int32_t SSPPushRowRequestOpLogMgr::InformReply(int32_t table_id, int32_t row_id,
int32_t clock, uint32_t curr_version, std::vector<int32_t> *app_thread_ids) {
(*app_thread_ids).clear();
std::pair<int32_t, int32_t> request_key(table_id, row_id);
std::list<RowRequestInfo> &request_list = pending_row_requests_[request_key];
int32_t clock_to_request = -1;
while (!request_list.empty()) {
RowRequestInfo &request = request_list.front();
if (request.clock <= clock) {
// remove the request
app_thread_ids->push_back(request.app_thread_id);
request_list.pop_front();
} else {
if (!request.sent) {
clock_to_request = request.clock;
request.sent = true;
}
break;
}
}
// if there's no request in that list, I can remove the empty list
if (request_list.empty())
pending_row_requests_.erase(request_key);
return clock_to_request;
}
char * _RequestPass(/*@unused@*/ const char * prompt)
{
/*@only@*/ /*@relnull@*/
static char * password = NULL;
#if defined(HAVE_KEYUTILS_H)
const char * foo = "user rpm:yyyy spoon";
ARGV_t av = NULL;
int xx = argvSplit(&av, foo, NULL);
key_serial_t dest = 0;
key_serial_t key = 0;
if (password != NULL) {
free(password);
password = NULL;
}
assert(av != NULL);
assert(av[0] != NULL);
assert(av[1] != NULL);
assert(av[2] != NULL);
key = request_key(av[0], av[1], av[2], dest);
av = argvFree(av);
/*@-nullstate@*/ /* XXX *password may be null. */
xx = keyctl_read_alloc(key, (void **)&password);
/*@=nullstate@*/
if (password == NULL)
password = (char *) "";
#endif /* HAVE_KEYUTILS_H */
/*@-statictrans@*/
return password;
/*@=statictrans@*/
}
static int validate_user_key(struct fscrypt_info *crypt_info,
struct fscrypt_context *ctx, u8 *raw_key,
u8 *prefix, int prefix_size)
{
u8 *full_key_descriptor;
struct key *keyring_key;
struct fscrypt_key *master_key;
const struct user_key_payload *ukp;
int full_key_len = prefix_size + (FS_KEY_DESCRIPTOR_SIZE * 2) + 1;
int res;
full_key_descriptor = kmalloc(full_key_len, GFP_NOFS);
if (!full_key_descriptor)
return -ENOMEM;
memcpy(full_key_descriptor, prefix, prefix_size);
sprintf(full_key_descriptor + prefix_size,
"%*phN", FS_KEY_DESCRIPTOR_SIZE,
ctx->master_key_descriptor);
full_key_descriptor[full_key_len - 1] = '\0';
keyring_key = request_key(&key_type_logon, full_key_descriptor, NULL);
kfree(full_key_descriptor);
if (IS_ERR(keyring_key))
return PTR_ERR(keyring_key);
if (keyring_key->type != &key_type_logon) {
printk_once(KERN_WARNING
"%s: key type must be logon\n", __func__);
res = -ENOKEY;
goto out;
}
down_read(&keyring_key->sem);
ukp = user_key_payload(keyring_key);
if (ukp->datalen != sizeof(struct fscrypt_key)) {
res = -EINVAL;
up_read(&keyring_key->sem);
goto out;
}
master_key = (struct fscrypt_key *)ukp->data;
BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE);
if (master_key->size != FS_AES_256_XTS_KEY_SIZE) {
printk_once(KERN_WARNING
"%s: key size incorrect: %d\n",
__func__, master_key->size);
res = -ENOKEY;
up_read(&keyring_key->sem);
goto out;
}
res = derive_key_aes(ctx->nonce, master_key->raw, raw_key);
up_read(&keyring_key->sem);
if (res)
goto out;
crypt_info->ci_keyring_key = keyring_key;
return 0;
out:
key_put(keyring_key);
return res;
}
int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
const char *digest, int digestlen)
{
if (id >= INTEGRITY_KEYRING_MAX)
return -EINVAL;
if (!keyring[id]) {
keyring[id] =
request_key(&key_type_keyring, keyring_name[id], NULL);
if (IS_ERR(keyring[id])) {
int err = PTR_ERR(keyring[id]);
pr_err("no %s keyring: %d\n", keyring_name[id], err);
keyring[id] = NULL;
return err;
}
}
switch (sig[1]) {
case 1:
/* v1 API expect signature without xattr type */
return digsig_verify(keyring[id], sig + 1, siglen - 1,
digest, digestlen);
case 2:
return asymmetric_verify(keyring[id], sig, siglen,
digest, digestlen);
}
return -EOPNOTSUPP;
}
bool SSPPushRowRequestOpLogMgr::AddRowRequest(RowRequestInfo &request,
int32_t table_id, int32_t row_id) {
request.sent = true;
std::pair<int32_t, int32_t> request_key(table_id, row_id);
if (pending_row_requests_.count(request_key) == 0) {
pending_row_requests_.insert(std::make_pair(request_key,
std::list<RowRequestInfo>()));
}
std::list<RowRequestInfo> &request_list = pending_row_requests_[request_key];
bool request_added = false;
// Requests are sorted in increasing order of clock number.
// When a request is to be inserted, start from the end as the requst's
// clock is more likely to be larger.
for (auto iter = request_list.end(); iter != request_list.begin(); iter--) {
auto iter_prev = std::prev(iter);
int32_t clock = request.clock;
if (clock >= iter_prev->clock) {
// insert before iter
request.sent = false;
request_list.insert(iter, request);
request_added = true;
break;
}
}
if (!request_added)
request_list.push_front(request);
return request.sent;
}
static int
id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid)
{
int rc;
struct key *sidkey;
struct cifs_sid *ksid;
unsigned int ksid_size;
char desc[3 + 10 + 1]; /* 3 byte prefix + 10 bytes for value + NULL */
const struct cred *saved_cred;
rc = snprintf(desc, sizeof(desc), "%ci:%u",
sidtype == SIDOWNER ? 'o' : 'g', cid);
if (rc >= sizeof(desc))
return -EINVAL;
rc = 0;
saved_cred = override_creds(root_cred);
sidkey = request_key(&cifs_idmap_key_type, desc, "");
if (IS_ERR(sidkey)) {
rc = -EINVAL;
cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n",
__func__, sidtype == SIDOWNER ? 'u' : 'g', cid);
goto out_revert_creds;
} else if (sidkey->datalen < CIFS_SID_BASE_SIZE) {
rc = -EIO;
cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n",
__func__, sidkey->datalen);
goto invalidate_key;
}
/*
* A sid is usually too large to be embedded in payload.value, but if
* there are no subauthorities and the host has 8-byte pointers, then
* it could be.
