xnu-7195.50.7.100.1.tar.gz

[apple/xnu.git] / bsd / sys / cprotect.h

diff --git a/bsd/sys/cprotect.h b/bsd/sys/cprotect.h
index eb0a134fdff7fca6d8ec54373325449543adf2eb..080dcc2036a273fa16ba43651fa1f209f5b8998e 100644 (file)
--- a/bsd/sys/cprotect.h
+++ b/bsd/sys/cprotect.h
@@ -1,8 +1,8 @@
 /*
 /*

- * Copyright (c) 2009 Apple Inc. All rights reserved.
+ * Copyright (c) 2009-2014 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,183 +22,197 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
 #ifndef _SYS_CPROTECT_H_
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
 #ifndef _SYS_CPROTECT_H_

-#define        _SYS_CPROTECT_H_
-
-#ifdef __cplusplus
-extern "C" {
-#endif
+#define _SYS_CPROTECT_H_

 
 

-#if KERNEL_PRIVATE
+#ifdef KERNEL_PRIVATE

 
 #include <sys/cdefs.h>
 
 #include <sys/cdefs.h>

-#include <sys/content_protection.h>
-#include <sys/kernel_types.h>
+#include <sys/param.h>
+#include <sys/buf.h>
+#include <sys/kdebug.h>

 #include <crypto/aes.h>
 #include <crypto/aes.h>

+#include <stdbool.h>
+#include <uuid/uuid.h>
+#include <libkern/crypto/sha1.h>

 
 

-#define CP_IV_KEYSIZE 20                       /* 16x8 = 128, but SHA1 pushes 20 bytes so keep space for that */
-#define CP_MAX_KEYSIZE 32              /* 8x4 = 32, 32x8 = 256 */
-#define CP_MAX_WRAPPEDKEYSIZE  128     /* The size of the largest allowed key */
-#define CP_INITIAL_WRAPPEDKEYSIZE 40
-#define CP_V2_WRAPPEDKEYSIZE 40                /* Size of the wrapped key in a v2 EA */
-
-/* lock events from AppleKeyStore */
-#define CP_LOCKED_STATE 0              /* Device is locked */
-#define CP_UNLOCKED_STATE 1            /* Device is unlocked */
+__BEGIN_DECLS

 
 

-#define CP_LOCKED_KEYCHAIN 0   
-#define CP_UNLOCKED_KEYCHAIN 1
+#define CP_CODE(code) FSDBG_CODE(DBG_CONTENT_PROT, code)
+/*
+ * Class DBG_FSYSTEM == 0x03
+ * Subclass DBG_CONTENT_PROT == 0xCF
+ * These debug codes are of the form 0x03CFzzzz
+ */

 
 

-/* For struct cprotect: cp_flags */
-#define CP_NEEDS_KEYS          0x1             /* File needs persistent keys */
-#define CP_KEY_FLUSHED         0x2             /* File's unwrapped key has been purged from memory */
-#define CP_NO_XATTR                    0x4             /* Key info has not been saved as EA to the FS */
-#define CP_OFF_IV_ENABLED      0x8             /* Only go down relative IV route if this flag is set */
+enum {
+       CPDBG_OFFSET_IO = CP_CODE(0),   /* 0x03CF0000 */
+};

 
 

-#define CP_RELOCATION_INFLIGHT 0x10    /* File with offset IVs is in the process of being relocated. */
+/* normally the debug events are no-ops */
+#define CP_DEBUG(x, a, b, c, d, e) do {} while (0);

 
 

-/* Content Protection VNOP Operation flags */
-#define CP_READ_ACCESS         0x1
-#define CP_WRITE_ACCESS 0x2
+/* dev kernels only! */
+#if !SECURE_KERNEL

 
 

-/* 
- * Check for this version when deciding to enable features
- */
-#define CONTENT_PROTECTION_XATTR_NAME  "com.apple.system.cprotect"
-#define CP_NEW_MAJOR_VERS 4
-#define CP_PREV_MAJOR_VERS 2
-#define CP_MINOR_VERS 0
+/* KDEBUG events used by content protection subsystem */
+#if 0
+#undef CP_DEBUG
+#define CP_DEBUG KERNEL_DEBUG_CONSTANT
+#endif

