// SPDX-License-Identifier: GPL-2.0-only/* * Copyright (C) 2003 Jana Saout <jana@saout.de> * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org> * Copyright (C) 2006-2020 Red Hat, Inc. All rights reserved. * Copyright (C) 2013-2020 Milan Broz <gmazyland@gmail.com> * * This file is released under the GPL. */ #include <linux/completion.h>#include <linux/err.h>#include <linux/module.h>#include <linux/hex.h>#include <linux/init.h>#include <linux/kernel.h>#include <linux/key.h>#include <linux/bio.h>#include <linux/blkdev.h>#include <linux/blk-integrity.h>#include <linux/crc32.h>#include <linux/mempool.h>#include <linux/slab.h>#include <linux/crypto.h>#include <linux/fips.h>#include <linux/workqueue.h>#include <linux/kthread.h>#include <linux/backing-dev.h>#include <linux/atomic.h>#include <linux/scatterlist.h>#include <linux/rbtree.h>#include <linux/ctype.h>#include <asm/page.h>#include <linux/unaligned.h>#include <crypto/aes.h>#include <crypto/hash.h>#include <crypto/md5.h>#include <crypto/skcipher.h>#include <crypto/aead.h>#include <crypto/authenc.h>#include <crypto/utils.h>#include <linux/rtnetlink.h> /* for struct rtattr and RTA macros only */#include <linux/key-type.h>#include <keys/user-type.h>#include <keys/encrypted-type.h>#include <keys/trusted-type.h> #include <linux/device-mapper.h> #include "dm-audit.h" #define DM_MSG_PREFIX "crypt" static DEFINE_IDA(workqueue_ida); /* * context holding the current state of a multi-part conversion */struct convert_context { struct completion restart; struct bio *bio_in; struct bvec_iter iter_in; struct bio *bio_out; struct bvec_iter iter_out; atomic_t cc_pending; unsigned int tag_offset; u64 cc_sector; union { struct skcipher_request *req; struct aead_request *req_aead; } r; bool aead_recheck; bool aead_failed; }; /* * per bio private data */struct dm_crypt_io { struct crypt_config *cc; struct bio *base_bio; u8 *integrity_metadata; bool integrity_metadata_from_pool:1; struct work_struct work; struct convert_context ctx; atomic_t io_pending; blk_status_t error; sector_t sector; struct bvec_iter saved_bi_iter; struct rb_node rb_node;} CRYPTO_MINALIGN_ATTR; struct dm_crypt_request { struct convert_context *ctx; struct scatterlist sg_in[4]; struct scatterlist sg_out[4]; u64 iv_sector;}; struct crypt_config; struct crypt_iv_operations { int (*ctr)(struct crypt_config *cc, struct dm_target *ti, const char *opts); void (*dtr)(struct crypt_config *cc); int (*init)(struct crypt_config *cc); void (*wipe)(struct crypt_config *cc); int (*generator)(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq); void (*post)(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq);}; struct iv_benbi_private { int shift;}; #define LMK_SEED_SIZE 64 /* hash + 0 */struct iv_lmk_private { u8 *seed;}; #define TCW_WHITENING_SIZE 16struct iv_tcw_private { u8 *iv_seed; u8 *whitening;}; #define ELEPHANT_MAX_KEY_SIZE 32struct iv_elephant_private { struct aes_enckey *key;}; /* * Crypt: maps a linear range of a block device * and encrypts / decrypts at the same time. */enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID, DM_CRYPT_SAME_CPU, DM_CRYPT_HIGH_PRIORITY, DM_CRYPT_NO_OFFLOAD, DM_CRYPT_NO_READ_WORKQUEUE, DM_CRYPT_NO_WRITE_WORKQUEUE, DM_CRYPT_WRITE_INLINE }; enum cipher_flags { CRYPT_MODE_INTEGRITY_AEAD, /* Use authenticated mode for cipher */ CRYPT_IV_LARGE_SECTORS, /* Calculate IV from sector_size, not 512B sectors */ CRYPT_ENCRYPT_PREPROCESS, /* Must preprocess data for encryption (elephant) */ CRYPT_KEY_MAC_SIZE_SET, /* The integrity_key_size option was used */}; /* * The fields in here must be read only after initialization. */struct crypt_config { struct dm_dev *dev; sector_t start; struct percpu_counter n_allocated_pages; struct workqueue_struct *io_queue; struct workqueue_struct *crypt_queue; spinlock_t write_thread_lock; struct task_struct *write_thread; struct rb_root write_tree; char *cipher_string; char *cipher_auth; char *key_string; const struct crypt_iv_operations *iv_gen_ops; union { struct iv_benbi_private benbi; struct iv_lmk_private lmk; struct iv_tcw_private tcw; struct iv_elephant_private elephant; } iv_gen_private; u64 iv_offset; unsigned int iv_size; unsigned short sector_size; unsigned char sector_shift; union { struct crypto_skcipher **tfms; struct crypto_aead **tfms_aead; } cipher_tfm; unsigned int tfms_count; int workqueue_id; unsigned long cipher_flags; /* * Layout of each crypto request: * * struct skcipher_request * context * padding * struct dm_crypt_request * padding * IV * * The padding is added so that dm_crypt_request and the IV are * correctly aligned. */ unsigned int dmreq_start; unsigned int per_bio_data_size; unsigned long flags; unsigned int key_size; unsigned int key_parts; /* independent parts in key buffer */ unsigned int key_extra_size; /* additional keys length */ unsigned int key_mac_size; /* MAC key size for authenc(...) */ unsigned int integrity_tag_size; unsigned int integrity_iv_size; unsigned int used_tag_size; unsigned int tuple_size; /* * pool for per bio private data, crypto requests, * encryption requeusts/buffer pages and integrity tags */ unsigned int tag_pool_max_sectors; mempool_t tag_pool; mempool_t req_pool; mempool_t page_pool; struct bio_set bs; struct mutex bio_alloc_lock; u8 *authenc_key; /* space for keys in authenc() format (if used) */ u8 key[] __counted_by(key_size);}; #define MIN_IOS 64#define MAX_TAG_SIZE 480#define POOL_ENTRY_SIZE 512 static DEFINE_SPINLOCK(dm_crypt_clients_lock);static unsigned int dm_crypt_clients_n;static volatile unsigned long dm_crypt_pages_per_client;#define DM_CRYPT_MEMORY_PERCENT 2#define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_VECS * 16)#define DM_CRYPT_DEFAULT_MAX_READ_SIZE 131072#define DM_CRYPT_DEFAULT_MAX_WRITE_SIZE 131072 static unsigned int max_read_size = 0;module_param(max_read_size, uint, 0644);MODULE_PARM_DESC(max_read_size, "Maximum size of a read request");static unsigned int max_write_size = 0;module_param(max_write_size, uint, 0644);MODULE_PARM_DESC(max_write_size, "Maximum size of a write request"); static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio, bool no_split){ struct crypt_config *cc = ti->private; unsigned val, sector_align; bool wrt = op_is_write(bio_op(bio)); if (no_split) { val = -1; } else if (wrt) { val = min_not_zero(READ_ONCE(max_write_size), DM_CRYPT_DEFAULT_MAX_WRITE_SIZE); } else { val = min_not_zero(READ_ONCE(max_read_size), DM_CRYPT_DEFAULT_MAX_READ_SIZE); } if (wrt || cc->used_tag_size) val = min(val, BIO_MAX_VECS << PAGE_SHIFT); sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size); val = round_down(val, sector_align); if (unlikely(!val)) val = sector_align; return val >> SECTOR_SHIFT;} static void crypt_endio(struct bio *clone);static void kcryptd_queue_crypt(struct dm_crypt_io *io);static struct scatterlist *crypt_get_sg_data(struct crypt_config *cc, struct scatterlist *sg); static bool crypt_integrity_aead(struct crypt_config *cc); /* * Use this to access cipher attributes that are independent of the key. */static struct crypto_skcipher *any_tfm(struct crypt_config *cc){ return cc->cipher_tfm.tfms[0];} static struct crypto_aead *any_tfm_aead(struct crypt_config *cc){ return cc->cipher_tfm.tfms_aead[0];} /* * Different IV generation algorithms: * * plain: the