*/
ksid = sidkey->datalen <= sizeof(sidkey->payload) ?
(struct cifs_sid *)&sidkey->payload :
(struct cifs_sid *)sidkey->payload.data[0];
ksid_size = CIFS_SID_BASE_SIZE + (ksid->num_subauth * sizeof(__le32));
if (ksid_size > sidkey->datalen) {
rc = -EIO;
cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu, ksid_size=%u)\n",
__func__, sidkey->datalen, ksid_size);
goto invalidate_key;
}
cifs_copy_sid(ssid, ksid);
out_key_put:
key_put(sidkey);
out_revert_creds:
revert_creds(saved_cred);
return rc;
invalidate_key:
key_invalidate(sidkey);
goto out_key_put;
}
static int validate_user_key(struct fscrypt_info *crypt_info,
struct fscrypt_context *ctx, u8 *raw_key,
const char *prefix, int min_keysize)
{
char *description;
struct key *keyring_key;
struct fscrypt_key *master_key;
const struct user_key_payload *ukp;
int res;
description = kasprintf(GFP_NOFS, "%s%*phN", prefix,
FS_KEY_DESCRIPTOR_SIZE,
ctx->master_key_descriptor);
if (!description)
return -ENOMEM;
keyring_key = request_key(&key_type_logon, description, NULL);
kfree(description);
if (IS_ERR(keyring_key))
return PTR_ERR(keyring_key);
down_read(&keyring_key->sem);
if (keyring_key->type != &key_type_logon) {
printk_once(KERN_WARNING
"%s: key type must be logon\n", __func__);
res = -ENOKEY;
goto out;
}
ukp = user_key_payload_locked(keyring_key);
if (!ukp) {
/* key was revoked before we acquired its semaphore */
res = -EKEYREVOKED;
goto out;
}
if (ukp->datalen != sizeof(struct fscrypt_key)) {
res = -EINVAL;
goto out;
}
master_key = (struct fscrypt_key *)ukp->data;
BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE);
if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE
|| master_key->size % AES_BLOCK_SIZE != 0) {
printk_once(KERN_WARNING
"%s: key size incorrect: %d\n",
__func__, master_key->size);
res = -ENOKEY;
goto out;
}
res = derive_key_aes(ctx->nonce, master_key, raw_key);
out:
up_read(&keyring_key->sem);
key_put(keyring_key);
return res;
}
/*
* Request an asymmetric key.
*/
static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid)
{
struct key *key;
char name[12];
sprintf(name, "id:%08x", keyid);
pr_debug("key search: \"%s\"\n", name);
key = get_ima_blacklist_keyring();
if (key) {
key_ref_t kref;
kref = keyring_search(make_key_ref(key, 1),
&key_type_asymmetric, name);
if (!IS_ERR(kref)) {
pr_err("Key '%s' is in ima_blacklist_keyring\n", name);
return ERR_PTR(-EKEYREJECTED);
}
}
if (keyring) {
/* search in specific keyring */
key_ref_t kref;
kref = keyring_search(make_key_ref(keyring, 1),
&key_type_asymmetric, name);
if (IS_ERR(kref))
key = ERR_CAST(kref);
else
key = key_ref_to_ptr(kref);
} else {
key = request_key(&key_type_asymmetric, name, NULL);
}
if (IS_ERR(key)) {
pr_err_ratelimited("Request for unknown key '%s' err %ld\n",
name, PTR_ERR(key));
switch (PTR_ERR(key)) {
/* Hide some search errors */
case -EACCES:
case -ENOTDIR:
case -EAGAIN:
return ERR_PTR(-ENOKEY);
default:
return key;
}
}
pr_debug("%s() = 0 [%x]\n", __func__, key_serial(key));
return key;
}
static ssize_t nfs_idmap_request_key(struct key_type *key_type,
const char *name, size_t namelen,
const char *type, void *data,
size_t data_size, struct idmap *idmap)
{
const struct cred *saved_cred;
struct key *rkey;
char *desc;
struct user_key_payload *payload;
ssize_t ret;
ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
if (ret <= 0)
goto out;
saved_cred = override_creds(id_resolver_cache);
if (idmap)
rkey = request_key_with_auxdata(key_type, desc, "", 0, idmap);
else
rkey = request_key(&key_type_id_resolver, desc, "");
revert_creds(saved_cred);
kfree(desc);
if (IS_ERR(rkey)) {
ret = PTR_ERR(rkey);
goto out;
}
rcu_read_lock();
rkey->perm |= KEY_USR_VIEW;
ret = key_validate(rkey);
if (ret < 0)
goto out_up;
payload = rcu_dereference(rkey->payload.data);
if (IS_ERR_OR_NULL(payload)) {
ret = PTR_ERR(payload);
goto out_up;
}
ret = payload->datalen;
if (ret > 0 && ret <= data_size)
memcpy(data, payload->data, ret);
else
ret = -EINVAL;
out_up:
rcu_read_unlock();
key_put(rkey);
out:
return ret;
}
int
cifs_resolve_server_name_to_ip(const char *unc, struct in_addr *ip_addr) {
int rc = -EAGAIN;
struct key *rkey;
char *name;
int len;
if ((!ip_addr) || (!unc)) {
return -EINVAL;
}
/* search for server name delimiter */
len = strlen( unc);
if (len < 3) {
cFYI(1, ("%s: unc is too short: %s",
__FUNCTION__, unc ));
return -EINVAL;
}
len -= 2;
name = memchr(unc+2, '\\', len);
if (!name) {
cFYI(1, ("%s: probably server name is whole unc: %s",
__FUNCTION__, unc ));
} else {
len = (name - unc) - 2/* leading // */;
}
name = kmalloc( len+1, GFP_KERNEL);
if (name == NULL) {
rc = -ENOMEM;
return rc;
}
memcpy( name, unc+2, len);
name[len] = 0;
rkey = request_key(&key_type_cifs_resolver, name, "");
if (!IS_ERR(rkey)) {
ip_addr->s_addr = rkey->payload.value;
cFYI(1, ("%s: resolved: %s to %u.%u.%u.%u", __FUNCTION__,
rkey->description,
NIPQUAD(ip_addr->s_addr)
));
key_put(rkey);
rc = 0;
} else {
cERROR(1, ("%s: unable to resolve: %s", __FUNCTION__, name));
}
kfree(name);
return rc;
}
void KSecretServiceTest::setupKeyring()
{
