2 * eCryptfs: Linux filesystem encryption layer
5 * Copyright (C) 1997-2003 Erez Zadok
6 * Copyright (C) 2001-2003 Stony Brook University
7 * Copyright (C) 2004-2006 International Business Machines Corp.
8 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
26 #ifndef ECRYPTFS_KERNEL_H
27 #define ECRYPTFS_KERNEL_H
29 #include <keys/user-type.h>
31 #include <linux/scatterlist.h>
33 /* Version verification for shared data structures w/ userspace */
34 #define ECRYPTFS_VERSION_MAJOR 0x00
35 #define ECRYPTFS_VERSION_MINOR 0x04
36 #define ECRYPTFS_SUPPORTED_FILE_VERSION 0x01
37 /* These flags indicate which features are supported by the kernel
38 * module; userspace tools such as the mount helper read
39 * ECRYPTFS_VERSIONING_MASK from a sysfs handle in order to determine
41 #define ECRYPTFS_VERSIONING_PASSPHRASE 0x00000001
42 #define ECRYPTFS_VERSIONING_PUBKEY 0x00000002
43 #define ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH 0x00000004
44 #define ECRYPTFS_VERSIONING_POLICY 0x00000008
45 #define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \
46 | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH)
48 #define ECRYPTFS_MAX_PASSWORD_LENGTH 64
49 #define ECRYPTFS_MAX_PASSPHRASE_BYTES ECRYPTFS_MAX_PASSWORD_LENGTH
50 #define ECRYPTFS_SALT_SIZE 8
51 #define ECRYPTFS_SALT_SIZE_HEX (ECRYPTFS_SALT_SIZE*2)
52 /* The original signature size is only for what is stored on disk; all
53 * in-memory representations are expanded hex, so it better adapted to
54 * be passed around or referenced on the command line */
55 #define ECRYPTFS_SIG_SIZE 8
56 #define ECRYPTFS_SIG_SIZE_HEX (ECRYPTFS_SIG_SIZE*2)
57 #define ECRYPTFS_PASSWORD_SIG_SIZE ECRYPTFS_SIG_SIZE_HEX
58 #define ECRYPTFS_MAX_KEY_BYTES 64
59 #define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512
60 #define ECRYPTFS_DEFAULT_IV_BYTES 16
61 #define ECRYPTFS_FILE_VERSION 0x01
62 #define ECRYPTFS_DEFAULT_HEADER_EXTENT_SIZE 8192
63 #define ECRYPTFS_DEFAULT_EXTENT_SIZE 4096
64 #define ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE 8192
66 #define RFC2440_CIPHER_DES3_EDE 0x02
67 #define RFC2440_CIPHER_CAST_5 0x03
68 #define RFC2440_CIPHER_BLOWFISH 0x04
69 #define RFC2440_CIPHER_AES_128 0x07
70 #define RFC2440_CIPHER_AES_192 0x08
71 #define RFC2440_CIPHER_AES_256 0x09
72 #define RFC2440_CIPHER_TWOFISH 0x0a
73 #define RFC2440_CIPHER_CAST_6 0x0b
75 #define ECRYPTFS_SET_FLAG(flag_bit_vector, flag) (flag_bit_vector |= (flag))
76 #define ECRYPTFS_CLEAR_FLAG(flag_bit_vector, flag) (flag_bit_vector &= ~(flag))
77 #define ECRYPTFS_CHECK_FLAG(flag_bit_vector, flag) (flag_bit_vector & (flag))
80 * For convenience, we may need to pass around the encrypted session
81 * key between kernel and userspace because the authentication token
82 * may not be extractable. For example, the TPM may not release the
83 * private key, instead requiring the encrypted data and returning the
86 struct ecryptfs_session_key
{
87 #define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_DECRYPT 0x00000001
