|
|
1.1 root 1: /* 1.1.1.3 ! root 2: Copyright (c) 2004-2006 TrueCrypt Foundation. All rights reserved. 1.1 root 3: 4: Covered by TrueCrypt License 2.0 the full text of which is contained in the file 5: License.txt included in TrueCrypt binary and source code distribution archives. 6: */ 7: 8: #include <linux/bio.h> 9: #include <linux/ctype.h> 10: #include <linux/init.h> 11: #include <linux/module.h> 12: #include <linux/moduleparam.h> 13: #include <linux/version.h> 14: #include <linux/workqueue.h> 15: 16: #include "dm.h" 17: 18: #include "Tcdefs.h" 19: #include "Crypto.h" 20: #include "Tests.h" 21: #include "Dm-target.h" 22: 23: #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,5) 24: #error Linux kernel 2.6.5 or later required 25: #endif 26: 27: int trace_level = 0; 28: 29: #define MSG_PREFIX "truecrypt: " 30: #define error(fmt, args...) printk(KERN_ERR MSG_PREFIX fmt, ## args) 31: #define trace(level, fmt, args...) level <= trace_level && printk(KERN_DEBUG MSG_PREFIX fmt, ## args) 32: #define dbg(fmt, args...) printk(KERN_DEBUG MSG_PREFIX fmt, ## args) 33: 34: #define MIN_POOL_SIZE 16 35: 36: struct target_ctx 37: { 38: struct dm_dev *dev; 39: sector_t start; 40: char *volume_path; 41: mempool_t *bio_ctx_pool; 42: mempool_t *pg_pool; 43: sector_t read_only_start; 44: sector_t read_only_end; 45: u64 mtime; 46: u64 atime; 47: int flags; 1.1.1.2 root 48: PCRYPTO_INFO ci; 1.1 root 49: }; 50: 51: struct bio_ctx 52: { 53: struct dm_target *target; 54: struct bio *orig_bio; 55: atomic_t ref_count; 56: u64 crypto_sector; 57: int error; 58: struct work_struct work; 59: }; 60: 61: static struct workqueue_struct *work_queue = NULL; 62: static kmem_cache_t *bio_ctx_cache = NULL; 63: 64: #define READ_ONLY(tc) (tc->flags & FLAG_READ_ONLY) 65: #define HID_VOL_PROT(tc) (tc->flags & FLAG_HIDDEN_VOLUME_PROTECTION) 66: 67: 68: static int hex2bin (char *hex_string, u8 *byte_buf, int max_length) 69: { 70: int i = 0, n; 71: char s[3]; 72: s[2] = 0; 73: 74: trace (3, "hex2bin (%p, %p, %d)\n", hex_string, byte_buf, max_length); 75: 76: while (i < max_length 77: && (s[0] = *hex_string++) 78: && (s[1] = *hex_string++)) 79: { 80: if (sscanf (s, "%x", &n) != 1) 81: return 0; 82: byte_buf[i++] = (u8) n; 83: } 84: 85: return i; 86: } 87: 88: #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,12) 89: static void *mempool_alloc_pg (unsigned int gfp_mask, void *pool_data) 90: #else 91: static void *mempool_alloc_pg (int gfp_mask, void *pool_data) 92: #endif 93: { 94: trace (3, "mempool_alloc_pg (%d, %p)\n", gfp_mask, pool_data); 95: return alloc_page (gfp_mask); 96: } 97: 98: 99: static void mempool_free_pg (void *element, void *pool_data) 100: { 101: trace (3, "mempool_free_pg (%p, %p)\n", element, pool_data); 102: __free_page (element); 103: } 104: 105: 1.1.1.2 root 106: static void wipe_args (unsigned int argc, char **argv) 107: { 108: int i; 109: for (i = 0; i < argc; i++) 110: { 111: if (argv[i] != NULL) 112: burn (argv[i], strlen (argv[i])); 113: } 114: } 115: 116: 1.1 root 117: static int truecrypt_ctr (struct dm_target *ti, unsigned int argc, char **argv) 118: { 119: