|
|
1.1 root 1: /*
2: Copyright (c) 2004-2005 TrueCrypt Foundation. All rights reserved.
3:
4: Covered by TrueCrypt License 2.0 the full text of which is contained in the file
5: License.txt included in TrueCrypt binary and source code distribution archives.
6: */
7:
8: #include <linux/bio.h>
9: #include <linux/ctype.h>
10: #include <linux/init.h>
11: #include <linux/module.h>
12: #include <linux/moduleparam.h>
13: #include <linux/version.h>
14: #include <linux/workqueue.h>
15:
16: #include "dm.h"
17:
18: #include "Tcdefs.h"
19: #include "Crypto.h"
20: #include "Tests.h"
21: #include "Dm-target.h"
22:
23: #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,5)
24: #error Linux kernel 2.6.5 or later required
25: #endif
26:
27: int trace_level = 0;
28:
29: #define MSG_PREFIX "truecrypt: "
30: #define error(fmt, args...) printk(KERN_ERR MSG_PREFIX fmt, ## args)
31: #define trace(level, fmt, args...) level <= trace_level && printk(KERN_DEBUG MSG_PREFIX fmt, ## args)
32: #define dbg(fmt, args...) printk(KERN_DEBUG MSG_PREFIX fmt, ## args)
33:
34: #define MIN_POOL_SIZE 16
35:
36: struct target_ctx
37: {
38: struct dm_dev *dev;
39: sector_t start;
40: char *volume_path;
41: mempool_t *bio_ctx_pool;
42: mempool_t *pg_pool;
43: sector_t read_only_start;
44: sector_t read_only_end;
45: u64 mtime;
46: u64 atime;
47: int flags;
1.1.1.2 ! root 48: PCRYPTO_INFO ci;
1.1 root 49: };
50:
51: struct bio_ctx
52: {
53: struct dm_target *target;
54: struct bio *orig_bio;
55: atomic_t ref_count;
56: u64 crypto_sector;
57: int error;
58: struct work_struct work;
59: };
60:
61: static struct workqueue_struct *work_queue = NULL;
62: static kmem_cache_t *bio_ctx_cache = NULL;
63:
64: #define READ_ONLY(tc) (tc->flags & FLAG_READ_ONLY)
65: #define HID_VOL_PROT(tc) (tc->flags & FLAG_HIDDEN_VOLUME_PROTECTION)
66:
67:
68: static int hex2bin (char *hex_string, u8 *byte_buf, int max_length)
69: {
70: int i = 0, n;
71: char s[3];
72: s[2] = 0;
73:
74: trace (3, "hex2bin (%p, %p, %d)\n", hex_string, byte_buf, max_length);
75:
76: while (i < max_length
77: && (s[0] = *hex_string++)
78: && (s[1] = *hex_string++))
79: {
80: if (sscanf (s, "%x", &n) != 1)
81: return 0;
82: byte_buf[i++] = (u8) n;
83: }
84:
85: return i;
86: }
87:
88: #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12)
89: static void *mempool_alloc_pg (unsigned int gfp_mask, void *pool_data)
90: #else
91: static void *mempool_alloc_pg (int gfp_mask, void *pool_data)
92: #endif
93: {
94: trace (3, "mempool_alloc_pg (%d, %p)\n", gfp_mask, pool_data);
95: return alloc_page (gfp_mask);
96: }
97:
98:
99: static void mempool_free_pg (void *element, void *pool_data)
100: {
101: trace (3, "mempool_free_pg (%p, %p)\n", element, pool_data);
102: __free_page (element);
103: }
104:
105:
1.1.1.2 ! root 106: static void wipe_args (unsigned int argc, char **argv)
! 107: {
! 108: int i;
! 109: for (i = 0; i < argc; i++)
! 110: {
! 111: if (argv[i] != NULL)
! 112: burn (argv[i], strlen (argv[i]));
! 113: }
! 114: }
! 115:
! 116:
1.1 root 117: static int truecrypt_ctr (struct dm_target *ti, unsigned int argc, char **argv)
118: {
119: struct target_ctx *tc;