const char* KSS_TEST_USER = "******";
QVERIFY(qEnvironmentVariableIsSet(KSS_TEST_USER));
QVERIFY(!qEnvironmentVariableIsEmpty(KSS_TEST_USER));
auto testUser = qgetenv(KSS_TEST_USER);
const char* KSS_TEST_PASSWORD = "******";
QVERIFY(qEnvironmentVariableIsSet(KSS_TEST_PASSWORD));
QVERIFY(!qEnvironmentVariableIsEmpty(KSS_TEST_PASSWORD));
auto testPass = qgetenv(KSS_TEST_PASSWORD);
const char* KEYNAME_ENCRYPTING = "ksecrets-test:encrypting";
const char* KEYNAME_MAC = "ksecrets-test:mac";
/* second prevention measure - change keyring keynames */
sharedConfig->group(QLatin1String("keyring"))
.writeEntry("keyname_encrypt", KEYNAME_ENCRYPTING);
sharedConfig->group(QLatin1String("keyring"))
.writeEntry("keyname_mac", KEYNAME_MAC);
/* third prevention measure - the encrypting key should not be present
* into the kernel keyring */
key_serial_t key;
key = request_key("user", KEYNAME_ENCRYPTING, 0, KEY_SPEC_SESSION_KEYRING);
QVERIFY(-1 == key);
/* now go setup user's keyring */
QVERIFY(1 == kss_set_credentials(testUser.constData(), testPass.constData(), secretsFilePath.toLocal8Bit().constData()));
// the right keys should be present into the kernel keyring
key = request_key("user", KEYNAME_ENCRYPTING, 0, KEY_SPEC_SESSION_KEYRING);
QVERIFY(-1 != key);
key = request_key("user", KEYNAME_MAC, 0, KEY_SPEC_SESSION_KEYRING);
QVERIFY(-1 != key);
}
static void do_test(void)
{
key_serial_t key;
key = add_key("user", "ltptestkey", "a", 1, KEY_SPEC_SESSION_KEYRING);
if (key == -1)
tst_brk(TBROK, "Failed to add key");
request_key("keyring", "foo", "bar", KEY_SPEC_THREAD_KEYRING);
TEST(keyctl(KEYCTL_UNLINK, key, KEY_SPEC_SESSION_KEYRING));
if (TEST_RETURN)
tst_res(TFAIL | TTERRNO, "keyctl unlink failed");
else
tst_res(TPASS, "Bug not reproduced");
}
/*
* request_user_key - request the user key
*
* Use a user provided key to encrypt/decrypt an encrypted-key.
*/
static struct key *request_user_key(const char *master_desc, const u8 **master_key,
size_t *master_keylen)
{
const struct user_key_payload *upayload;
struct key *ukey;
ukey = request_key(&key_type_user, master_desc, NULL);
if (IS_ERR(ukey))
goto error;
down_read(&ukey->sem);
upayload = user_key_payload(ukey);
*master_key = upayload->data;
*master_keylen = upayload->datalen;
error:
return ukey;
}
struct key *request_trusted_key(const char *trusted_desc,
u8 **master_key, size_t *master_keylen)
{
struct trusted_key_payload *tpayload;
struct key *tkey;
tkey = request_key(&key_type_trusted, trusted_desc, NULL);
if (IS_ERR(tkey))
goto error;
down_read(&tkey->sem);
tpayload = tkey->payload.data;
*master_key = tpayload->key;
*master_keylen = tpayload->key_len;
error:
return tkey;
}
static void verify_request_key(unsigned int n)
{
struct test_case *tc = tcases + n;
TEST(request_key("keyring", tc->des, NULL, *tc->id));
if (TST_RET != -1) {
tst_res(TFAIL, "request_key() succeed unexpectly");
return;
}
if (TST_ERR == tc->exp_err) {
tst_res(TPASS | TTERRNO, "request_key() failed expectly");
return;
}
tst_res(TFAIL | TTERRNO, "request_key() failed unexpectly, "
"expected %s", tst_strerrno(tc->exp_err));
}
/* get secret from key store */
static int get_secret(struct ceph_crypto_key *dst, const char *name) {
struct key *ukey;
int key_err;
int err = 0;
struct ceph_crypto_key *ckey;
ukey = request_key(&key_type_ceph, name, NULL);
if (!ukey || IS_ERR(ukey)) {
/* request_key errors don't map nicely to mount(2)
errors; don't even try, but still printk */
key_err = PTR_ERR(ukey);
switch (key_err) {
case -ENOKEY:
pr_warn("ceph: Mount failed due to key not found: %s\n",
name);
break;
case -EKEYEXPIRED:
pr_warn("ceph: Mount failed due to expired key: %s\n",
name);
break;
case -EKEYREVOKED:
pr_warn("ceph: Mount failed due to revoked key: %s\n",
name);
break;
default:
pr_warn("ceph: Mount failed due to unknown key error %d: %s\n",
key_err, name);
}
err = -EPERM;
goto out;
}
ckey = ukey->payload.data[0];
err = ceph_crypto_key_clone(dst, ckey);
if (err)
goto out_key;
/* pass through, err is 0 */
out_key:
key_put(ukey);
out:
return err;
}
char* getKey(char *login)
{
char buffer[255];
memset(buffer,0,sizeof(buffer));
int ret;
// ищем номер пользовательского ключа
ret = request_key("user", login, NULL, 0);
if (ret < 0)
{
return "";
};
// Возвращаем значение ключа
ret = keyctl_read(ret, buffer, sizeof(buffer));
if (ret < 0)
{
return "";
};
return buffer;
};
int clearKey(char *login)
{
int ret;
key_serial_t dest;
dest = KEY_SPEC_USER_SESSION_KEYRING;
// ищем номер пользовательского ключа
ret = request_key("user", login, NULL, 0);
if (ret < 0)
{
return 1;
};
// удаляем ключ
ret = keyctl_unlink(ret, dest);
if (ret < 0)
{
return 1;
};
return 0;
};
static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
const char *type, struct idmap *idmap)
{
char *desc;
struct key *rkey;
ssize_t ret;
ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
if (ret <= 0)
return ERR_PTR(ret);
rkey = request_key(&key_type_id_resolver, desc, "");
if (IS_ERR(rkey)) {
mutex_lock(&idmap->idmap_mutex);
rkey = request_key_with_auxdata(&key_type_id_resolver_legacy,
desc, "", 0, idmap);
