Print this page
5857 lofiadm should ask passphrase once if the crypto is already set up
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Toomas Soome <tsoome@me.com>
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/sys/lofi.h
+++ new/usr/src/uts/common/sys/lofi.h
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
|
↓ open down ↓ |
14 lines elided |
↑ open up ↑ |
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21 /*
22 22 * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
23 23 *
24 24 * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
25 + * Copyright (c) 2016 Andrey Sokolov
25 26 */
26 27
27 28 #ifndef _SYS_LOFI_H
28 29 #define _SYS_LOFI_H
29 30
30 31 #include <sys/types.h>
31 32 #include <sys/time.h>
32 33 #include <sys/taskq.h>
33 34 #include <sys/vtoc.h>
34 35 #include <sys/dkio.h>
35 36 #include <sys/vnode.h>
36 37 #include <sys/list.h>
37 38 #include <sys/crypto/api.h>
38 39 #include <sys/zone.h>
39 40
40 41 #ifdef __cplusplus
41 42 extern "C" {
42 43 #endif
43 44
44 45 /*
45 46 * /dev names:
46 47 * /dev/lofictl - master control device
47 48 * /dev/lofi - block devices, named by minor number
48 49 * /dev/rlofi - character devices, named by minor number
49 50 */
50 51 #define LOFI_DRIVER_NAME "lofi"
51 52 #define LOFI_CTL_NODE "ctl"
52 53 #define LOFI_CTL_NAME LOFI_DRIVER_NAME LOFI_CTL_NODE
53 54 #define LOFI_BLOCK_NAME LOFI_DRIVER_NAME
54 55 #define LOFI_CHAR_NAME "r" LOFI_DRIVER_NAME
55 56
56 57 #define SEGHDR 1
57 58 #define COMPRESSED 1
58 59 #define UNCOMPRESSED 0
59 60 #define MAXALGLEN 36
60 61
61 62 /*
62 63 *
63 64 * Use is:
64 65 * ld = open("/dev/lofictl", O_RDWR | O_EXCL);
65 66 *
66 67 * lofi must be opened exclusively. Access is controlled by permissions on
67 68 * the device, which is 644 by default. Write-access is required for ioctls
68 69 * that change state, but only read-access is required for the ioctls that
69 70 * return information. Basically, only root can add and remove files, but
70 71 * non-root can look at the current lists.
71 72 *
72 73 * ioctl usage:
73 74 *
74 75 * kernel ioctls
75 76 *
76 77 * strcpy(li.li_filename, "somefilename");
77 78 * ioctl(ld, LOFI_MAP_FILE, &li);
78 79 * newminor = li.li_minor;
79 80 *
80 81 * strcpy(li.li_filename, "somefilename");
81 82 * ioctl(ld, LOFI_UNMAP_FILE, &li);
82 83 *
83 84 * strcpy(li.li_filename, "somefilename");
84 85 * li.li_minor = minor_number;
85 86 * ioctl(ld, LOFI_MAP_FILE_MINOR, &li);
86 87 *
87 88 * li.li_minor = minor_number;
88 89 * ioctl(ld, LOFI_UNMAP_FILE_MINOR, &li);
89 90 *
90 91 * li.li_minor = minor_number;
91 92 * ioctl(ld, LOFI_GET_FILENAME, &li);
92 93 * filename = li.li_filename;
93 94 * encrypted = li.li_crypto_enabled;
94 95 *
95 96 * strcpy(li.li_filename, "somefilename");
96 97 * ioctl(ld, LOFI_GET_MINOR, &li);
97 98 * minor = li.li_minor;
98 99 *
99 100 * li.li_minor = 0;
100 101 * ioctl(ld, LOFI_GET_MAXMINOR, &li);
101 102 * maxminor = li.li_minor;
102 103 *
103 104 * strcpy(li.li_filename, "somefilename");
104 105 * li.li_minor = 0;
105 106 * ioctl(ld, LOFI_CHECK_COMPRESSED, &li);
106 107 *
107 108 * If the 'li_force' flag is set for any of the LOFI_UNMAP_* commands, then if
108 109 * the device is busy, the underlying vnode will be closed, and any subsequent
109 110 * operations will fail. It will behave as if the device had been forcibly
110 111 * removed, so the DKIOCSTATE ioctl will return DKIO_DEV_GONE. When the device
111 112 * is last closed, it will be torn down.
112 113 *
113 114 * If the 'li_cleanup' flag is set for any of the LOFI_UNMAP_* commands, then
114 115 * if the device is busy, it is marked for removal at the next time it is
115 116 * no longer held open by anybody. When the device is last closed, it will be
116 117 * torn down.
117 118 *
118 119 * Oh, and last but not least: these ioctls are totally private and only
119 120 * for use by lofiadm(1M).