 
 

-typedef struct cprotect *cprotect_t;
-typedef struct cp_wrap_func *cp_wrap_func_t;
-typedef struct cp_global_state *cp_global_state_t;
-typedef struct cp_xattr *cp_xattr_t;
-
-typedef struct cnode * cnode_ptr_t;
-//forward declare the struct.
-struct hfsmount;
-
-/* The wrappers are invoked by the AKS kext */
-typedef int wrapper_t(uint32_t properties, uint64_t file_id, void *key_bytes, size_t key_length, void *wrapped_data, size_t *wrapped_length);
-typedef        int unwrapper_t(uint32_t properties, void *wrapped_data, size_t wrapped_data_length, void *key_bytes, size_t *key_length);
-
-/* 
- * Runtime-only structure containing the content protection status 
- * for the given file.  This is contained within the cnode 
- * This is passed down to IOStorageFamily via the bufattr struct
- *
- ******************************************************
- * Some Key calculation information for offset based IV
- ******************************************************
- * Kf  = original 256 bit per file key
- * Kiv = SHA1(Kf), use full Kf, but truncate Kiv to 128 bits
- * Kiv can be cached in the cprotect, so it only has to be calculated once for the file init
- *
- * IVb = Encrypt(Kiv, offset)
- *
- */
-struct cprotect {
-       uint32_t        cp_flags;
-       uint32_t        cp_pclass;
-       aes_encrypt_ctx cp_cache_iv_ctx;
-       uint32_t        cp_cache_key_len;
-       uint8_t         cp_cache_key[CP_MAX_KEYSIZE];
-       uint32_t        cp_persistent_key_len;
-       uint8_t         cp_persistent_key[];
-};
+#endif

 
 

-struct cp_wrap_func {
-       wrapper_t       *wrapper;
-       unwrapper_t     *unwrapper;
-};
+#define CP_MAX_WRAPPEDKEYSIZE     128   /* The size of the largest allowed key */
+#define VFS_CP_MAX_CACHEBUFLEN    64    /* Maximum size of the cached key */

 
 

-struct cp_global_state {
-       uint8_t wrap_functions_set;
-       uint8_t lock_state;
-       u_int16_t reserved;
+/* lock events from AppleKeyStore */
+enum {
+       CP_ACTION_LOCKED        = 0,
+       CP_ACTION_UNLOCKED      = 1,

 };
 };

-

 /*
 /*

- * On-disk structure written as the per-file EA payload 
- * All on-disk multi-byte fields for the CP XATTR must be stored
- * little-endian on-disk.  This means they must be endian swapped to
- * L.E on getxattr() and converted to LE on setxattr().        
+ * Ideally, cp_key_store_action_t would be an enum, but we cannot fix
+ * that until AppleKeyStore is updated.

  */
  */

-struct cp_xattr_v2 {
-       u_int16_t xattr_major_version;
-       u_int16_t xattr_minor_version;
-       u_int32_t flags;
-       u_int32_t persistent_class;
-       u_int32_t key_size;
-       uint8_t   persistent_key[CP_V2_WRAPPEDKEYSIZE];
-};
+typedef int cp_key_store_action_t;

 
 

-struct cp_xattr_v4 {
-       u_int16_t xattr_major_version;
-       u_int16_t xattr_minor_version;
-       u_int32_t flags;
-       u_int32_t persistent_class;
-       u_int32_t key_size;
-       u_int32_t reserved1;
-       u_int32_t reserved2;
-       u_int32_t reserved3;
-       u_int32_t reserved4;
-       u_int32_t reserved5;
-       uint8_t   persistent_key[CP_MAX_WRAPPEDKEYSIZE];
+/*
+ * It was once the case (and it may still be the case) where the lock
+ * state got conflated with the possible actions/events that
+ * AppleKeyStore can send.  For that reason, the locked states below
+ * should numerically match their corresponding actions above.
+ */
+typedef unsigned char cp_lock_state_t;
+enum {
+       CP_LOCKED_STATE         = 0,
+       CP_UNLOCKED_STATE       = 1,