mutex_unlock(&idmap->idmap_mutex);
}
if (!IS_ERR(rkey))
set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags);
kfree(desc);
return rkey;
}
struct key *afs_request_key(struct afs_cell *cell)
{
struct key *key;
_enter("{%x}", key_serial(cell->anonymous_key));
_debug("key %s", cell->anonymous_key->description);
key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
NULL);
if (IS_ERR(key)) {
if (PTR_ERR(key) != -ENOKEY) {
_leave(" = %ld", PTR_ERR(key));
return key;
}
_leave(" = {%x} [anon]", key_serial(cell->anonymous_key));
return key_get(cell->anonymous_key);
} else {
_leave(" = {%x} [auth]", key_serial(key));
return key;
}
}
/*
* Get the key from the TPM for the SHA1-HMAC
*/
int evm_init_key(void)
{
struct key *evm_key;
struct encrypted_key_payload *ekp;
int rc = 0;
evm_key = request_key(&key_type_encrypted, EVMKEY, NULL);
if (IS_ERR(evm_key))
return -ENOENT;
down_read(&evm_key->sem);
ekp = evm_key->payload.data;
if (ekp->decrypted_datalen > MAX_KEY_SIZE) {
rc = -EINVAL;
goto out;
}
memcpy(evmkey, ekp->decrypted_data, ekp->decrypted_datalen);
out:
/* burn the original key contents */
memset(ekp->decrypted_data, 0, ekp->decrypted_datalen);
up_read(&evm_key->sem);
key_put(evm_key);
return rc;
}
/**
* dns_query - Query the DNS
* @type: Query type (or NULL for straight host->IP lookup)
* @name: Name to look up
* @namelen: Length of name
* @options: Request options (or NULL if no options)
* @_result: Where to place the returned data (or NULL)
* @_expiry: Where to store the result expiry time (or NULL)
*
* The data will be returned in the pointer at *result, if provided, and the
* caller is responsible for freeing it.
*
* The description should be of the form "[<query_type>:]<domain_name>", and
* the options need to be appropriate for the query type requested. If no
* query_type is given, then the query is a straight hostname to IP address
* lookup.
*
* The DNS resolution lookup is performed by upcalling to userspace by way of
* requesting a key of type dns_resolver.
*
* Returns the size of the result on success, -ve error code otherwise.
*/
int dns_query(const char *type, const char *name, size_t namelen,
const char *options, char **_result, time64_t *_expiry)
{
struct key *rkey;
struct user_key_payload *upayload;
const struct cred *saved_cred;
size_t typelen, desclen;
char *desc, *cp;
int ret, len;
kenter("%s,%*.*s,%zu,%s",
type, (int)namelen, (int)namelen, name, namelen, options);
if (!name || namelen == 0)
return -EINVAL;
/* construct the query key description as "[<type>:]<name>" */
typelen = 0;
desclen = 0;
if (type) {
typelen = strlen(type);
if (typelen < 1)
return -EINVAL;
desclen += typelen + 1;
}
if (!namelen)
namelen = strnlen(name, 256);
if (namelen < 3 || namelen > 255)
return -EINVAL;
desclen += namelen + 1;
desc = kmalloc(desclen, GFP_KERNEL);
if (!desc)
return -ENOMEM;
cp = desc;
if (type) {
memcpy(cp, type, typelen);
cp += typelen;
*cp++ = ':';
}
memcpy(cp, name, namelen);
cp += namelen;
*cp = '\0';
if (!options)
options = "";
kdebug("call request_key(,%s,%s)", desc, options);
/* make the upcall, using special credentials to prevent the use of
* add_key() to preinstall malicious redirections
*/
saved_cred = override_creds(dns_resolver_cache);
rkey = request_key(&key_type_dns_resolver, desc, options);
revert_creds(saved_cred);
kfree(desc);
if (IS_ERR(rkey)) {
ret = PTR_ERR(rkey);
goto out;
}
down_read(&rkey->sem);
set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags);
rkey->perm |= KEY_USR_VIEW;
ret = key_validate(rkey);
if (ret < 0)
goto put;
/* If the DNS server gave an error, return that to the caller */
ret = PTR_ERR(rkey->payload.data[dns_key_error]);
if (ret)
goto put;
upayload = user_key_payload_locked(rkey);
len = upayload->datalen;
if (_result) {
ret = -ENOMEM;
*_result = kmalloc(len + 1, GFP_KERNEL);
if (!*_result)
goto put;
memcpy(*_result, upayload->data, len);
(*_result)[len] = '\0';
}
if (_expiry)
*_expiry = rkey->expiry;
ret = len;
put:
up_read(&rkey->sem);
key_put(rkey);
out:
kleave(" = %d", ret);
return ret;
}
/* get a key struct with a SPNEGO security blob, suitable for session setup */
struct key *
cifs_get_spnego_key(struct cifsSesInfo *sesInfo)
{
struct TCP_Server_Info *server = sesInfo->server;
char *description, *dp;
size_t desc_len;
struct key *spnego_key;
const char *hostname = server->hostname;
/* length of fields (with semicolons): ver=0xyz ip4=ipaddress
host=hostname sec=mechanism uid=0xFF user=username */
desc_len = MAX_VER_STR_LEN +
HOST_KEY_LEN + strlen(hostname) +
IP_KEY_LEN + INET6_ADDRSTRLEN +
MAX_MECH_STR_LEN +
UID_KEY_LEN + (sizeof(uid_t) * 2) +
USER_KEY_LEN + strlen(sesInfo->userName) +
PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
spnego_key = ERR_PTR(-ENOMEM);
description = kzalloc(desc_len, GFP_KERNEL);
if (description == NULL)
goto out;
dp = description;
/* start with version and hostname portion of UNC string */
spnego_key = ERR_PTR(-EINVAL);
sprintf(dp, "ver=0x%x;host=%s;", CIFS_SPNEGO_UPCALL_VERSION,
hostname);
dp = description + strlen(description);