struct target_ctx *tc; 120: int key_size; 121: int error = -EINVAL; 122: 123: trace (3, "truecrypt_ctr (%p, %d, %p)\n", ti, argc, argv); 124: 1.1.1.2 root 125: if (argc != LAST_ARG + 1) 1.1 root 126: { 1.1.1.2 root 127: ti->error = "truecrypt: Usage: <start_sector> <sector_count> truecrypt <EA> <mode> <key> <key2/IV> <host_device> <sector_offset> <read_only_start> <read_only_end> <mtime> <atime> <flags> <volume_path>"; 1.1 root 128: return -EINVAL; 129: } 130: 131: tc = kmalloc (sizeof (*tc), GFP_KERNEL); 132: if (tc == NULL) 133: { 134: ti->error = "truecrypt: Cannot allocate target context"; 135: error = -ENOMEM; 136: goto err; 137: } 138: memset (tc, 0, sizeof (*tc)); 139: 1.1.1.2 root 140: tc->ci = crypto_open (); 141: if (tc == NULL) 142: { 143: ti->error = "truecrypt: Cannot allocate crypto_info"; 144: error = -ENOMEM; 145: goto err; 146: } 147: 1.1 root 148: tc->bio_ctx_pool = mempool_create (MIN_POOL_SIZE, mempool_alloc_slab, mempool_free_slab, bio_ctx_cache); 149: if (!tc->bio_ctx_pool) 150: { 151: ti->error = "truecrypt: Cannot create bio context memory pool"; 152: error = -ENOMEM; 153: goto err; 154: } 155: 156: tc->pg_pool = mempool_create (MIN_POOL_SIZE, mempool_alloc_pg, mempool_free_pg, NULL); 157: if (!tc->pg_pool) 158: { 159: ti->error = "truecrypt: Cannot create page memory pool"; 160: error = -ENOMEM; 161: goto err; 162: } 163: 164: if (sscanf (argv[ARG_SEC], SECTOR_FORMAT, &tc->start) != 1) 165: { 166: ti->error = "truecrypt: Invalid device sector"; 167: goto err; 168: } 169: 170: if (dm_get_device (ti, argv[ARG_DEV], tc->start, ti->len, dm_table_get_mode (ti->table), &tc->dev)) 171: { 172: ti->error = "truecrypt: Device lookup failed"; 173: goto err; 174: } 175: 176: // Encryption algorithm 1.1.1.2 root 177: tc->ci->ea = 0; 178: if (sscanf (argv[ARG_EA], "%d", &tc->ci->ea) != 1 179: || tc->ci->ea < EAGetFirst () 180: || tc->ci->ea > EAGetCount ()) 1.1 root 181: { 182: ti->error = "truecrypt: Invalid encryption algorithm"; 183: goto err; 184: } 185: 1.1.1.2 root 186: // Mode of operation 187: tc->ci->mode = 0; 188: if (sscanf (argv[ARG_MODE], "%d", &tc->ci->mode) != 1 189: || tc->ci->mode < 1 190: || tc->ci->mode >= INVALID_MODE) 1.1 root 191: { 1.1.1.2 root 192: ti->error = "truecrypt: Invalid mode of operation"; 1.1 root 193: goto err; 194: } 195: 1.1.1.2 root 196: // Key 197: key_size = EAGetKeySize (tc->ci->ea); 198: if (hex2bin (argv[ARG_KEY], tc->ci->master_key, key_size) != key_size) 1.1 root 199: { 200: ti->error = "truecrypt: Invalid key"; 201: goto err; 202: } 1.1.1.2 root 203: 204: // EA init 205: trace (2, "EAInit (%d, %p, %p)\n", tc->ci->ea, tc->ci->master_key, tc->ci->ks); 206: if (EAInit (tc->ci->ea, tc->ci->master_key, tc->ci->ks) == ERR_CIPHER_INIT_FAILURE) 1.1 root 207: { 1.1.1.2 root 208: ti->error = "truecrypt: Encryption algorithm initialization failed"; 1.1 root 209: goto err; 210: } 211: 1.1.1.2 root 212: // Key2 / IV 213: if (hex2bin (argv[ARG_IV], tc->ci->iv, sizeof (tc->ci->iv)) != sizeof (tc->ci->iv)) 1.1 root 214: { 215: ti->error = "truecrypt: Invalid IV"; 216: goto err; 217: } 218: 1.1.1.2 root 219: // Mode