initial vector is the 32-bit little-endian version of the sector * number, padded with zeros if necessary. * * plain64: the initial vector is the 64-bit little-endian version of the sector * number, padded with zeros if necessary. * * plain64be: the initial vector is the 64-bit big-endian version of the sector * number, padded with zeros if necessary. * * essiv: "encrypted sector|salt initial vector", the sector number is * encrypted with the bulk cipher using a salt as key. The salt * should be derived from the bulk cipher's key via hashing. * * benbi: the 64-bit "big-endian 'narrow block'-count", starting at 1 * (needed for LRW-32-AES and possible other narrow block modes) * * null: the initial vector is always zero. Provides compatibility with * obsolete loop_fish2 devices. Do not use for new devices. * * lmk: Compatible implementation of the block chaining mode used * by the Loop-AES block device encryption system * designed by Jari Ruusu. See http://loop-aes.sourceforge.net/ * It operates on full 512 byte sectors and uses CBC * with an IV derived from the sector number, the data and * optionally extra IV seed. * This means that after decryption the first block * of sector must be tweaked according to decrypted data. * Loop-AES can use three encryption schemes: * version 1: is plain aes-cbc mode * version 2: uses 64 multikey scheme with lmk IV generator * version 3: the same as version 2 with additional IV seed * (it uses 65 keys, last key is used as IV seed) * * tcw: Compatible implementation of the block chaining mode used * by the TrueCrypt device encryption system (prior to version 4.1). * For more info see: https://gitlab.com/cryptsetup/cryptsetup/wikis/TrueCryptOnDiskFormat * It operates on full 512 byte sectors and uses CBC * with an IV derived from initial key and the sector number. * In addition, whitening value is applied on every sector, whitening * is calculated from initial key, sector number and mixed using CRC32. * Note that this encryption scheme is vulnerable to watermarking attacks * and should be used for old compatible containers access only. * * eboiv: Encrypted byte-offset IV (used in Bitlocker in CBC mode) * The IV is encrypted little-endian byte-offset (with the same key * and cipher as the volume). * * elephant: The extended version of eboiv with additional Elephant diffuser * used with Bitlocker CBC mode. * This mode was used in older Windows systems * https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/bitlockercipher200608.pdf */ static int crypt_iv_plain_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ memset(iv, 0, cc->iv_size); *(__le32 *)iv = cpu_to_le32(dmreq->iv_sector & 0xffffffff); return 0;} static int crypt_iv_plain64_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ memset(iv, 0, cc->iv_size); *(__le64 *)iv = cpu_to_le64(dmreq->iv_sector); return 0;} static int crypt_iv_plain64be_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ memset(iv, 0, cc->iv_size); /* iv_size is at least of size u64; usually it is 16 bytes */ *(__be64 *)&iv[cc->iv_size - sizeof(u64)] = cpu_to_be64(dmreq->iv_sector); return 0;} static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ /* * ESSIV encryption of the IV is now handled by the crypto API, * so just pass the plain sector number here. */ memset(iv, 0, cc->iv_size); *(__le64 *)iv = cpu_to_le64(dmreq->iv_sector); return 0;} static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti, const char *opts){ unsigned int bs; int log; if (crypt_integrity_aead(cc)) bs = crypto_aead_blocksize(any_tfm_aead(cc)); else bs = crypto_skcipher_blocksize(any_tfm(cc)); log = ilog2(bs); /* * We need to calculate how far we must shift the sector count * to get the cipher block count, we use this shift in _gen. */ if (1 << log != bs) { ti->error = "cypher blocksize is not a power of 2"; return -EINVAL; } if (log > 9) { ti->error = "cypher blocksize is > 512"; return -EINVAL; } cc->iv_gen_private.benbi.shift = 9 - log; return 0;} static void crypt_iv_benbi_dtr(struct crypt_config *cc){} static int crypt_iv_benbi_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ __be64 val; memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */ val = cpu_to_be64(((u64)dmreq->iv_sector << cc->iv_gen_private.benbi.shift) + 1); put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64))); return 0;} static int crypt_iv_null_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq){ memset(iv, 0, cc->iv_size); return 0;} static void crypt_iv_lmk_dtr(struct crypt_config *cc){ struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk; kfree_sensitive(lmk->seed); lmk->seed = NULL;} static int crypt_iv_lmk_ctr(struct crypt_config *cc, struct dm_target *ti, const char *opts){ struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk; if (cc->sector_size != (1 << SECTOR_SHIFT)) { ti->error = "Unsupported sector size for LMK"; return -EINVAL; } if (fips_enabled) { ti->error = "LMK support is disabled due to FIPS"; /* ... because it uses MD5. */ return -EINVAL; } /* No seed in LMK version 2 */ if (cc->key_parts == cc->tfms_count) { lmk->seed = NULL; return 0; } lmk->seed = kzalloc(LMK_SEED_SIZE, GFP_KERNEL); if (!lmk->seed) { ti->error = "Error kmallocing seed storage in LMK"; return -ENOMEM; } return 0;} static int crypt_iv_lmk_init(struct crypt_config *cc){ struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;Lines 1–500 of 3722. Load more
// SPDX-License-Identifier: GPL-2.0-only /* * Copyright (C) 2003 Jana Saout <jana@saout.de> * Copyright (C) 2004 Clemens Fruhwirth <clemens@endorphin.org> * Copyright (C) 2006-2020 Red Hat, Inc. All rights reserved. * Copyright (C) 2013-2020 Milan Broz <gmazyland@gmail.com> * * This file is released under the GPL. */ #include <linux/completion.h> #include <linux/err.h> #include <linux/module.h> #include <linux/hex.h> #include <linux/init.h> #include <linux/kernel.h> #include <linux/key.h> #include <linux/bio.h> #include <linux/blkdev.h> #include <linux/blk-integrity.h> #include <linux/crc32.h> #include <linux/mempool.h> #include <linux/slab.h> #include <linux/crypto.h> #include <linux/fips.h> #include <linux/workqueue.h> #include <linux/kthread.h> #include <linux/backing-dev.h> #include <linux/atomic.h> #include <linux/scatterlist.h> #include <linux/rbtree.h> #include <linux/ctype.h> #include <asm/page.h> #include <linux/unaligned.h> #include <crypto/aes.h> #include <crypto/hash.h> #include <crypto/md5.h> #include <crypto/skcipher.h> #include <crypto/aead.h> #include <crypto/authenc.h> #include <crypto/utils.h> #include <linux/rtnetlink.h> /* for struct rtattr and RTA macros only */ #include <linux/key-type.h> #include <keys/user-type.h> #include <keys/encrypted-type.h> #include <keys/trusted-type.h> #include <linux/device-mapper.h> #include "dm-audit.h" #define DM_MSG_PREFIX "crypt" static DEFINE_IDA(workqueue_ida); /* * context holding the current state of a multi-part conversion */ struct convert_context { struct completion restart; struct bio *bio_in; struct bvec_iter iter_in; struct bio *bio_out; struct bvec_iter iter_out; atomic_t cc_pending; unsigned int tag_offset; u64 cc_sector; union { struct skcipher_request *req; struct aead_request *req_aead; } r; bool aead_recheck; bool aead_failed; }; /* * per bio private data */ struct dm_crypt_io { struct crypt_config *cc; struct bio *base_bio; u8 *integrity_metadata; bool integrity_metadata_from_pool:1; struct work_struct work; struct convert_context ctx; atomic_t io_pending; blk_status_t error; sector_t sector; struct bvec_iter saved_bi_iter; struct rb_node rb_node; } CRYPTO_MINALIGN_ATTR; struct dm_crypt_request { struct convert_context *ctx; struct scatterlist sg_in[4]; struct scatterlist sg_out[4]; u64 iv_sector; }; struct crypt_config; struct crypt_iv_operations { int (*ctr)(struct crypt_config *cc, struct dm_target *ti, const char *opts); void (*dtr)(struct crypt_config *cc); int (*init)(struct crypt_config *cc); void (*wipe)(struct crypt_config *cc); int (*generator)(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq); void (*post)(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq); }; struct iv_benbi_private { int shift; }; #define LMK_SEED_SIZE 64 /* hash + 0 */ struct iv_lmk_private { u8 *seed; }; #define TCW_WHITENING_SIZE 16 struct iv_tcw_private { u8 *iv_seed; u8 *whitening; }; #define ELEPHANT_MAX_KEY_SIZE 32 struct iv_elephant_private { struct aes_enckey *key; }; /* * Crypt: maps a linear range of a block device * and encrypts / decrypts at the same time. */ enum flags { DM_CRYPT_SUSPENDED, DM_CRYPT_KEY_VALID, DM_CRYPT_SAME_CPU, DM_CRYPT_HIGH_PRIORITY, DM_CRYPT_NO_OFFLOAD, DM_CRYPT_NO_READ_WORKQUEUE, DM_CRYPT_NO_WRITE_WORKQUEUE, DM_CRYPT_WRITE_INLINE }; enum cipher_flags { CRYPT_MODE_INTEGRITY_AEAD, /* Use authenticated mode for cipher */ CRYPT_IV_LARGE_SECTORS, /* Calculate IV from sector_size, not 512B sectors */ CRYPT_ENCRYPT_PREPROCESS, /* Must preprocess data for encryption (elephant) */ CRYPT_KEY_MAC_SIZE_SET, /* The integrity_key_size option was used */ }; /* * The fields in here must be read only after initialization. */ struct crypt_config { struct dm_dev *dev; sector_t start; struct percpu_counter n_allocated_pages; struct workqueue_struct *io_queue; struct workqueue_struct *crypt_queue; spinlock_t write_thread_lock; struct task_struct *write_thread; struct rb_root write_tree; char *cipher_string; char *cipher_auth; char *key_string; const struct crypt_iv_operations *iv_gen_ops; union { struct iv_benbi_private benbi; struct iv_lmk_private lmk; struct iv_tcw_private tcw; struct iv_elephant_private elephant; } iv_gen_private; u64 iv_offset; unsigned int iv_size; unsigned short sector_size; unsigned char sector_shift; union { struct crypto_skcipher **tfms; struct crypto_aead **tfms_aead; } cipher_tfm; unsigned int tfms_count; int workqueue_id; unsigned long cipher_flags; /* * Layout of each crypto request: * * struct skcipher_request * context * padding * struct dm_crypt_request * padding * IV * * The padding is added so that dm_crypt_request and the IV are * correctly aligned. */ unsigned int dmreq_start; unsigned int per_bio_data_size; unsigned long flags; unsigned int key_size; unsigned int key_parts; /* independent parts in key buffer */ unsigned int key_extra_size; /* additional keys length */ unsigned int key_mac_size; /* MAC key size for authenc(...) */ unsigned int integrity_tag_size; unsigned int integrity_iv_size; unsigned int used_tag_size; unsigned int tuple_size; /* * pool for per bio private data, crypto requests, * encryption requeusts/buffer pages and integrity tags */ unsigned int tag_pool_max_sectors; mempool_t tag_pool; mempool_t req_pool; mempool_t page_pool; struct bio_set bs; struct mutex bio_alloc_lock; u8 *authenc_key; /* space for keys in authenc() format (if used) */ u8 key[] __counted_by(key_size); }; #define MIN_IOS 64 #define MAX_TAG_SIZE 480 #define POOL_ENTRY_SIZE 512 static DEFINE_SPINLOCK(dm_crypt_clients_lock); static