/* add the server address */
if (server->addr.sockAddr.sin_family == AF_INET)
sprintf(dp, "ip4=%pI4", &server->addr.sockAddr.sin_addr);
else if (server->addr.sockAddr.sin_family == AF_INET6)
sprintf(dp, "ip6=%pI6", &server->addr.sockAddr6.sin6_addr);
else
goto out;
dp = description + strlen(description);
/* for now, only sec=krb5 and sec=mskrb5 are valid */
if (server->sec_kerberos)
sprintf(dp, ";sec=krb5");
else if (server->sec_mskerberos)
sprintf(dp, ";sec=mskrb5");
else
goto out;
dp = description + strlen(description);
sprintf(dp, ";uid=0x%x", sesInfo->linux_uid);
dp = description + strlen(description);
sprintf(dp, ";user=%s", sesInfo->userName);
dp = description + strlen(description);
sprintf(dp, ";pid=0x%x", current->pid);
cFYI(1, "key description = %s", description);
spnego_key = request_key(&cifs_spnego_key_type, description, "");
#ifdef CONFIG_CIFS_DEBUG2
if (cifsFYI && !IS_ERR(spnego_key)) {
struct cifs_spnego_msg *msg = spnego_key->payload.data;
cifs_dump_mem("SPNEGO reply blob:", msg->data, min(1024U,
msg->secblob_len + msg->sesskey_len));
}
#endif /* CONFIG_CIFS_DEBUG2 */
out:
kfree(description);
return spnego_key;
}
static int
sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
struct cifs_fattr *fattr, uint sidtype)
{
int rc;
unsigned long cid;
struct key *idkey;
const struct cred *saved_cred;
struct cifs_sid_id *psidid, *npsidid;
struct rb_root *cidtree;
spinlock_t *cidlock;
if (sidtype == SIDOWNER) {
cid = cifs_sb->mnt_uid;
cidlock = &siduidlock;
cidtree = &uidtree;
} else if (sidtype == SIDGROUP) {
cid = cifs_sb->mnt_gid;
cidlock = &sidgidlock;
cidtree = &gidtree;
} else
return -ENOENT;
spin_lock(cidlock);
psidid = id_rb_search(cidtree, psid);
if (!psidid) {
spin_unlock(cidlock);
npsidid = kzalloc(sizeof(struct cifs_sid_id), GFP_KERNEL);
if (!npsidid)
return -ENOMEM;
npsidid->sidstr = kmalloc(SIDLEN, GFP_KERNEL);
if (!npsidid->sidstr) {
kfree(npsidid);
return -ENOMEM;
}
spin_lock(cidlock);
psidid = id_rb_search(cidtree, psid);
if (psidid) {
++psidid->refcount;
spin_unlock(cidlock);
kfree(npsidid->sidstr);
kfree(npsidid);
} else {
psidid = npsidid;
id_rb_insert(cidtree, psid, &psidid,
sidtype == SIDOWNER ? "os:" : "gs:");
++psidid->refcount;
spin_unlock(cidlock);
}
} else {
++psidid->refcount;
spin_unlock(cidlock);
}
if (test_bit(SID_ID_MAPPED, &psidid->state)) {
cid = psidid->id;
psidid->time = jiffies;
goto sid_to_id_out;
}
if (time_after(psidid->time + SID_MAP_RETRY, jiffies))
goto sid_to_id_out;
if (!test_and_set_bit(SID_ID_PENDING, &psidid->state)) {
saved_cred = override_creds(root_cred);
idkey = request_key(&cifs_idmap_key_type, psidid->sidstr, "");
if (IS_ERR(idkey))
cFYI(1, "%s: Can't map SID to an id", __func__);
else {
cid = *(unsigned long *)idkey->payload.value;
psidid->id = cid;
set_bit(SID_ID_MAPPED, &psidid->state);
key_put(idkey);
kfree(psidid->sidstr);
}
revert_creds(saved_cred);
psidid->time = jiffies;
clear_bit(SID_ID_PENDING, &psidid->state);
wake_up_bit(&psidid->state, SID_ID_PENDING);
} else {
rc = wait_on_bit(&psidid->state, SID_ID_PENDING,
sidid_pending_wait, TASK_INTERRUPTIBLE);
if (rc) {
cFYI(1, "%s: sidid_pending_wait interrupted %d",
__func__, rc);
--psidid->refcount;
return rc;
}
if (test_bit(SID_ID_MAPPED, &psidid->state))
cid = psidid->id;
}
sid_to_id_out:
--psidid->refcount;
if (sidtype == SIDOWNER)
fattr->cf_uid = cid;
else
fattr->cf_gid = cid;
return 0;
}
static int
id_to_sid(unsigned long cid, uint sidtype, struct cifs_sid *ssid)
{
int rc = 0;
struct key *sidkey;
const struct cred *saved_cred;
struct cifs_sid *lsid;
struct cifs_sid_id *psidid, *npsidid;
struct rb_root *cidtree;
spinlock_t *cidlock;
if (sidtype == SIDOWNER) {
cidlock = &siduidlock;
cidtree = &uidtree;
} else if (sidtype == SIDGROUP) {
cidlock = &sidgidlock;
cidtree = &gidtree;
} else
return -EINVAL;
spin_lock(cidlock);
psidid = sid_rb_search(cidtree, cid);
if (!psidid) {
spin_unlock(cidlock);
npsidid = kzalloc(sizeof(struct cifs_sid_id), GFP_KERNEL);
if (!npsidid)
return -ENOMEM;
npsidid->sidstr = kmalloc(SIDLEN, GFP_KERNEL);
if (!npsidid->sidstr) {
kfree(npsidid);
return -ENOMEM;
}
spin_lock(cidlock);
psidid = sid_rb_search(cidtree, cid);
if (psidid) {
++psidid->refcount;
spin_unlock(cidlock);
kfree(npsidid->sidstr);
kfree(npsidid);
} else {
psidid = npsidid;
sid_rb_insert(cidtree, cid, &psidid,
sidtype == SIDOWNER ? "oi:" : "gi:");
++psidid->refcount;
spin_unlock(cidlock);
}
} else {
++psidid->refcount;
spin_unlock(cidlock);
}
if (test_bit(SID_ID_MAPPED, &psidid->state)) {
memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
psidid->time = jiffies;
goto id_sid_out;
}
if (time_after(psidid->time + SID_MAP_RETRY, jiffies)) {
rc = -EINVAL;
goto id_sid_out;
}
if (!test_and_set_bit(SID_ID_PENDING, &psidid->state)) {
saved_cred = override_creds(root_cred);
sidkey = request_key(&cifs_idmap_key_type, psidid->sidstr, "");
if (IS_ERR(sidkey)) {
rc = -EINVAL;
cFYI(1, "%s: Can't map and id to a SID", __func__);
} else {
lsid = (struct cifs_sid *)sidkey->payload.data;
memcpy(&psidid->sid, lsid,
sidkey->datalen < sizeof(struct cifs_sid) ?