120: int key_size;
121: int error = -EINVAL;
122:
123: trace (3, "truecrypt_ctr (%p, %d, %p)\n", ti, argc, argv);
124:
1.1.1.2 ! root 125: if (argc != LAST_ARG + 1)
1.1 root 126: {
1.1.1.2 ! root 127: ti->error = "truecrypt: Usage: <start_sector> <sector_count> truecrypt <EA> <mode> <key> <key2/IV> <host_device> <sector_offset> <read_only_start> <read_only_end> <mtime> <atime> <flags> <volume_path>";
1.1 root 128: return -EINVAL;
129: }
130:
131: tc = kmalloc (sizeof (*tc), GFP_KERNEL);
132: if (tc == NULL)
133: {
134: ti->error = "truecrypt: Cannot allocate target context";
135: error = -ENOMEM;
136: goto err;
137: }
138: memset (tc, 0, sizeof (*tc));
139:
1.1.1.2 ! root 140: tc->ci = crypto_open ();
! 141: if (tc == NULL)
! 142: {
! 143: ti->error = "truecrypt: Cannot allocate crypto_info";
! 144: error = -ENOMEM;
! 145: goto err;
! 146: }
! 147:
1.1 root 148: tc->bio_ctx_pool = mempool_create (MIN_POOL_SIZE, mempool_alloc_slab, mempool_free_slab, bio_ctx_cache);
149: if (!tc->bio_ctx_pool)
150: {
151: ti->error = "truecrypt: Cannot create bio context memory pool";
152: error = -ENOMEM;
153: goto err;
154: }
155:
156: tc->pg_pool = mempool_create (MIN_POOL_SIZE, mempool_alloc_pg, mempool_free_pg, NULL);
157: if (!tc->pg_pool)
158: {
159: ti->error = "truecrypt: Cannot create page memory pool";
160: error = -ENOMEM;
161: goto err;
162: }
163:
164: if (sscanf (argv[ARG_SEC], SECTOR_FORMAT, &tc->start) != 1)
165: {
166: ti->error = "truecrypt: Invalid device sector";
167: goto err;
168: }
169:
170: if (dm_get_device (ti, argv[ARG_DEV], tc->start, ti->len, dm_table_get_mode (ti->table), &tc->dev))
171: {
172: ti->error = "truecrypt: Device lookup failed";
173: goto err;
174: }
175:
176: // Encryption algorithm
1.1.1.2 ! root 177: tc->ci->ea = 0;
! 178: if (sscanf (argv[ARG_EA], "%d", &tc->ci->ea) != 1
! 179: || tc->ci->ea < EAGetFirst ()
! 180: || tc->ci->ea > EAGetCount ())
1.1 root 181: {
182: ti->error = "truecrypt: Invalid encryption algorithm";
183: goto err;
184: }
185:
1.1.1.2 ! root 186: // Mode of operation
! 187: tc->ci->mode = 0;
! 188: if (sscanf (argv[ARG_MODE], "%d", &tc->ci->mode) != 1
! 189: || tc->ci->mode < 1
! 190: || tc->ci->mode >= INVALID_MODE)
1.1 root 191: {
1.1.1.2 ! root 192: ti->error = "truecrypt: Invalid mode of operation";
1.1 root 193: goto err;
194: }
195:
1.1.1.2 ! root 196: // Key
! 197: key_size = EAGetKeySize (tc->ci->ea);
! 198: if (hex2bin (argv[ARG_KEY], tc->ci->master_key, key_size) != key_size)
1.1 root 199: {
200: ti->error = "truecrypt: Invalid key";
201: goto err;
202: }
1.1.1.2 ! root 203:
! 204: // EA init
! 205: trace (2, "EAInit (%d, %p, %p)\n", tc->ci->ea, tc->ci->master_key, tc->ci->ks);
! 206: if (EAInit (tc->ci->ea, tc->ci->master_key, tc->ci->ks) == ERR_CIPHER_INIT_FAILURE)
1.1 root 207: {
1.1.1.2 ! root 208: ti->error = "truecrypt: Encryption algorithm initialization failed";
1.1 root 209: goto err;
210: }
211:
1.1.1.2 ! root 212: // Key2 / IV
! 213: if (hex2bin (argv[ARG_IV], tc->ci->iv, sizeof (tc->ci->iv)) != sizeof (tc->ci->iv))
1.1 root 214: {
215: ti->error = "truecrypt: Invalid IV";
216: goto err;
217: }