 };
 
 };
 

-/* Same is true for the root EA, all fields must be written little endian. */
-struct cp_root_xattr {
-       u_int16_t major_version;
-       u_int16_t minor_version;
-       u_int64_t flags;
-       u_int32_t reserved1;
-       u_int32_t reserved2;
-       u_int32_t reserved3;
-       u_int32_t reserved4;
-};
+typedef uint32_t cp_key_class_t;
+typedef uint32_t cp_key_os_version_t;
+typedef uint16_t cp_key_revision_t;
+typedef uint64_t cp_crypto_id_t;

 
 

+typedef struct cprotect *cprotect_t;
+typedef struct cpx *cpx_t;

 
 

-/* 
- * Functions to check the status of a CP and to query 
- * the containing filesystem to see if it is supported.
+#ifdef BSD_KERNEL_PRIVATE
+/* Not for consumption outside of XNU */
+typedef uint32_t cpx_flags_t;
+/*
+ * This is a CPX structure with a fixed-length key buffer. We need this defined in a header
+ * so that we can use this structure to allocate the memory for the zone(s) properly.

  */
  */

-int cp_vnode_getclass(vnode_t, int *);
-int cp_vnode_setclass(vnode_t, uint32_t);
-int cp_vnode_transcode(vnode_t);
-
-int cp_key_store_action(int);
-int cp_register_wraps(cp_wrap_func_t);
-
-int cp_entry_init(cnode_ptr_t, struct mount *);
-int cp_entry_create_keys(struct cprotect **entry_ptr, struct cnode *dcp, struct hfsmount *hfsmp, 
-               uint32_t input_class, uint32_t fileid, mode_t cmode);
-int cp_entry_gentempkeys(struct cprotect **entry_ptr, struct hfsmount *hfsmp);
-void cp_entry_destroy(struct cprotect **entry_ptr);
-
-cnode_ptr_t cp_get_protected_cnode(vnode_t);
-int cp_handle_vnop(vnode_t, int, int);
-int cp_fs_protected (mount_t);
-int cp_getrootxattr (struct hfsmount *hfsmp, struct cp_root_xattr *outxattr);
-int cp_setrootxattr (struct hfsmount *hfsmp, struct cp_root_xattr *newxattr);
-int cp_setxattr(struct cnode *cp, struct cprotect *entry, struct hfsmount *hfsmp, uint32_t fileid, int options);
-int cp_update_mkb (struct cprotect *entry, uint32_t fileid);
-int cp_handle_relocate (cnode_ptr_t cp, struct hfsmount *hfsmp);
-int cp_handle_open(struct vnode *vp, int mode);
-int cp_get_root_major_vers (struct vnode *vp, uint32_t *level);
+typedef struct fcpx {
+#ifdef DEBUG
+       uint32_t                cpx_magic1;
+#endif // DEBUG
+       aes_encrypt_ctx         *cpx_iv_aes_ctx_ptr;// Context used for generating the IV
+       cpx_flags_t             cpx_flags;
+       uint16_t                cpx_max_key_len;
+       uint16_t                cpx_key_len;
+       uint8_t                 cpx_cached_key[VFS_CP_MAX_CACHEBUFLEN];
+       //Fixed length all the way through
+} fcpx_t;
+
+#endif // BSD_KERNEL_PRIVATE
+
+typedef struct cp_key {
+       uint8_t len;
+       void *key;
+} cp_key_t;
+
+/* Interface to AKS kext */
+typedef struct {
+       void     *key;
+       unsigned key_len;
+       void     *iv_key;
+       unsigned iv_key_len;
+       uint32_t flags;
+} cp_raw_key_s;
+
+typedef cp_raw_key_s* cp_raw_key_t;
+
+typedef struct {
+       void     *key;
+       unsigned key_len;
+       cp_key_class_t dp_class;
+} cp_wrapped_key_s;
+
+typedef cp_wrapped_key_s* cp_wrapped_key_t;
+
+typedef struct {
+       union {
+               ino64_t                 inode;
+               cp_crypto_id_t  crypto_id;
+       };
+       uint32_t                        volume;
+       pid_t                           pid;
+       uid_t                           uid;
+       cp_key_revision_t       key_revision;
+} cp_cred_s;
+
+typedef cp_cred_s* cp_cred_t;
+
+/* The wrappers are invoked on the AKS kext */
+typedef int unwrapper_t(cp_cred_t access, const cp_wrapped_key_t wrapped_key_in, cp_raw_key_t key_out);
+typedef int rewrapper_t(cp_cred_t access, cp_key_class_t dp_class, const cp_wrapped_key_t wrapped_key_in, cp_wrapped_key_t wrapped_key_out);
+typedef int new_key_t(cp_cred_t access, cp_key_class_t dp_class, cp_raw_key_t key_out, cp_wrapped_key_t wrapped_key_out);
+typedef int invalidater_t(cp_cred_t access); /* invalidates keys */
+typedef int backup_key_t(cp_cred_t access, const cp_wrapped_key_t wrapped_key_in, cp_wrapped_key_t wrapped_key_out);