init 220: if (!EAInitMode (tc->ci)) 221: { 222: ti->error = "truecrypt: Mode of operation initialization failed"; 223: goto err; 224: } 225: 1.1 root 226: // Read-only start sector 227: if (sscanf (argv[ARG_RO_START], SECTOR_FORMAT, &tc->read_only_start) != 1) 228: { 229: ti->error = "truecrypt: Invalid read-only start sector"; 230: goto err; 231: } 232: 233: // Read-only end sector 234: if (sscanf (argv[ARG_RO_END], SECTOR_FORMAT, &tc->read_only_end) != 1) 235: { 236: ti->error = "truecrypt: Invalid read-only end sector"; 237: goto err; 238: } 239: 240: // Modification time 241: if (sscanf (argv[ARG_MTIME], "%Ld", &tc->mtime) != 1) 242: { 243: ti->error = "truecrypt: Invalid modification time"; 244: goto err; 245: } 246: 247: // Access time 248: if (sscanf (argv[ARG_ATIME], "%Ld", &tc->atime) != 1) 249: { 250: ti->error = "truecrypt: Invalid access time"; 251: goto err; 252: } 253: 254: // Flags 255: if (sscanf (argv[ARG_FLAGS], "%d", &tc->flags) != 1) 256: { 257: ti->error = "truecrypt: Invalid flags"; 258: goto err; 259: } 260: 261: // Volume path 262: tc->volume_path = kmalloc (strlen (argv[ARG_VOL]) + 1, GFP_KERNEL); 263: if (tc->volume_path == NULL) 264: { 265: ti->error = "truecrypt: Cannot allocate volume path buffer"; 266: error = -ENOMEM; 267: goto err; 268: } 269: strcpy (tc->volume_path, argv[ARG_VOL]); 270: 1.1.1.2 root 271: // Hidden volume 272: if (tc->start > 1) 273: { 274: tc->ci->hiddenVolume = TRUE; 275: tc->ci->hiddenVolumeOffset = tc->start * SECTOR_SIZE; 276: } 277: 1.1 root 278: ti->private = tc; 1.1.1.2 root 279: 280: wipe_args (argc, argv); 1.1 root 281: return 0; 282: 283: err: 284: trace (3, "truecrypt_ctr: error\n"); 285: 286: if (tc) 287: { 1.1.1.2 root 288: if (tc->ci) 289: crypto_close (tc->ci); 1.1 root 290: if (tc->volume_path) 291: kfree (tc->volume_path); 292: if (tc->bio_ctx_pool) 293: mempool_destroy (tc->bio_ctx_pool); 294: if (tc->pg_pool) 295: mempool_destroy (tc->pg_pool); 296: kfree (tc); 297: } 298: 1.1.1.2 root 299: wipe_args (argc, argv); 1.1 root 300: return error; 301: } 302: 303: 304: static void truecrypt_dtr (struct dm_target *ti) 305: { 306: struct target_ctx *tc = (struct target_ctx *) ti->private; 307: 308: trace (3, "truecrypt_dtr (%p)\n", ti); 309: 310: mempool_destroy (tc->bio_ctx_pool); 1.1.1.2 root 311: mempool_destroy (tc->pg_pool); 312: crypto_close (tc->ci); 1.1 root 313: kfree(tc->volume_path); 1.1.1.2 root 314: dm_put_device(ti, tc->dev); 1.1 root 315: kfree(tc); 316: } 317: 318: 319: // Checks if two regions overlap (borders are parts of regions) 320: static int RegionsOverlap (sector_t start1, sector_t end1, sector_t start2, sector_t end2) 321: { 322: return (start1 < start2) ? (end1 >= start2) : (start1 <= end2); 323: } 324: 325: 326: static void dereference_bio_ctx (struct bio_ctx *bc) 327: { 328: struct target_ctx *tc = (struct target_ctx *) bc->target->private; 329: trace (3, "dereference_bio_ctx (%p)\n", bc); 330: 331: if (!atomic_dec_and_test (&bc->ref_count)) 332: return; 333: 334: bio_endio (bc->orig_bio, bc->orig_bio->bi_size, bc->error); 335: trace (3, "dereference_bio_ctx: mempool_free (%p)\n", bc); 336: mempool_free (bc, tc->bio_ctx_pool); 337: } 338: 339: 340: static void work_process (void *data) 341: { 342: struct bio_ctx *bc = (struct bio_ctx *) data; 343: struct target_ctx *tc = (struct target_ctx *) bc->target->private; 344: struct bio_vec *bv; 345: sector_t sec_no = bc->crypto_sector; 346: int seg_no; 347: unsigned long flags; 348: 349: trace (3, "work_process (%p)\n", data); 350: 351: // Decrypt queued data 352: bio_for_each_segment (bv, bc->orig_bio, seg_no) 353: { 354: unsigned int secs = bv->bv_len / SECTOR_SIZE; 355: char *data = bvec_kmap_irq (bv, &flags); 356: 357: trace (2, "DecryptSectors (%Ld, %d)\n", sec_no, secs); 1.1.1.2 root 358: DecryptSectors ((unsigned __int32 *)data, sec_no, secs, tc->ci); 1.1 root 359: 360: sec_no += secs; 361: 362: flush_dcache_page (bv->bv_page); 363: bvec_kunmap_irq (data, &flags); 364: } 365: 366: dereference_bio_ctx (bc); 367: } 368: 369: 370: static int truecrypt_endio (struct bio *bio, unsigned int bytes_done, int error) 371: { 372: struct bio_ctx *bc = (struct bio_ctx *) bio->bi_private; 373: struct target_ctx *tc = (struct target_ctx *) bc->target->private; 374: struct bio_vec *bv; 375: int seg_no; 376: 377: trace (3, "truecrypt_endio (%p, %d, %d)\n", bio, bytes_done, error); 378: trace (1, "end: sc=" SECTOR_FORMAT " fl=%ld rw=%ld sz=%d ix=%hd vc=%hd dn=%d er=%d\n", 379: bio->bi_sector, bio->bi_flags, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt, bytes_done, error); 380: 381: if (error != 0) 382: bc->error = error; 383: 384: if (bio->bi_size) 385: { 386: trace (2, "Outstanding IO: %d\n", bio->bi_size); 387: return 1; 388: } 389: 390: if (bio_data_dir (bio) == READ) 391: { 392: bio_put (bio); 393: 394: // Queue decryption to leave completion interrupt ASAP 395: INIT_WORK (&bc->work, work_process, bc); 396: trace (3, "queue_work (%p)\n", work_queue); 397: queue_work (work_queue, &bc->work); 398: return error; 399: } 400: 401: // Free pages allocated for encryption 402: bio_for_each_segment (bv, bio, seg_no) 403: { 404: trace (3, "mempool_free (%p, %p)\n", bv->bv_page, tc->pg_pool); 405: mempool_free (bv->bv_page, tc->pg_pool); 406: } 407: 408: bio_put (bio); 409: dereference_bio_ctx (bc); 410: return error; 411: } 412: 413: 414: static int truecrypt_map (struct dm_target *ti, struct bio *bio, union map_info *map_context) 415: { 416: struct target_ctx *tc = (struct target_ctx *) ti->private; 417: struct bio_ctx *bc; 418: struct bio *bion; 419: struct bio_vec *bv; 420: int seg_no; 421: 422: trace (3, "truecrypt_map (%p, %p, %p)\n", ti, bio, map_context); 423: trace (1, "map: sc=" SECTOR_FORMAT " fl=%ld rw=%ld sz=%d ix=%hd vc=%hd\n", 424: bio->bi_sector, bio->bi_flags, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt); 425: 426: // Write protection 427: if (bio_data_dir (bio) == WRITE && READ_ONLY (tc)) 428: return -EPERM; 429: 430: // Validate segment sizes 431: bio_for_each_segment (bv, bio, seg_no) 432: { 433: if (bv->bv_len & (SECTOR_SIZE - 1)) 434: { 435: error ("unsupported segment size %d (%ld %d %hd %hd)\n", 436: bv->bv_len, bio->bi_rw, bio->bi_size, bio->bi_idx, bio->bi_vcnt); 