218:
1.1.1.2 ! root 219: // Mode init
! 220: if (!EAInitMode (tc->ci))
! 221: {
! 222: ti->error = "truecrypt: Mode of operation initialization failed";
! 223: goto err;
! 224: }
! 225:
1.1 root 226: // Read-only start sector
227: if (sscanf (argv[ARG_RO_START], SECTOR_FORMAT, &tc->read_only_start) != 1)
228: {
229: ti->error = "truecrypt: Invalid read-only start sector";
230: goto err;
231: }
232:
233: // Read-only end sector
234: if (sscanf (argv[ARG_RO_END], SECTOR_FORMAT, &tc->read_only_end) != 1)
235: {
236: ti->error = "truecrypt: Invalid read-only end sector";
237: goto err;
238: }
239:
240: // Modification time
241: if (sscanf (argv[ARG_MTIME], "%Ld", &tc->mtime) != 1)
242: {
243: ti->error = "truecrypt: Invalid modification time";
244: goto err;
245: }
246:
247: // Access time
248: if (sscanf (argv[ARG_ATIME], "%Ld", &tc->atime) != 1)
249: {
250: ti->error = "truecrypt: Invalid access time";
251: goto err;
252: }
253:
254: // Flags
255: if (sscanf (argv[ARG_FLAGS], "%d", &tc->flags) != 1)
256: {
257: ti->error = "truecrypt: Invalid flags";
258: goto err;
259: }
260:
261: // Volume path
262: tc->volume_path = kmalloc (strlen (argv[ARG_VOL]) + 1, GFP_KERNEL);
263: if (tc->volume_path == NULL)
264: {
265: ti->error = "truecrypt: Cannot allocate volume path buffer";
266: error = -ENOMEM;
267: goto err;
268: }
269: strcpy (tc->volume_path, argv[ARG_VOL]);
270:
1.1.1.2 ! root 271: // Hidden volume
! 272: if (tc->start > 1)
! 273: {
! 274: tc->ci->hiddenVolume = TRUE;
! 275: tc->ci->hiddenVolumeOffset = tc->start * SECTOR_SIZE;
! 276: }
! 277:
1.1 root 278: ti->private = tc;
1.1.1.2 ! root 279:
! 280: wipe_args (argc, argv);
1.1 root 281: return 0;
282:
283: err:
284: trace (3, "truecrypt_ctr: error\n");
285:
286: if (tc)
287: {
1.1.1.2 ! root 288: if (tc->ci)
! 289: crypto_close (tc->ci);
1.1 root 290: if (tc->volume_path)
291: kfree (tc->volume_path);
292: if (tc->bio_ctx_pool)
293: mempool_destroy (tc->bio_ctx_pool);
294: if (tc->pg_pool)
295: mempool_destroy (tc->pg_pool);
296: kfree (tc);
297: }
298:
1.1.1.2 ! root 299: wipe_args (argc, argv);
1.1 root 300: return error;
301: }
302:
303:
304: static void truecrypt_dtr (struct dm_target *ti)
305: {
306: struct target_ctx *tc = (struct target_ctx *) ti->private;
307:
308: trace (3, "truecrypt_dtr (%p)\n", ti);
309:
310: mempool_destroy (tc->bio_ctx_pool);
1.1.1.2 ! root 311: mempool_destroy (tc->pg_pool);
! 312: crypto_close (tc->ci);
1.1 root 313: kfree(tc->volume_path);
1.1.1.2 ! root 314: dm_put_device(ti, tc->dev);
1.1 root 315: kfree(tc);
316: }
317:
318:
319: // Checks if two regions overlap (borders are parts of regions)
320: static int RegionsOverlap (sector_t start1, sector_t end1, sector_t start2, sector_t end2)
321: {
322: return (start1 < start2) ? (end1 >= start2) : (start1 <= end2);
323: }
324:
325:
326: static void dereference_bio_ctx (struct bio_ctx *bc)
327: {
328: struct target_ctx *tc = (struct target_ctx *) bc->target->private;
329: trace (3, "dereference_bio_ctx (%p)\n", bc);
330:
331: if (!atomic_dec_and_test (&bc->ref_count))
332: return;
333:
334: bio_endio (bc->orig_bio, bc->orig_bio->bi_size, bc->error);