120 121 *
121 122 */
122 123
123 124 typedef enum iv_method {
124 125 IVM_NONE, /* no iv needed, iv is null */
125 126 IVM_ENC_BLKNO /* iv is logical block no. encrypted */
126 127 } iv_method_t;
127 128
128 129 struct lofi_ioctl {
129 130 uint32_t li_minor;
130 131 boolean_t li_force;
131 132 boolean_t li_cleanup;
132 133 boolean_t li_readonly;
133 134 char li_filename[MAXPATHLEN];
134 135
135 136 /* the following fields are required for compression support */
136 137 char li_algorithm[MAXALGLEN];
137 138
138 139 /* the following fields are required for encryption support */
139 140 boolean_t li_crypto_enabled;
140 141 crypto_mech_name_t li_cipher; /* for data */
141 142 uint32_t li_key_len; /* for data */
142 143 char li_key[56]; /* for data: max 448-bit Blowfish key */
143 144 crypto_mech_name_t li_iv_cipher; /* for iv derivation */
144 145 uint32_t li_iv_len; /* for iv derivation */
145 146 iv_method_t li_iv_type; /* for iv derivation */
146 147 };
147 148
148 149 #define LOFI_IOC_BASE (('L' << 16) | ('F' << 8))
149 150
150 151 #define LOFI_MAP_FILE (LOFI_IOC_BASE | 0x01)
151 152 #define LOFI_MAP_FILE_MINOR (LOFI_IOC_BASE | 0x02)
152 153 #define LOFI_UNMAP_FILE (LOFI_IOC_BASE | 0x03)
153 154 #define LOFI_UNMAP_FILE_MINOR (LOFI_IOC_BASE | 0x04)
154 155 #define LOFI_GET_FILENAME (LOFI_IOC_BASE | 0x05)
155 156 #define LOFI_GET_MINOR (LOFI_IOC_BASE | 0x06)
|
↓ open down ↓ |
121 lines elided |
↑ open up ↑ |
156 157 #define LOFI_GET_MAXMINOR (LOFI_IOC_BASE | 0x07)
157 158 #define LOFI_CHECK_COMPRESSED (LOFI_IOC_BASE | 0x08)
158 159
159 160 /*
160 161 * file types that might be usable with lofi, maybe. Only regular
161 162 * files are documented though.
162 163 */
163 164 #define S_ISLOFIABLE(mode) \
164 165 (S_ISREG(mode) || S_ISBLK(mode) || S_ISCHR(mode))
165 166
167 +/*
168 + * The basis for CRYOFF is derived from usr/src/uts/common/sys/fs/ufs_fs.h.
169 + * Crypto metadata, if it exists, is located at the end of the boot block
170 + * (BBOFF + BBSIZE, which is SBOFF). The super block and everything after
171 + * is offset by the size of the crypto metadata which is handled by
172 + * lsp->ls_crypto_offset.
173 + */
174 +#define CRYOFF ((off_t)8192)
175 +
176 +#define LOFI_CRYPTO_MAGIC { 'C', 'F', 'L', 'O', 'F', 'I' }
177 +
166 178 #if defined(_KERNEL)
167 179
168 180
169 181 /*
170 182 * Cache decompressed data segments for the compressed lofi images.
171 183 *
172 184 * To avoid that we have to decompress data of a compressed
173 185 * segment multiple times when accessing parts of the segment's
174 186 * data we cache the uncompressed data, using a simple linked list.
175 187 */
176 188 struct lofi_comp_cache {
177 189 list_node_t lc_list; /* linked list */
178 190 uchar_t *lc_data; /* decompressed segment data */
179 191 uint64_t lc_index; /* segment index */
180 192 };
181 193
182 194 #define V_ISLOFIABLE(vtype) \
183 195 ((vtype == VREG) || (vtype == VBLK) || (vtype == VCHR))
184 196
185 197 /*
186 198 * Pre-allocated memory buffers for the purpose of compression
187 199 */
|
↓ open down ↓ |
12 lines elided |
↑ open up ↑ |
188 200 struct compbuf {
189 201 void *buf;
190 202 uint32_t bufsize;
191 203 int inuse;
192 204 };
193 205
194 206 /*
195 207 * Need exactly 6 bytes to identify encrypted lofi image
196 208 */
197 209 extern const char lofi_crypto_magic[6];
198 -#define LOFI_CRYPTO_MAGIC { 'C', 'F', 'L', 'O', 'F', 'I' }
199 210 #define LOFI_CRYPTO_VERSION ((uint16_t)0)
200 211 #define LOFI_CRYPTO_DATA_SECTOR ((uint32_t)16) /* for version 0 */
201 212
202 213 /*
203 214 * Crypto metadata for encrypted lofi images
204 215 * The fields here only satisfy initial implementation requirements.