88 #define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_ENCRYPT 0x00000002
89 #define ECRYPTFS_CONTAINS_DECRYPTED_KEY 0x00000004
90 #define ECRYPTFS_CONTAINS_ENCRYPTED_KEY 0x00000008
92 u32 encrypted_key_size
;
93 u32 decrypted_key_size
;
94 u8 encrypted_key
[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES
];
95 u8 decrypted_key
[ECRYPTFS_MAX_KEY_BYTES
];
98 struct ecryptfs_password
{
102 u32 session_key_encryption_key_bytes
;
103 #define ECRYPTFS_PERSISTENT_PASSWORD 0x01
104 #define ECRYPTFS_SESSION_KEY_ENCRYPTION_KEY_SET 0x02
106 /* Iterated-hash concatenation of salt and passphrase */
107 u8 session_key_encryption_key
[ECRYPTFS_MAX_KEY_BYTES
];
108 u8 signature
[ECRYPTFS_PASSWORD_SIG_SIZE
+ 1];
109 /* Always in expanded hex */
110 u8 salt
[ECRYPTFS_SALT_SIZE
];
113 enum ecryptfs_token_types
{ECRYPTFS_PASSWORD
, ECRYPTFS_PRIVATE_KEY
};
115 /* May be a password or a private key */
116 struct ecryptfs_auth_tok
{
117 u16 version
; /* 8-bit major and 8-bit minor */
120 struct ecryptfs_session_key session_key
;
123 struct ecryptfs_password password
;
124 /* Private key is in future eCryptfs releases */
126 } __attribute__ ((packed
));
128 void ecryptfs_dump_auth_tok(struct ecryptfs_auth_tok
*auth_tok
);
129 extern void ecryptfs_to_hex(char *dst
, char *src
, size_t src_size
);
130 extern void ecryptfs_from_hex(char *dst
, char *src
, int dst_size
);
132 struct ecryptfs_key_record
{
135 unsigned char sig
[ECRYPTFS_SIG_SIZE
];
136 unsigned char enc_key
[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES
];
139 struct ecryptfs_auth_tok_list
{
140 struct ecryptfs_auth_tok
*auth_tok
;
141 struct list_head list
;
144 struct ecryptfs_crypt_stat
;
145 struct ecryptfs_mount_crypt_stat
;
147 struct ecryptfs_page_crypt_context
{
149 #define ECRYPTFS_PREPARE_COMMIT_MODE 0
150 #define ECRYPTFS_WRITEPAGE_MODE 1
153 struct file
*lower_file
;
154 struct writeback_control
*wbc
;
158 static inline struct ecryptfs_auth_tok
*
159 ecryptfs_get_key_payload_data(struct key
*key
)
161 return (struct ecryptfs_auth_tok
*)
162 (((struct user_key_payload
*)key
->payload
.data
)->data
);
165 #define ECRYPTFS_SUPER_MAGIC 0xf15f
166 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
167 #define ECRYPTFS_MAX_CIPHER_NAME_SIZE 32
168 #define ECRYPTFS_MAX_NUM_ENC_KEYS 64
169 #define ECRYPTFS_MAX_NUM_KEYSIGS 2 /* TODO: Make this a linked list */
170 #define ECRYPTFS_MAX_IV_BYTES 16 /* 128 bits */
171 #define ECRYPTFS_SALT_BYTES 2
172 #define MAGIC_ECRYPTFS_MARKER 0x3c81b7f5
173 #define MAGIC_ECRYPTFS_MARKER_SIZE_BYTES 8 /* 4*2 */
174 #define ECRYPTFS_FILE_SIZE_BYTES 8
175 #define ECRYPTFS_DEFAULT_CIPHER "aes"
176 #define ECRYPTFS_DEFAULT_KEY_BYTES 16
177 #define ECRYPTFS_DEFAULT_CHAINING_MODE CRYPTO_TFM_MODE_CBC
178 #define ECRYPTFS_TAG_3_PACKET_TYPE 0x8C
179 #define ECRYPTFS_TAG_11_PACKET_TYPE 0xED
180 #define MD5_DIGEST_SIZE 16
183 * This is the primary struct associated with each encrypted file.
185 * TODO: cache align/pack?