437: return -EINVAL; 438: } 439: } 440: 441: // Bio context 442: bc = mempool_alloc (tc->bio_ctx_pool, GFP_NOIO); 443: if (!bc) 444: { 445: error ("bio context allocation failed\n"); 446: return -ENOMEM; 447: } 448: trace (3, "truecrypt_map: mempool_alloc bc: %p\n", bc); 449: 450: atomic_set (&bc->ref_count, 1); 451: bc->orig_bio = bio; 452: bc->error = 0; 453: bc->target = ti; 454: bc->crypto_sector = tc->start + (bio->bi_sector - ti->begin); 455: 456: // New bio for encrypted device 457: trace (3, "bio_alloc (%hd)\n", bio_segments (bio)); 458: bion = bio_alloc (GFP_NOIO, bio_segments (bio)); 459: if (!bion) 460: { 461: error ("bio allocation failed\n"); 462: bc->error = -ENOMEM; 463: dereference_bio_ctx (bc); 464: return 0; 465: } 466: 467: bion->bi_bdev = tc->dev->bdev; 468: bion->bi_end_io = truecrypt_endio; 469: bion->bi_idx = 0; 470: bion->bi_private = bc; 471: bion->bi_rw = bio->bi_rw; 472: bion->bi_sector = bc->crypto_sector; 473: bion->bi_size = bio->bi_size; 474: bion->bi_vcnt = bio_segments (bio); 475: 476: if (bio_data_dir (bio) == READ) 477: { 478: // Buffers of originating bio can be used for decryption 479: memcpy (bion->bi_io_vec, 480: bio_iovec (bio), 481: bion->bi_vcnt * sizeof (struct bio_vec)); 482: } 483: else 484: { 485: // Encrypt data to be written 486: unsigned long flags, copyFlags; 487: char *data, *copy; 488: long long sec_no = bc->crypto_sector; 489: 490: memset (bion->bi_io_vec, 0, sizeof (struct bio_vec) * bion->bi_vcnt); 491: 492: bio_for_each_segment (bv, bio, seg_no) 493: { 494: struct bio_vec *cbv = bio_iovec_idx (bion, seg_no); 495: unsigned int secs = bv->bv_len / SECTOR_SIZE; 496: 497: // Hidden volume protection 498: if (!READ_ONLY (tc) && HID_VOL_PROT (tc) 499: && RegionsOverlap (sec_no, sec_no + secs - 1, tc->read_only_start, tc->read_only_end)) 500: { 501: tc->flags |= FLAG_READ_ONLY | FLAG_PROTECTION_ACTIVATED; 502: } 503: 504: if (!READ_ONLY (tc)) 505: { 506: cbv->bv_page = mempool_alloc (tc->pg_pool, GFP_NOIO); 507: if (cbv->bv_page == NULL) 508: error ("page allocation failed during write\n"); 509: } 510: 511: if (READ_ONLY (tc) || cbv->bv_page == NULL) 512: { 513: // Write not permitted or no memory 514: bio_for_each_segment (cbv, bion, seg_no) 515: { 516: if (cbv->bv_page != NULL) 517: mempool_free (cbv->bv_page, tc->pg_pool); 518: } 519: 520: bio_put (bion); 521: bc->error = READ_ONLY (tc) ? -EPERM : -ENOMEM; 522: dereference_bio_ctx (bc); 523: return 0; 524: } 525: trace (3, "truecrypt_map: mempool_alloc pg: %p\n", cbv->bv_page); 526: 527: cbv->bv_offset = 0; 528: cbv->bv_len = bv->bv_len; 529: 530: copy = bvec_kmap_irq (cbv, ©Flags); 1.1.1.3 ! root 531: data = bvec_kmap_irq (bv, &flags); 1.1 root 532: 533: memcpy (copy, data, bv->bv_len); 534: 535: flush_dcache_page (bv->bv_page); 536: bvec_kunmap_irq (data, &flags); 537: 538: trace (2, "EncryptSectors (%Ld, %d)\n", sec_no, secs); 539: 1.1.1.2 root 540: EncryptSectors ((unsigned __int32 *)copy, sec_no, secs, tc->ci); 1.1 root 541: sec_no += secs; 542: 543: flush_dcache_page (cbv->bv_page); 544: bvec_kunmap_irq (copy, ©Flags); 545: } 546: } 547: 548: atomic_inc (&bc->ref_count); 549: 550: trace (3, "generic_make_request (rw=%ld sc=" SECTOR_FORMAT ")\n", bion->bi_rw, bion->bi_sector); 551: generic_make_request (bion); 552: 553: dereference_bio_ctx (bc); 554: return 0; 555: } 556: 557: 558: static int truecrypt_status (struct dm_target *ti, status_type_t type, char *result, unsigned int maxlen) 559: { 560: struct target_ctx *tc = (struct target_ctx *) ti->private; 561: 562: switch (type) 563: { 564: case STATUSTYPE_INFO: 565: result[0] = 0; 566: break; 567: 568: case STATUSTYPE_TABLE: 569: { 570: char name[32]; 571: format_dev_t (name, tc->dev->bdev->bd_dev); 1.1.1.2 root 572: snprintf (result, maxlen, "%d %d 0 0 %s " SECTOR_FORMAT " " SECTOR_FORMAT " " SECTOR_FORMAT " %Ld %Ld %d %s", 573: tc->ci->ea, 574: tc->ci->mode, 1.1 root 575: name, 576: tc->start, 577: tc->read_only_start, 578: tc->read_only_end, 579: tc->mtime, 580: tc->atime, 581: tc->flags, 582: tc->volume_path); 583: } 584: break; 585: } 586: 587: return 0; 588: } 589: 590: 591: static struct target_type truecrypt_target = { 592: .name = "truecrypt", 593: .version= {VERSION_NUM1, VERSION_NUM2, VERSION_NUM3}, 594: .module = THIS_MODULE, 595: .ctr = truecrypt_ctr, 596: .dtr = truecrypt_dtr, 597: .map = truecrypt_map, 598: .status = truecrypt_status 599: }; 600: 601: 602: int __init dm_truecrypt_init(void) 603: { 604: int r; 605: trace (3, "dm_truecrypt_init (trace_level=%d)\n", trace_level); 606: 607: if (!AutoTestAlgorithms ()) 608: { 609: DMERR ("truecrypt: self-test of algorithms failed"); 610: return -ERANGE; 611: } 612: 613: work_queue = create_workqueue ("truecryptq"); 614: 615: if (!work_queue) 616: { 617: DMERR ("truecrypt: create_workqueue creation failed"); 618: goto err; 619: } 620: 621: bio_ctx_cache = kmem_cache_create ("truecrypt-bioctx", sizeof (struct bio_ctx), 0, 0, NULL, NULL); 622: if (!bio_ctx_cache) 623: { 624: DMERR ("truecrypt: kmem_cache_create failed"); 625: goto err; 626: } 627: 628: r = dm_register_target (&truecrypt_target); 629: if (r < 0) 630: { 631: DMERR ("truecrypt: register failed %d", r); 632: goto err; 633: } 634: 635: return r; 636: 637: err: 638: if (work_queue) 639: destroy_workqueue (work_queue); 640: if (bio_ctx_cache) 641: kmem_cache_destroy (bio_ctx_cache); 642: 643: return -ENOMEM; 644: } 645: 646: 647: void __exit dm_truecrypt_exit(void) 648: { 649: int r; 650: trace (3, "dm_truecrypt_exit ()\n"); 651: 652: r = dm_unregister_target (&truecrypt_target); 653: 654: if (r < 0) 655: DMERR ("truecrypt: unregister failed %d", r); 656: 657: destroy_workqueue (work_queue); 658: kmem_cache_destroy (bio_ctx_cache); 659: } 660: 661: 662: module_init(dm_truecrypt_init); 663: module_exit(dm_truecrypt_exit); 664: module_param_named(trace, trace_level, int, 0); 665: 666: MODULE_AUTHOR("TrueCrypt Foundation"); 667: MODULE_DESCRIPTION(DM_NAME " target for encryption and decryption of TrueCrypt volumes"); 668: MODULE_PARM_DESC(trace, "Trace level"); 669: MODULE_LICENSE("GPL and additional rights"); // Kernel thinks only GPL/BSD/MPL != closed-source code
This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.