205 216 */
206 217 struct crypto_meta {
207 218 char magic[6]; /* LOFI_CRYPTO_MAGIC */
208 219 uint16_t version; /* version of encrypted lofi */
209 220 char reserved1[96]; /* future use */
210 221 uint32_t data_sector; /* start of data area */
211 222 char pad[404]; /* end on DEV_BSIZE bdry */
212 223 /* second header block is not defined at this time */
213 224 };
214 225
215 226 struct lofi_state {
216 227 vnode_t *ls_vp; /* open real vnode */
217 228 vnode_t *ls_stacked_vp; /* open vnode */
218 229 kmutex_t ls_vp_lock; /* protects ls_vp */
219 230 kcondvar_t ls_vp_cv; /* signal changes to ls_vp */
220 231 uint32_t ls_vp_iocount; /* # pending I/O requests */
221 232 boolean_t ls_vp_closereq; /* force close requested */
222 233 u_offset_t ls_vp_size;
223 234 uint32_t ls_blk_open;
224 235 uint32_t ls_chr_open;
225 236 uint32_t ls_lyr_open_count;
226 237 int ls_openflag;
227 238 boolean_t ls_cleanup; /* cleanup on close */
228 239 boolean_t ls_readonly;
229 240 taskq_t *ls_taskq;
230 241 kstat_t *ls_kstat;
231 242 kmutex_t ls_kstat_lock;
232 243 struct dk_geom ls_dkg;
233 244 struct vtoc ls_vtoc;
234 245 struct dk_cinfo ls_ci;
235 246 zone_ref_t ls_zone;
236 247 list_node_t ls_list; /* all lofis */
237 248 dev_t ls_dev; /* this node's dev_t */
238 249
239 250 /* the following fields are required for compression support */
240 251 int ls_comp_algorithm_index; /* idx into compress_table */
241 252 char ls_comp_algorithm[MAXALGLEN];
242 253 uint32_t ls_uncomp_seg_sz; /* sz of uncompressed segment */
243 254 uint32_t ls_comp_index_sz; /* number of index entries */
244 255 uint32_t ls_comp_seg_shift; /* exponent for byte shift */
245 256 uint32_t ls_uncomp_last_seg_sz; /* sz of last uncomp segment */
246 257 uint64_t ls_comp_offbase; /* offset of actual compressed data */
247 258 uint64_t *ls_comp_seg_index; /* array of index entries */
248 259 caddr_t ls_comp_index_data; /* index pages loaded from file */
249 260 uint32_t ls_comp_index_data_sz;
250 261 u_offset_t ls_vp_comp_size; /* actual compressed file size */
251 262
252 263 /* pre-allocated list of buffers for compressed segment data */
253 264 kmutex_t ls_comp_bufs_lock;
254 265 struct compbuf *ls_comp_bufs;
255 266
256 267 /* lock and anchor for compressed segment caching */
257 268 kmutex_t ls_comp_cache_lock; /* protects ls_comp_cache */
258 269 list_t ls_comp_cache; /* cached decompressed segs */
259 270 uint32_t ls_comp_cache_count;
260 271
261 272 /* the following fields are required for encryption support */
262 273 boolean_t ls_crypto_enabled;
263 274 u_offset_t ls_crypto_offset; /* crypto meta size */
264 275 struct crypto_meta ls_crypto;
265 276 crypto_mechanism_t ls_mech; /* for data encr/decr */
266 277 crypto_key_t ls_key; /* for data encr/decr */
267 278 crypto_mechanism_t ls_iv_mech; /* for iv derivation */
268 279 size_t ls_iv_len; /* for iv derivation */
269 280 iv_method_t ls_iv_type; /* for iv derivation */
270 281 kmutex_t ls_crypto_lock;
271 282 crypto_ctx_template_t ls_ctx_tmpl;
272 283
273 284 };
274 285
275 286 #endif /* _KERNEL */
276 287
277 288 /*
278 289 * Common signature for all lofi compress functions
279 290 */
280 291 typedef int lofi_compress_func_t(void *src, size_t srclen, void *dst,
281 292 size_t *destlen, int level);
282 293
283 294 /*
284 295 * Information about each compression function
285 296 */
286 297 typedef struct lofi_compress_info {
287 298 lofi_compress_func_t *l_decompress;
288 299 lofi_compress_func_t *l_compress;
289 300 int l_level;
290 301 char *l_name; /* algorithm name */
291 302 } lofi_compress_info_t;
292 303
293 304 enum lofi_compress {
294 305 LOFI_COMPRESS_GZIP = 0,
295 306 LOFI_COMPRESS_GZIP_6 = 1,
296 307 LOFI_COMPRESS_GZIP_9 = 2,
297 308 LOFI_COMPRESS_LZMA = 3,
298 309 LOFI_COMPRESS_FUNCTIONS
299 310 };
300 311
301 312 #ifdef __cplusplus
302 313 }
303 314 #endif
304 315
305 316 #endif /* _SYS_LOFI_H */
|
↓ open down ↓ |
97 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX