Commit | Line | Data |
---|---|---|
9bd8212f MH |
1 | /* |
2 | * linux/fs/ext4/ext4_crypto.h | |
3 | * | |
4 | * Copyright (C) 2015, Google, Inc. | |
5 | * | |
6 | * This contains encryption header content for ext4 | |
7 | * | |
8 | * Written by Michael Halcrow, 2015. | |
9 | */ | |
10 | ||
11 | #ifndef _EXT4_CRYPTO_H | |
12 | #define _EXT4_CRYPTO_H | |
13 | ||
14 | #include <linux/fs.h> | |
15 | ||
16 | #define EXT4_KEY_DESCRIPTOR_SIZE 8 | |
17 | ||
18 | /* Policy provided via an ioctl on the topmost directory */ | |
19 | struct ext4_encryption_policy { | |
20 | char version; | |
21 | char contents_encryption_mode; | |
22 | char filenames_encryption_mode; | |
a44cd7a0 | 23 | char flags; |
9bd8212f MH |
24 | char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE]; |
25 | } __attribute__((__packed__)); | |
26 | ||
27 | #define EXT4_ENCRYPTION_CONTEXT_FORMAT_V1 1 | |
28 | #define EXT4_KEY_DERIVATION_NONCE_SIZE 16 | |
29 | ||
a44cd7a0 TT |
30 | #define EXT4_POLICY_FLAGS_PAD_4 0x00 |
31 | #define EXT4_POLICY_FLAGS_PAD_8 0x01 | |
32 | #define EXT4_POLICY_FLAGS_PAD_16 0x02 | |
33 | #define EXT4_POLICY_FLAGS_PAD_32 0x03 | |
34 | #define EXT4_POLICY_FLAGS_PAD_MASK 0x03 | |
35 | #define EXT4_POLICY_FLAGS_VALID 0x03 | |
36 | ||
9bd8212f MH |
37 | /** |
38 | * Encryption context for inode | |
39 | * | |
40 | * Protector format: | |
41 | * 1 byte: Protector format (1 = this version) | |
42 | * 1 byte: File contents encryption mode | |
43 | * 1 byte: File names encryption mode | |
44 | * 1 byte: Reserved | |
45 | * 8 bytes: Master Key descriptor | |
46 | * 16 bytes: Encryption Key derivation nonce | |
47 | */ | |
48 | struct ext4_encryption_context { | |
49 | char format; | |
50 | char contents_encryption_mode; | |
51 | char filenames_encryption_mode; | |
a44cd7a0 | 52 | char flags; |
9bd8212f MH |
53 | char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE]; |
54 | char nonce[EXT4_KEY_DERIVATION_NONCE_SIZE]; | |
55 | } __attribute__((__packed__)); | |
56 | ||
b30ab0e0 MH |
57 | /* Encryption parameters */ |
58 | #define EXT4_XTS_TWEAK_SIZE 16 | |
59 | #define EXT4_AES_128_ECB_KEY_SIZE 16 | |
60 | #define EXT4_AES_256_GCM_KEY_SIZE 32 | |
61 | #define EXT4_AES_256_CBC_KEY_SIZE 32 | |
62 | #define EXT4_AES_256_CTS_KEY_SIZE 32 | |
63 | #define EXT4_AES_256_XTS_KEY_SIZE 64 | |
64 | #define EXT4_MAX_KEY_SIZE 64 | |
65 | ||
88bd6ccd MH |
66 | #define EXT4_KEY_DESC_PREFIX "ext4:" |
67 | #define EXT4_KEY_DESC_PREFIX_SIZE 5 | |
68 | ||
e2881b1b | 69 | /* This is passed in from userspace into the kernel keyring */ |
b30ab0e0 | 70 | struct ext4_encryption_key { |
e2881b1b TT |
71 | __u32 mode; |
72 | char raw[EXT4_MAX_KEY_SIZE]; | |
73 | __u32 size; | |
74 | } __attribute__((__packed__)); | |
75 | ||
76 | struct ext4_crypt_info { | |
e2881b1b | 77 | unsigned char ci_size; |
b7236e21 TT |
78 | char ci_data_mode; |
79 | char ci_filename_mode; | |