sidkey->datalen : sizeof(struct cifs_sid));
memcpy(ssid, &psidid->sid,
sidkey->datalen < sizeof(struct cifs_sid) ?
sidkey->datalen : sizeof(struct cifs_sid));
set_bit(SID_ID_MAPPED, &psidid->state);
key_put(sidkey);
kfree(psidid->sidstr);
}
psidid->time = jiffies;
revert_creds(saved_cred);
clear_bit(SID_ID_PENDING, &psidid->state);
wake_up_bit(&psidid->state, SID_ID_PENDING);
} else {
rc = wait_on_bit(&psidid->state, SID_ID_PENDING,
sidid_pending_wait, TASK_INTERRUPTIBLE);
if (rc) {
cFYI(1, "%s: sidid_pending_wait interrupted %d",
__func__, rc);
--psidid->refcount;
return rc;
}
if (test_bit(SID_ID_MAPPED, &psidid->state))
memcpy(ssid, &psidid->sid, sizeof(struct cifs_sid));
else
rc = -EINVAL;
}
id_sid_out:
--psidid->refcount;
return rc;
}
static int
sid_to_id(struct cifs_sb_info *cifs_sb, struct cifs_sid *psid,
struct cifs_fattr *fattr, uint sidtype)
{
int rc;
struct key *sidkey;
char *sidstr;
const struct cred *saved_cred;
kuid_t fuid = cifs_sb->mnt_uid;
kgid_t fgid = cifs_sb->mnt_gid;
/*
* If we have too many subauthorities, then something is really wrong.
* Just return an error.
*/
if (unlikely(psid->num_subauth > SID_MAX_SUB_AUTHORITIES)) {
cifs_dbg(FYI, "%s: %u subauthorities is too many!\n",
__func__, psid->num_subauth);
return -EIO;
}
sidstr = sid_to_key_str(psid, sidtype);
if (!sidstr)
return -ENOMEM;
saved_cred = override_creds(root_cred);
sidkey = request_key(&cifs_idmap_key_type, sidstr, "");
if (IS_ERR(sidkey)) {
rc = -EINVAL;
cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n",
__func__, sidstr, sidtype == SIDOWNER ? 'u' : 'g');
goto out_revert_creds;
}
/*
* FIXME: Here we assume that uid_t and gid_t are same size. It's
* probably a safe assumption but might be better to check based on
* sidtype.
*/
BUILD_BUG_ON(sizeof(uid_t) != sizeof(gid_t));
if (sidkey->datalen != sizeof(uid_t)) {
rc = -EIO;
cifs_dbg(FYI, "%s: Downcall contained malformed key (datalen=%hu)\n",
__func__, sidkey->datalen);
key_invalidate(sidkey);
goto out_key_put;
}
if (sidtype == SIDOWNER) {
kuid_t uid;
uid_t id;
memcpy(&id, &sidkey->payload.data[0], sizeof(uid_t));
uid = make_kuid(&init_user_ns, id);
if (uid_valid(uid))
fuid = uid;
} else {
kgid_t gid;
gid_t id;
memcpy(&id, &sidkey->payload.data[0], sizeof(gid_t));
gid = make_kgid(&init_user_ns, id);
if (gid_valid(gid))
fgid = gid;
}
out_key_put:
key_put(sidkey);
out_revert_creds:
revert_creds(saved_cred);
kfree(sidstr);
/*
* Note that we return 0 here unconditionally. If the mapping
* fails then we just fall back to using the mnt_uid/mnt_gid.
