO_NONE:
 467                 if (*dst1_len + *dst2_len < src_len)
 468                         return -ERANGE;
 469                 t = min(*dst1_len, src_len);
 470                 memcpy(dst1, src, t);
 471                 *dst1_len = t;
 472                 src += t;
 473                 src_len -= t;
 474                 if (src_len) {
 475                         t = min(*dst2_len, src_len);
 476                         memcpy(dst2, src, t);
 477                         *dst2_len = t;
 478                 }
 479                 return 0;
 480
 481         case CEPH_CRYPTO_AES:
 482                 return ceph_aes_decrypt2(secret->key, secret->len,
 483                                          dst1, dst1_len, dst2, dst2_len,
 484                                          src, src_len);
 485
 486         default:
 487                 return -EINVAL;
 488         }
 489 }
 490
 491 int ceph_encrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
 492                  const void *src, size_t src_len)
 493 {
 494         switch (secret->type) {
 495         case CEPH_CRYPTO_NONE:
 496                 if (*dst_len < src_len)
 497                         return -ERANGE;
 498                 memcpy(dst, src, src_len);
 499                 *dst_len = src_len;
 500                 return 0;
 501
 502         case CEPH_CRYPTO_AES:
 503                 return ceph_aes_encrypt(secret->key, secret->len, dst,
 504                                         dst_len, src, src_len);
 505
 506         default:
 507                 return -EINVAL;
 508         }
 509 }
 510
 511 int ceph_encrypt2(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
 512                   const void *src1, size_t src1_len,
 513                   const void *src2, size_t src2_len)
 514 {
 515         switch (secret->type) {
 516         case CEPH_CRYPTO_NONE:
 517                 if (*dst_len < src1_len + src2_len)
 518                         return -ERANGE;
 519                 memcpy(dst, src1, src1_len);
 520                 memcpy(dst + src1_len, src2, src2_len);
 521                 *dst_len = src1_len + src2_len;
 522                 return 0;
 523
 524         case CEPH_CRYPTO_AES:
 525                 return ceph_aes_encrypt2(secret->key, secret->len, dst, dst_len,
 526                                          src1, src1_len, src2, src2_len);
 527
 528         default:
 529                 return -EINVAL;
 530         }
 531 }
 532
 533 static int ceph_key_preparse(struct key_preparsed_payload *prep)
 534 {
 535         struct ceph_crypto_key *ckey;
 536         size_t datalen = prep->datalen;
 537         int ret;
 538         void *p;
 539
 540         ret = -EINVAL;
 541         if (datalen <= 0 || datalen > 32767 || !prep->data)
 542                 goto err;
 543
 544         ret = -ENOMEM;
 545         ckey = kmalloc(sizeof(*ckey), GFP_KERNEL);
 546         if (!ckey)
 547                 goto err;
 548
 549         /* TODO ceph_crypto_key_decode should really take const input */
 550         p = (void *)prep->data;
 551         ret = ceph_crypto_key_decode(ckey, &p, (char*)prep->data+datalen);
 552         if (ret < 0)
 553                 goto err_ckey;
 554
 555         prep->payload.data[0] = ckey;
 556         prep->quotalen = datalen;
 557         return 0;
 558
 559 err_ckey:
 560         kfree(ckey);
 561 err:
 562         return ret;
 563 }
 564
 565 static void ceph_key_free_preparse(struct key_preparsed_payload *prep)
 566 {
 567         struct ceph_crypto_key *ckey = prep->payload.data[0];
 568         ceph_crypto_key_destroy(ckey);
 569         kfree(ckey);
 570 }
 571
 572 static void ceph_key_destroy(struct key *key)
 573 {
 574         struct ceph_crypto_key *ckey = key->payload.data[0];
 575
 576         ceph_crypto_key_destroy(ckey);
 577         kfree(ckey);
 578 }
 579
 580 struct key_type key_type_ceph = {
 581         .name           = "ceph",
 582         .preparse       = ceph_key_preparse,
 583         .free_preparse  = ceph_key_free_preparse,
 584         .instantiate    = generic_key_instantiate,
 585         .destroy        = ceph_key_destroy,
 586 };
 587
 588 int ceph_crypto_init(void) {
 589         return register_key_type(&key_type_ceph);
 590 }
 591
 592 void ceph_crypto_shutdown(void) {
 593         unregister_key_type(&key_type_ceph);
 594 }