80 | char ci_flags; | |
81 | struct crypto_ablkcipher *ci_ctfm; | |
82 | struct key *ci_keyring_key; | |
e2881b1b | 83 | char ci_raw[EXT4_MAX_KEY_SIZE]; |
b7236e21 | 84 | char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE]; |
b30ab0e0 MH |
85 | }; |
86 | ||
87 | #define EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001 | |
88 | #define EXT4_BOUNCE_PAGE_REQUIRES_FREE_ENCRYPT_FL 0x00000002 | |
89 | ||
90 | struct ext4_crypto_ctx { | |
91 | struct crypto_tfm *tfm; /* Crypto API context */ | |
92 | struct page *bounce_page; /* Ciphertext page on write path */ | |
93 | struct page *control_page; /* Original page on write path */ | |
94 | struct bio *bio; /* The bio for this context */ | |
95 | struct work_struct work; /* Work queue for read complete path */ | |
96 | struct list_head free_list; /* Free list */ | |
97 | int flags; /* Flags */ | |
98 | int mode; /* Encryption mode for tfm */ | |
99 | }; | |
100 | ||
101 | struct ext4_completion_result { | |
102 | struct completion completion; | |
103 | int res; | |
104 | }; | |
105 | ||
106 | #define DECLARE_EXT4_COMPLETION_RESULT(ecr) \ | |
107 | struct ext4_completion_result ecr = { \ | |
108 | COMPLETION_INITIALIZER((ecr).completion), 0 } | |
109 | ||
110 | static inline int ext4_encryption_key_size(int mode) | |
111 | { | |
112 | switch (mode) { | |
113 | case EXT4_ENCRYPTION_MODE_AES_256_XTS: | |
114 | return EXT4_AES_256_XTS_KEY_SIZE; | |
115 | case EXT4_ENCRYPTION_MODE_AES_256_GCM: | |
116 | return EXT4_AES_256_GCM_KEY_SIZE; | |
117 | case EXT4_ENCRYPTION_MODE_AES_256_CBC: | |
118 | return EXT4_AES_256_CBC_KEY_SIZE; | |
119 | case EXT4_ENCRYPTION_MODE_AES_256_CTS: | |
120 | return EXT4_AES_256_CTS_KEY_SIZE; | |
121 | default: | |
122 | BUG(); | |
123 | } | |
124 | return 0; | |
125 | } | |
126 | ||
d5d0e8c7 MH |
127 | #define EXT4_FNAME_NUM_SCATTER_ENTRIES 4 |
128 | #define EXT4_CRYPTO_BLOCK_SIZE 16 | |
129 | #define EXT4_FNAME_CRYPTO_DIGEST_SIZE 32 | |
130 | ||
131 | struct ext4_str { | |
132 | unsigned char *name; | |
133 | u32 len; | |
134 | }; | |
135 | ||
f348c252 TT |
136 | /** |
137 | * For encrypted symlinks, the ciphertext length is stored at the beginning | |
138 | * of the string in little-endian format. | |
139 | */ | |
140 | struct ext4_encrypted_symlink_data { | |
141 | __le16 len; | |
142 | char encrypted_path[1]; | |
143 | } __attribute__((__packed__)); | |
144 | ||
145 | /** | |
146 | * This function is used to calculate the disk space required to | |
147 | * store a filename of length l in encrypted symlink format. | |
148 | */ | |
149 | static inline u32 encrypted_symlink_data_len(u32 l) | |
150 | { | |
151 | if (l < EXT4_CRYPTO_BLOCK_SIZE) | |
152 | l = EXT4_CRYPTO_BLOCK_SIZE; | |
153 | return (l + sizeof(struct ext4_encrypted_symlink_data) - 1); | |
154 | } | |
155 | ||
9bd8212f | 156 | #endif /* _EXT4_CRYPTO_H */ |