187 struct ecryptfs_crypt_stat
{
188 #define ECRYPTFS_STRUCT_INITIALIZED 0x00000001
189 #define ECRYPTFS_POLICY_APPLIED 0x00000002
190 #define ECRYPTFS_NEW_FILE 0x00000004
191 #define ECRYPTFS_ENCRYPTED 0x00000008
192 #define ECRYPTFS_SECURITY_WARNING 0x00000010
193 #define ECRYPTFS_ENABLE_HMAC 0x00000020
194 #define ECRYPTFS_ENCRYPT_IV_PAGES 0x00000040
195 #define ECRYPTFS_KEY_VALID 0x00000080
197 unsigned int file_version
;
200 size_t header_extent_size
;
201 size_t num_header_extents_at_front
;
202 size_t extent_size
; /* Data extent size; default is 4096 */
205 unsigned int extent_mask
;
206 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
;
207 struct crypto_tfm
*tfm
;
208 struct crypto_tfm
*md5_tfm
; /* Crypto context for generating
209 * the initialization vectors */
210 unsigned char cipher
[ECRYPTFS_MAX_CIPHER_NAME_SIZE
];
211 unsigned char key
[ECRYPTFS_MAX_KEY_BYTES
];
212 unsigned char root_iv
[ECRYPTFS_MAX_IV_BYTES
];
213 unsigned char keysigs
[ECRYPTFS_MAX_NUM_KEYSIGS
][ECRYPTFS_SIG_SIZE_HEX
];
214 struct mutex cs_tfm_mutex
;
215 struct mutex cs_md5_tfm_mutex
;
216 struct mutex cs_mutex
;
219 /* inode private data. */
220 struct ecryptfs_inode_info
{
221 struct inode vfs_inode
;
222 struct inode
*wii_inode
;
223 struct ecryptfs_crypt_stat crypt_stat
;
226 /* dentry private data. Each dentry must keep track of a lower
228 struct ecryptfs_dentry_info
{
229 struct dentry
*wdi_dentry
;
230 struct vfsmount
*lower_mnt
;
231 struct ecryptfs_crypt_stat
*crypt_stat
;
235 * This struct is to enable a mount-wide passphrase/salt combo. This
236 * is more or less a stopgap to provide similar functionality to other
237 * crypto filesystems like EncFS or CFS until full policy support is
238 * implemented in eCryptfs.
240 struct ecryptfs_mount_crypt_stat
{
241 /* Pointers to memory we do not own, do not free these */
242 #define ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED 0x00000001
244 struct ecryptfs_auth_tok
*global_auth_tok
;
245 struct key
*global_auth_tok_key
;
246 size_t global_default_cipher_key_size
;
247 struct crypto_tfm
*global_key_tfm
;
248 struct mutex global_key_tfm_mutex
;
249 unsigned char global_default_cipher_name
[ECRYPTFS_MAX_CIPHER_NAME_SIZE
251 unsigned char global_auth_tok_sig
[ECRYPTFS_SIG_SIZE_HEX
+ 1];
254 /* superblock private data. */
255 struct ecryptfs_sb_info
{
256 struct super_block
*wsi_sb
;
257 struct ecryptfs_mount_crypt_stat mount_crypt_stat
;
260 /* file private data. */
261 struct ecryptfs_file_info
{
262 struct file
*wfi_file
;
263 struct ecryptfs_crypt_stat
*crypt_stat
;
266 /* auth_tok <=> encrypted_session_key mappings */
267 struct ecryptfs_auth_tok_list_item
{
268 unsigned char encrypted_session_key
[ECRYPTFS_MAX_KEY_BYTES
];
269 struct list_head list
;
270 struct ecryptfs_auth_tok auth_tok
;
273 static inline struct ecryptfs_file_info
*
274 ecryptfs_file_to_private(struct file
*file
)
276 return (struct ecryptfs_file_info
*)file
->private_data
;
280 ecryptfs_set_file_private(struct file
*file
,
281 struct ecryptfs_file_info
*file_info
)
283 file
->private_data
= file_info
;
286 static inline struct file
*ecryptfs_file_to_lower(struct file
*file
)
288 return ((struct ecryptfs_file_info
*)file
->private_data
)->wfi_file
;
292 ecryptfs_set_file_lower(struct file
*file
, struct file
*lower_file
)
294 ((struct ecryptfs_file_info
*)file
->private_data
)->wfi_file
=
298 static inline struct ecryptfs_inode_info
*
299 ecryptfs_inode_to_private(struct inode
*inode
)
301 return container_of(inode
, struct ecryptfs_inode_info