335: trace (3, "dereference_bio_ctx: mempool_free (%p)\n", bc);
336: mempool_free (bc, tc->bio_ctx_pool);
337: }
338:
339:
340: static void work_process (void *data)
341: {
342: struct bio_ctx *bc = (struct bio_ctx *) data;
343: struct target_ctx *tc = (struct target_ctx *) bc->target->private;
344: struct bio_vec *bv;
345: sector_t sec_no = bc->crypto_sector;
346: int seg_no;
347: unsigned long flags;
348:
349: trace (3, "work_process (%p)\n", data);
350:
351: // Decrypt queued data
352: bio_for_each_segment (bv, bc->orig_bio, seg_no)
353: {
354: unsigned int secs = bv->bv_len / SECTOR_SIZE;
355: char *data = bvec_kmap_irq (bv, &flags);
356:
357: trace (2, "DecryptSectors (%Ld, %d)\n", sec_no, secs);
1.1.1.2 ! root 358: DecryptSectors ((unsigned __int32 *)data, sec_no, secs, tc->ci);
1.1 root 359:
360: sec_no += secs;
361:
362: flush_dcache_page (bv->bv_page);
363: bvec_kunmap_irq (data, &flags);
364: }
365:
366: dereference_bio_ctx (bc);
367: }
368:
369:
370: static int truecrypt_endio (struct bio *bio, unsigned int bytes_done, int error)
371: {
372: struct bio_ctx *bc = (struct bio_ctx *) bio->bi_private;
373: struct target_ctx *tc = (struct target_ctx *) bc->target->private;
374: struct bio_vec *bv;
375: int seg_no;
376:
377: trace (3, "truecrypt_endio (%p, %d, %d)\n", bio, bytes_done, error);
378: trace (1, "end: sc=" SECTOR_FORMAT " fl=%ld rw=%ld sz=%d ix=%hd vc=%hd dn=%d er=%d\n",
379: bio->bi_sector, bio->bi_flags, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt, bytes_done, error);
380:
381: if (error != 0)
382: bc->error = error;
383:
384: if (bio->bi_size)
385: {
386: trace (2, "Outstanding IO: %d\n", bio->bi_size);
387: return 1;
388: }
389:
390: if (bio_data_dir (bio) == READ)
391: {
392: bio_put (bio);
393:
394: // Queue decryption to leave completion interrupt ASAP
395: INIT_WORK (&bc->work, work_process, bc);
396: trace (3, "queue_work (%p)\n", work_queue);
397: queue_work (work_queue, &bc->work);
398: return error;
399: }
400:
401: // Free pages allocated for encryption
402: bio_for_each_segment (bv, bio, seg_no)
403: {
404: trace (3, "mempool_free (%p, %p)\n", bv->bv_page, tc->pg_pool);
405: mempool_free (bv->bv_page, tc->pg_pool);
406: }
407:
408: bio_put (bio);
409: dereference_bio_ctx (bc);
410: return error;
411: }
412:
413:
414: static int truecrypt_map (struct dm_target *ti, struct bio *bio, union map_info *map_context)
415: {
416: struct target_ctx *tc = (struct target_ctx *) ti->private;
417: struct bio_ctx *bc;
418: struct bio *bion;
419: struct bio_vec *bv;
420: int seg_no;
421:
422: trace (3, "truecrypt_map (%p, %p, %p)\n", ti, bio, map_context);
423: trace (1, "map: sc=" SECTOR_FORMAT " fl=%ld rw=%ld sz=%d ix=%hd vc=%hd\n",
424: bio->bi_sector, bio->bi_flags, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt);
425:
426: // Write protection
427: if (bio_data_dir (bio) == WRITE && READ_ONLY (tc))
428: return -EPERM;
429:
430: // Validate segment sizes
431: bio_for_each_segment (bv, bio, seg_no)
432: {
433: if (bv->bv_len & (SECTOR_SIZE - 1))
434: {
435: error ("unsupported segment size %d (%ld %d %hd %hd)\n",
436: bv->bv_len, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt);
437: return -EINVAL;
438: }
439: }
440:
441: // Bio context
442: bc = mempool_alloc (tc->bio_ctx_pool, GFP_NOIO);
443: if (!bc)
444: {
445: error ("bio context allocation failed\n");
446: return -ENOMEM;
447: }
448: trace (3, "truecrypt_map: mempool_alloc bc: %p\n", bc);
449:
450: atomic_set (&bc->ref_count, 1);
451: bc->orig_bio = bio;
452: bc->error = 0;
453: bc->target = ti;
454: bc->crypto_sector = tc->start + (bio->bi_sector - ti->begin);
455:
456: // New bio for encrypted device
457: trace (3, "bio_alloc (%hd)\n", bio_segments (bio));
458: bion = bio_alloc (GFP_NOIO, bio_segments (bio));
459: if (!bion)
460: {
461: error ("bio allocation failed\n");
462: bc->error = -ENOMEM;
463: dereference_bio_ctx (bc);
464: return 0;
465: }
466:
467: bion->bi_bdev = tc->dev->bdev;
468: bion->bi_end_io = truecrypt_endio;
469: bion->bi_idx = 0;
470: bion->bi_private = bc;
471: bion->bi_rw = bio->bi_rw;
472: bion->bi_sector = bc->crypto_sector;
473: bion->bi_size = bio->bi_size;
474: bion->bi_vcnt = bio_segments (bio);
475:
476: if (bio_data_dir (bio) == READ)
477: {
478: // Buffers of originating bio can be used for decryption
479: memcpy (bion->bi_io_vec,
480: bio_iovec (bio),
481: bion->bi_vcnt * sizeof (struct bio_vec));
482: }
483: else
484: {
485: // Encrypt data to be written
486: unsigned long flags, copyFlags;
487: char *data, *copy;
488: long long sec_no = bc->crypto_sector;
489:
490: memset (bion->bi_io_vec, 0, sizeof (struct bio_vec) * bion->bi_vcnt);
491:
492: bio_for_each_segment (bv, bio, seg_no)
493: {
494: struct bio_vec *cbv = bio_iovec_idx (bion, seg_no);
495: unsigned int secs = bv->bv_len / SECTOR_SIZE;
496:
497: // Hidden volume protection
498: if (!READ_ONLY (tc) && HID_VOL_PROT (tc)
499: && RegionsOverlap (sec_no, sec_no + secs - 1, tc->read_only_start, tc->read_only_end))
500: {
501: tc->flags |= FLAG_READ_ONLY | FLAG_PROTECTION_ACTIVATED;
502: }
503:
504: if (!READ_ONLY (tc))
505: {
506: cbv->bv_page = mempool_alloc (tc->pg_pool, GFP_NOIO);
507: if (cbv->bv_page == NULL)
508: error ("page allocation failed during write\n");
509: }
510:
511: if (READ_ONLY (tc) || cbv->bv_page == NULL)
512: {
513: // Write not permitted or no memory
514: bio_for_each_segment (cbv, bion, seg_no)
515: {
516: if (cbv->bv_page != NULL)
517: mempool_free (cbv->bv_page, tc->pg_pool);
518: }
519:
520: bio_put (bion);
521: bc->error = READ_ONLY (tc) ? -EPERM : -ENOMEM;
522: dereference_bio_ctx (bc);
523: return 0;
524: }
525: trace (3, "truecrypt_map: mempool_alloc pg: %p\n", cbv->bv_page);
526:
527: cbv->bv_offset = 0;
528: cbv->bv_len = bv->bv_len;
529:
530: data = bvec_kmap_irq (bv, &flags);
531: copy = bvec_kmap_irq (cbv, ©Flags);
532:
533: memcpy (copy, data, bv->bv_len);
534:
535: flush_dcache_page (bv->bv_page);
536: bvec_kunmap_irq (data, &flags);
537:
538: trace (2, "EncryptSectors (%Ld, %d)\n", sec_no, secs);
539:
1.1.1.2 ! root 540: EncryptSectors ((unsigned __int32 *)copy, sec_no, secs, tc->ci);
1.1 root 541: sec_no += secs;
542:
543: flush_dcache_page (cbv->bv_page);
544: bvec_kunmap_irq (copy, ©Flags);
545: }
546: }
547:
548: atomic_inc (&bc->ref_count);
549:
550: trace (3, "generic_make_request (rw=%ld sc=" SECTOR_FORMAT ")\n", bion->bi_rw, bion->bi_sector);
551: generic_make_request (bion);
552:
553: dereference_bio_ctx (bc);
554: return 0;
555: }
556:
557:
558: static int truecrypt_status (struct dm_target *ti, status_type_t type, char *result, unsigned int maxlen)
559: {
560: struct target_ctx *tc = (struct target_ctx *) ti->private;
561:
562: switch (type)
563: {
564: case STATUSTYPE_INFO:
565: result[0] = 0;
566: break;
567:
568: case STATUSTYPE_TABLE:
569: {
570: char name[32];
571: format_dev_t (name, tc->dev->bdev->bd_dev);
1.1.1.2 ! root 572: snprintf (result, maxlen, "%d %d 0 0 %s " SECTOR_FORMAT " " SECTOR_FORMAT " " SECTOR_FORMAT " %Ld %Ld %d %s",
! 573: tc->ci->ea,
! 574: tc->ci->mode,
1.1 root 575: name,
576: tc->start,
577: tc->read_only_start,
578: tc->read_only_end,
579: tc->mtime,
580: tc->atime,
581: tc->flags,
582: tc->volume_path);
583: }
584: break;
585: }
586:
587: return 0;
588: }
589:
590:
591: static struct target_type truecrypt_target = {
592: .name = "truecrypt",
593: .version= {VERSION_NUM1, VERSION_NUM2, VERSION_NUM3},
594: .module = THIS_MODULE,
595: .ctr = truecrypt_ctr,
596: .dtr = truecrypt_dtr,
597: .map = truecrypt_map,
598: .status = truecrypt_status
599: };
600:
601:
602: int __init dm_truecrypt_init(void)
603: {
604: int r;
605: trace (3, "dm_truecrypt_init (trace_level=%d)\n", trace_level);
606:
607: if (!AutoTestAlgorithms ())
608: {
609: DMERR ("truecrypt: self-test of algorithms failed");
610: return -ERANGE;
611: }
612:
613: work_queue = create_workqueue ("truecryptq");
614:
615: if (!work_queue)
616: {
617: DMERR ("truecrypt: create_workqueue creation failed");
618: goto err;
619: }
620:
621: bio_ctx_cache = kmem_cache_create ("truecrypt-bioctx", sizeof (struct bio_ctx), 0, 0, NULL, NULL);
622: if (!bio_ctx_cache)
623: {
624: DMERR ("truecrypt: kmem_cache_create failed");
625: goto err;
626: }
627:
628: r = dm_register_target (&truecrypt_target);
629: if (r < 0)
630: {
631: DMERR ("truecrypt: register failed %d", r);
632: goto err;
633: }
634:
635: return r;
636:
637: err:
638: if (work_queue)
639: destroy_workqueue (work_queue);
640: if (bio_ctx_cache)
641: kmem_cache_destroy (bio_ctx_cache);
642:
643: return -ENOMEM;
644: }
645:
646:
647: void __exit dm_truecrypt_exit(void)
648: {
649: int r;
650: trace (3, "dm_truecrypt_exit ()\n");
651:
652: r = dm_unregister_target (&truecrypt_target);
653:
654: if (r < 0)
655: DMERR ("truecrypt: unregister failed %d", r);
656:
657: destroy_workqueue (work_queue);
658: kmem_cache_destroy (bio_ctx_cache);
659: }
660:
661:
662: module_init(dm_truecrypt_init);
663: module_exit(dm_truecrypt_exit);
664: module_param_named(trace, trace_level, int, 0);
665:
666: MODULE_AUTHOR("TrueCrypt Foundation");
667: MODULE_DESCRIPTION(DM_NAME " target for encryption and decryption of TrueCrypt volumes");
668: MODULE_PARM_DESC(trace, "Trace level");
669: MODULE_LICENSE("GPL and additional rights"); // Kernel thinks only GPL/BSD/MPL != closed-source code
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.