 
 

-#if 0
-int cp_isdevice_locked (void);
-#endif
-
-#endif /* KERNEL_PRIVATE */
-
-#ifdef __cplusplus
-};
-#endif
+/*
+ * Flags for Interaction between AKS / Kernel
+ * These are twiddled via the input/output structs in the above
+ * wrapper/unwrapper functions.
+ */
+#define CP_RAW_KEY_WRAPPEDKEY   0x00000001

 
 

+/*
+ * Function prototypes for kexts to interface with our internal cprotect
+ * fields;  cpx provides opacity and allows us to modify behavior internally
+ * without requiring kext changes.
+ */
+cpx_t cpx_alloc(size_t key_size, bool needs_ctx);
+int cpx_alloc_ctx(cpx_t cpx);
+void cpx_free_ctx(cpx_t cpx);
+void cpx_init(cpx_t, size_t key_len);
+void cpx_init_ctx_ptr(cpx_t cpx);
+void cpx_free(cpx_t);
+void cpx_writeprotect(cpx_t cpx);
+__attribute__((const)) size_t cpx_size(size_t key_len);
+__attribute__((pure)) bool cpx_is_sep_wrapped_key(const struct cpx *);
+void cpx_set_is_sep_wrapped_key(struct cpx *, bool);
+__attribute__((pure)) bool cpx_is_composite_key(const struct cpx *);
+void cpx_set_is_composite_key(struct cpx *, bool);
+__attribute__((pure)) bool cpx_use_offset_for_iv(const struct cpx *);
+void cpx_set_use_offset_for_iv(struct cpx *, bool);
+__attribute__((pure)) bool cpx_synthetic_offset_for_iv(const struct cpx *);
+void cpx_set_synthetic_offset_for_iv(struct cpx *, bool);
+__attribute__((pure)) uint16_t cpx_key_len(const struct cpx *);
+void cpx_set_key_len(struct cpx *, uint16_t key_len);
+__attribute__((pure)) void *cpx_key(const struct cpx *);
+aes_encrypt_ctx *cpx_iv_aes_ctx(struct cpx *);
+void cpx_flush(cpx_t cpx);
+bool cpx_can_copy(const struct cpx *src, const struct cpx *dst);
+void cpx_copy(const struct cpx *src, cpx_t dst);
+uint16_t cpx_max_key_len(const struct cpx *cpx);
+bool cpx_has_key(const struct cpx *cpx);
+size_t cpx_sizex(const struct cpx *cpx);
+void cpx_set_aes_iv_key(struct cpx *cpx, void *iv_key);
+
+int cp_key_store_action(cp_key_store_action_t);
+int cp_key_store_action_for_volume(uuid_t volume_uuid, cp_key_store_action_t action);
+cp_key_os_version_t cp_os_version(void);
+// Should be cp_key_class_t but HFS has a conflicting definition
+int cp_is_valid_class(int isdir, int32_t protectionclass);
+
+__END_DECLS
+
+#endif /* KERNEL_PRIVATE */

 #endif /* !_SYS_CPROTECT_H_ */
 #endif /* !_SYS_CPROTECT_H_ */