*/
if (sidtype == SIDOWNER)
fattr->cf_uid = fuid;
else
fattr->cf_gid = fgid;
return 0;
}
int parse_packet(struct ecryptfs_ctx *ctx,
struct ecryptfs_message *emsg,
struct ecryptfs_message **reply)
{
struct ecryptfs_auth_tok *auth_tok = NULL;
size_t i = 0;
size_t data_size;
size_t key_size;
size_t length_size;
size_t key_out_size;
unsigned char *signature = NULL;
unsigned char packet_type;
char *key = NULL;
char *key_out = NULL;
key_serial_t key_sub;
int rc;
packet_type = emsg->data[i++];
if ((rc = ecryptfs_parse_packet_length(&emsg->data[i], &data_size,
&length_size))) {
syslog(LOG_ERR, "Invalid packet format\n");
goto write_failure;
}
i += length_size;
signature = malloc(data_size + 1);
if (!signature) {
rc = -errno;
syslog(LOG_ERR, "Failed to allocate memory: %m\n");
goto write_failure;
}
memcpy(signature, &emsg->data[i], data_size);
signature[data_size] = '\0';
i += data_size;
rc = ecryptfs_parse_packet_length(&emsg->data[i], &key_size,
&length_size);
if (rc) {
syslog(LOG_ERR, "Invalid packet format\n");
goto write_failure;
}
i += length_size;
if ((key = malloc(key_size)) == NULL) {
rc = -ENOMEM;
syslog(LOG_ERR, "Failed to allocate memory\n");
goto write_failure;
}
memcpy(key, &emsg->data[i], key_size);
i += key_size;
key_sub = request_key("user", (char *)signature, NULL,
KEY_SPEC_USER_KEYRING);
if (key_sub < 0) {
syslog(LOG_ERR, "Could not find key with signature: "
"[%s]\n", signature);
rc = -EINVAL;
goto write_failure;
}
rc = keyctl_read_alloc(key_sub, (void **)(&auth_tok));
switch (packet_type) {
case ECRYPTFS_TAG_64_PACKET:
if ((rc = key_mod_decrypt(&key_out, &key_out_size, ctx,
auth_tok, key, key_size))) {
syslog(LOG_ERR, "Failed to decrypt key; rc = [%d]\n",
rc);
rc = write_failure_packet(ECRYPTFS_TAG_65_PACKET,
reply);
goto write_failure;
}
if ((rc = write_tag_65_packet((unsigned char *)key_out,
key_out_size, reply))) {
syslog(LOG_ERR, "Failed to write decrypted "
"key via tag 65 packet\n");
goto write_failure;
}
break;
case ECRYPTFS_TAG_66_PACKET:
rc = key_mod_encrypt(&key_out, &key_out_size, ctx, auth_tok,
key, key_size);
if (rc) {
syslog(LOG_ERR, "Failed to encrypt public "
"key\n");
goto write_failure;
}
rc = write_tag_67_packet(key_out, key_out_size, reply);
if (rc) {
syslog(LOG_ERR, "Failed to write encrypted "
"key to tag 67 packet\n");
goto write_failure;
}
break;
default:
syslog(LOG_ERR, "Unrecognized packet type: [%d]\n",
packet_type);
rc = -EINVAL;
break;
}
free(key);
free(signature);
free(key_out);
memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok)
+ auth_tok->token.private_key.data_len));
free(auth_tok);
return rc;
write_failure:
if(packet_type == ECRYPTFS_TAG_66_PACKET)
rc = write_failure_packet(ECRYPTFS_TAG_67_PACKET, reply);
else
rc = write_failure_packet(ECRYPTFS_TAG_65_PACKET, reply);
free(key);
free(signature);
free(key_out);
if (auth_tok) {
memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok)
+ auth_tok->token.private_key.data_len));
free(auth_tok);
}
return rc;
}
void *
handle_client(void * arg)
{
struct thread_data_t * datum = (struct thread_data_t *)(arg);
/* Fetch the ID from the argument */
#ifndef NDEBUG
fprintf(stderr, "[thread %lu] INFO: worker started\n", datum->id);
#endif
/* Worker thread signal handling is unique */
sigaction(SIGUSR1, datum->signal_action, NULL);
sigaction(SIGUSR2, datum->signal_action, NULL);
/* As long as possible, grab up whatever connection is available */
while (!session_data.caught_signal && !datum->caught_signal) {
/* Ensure only one worker accepts the next client */
gcry_pthread_mutex_lock((void **)(&session_data.accept_mutex));
datum->sock = accept(session_data.sock,
(struct sockaddr *)(&datum->remote_addr),
&datum->remote_addr_len);
gcry_pthread_mutex_unlock((void **)(&session_data.accept_mutex));
if (datum->sock >= 0) {
#ifndef NDEBUG
fprintf(stderr,
"[thread %lu] INFO: worker connected to client\n",
datum->id);
#endif
/* Receive a "hello" message from the client */
recv_message(&datum->buffet, datum->sock);
/* Decrypt it with the default key */
decrypt_message(&datum->buffet, keystore.key);
/* Verify it is an authentication request */
if (strncmp(datum->buffet.tbuffer,
AUTH_CHECK_MSG, sizeof(AUTH_CHECK_MSG))) {
/* Respond with nonce (misdirection) */
gcry_create_nonce(datum->buffet.pbuffer, MAX_COMMAND_LENGTH);
encrypt_message(&datum->buffet, keystore.key);
send_message(&datum->buffet, datum->sock);
} else {
/* Request a session key */
gcry_pthread_mutex_lock((void **)(&session_data.keystore_mutex));
#ifndef NDEBUG
print_keystore(stderr, "before request");
#endif
request_key(&datum->credentials.key);
#ifndef NDEBUG
print_keystore(stderr, "after request");
#endif
gcry_pthread_mutex_unlock((void **)(&session_data.keystore_mutex));
/* Encrypted it using the default key */
salt_and_pepper((char *)(datum->credentials.key), NULL,
&datum->buffet);
encrypt_message(&datum->buffet, keystore.key);
send_message(&datum->buffet, datum->sock);
clear_buffet(&datum->buffet);
/* Repeatedly poll for message streams */
while (handle_stream(datum) == BANKING_SUCCESS);
/* Revoke the session key */
gcry_pthread_mutex_lock((void **)(&session_data.keystore_mutex));
#ifndef NDEBUG
print_keystore(stderr, "before revoke");
#endif
revoke_key(&datum->credentials.key);
#ifndef NDEBUG
print_keystore(stderr, "after revoke");
#endif
gcry_pthread_mutex_unlock((void **)(&session_data.keystore_mutex));
}
/* Cleanup (disconnect) */
#ifndef NDEBUG
fprintf(stderr,
"[thread %lu] INFO: worker disconnected from client\n",
datum->id);
#endif
clear_buffet(&datum->buffet);
destroy_socket(datum->sock);
datum->sock = BANKING_FAILURE;
} else {
fprintf(stderr,
"[thread %lu] ERROR: worker unable to connect\n",
datum->id);
}
}
/* Teardown */
handle_interruption(0);
return NULL;
}
/* Resolves server name to ip address.
* input:
* unc - server UNC
* output:
* *ip_addr - pointer to server ip, caller responcible for freeing it.