, vfs_inode
);
304 static inline struct inode
*ecryptfs_inode_to_lower(struct inode
*inode
)
306 return ecryptfs_inode_to_private(inode
)->wii_inode
;
310 ecryptfs_set_inode_lower(struct inode
*inode
, struct inode
*lower_inode
)
312 ecryptfs_inode_to_private(inode
)->wii_inode
= lower_inode
;
315 static inline struct ecryptfs_sb_info
*
316 ecryptfs_superblock_to_private(struct super_block
*sb
)
318 return (struct ecryptfs_sb_info
*)sb
->s_fs_info
;
322 ecryptfs_set_superblock_private(struct super_block
*sb
,
323 struct ecryptfs_sb_info
*sb_info
)
325 sb
->s_fs_info
= sb_info
;
328 static inline struct super_block
*
329 ecryptfs_superblock_to_lower(struct super_block
*sb
)
331 return ((struct ecryptfs_sb_info
*)sb
->s_fs_info
)->wsi_sb
;
335 ecryptfs_set_superblock_lower(struct super_block
*sb
,
336 struct super_block
*lower_sb
)
338 ((struct ecryptfs_sb_info
*)sb
->s_fs_info
)->wsi_sb
= lower_sb
;
341 static inline struct ecryptfs_dentry_info
*
342 ecryptfs_dentry_to_private(struct dentry
*dentry
)
344 return (struct ecryptfs_dentry_info
*)dentry
->d_fsdata
;
348 ecryptfs_set_dentry_private(struct dentry
*dentry
,
349 struct ecryptfs_dentry_info
*dentry_info
)
351 dentry
->d_fsdata
= dentry_info
;
354 static inline struct dentry
*
355 ecryptfs_dentry_to_lower(struct dentry
*dentry
)
357 return ((struct ecryptfs_dentry_info
*)dentry
->d_fsdata
)->wdi_dentry
;
361 ecryptfs_set_dentry_lower(struct dentry
*dentry
, struct dentry
*lower_dentry
)
363 ((struct ecryptfs_dentry_info
*)dentry
->d_fsdata
)->wdi_dentry
=
367 static inline struct vfsmount
*
368 ecryptfs_dentry_to_lower_mnt(struct dentry
*dentry
)
370 return ((struct ecryptfs_dentry_info
*)dentry
->d_fsdata
)->lower_mnt
;
374 ecryptfs_set_dentry_lower_mnt(struct dentry
*dentry
, struct vfsmount
*lower_mnt
)
376 ((struct ecryptfs_dentry_info
*)dentry
->d_fsdata
)->lower_mnt
=
380 #define ecryptfs_printk(type, fmt, arg...) \
381 __ecryptfs_printk(type "%s: " fmt, __FUNCTION__, ## arg);
382 void __ecryptfs_printk(const char *fmt
, ...);
384 extern const struct file_operations ecryptfs_main_fops
;
385 extern const struct file_operations ecryptfs_dir_fops
;
386 extern struct inode_operations ecryptfs_main_iops
;
387 extern struct inode_operations ecryptfs_dir_iops
;
388 extern struct inode_operations ecryptfs_symlink_iops
;
389 extern struct super_operations ecryptfs_sops
;
390 extern struct dentry_operations ecryptfs_dops
;
391 extern struct address_space_operations ecryptfs_aops
;
392 extern int ecryptfs_verbosity
;
394 extern struct kmem_cache
*ecryptfs_auth_tok_list_item_cache
;
395 extern struct kmem_cache
*ecryptfs_file_info_cache
;
396 extern struct kmem_cache
*ecryptfs_dentry_info_cache
;
397 extern struct kmem_cache
*ecryptfs_inode_info_cache
;
398 extern struct kmem_cache
*ecryptfs_sb_info_cache
;
399 extern struct kmem_cache
*ecryptfs_header_cache_0
;
400 extern struct kmem_cache
*ecryptfs_header_cache_1
;
401 extern struct kmem_cache
*ecryptfs_header_cache_2
;
402 extern struct kmem_cache
*ecryptfs_lower_page_cache
;
404 int ecryptfs_interpose(struct dentry
*hidden_dentry
,
405 struct dentry
*this_dentry
, struct super_block
*sb
,
407 int ecryptfs_fill_zeros(struct file
*file
, loff_t new_length
);
408 int ecryptfs_decode_filename(struct ecryptfs_crypt_stat
*crypt_stat
,
409 const char *name
, int length
,
410 char **decrypted_name
);
411 int ecryptfs_encode_filename(struct ecryptfs_crypt_stat
*crypt_stat
,
412 const char *name
, int length
,
413 char **encoded_name
);
414 struct dentry
*ecryptfs_lower_dentry(struct dentry