unsigned int dm_crypt_clients_n; static volatile unsigned long dm_crypt_pages_per_client; #define DM_CRYPT_MEMORY_PERCENT 2 #define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_VECS * 16) #define DM_CRYPT_DEFAULT_MAX_READ_SIZE 131072 #define DM_CRYPT_DEFAULT_MAX_WRITE_SIZE 131072 static unsigned int max_read_size = 0; module_param(max_read_size, uint, 0644); MODULE_PARM_DESC(max_read_size, "Maximum size of a read request"); static unsigned int max_write_size = 0; module_param(max_write_size, uint, 0644); MODULE_PARM_DESC(max_write_size, "Maximum size of a write request"); static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio, bool no_split) { struct crypt_config *cc = ti->private; unsigned val, sector_align; bool wrt = op_is_write(bio_op(bio)); if (no_split) { val = -1; } else if (wrt) { val = min_not_zero(READ_ONCE(max_write_size), DM_CRYPT_DEFAULT_MAX_WRITE_SIZE); } else { val = min_not_zero(READ_ONCE(max_read_size), DM_CRYPT_DEFAULT_MAX_READ_SIZE); } if (wrt || cc->used_tag_size) val = min(val, BIO_MAX_VECS << PAGE_SHIFT); sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size); val = round_down(val, sector_align); if (unlikely(!val)) val = sector_align; return val >> SECTOR_SHIFT; } static void crypt_endio(struct bio *clone); static void kcryptd_queue_crypt(struct dm_crypt_io *io); static struct scatterlist *crypt_get_sg_data(struct crypt_config *cc, struct scatterlist *sg); static bool crypt_integrity_aead(struct crypt_config *cc); /* * Use this to access cipher attributes that are independent of the key. */ static struct crypto_skcipher *any_tfm(struct crypt_config *cc) { return cc->cipher_tfm.tfms[0]; } static struct crypto_aead *any_tfm_aead(struct crypt_config *cc) { return cc->cipher_tfm.tfms_aead[0]; } /* * Different IV generation algorithms: * * plain: the initial vector is the 32-bit little-endian version of the sector * number, padded with zeros if necessary. * * plain64: the initial vector is the 64-bit little-endian version of the sector * number, padded with zeros if necessary. * * plain64be: the initial vector is the 64-bit big-endian version of the sector * number, padded with zeros if necessary. * * essiv: "encrypted sector|salt initial vector", the sector number is * encrypted with the bulk cipher using a salt as key. The salt * should be derived from the bulk cipher's key via hashing. * * benbi: the 64-bit "big-endian 'narrow block'-count", starting at 1 * (needed for LRW-32-AES and possible other narrow block modes) * * null: the initial vector is always zero. Provides compatibility with * obsolete loop_fish2 devices. Do not use for new devices. * * lmk: Compatible implementation of the block chaining mode used * by the Loop-AES block device encryption system * designed by Jari Ruusu. See http://loop-aes.sourceforge.net/ * It operates on full 512 byte sectors and uses CBC * with an IV derived from the sector number, the data and * optionally extra IV seed. * This means that after decryption the first block * of sector must be tweaked according to decrypted data. * Loop-AES can use three encryption schemes: * version 1: is plain aes-cbc mode * version 2: uses 64 multikey scheme with lmk IV generator * version 3: the same as version 2 with additional IV seed * (it uses 65 keys, last key is used as IV seed) * * tcw: Compatible implementation of the block chaining mode used * by the TrueCrypt device encryption system (prior to version 4.1). * For more info see: https://gitlab.com/cryptsetup/cryptsetup/wikis/TrueCryptOnDiskFormat * It operates on full 512 byte sectors and uses CBC * with an IV derived from initial key and