* return 0 on success
*/
int
dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
{
const struct cred *saved_cred;
int rc = -EAGAIN;
struct key *rkey = ERR_PTR(-EAGAIN);
char *name;
char *data = NULL;
int len;
if (!ip_addr || !unc)
return -EINVAL;
/* search for server name delimiter */
len = strlen(unc);
if (len < 3) {
cFYI(1, ("%s: unc is too short: %s", __func__, unc));
return -EINVAL;
}
len -= 2;
name = memchr(unc+2, '\\', len);
if (!name) {
cFYI(1, ("%s: probably server name is whole unc: %s",
__func__, unc));
} else {
len = (name - unc) - 2/* leading // */;
}
name = kmalloc(len+1, GFP_KERNEL);
if (!name) {
rc = -ENOMEM;
return rc;
}
memcpy(name, unc+2, len);
name[len] = 0;
if (is_ip(name)) {
cFYI(1, ("%s: it is IP, skipping dns upcall: %s",
__func__, name));
data = name;
goto skip_upcall;
}
saved_cred = override_creds(dns_resolver_cache);
rkey = request_key(&key_type_dns_resolver, name, "");
revert_creds(saved_cred);
if (!IS_ERR(rkey)) {
if (!(rkey->perm & KEY_USR_VIEW)) {
down_read(&rkey->sem);
rkey->perm |= KEY_USR_VIEW;
up_read(&rkey->sem);
}
len = rkey->type_data.x[0];
data = rkey->payload.data;
} else {
cERROR(1, ("%s: unable to resolve: %s", __func__, name));
goto out;
}
skip_upcall:
if (data) {
*ip_addr = kmalloc(len + 1, GFP_KERNEL);
if (*ip_addr) {
memcpy(*ip_addr, data, len + 1);
if (!IS_ERR(rkey))
cFYI(1, ("%s: resolved: %s to %s", __func__,
name,
*ip_addr
));
rc = 0;
} else {
rc = -ENOMEM;
}
if (!IS_ERR(rkey))
key_put(rkey);
}
out:
kfree(name);
return rc;
}
int _f2fs_get_encryption_info(struct inode *inode)
{
struct f2fs_inode_info *fi = F2FS_I(inode);
struct f2fs_crypt_info *crypt_info;
char full_key_descriptor[F2FS_KEY_DESC_PREFIX_SIZE +
(F2FS_KEY_DESCRIPTOR_SIZE * 2) + 1];
struct key *keyring_key = NULL;
struct f2fs_encryption_key *master_key;
struct f2fs_encryption_context ctx;
const struct user_key_payload *ukp;
struct crypto_ablkcipher *ctfm;
const char *cipher_str;
char raw_key[F2FS_MAX_KEY_SIZE];
char mode;
int res;
res = f2fs_crypto_initialize();
if (res)
return res;
retry:
crypt_info = ACCESS_ONCE(fi->i_crypt_info);
if (crypt_info) {
if (!crypt_info->ci_keyring_key ||
key_validate(crypt_info->ci_keyring_key) == 0)
return 0;
f2fs_free_encryption_info(inode, crypt_info);
goto retry;
}
res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION,
F2FS_XATTR_NAME_ENCRYPTION_CONTEXT,
&ctx, sizeof(ctx), NULL);
if (res < 0)
return res;
else if (res != sizeof(ctx))
return -EINVAL;
res = 0;
crypt_info = kmem_cache_alloc(f2fs_crypt_info_cachep, GFP_NOFS);
if (!crypt_info)
return -ENOMEM;
crypt_info->ci_flags = ctx.flags;
crypt_info->ci_data_mode = ctx.contents_encryption_mode;
crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
crypt_info->ci_ctfm = NULL;
crypt_info->ci_keyring_key = NULL;
memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
sizeof(crypt_info->ci_master_key));
if (S_ISREG(inode->i_mode))
mode = crypt_info->ci_data_mode;
else if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
mode = crypt_info->ci_filename_mode;
else
BUG();
switch (mode) {
case F2FS_ENCRYPTION_MODE_AES_256_XTS:
cipher_str = "xts(aes)";
break;
case F2FS_ENCRYPTION_MODE_AES_256_CTS:
cipher_str = "cts(cbc(aes))";
break;
default:
printk_once(KERN_WARNING
"f2fs: unsupported key mode %d (ino %u)\n",
mode, (unsigned) inode->i_ino);
res = -ENOKEY;
goto out;
}
memcpy(full_key_descriptor, F2FS_KEY_DESC_PREFIX,
F2FS_KEY_DESC_PREFIX_SIZE);
sprintf(full_key_descriptor + F2FS_KEY_DESC_PREFIX_SIZE,
"%*phN", F2FS_KEY_DESCRIPTOR_SIZE,
ctx.master_key_descriptor);
full_key_descriptor[F2FS_KEY_DESC_PREFIX_SIZE +
(2 * F2FS_KEY_DESCRIPTOR_SIZE)] = '\0';
keyring_key = request_key(&key_type_logon, full_key_descriptor, NULL);
if (IS_ERR(keyring_key)) {
res = PTR_ERR(keyring_key);
keyring_key = NULL;
goto out;
}
crypt_info->ci_keyring_key = keyring_key;
BUG_ON(keyring_key->type != &key_type_logon);
ukp = user_key_payload(keyring_key);
if (ukp->datalen != sizeof(struct f2fs_encryption_key)) {
res = -EINVAL;
goto out;
}
master_key = (struct f2fs_encryption_key *)ukp->data;
BUILD_BUG_ON(F2FS_AES_128_ECB_KEY_SIZE !=
F2FS_KEY_DERIVATION_NONCE_SIZE);
BUG_ON(master_key->size != F2FS_AES_256_XTS_KEY_SIZE);
res = f2fs_derive_key_aes(ctx.nonce, master_key->raw,
raw_key);
if (res)
goto out;
ctfm = crypto_alloc_ablkcipher(cipher_str, 0, 0);
if (!ctfm || IS_ERR(ctfm)) {
res = ctfm ? PTR_ERR(ctfm) : -ENOMEM;
printk(KERN_DEBUG
"%s: error %d (inode %u) allocating crypto tfm\n",
__func__, res, (unsigned) inode->i_ino);
goto out;
}
crypt_info->ci_ctfm = ctfm;
crypto_ablkcipher_clear_flags(ctfm, ~0);
crypto_tfm_set_flags(crypto_ablkcipher_tfm(ctfm),
CRYPTO_TFM_REQ_WEAK_KEY);
res = crypto_ablkcipher_setkey(ctfm, raw_key,
f2fs_encryption_key_size(mode));
if (res)
goto out;
memzero_explicit(raw_key, sizeof(raw_key));
if (cmpxchg(&fi->i_crypt_info, NULL, crypt_info) != NULL) {
f2fs_free_crypt_info(crypt_info);
goto retry;
}
return 0;
out:
if (res == -ENOKEY && !S_ISREG(inode->i_mode))
res = 0;
f2fs_free_crypt_info(crypt_info);
memzero_explicit(raw_key, sizeof(raw_key));
return res;
}