*this_dentry
);
415 void ecryptfs_copy_attr_atime(struct inode
*dest
, const struct inode
*src
);
416 void ecryptfs_copy_attr_all(struct inode
*dest
, const struct inode
*src
);
417 void ecryptfs_copy_inode_size(struct inode
*dst
, const struct inode
*src
);
418 void ecryptfs_dump_hex(char *data
, int bytes
);
419 int virt_to_scatterlist(const void *addr
, int size
, struct scatterlist
*sg
,
421 int ecryptfs_compute_root_iv(struct ecryptfs_crypt_stat
*crypt_stat
);
422 void ecryptfs_rotate_iv(unsigned char *iv
);
423 void ecryptfs_init_crypt_stat(struct ecryptfs_crypt_stat
*crypt_stat
);
424 void ecryptfs_destruct_crypt_stat(struct ecryptfs_crypt_stat
*crypt_stat
);
425 void ecryptfs_destruct_mount_crypt_stat(
426 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
);
427 int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat
*crypt_stat
);
428 int ecryptfs_write_inode_size_to_header(struct file
*lower_file
,
429 struct inode
*lower_inode
,
430 struct inode
*inode
);
431 int ecryptfs_get_lower_page(struct page
**lower_page
, struct inode
*lower_inode
,
432 struct file
*lower_file
,
433 unsigned long lower_page_index
, int byte_offset
,
436 ecryptfs_commit_lower_page(struct page
*lower_page
, struct inode
*lower_inode
,
437 struct file
*lower_file
, int byte_offset
,
439 int ecryptfs_copy_page_to_lower(struct page
*page
, struct inode
*lower_inode
,
440 struct file
*lower_file
);
441 int ecryptfs_do_readpage(struct file
*file
, struct page
*page
,
442 pgoff_t lower_page_index
);
443 int ecryptfs_grab_and_map_lower_page(struct page
**lower_page
,
445 struct inode
*lower_inode
,
446 unsigned long lower_page_index
);
447 int ecryptfs_writepage_and_release_lower_page(struct page
*lower_page
,
448 struct inode
*lower_inode
,
449 struct writeback_control
*wbc
);
450 int ecryptfs_encrypt_page(struct ecryptfs_page_crypt_context
*ctx
);
451 int ecryptfs_decrypt_page(struct file
*file
, struct page
*page
);
452 int ecryptfs_write_headers(struct dentry
*ecryptfs_dentry
,
453 struct file
*lower_file
);
454 int ecryptfs_write_headers_virt(char *page_virt
,
455 struct ecryptfs_crypt_stat
*crypt_stat
,
456 struct dentry
*ecryptfs_dentry
);
457 int ecryptfs_read_headers(struct dentry
*ecryptfs_dentry
,
458 struct file
*lower_file
);
459 int ecryptfs_new_file_context(struct dentry
*ecryptfs_dentry
);
460 int contains_ecryptfs_marker(char *data
);
461 int ecryptfs_read_header_region(char *data
, struct dentry
*dentry
,
462 struct vfsmount
*mnt
);
463 u16
ecryptfs_code_for_cipher_string(struct ecryptfs_crypt_stat
*crypt_stat
);
464 int ecryptfs_cipher_code_to_string(char *str
, u16 cipher_code
);
465 void ecryptfs_set_default_sizes(struct ecryptfs_crypt_stat
*crypt_stat
);
466 int ecryptfs_generate_key_packet_set(char *dest_base
,
467 struct ecryptfs_crypt_stat
*crypt_stat
,
468 struct dentry
*ecryptfs_dentry
,
469 size_t *len
, size_t max
);
470 int process_request_key_err(long err_code
);
472 ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat
*crypt_stat
,
473 unsigned char *src
, struct dentry
*ecryptfs_dentry
);
474 int ecryptfs_truncate(struct dentry
*dentry
, loff_t new_length
);
476 ecryptfs_process_cipher(struct crypto_tfm
**tfm
, struct crypto_tfm
**key_tfm
,
477 char *cipher_name
, size_t key_size
);
478 int ecryptfs_inode_test(struct inode
*inode
, void *candidate_lower_inode
);
479 int ecryptfs_inode_set(struct inode
*inode
, void *lower_inode
);
480 void ecryptfs_init_inode(struct inode
*inode
, struct inode
*lower_inode
);
482 #endif /* #ifndef ECRYPTFS_KERNEL_H */