the sector number. * In addition, whitening value is applied on every sector, whitening * is calculated from initial key, sector number and mixed using CRC32. * Note that this encryption scheme is vulnerable to watermarking attacks * and should be used for old compatible containers access only. * * eboiv: Encrypted byte-offset IV (used in Bitlocker in CBC mode) * The IV is encrypted little-endian byte-offset (with the same key * and cipher as the volume). * * elephant: The extended version of eboiv with additional Elephant diffuser * used with Bitlocker CBC mode. * This mode was used in older Windows systems * https://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/bitlockercipher200608.pdf */ static int crypt_iv_plain_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { memset(iv, 0, cc->iv_size); *(__le32 *)iv = cpu_to_le32(dmreq->iv_sector & 0xffffffff); return 0; } static int crypt_iv_plain64_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { memset(iv, 0, cc->iv_size); *(__le64 *)iv = cpu_to_le64(dmreq->iv_sector); return 0; } static int crypt_iv_plain64be_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { memset(iv, 0, cc->iv_size); /* iv_size is at least of size u64; usually it is 16 bytes */ *(__be64 *)&iv[cc->iv_size - sizeof(u64)] = cpu_to_be64(dmreq->iv_sector); return 0; } static int crypt_iv_essiv_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { /* * ESSIV encryption of the IV is now handled by the crypto API, * so just pass the plain sector number here. */ memset(iv, 0, cc->iv_size); *(__le64 *)iv = cpu_to_le64(dmreq->iv_sector); return 0; } static int crypt_iv_benbi_ctr(struct crypt_config *cc, struct dm_target *ti, const char *opts) { unsigned int bs; int log; if (crypt_integrity_aead(cc)) bs = crypto_aead_blocksize(any_tfm_aead(cc)); else bs = crypto_skcipher_blocksize(any_tfm(cc)); log = ilog2(bs); /* * We need to calculate how far we must shift the sector count * to get the cipher block count, we use this shift in _gen. */ if (1 << log != bs) { ti->error = "cypher blocksize is not a power of 2"; return -EINVAL; } if (log > 9) { ti->error = "cypher blocksize is > 512"; return -EINVAL; } cc->iv_gen_private.benbi.shift = 9 - log; return 0; } static void crypt_iv_benbi_dtr(struct crypt_config *cc) { } static int crypt_iv_benbi_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { __be64 val; memset(iv, 0, cc->iv_size - sizeof(u64)); /* rest is cleared below */ val = cpu_to_be64(((u64)dmreq->iv_sector << cc->iv_gen_private.benbi.shift) + 1); put_unaligned(val, (__be64 *)(iv + cc->iv_size - sizeof(u64))); return 0; } static int crypt_iv_null_gen(struct crypt_config *cc, u8 *iv, struct dm_crypt_request *dmreq) { memset(iv, 0, cc->iv_size); return 0; } static void crypt_iv_lmk_dtr(struct crypt_config *cc) { struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk; kfree_sensitive(lmk->seed); lmk->seed = NULL; } static int crypt_iv_lmk_ctr(struct crypt_config *cc, struct dm_target *ti, const char *opts) { struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk; if (cc->sector_size != (1 << SECTOR_SHIFT)) { ti->error = "Unsupported sector size for LMK"; return -EINVAL; } if (fips_enabled) { ti->error = "LMK support is disabled due to FIPS"; /* ... because it uses MD5. */ return -EINVAL; } /* No seed in LMK version 2 */ if (cc->key_parts == cc->tfms_count) { lmk->seed = NULL; return 0; } lmk->seed = kzalloc(LMK_SEED_SIZE, GFP_KERNEL); if (!lmk->seed) { ti->error = "Error kmallocing seed storage in LMK"; return -ENOMEM; } return 0; } static int crypt_iv_lmk_init(struct crypt_config *cc) { struct iv_lmk_private *lmk = &cc->iv_gen_private.lmk;