1eda14cbcSMatt Macy /* 2eda14cbcSMatt Macy * CDDL HEADER START 3eda14cbcSMatt Macy * 4eda14cbcSMatt Macy * This file and its contents are supplied under the terms of the 5eda14cbcSMatt Macy * Common Development and Distribution License ("CDDL"), version 1.0. 6eda14cbcSMatt Macy * You may only use this file in accordance with the terms of version 7eda14cbcSMatt Macy * 1.0 of the CDDL. 8eda14cbcSMatt Macy * 9eda14cbcSMatt Macy * A full copy of the text of the CDDL should have accompanied this 10eda14cbcSMatt Macy * source. A copy of the CDDL is also available via the Internet at 11eda14cbcSMatt Macy * http://www.illumos.org/license/CDDL. 12eda14cbcSMatt Macy * 13eda14cbcSMatt Macy * CDDL HEADER END 14eda14cbcSMatt Macy */ 15eda14cbcSMatt Macy 16eda14cbcSMatt Macy /* 17eda14cbcSMatt Macy * Copyright (c) 2017, Datto, Inc. All rights reserved. 18eda14cbcSMatt Macy * Copyright (c) 2018 by Delphix. All rights reserved. 19eda14cbcSMatt Macy */ 20eda14cbcSMatt Macy 21eda14cbcSMatt Macy #include <sys/dsl_crypt.h> 22eda14cbcSMatt Macy #include <sys/dsl_pool.h> 23eda14cbcSMatt Macy #include <sys/zap.h> 24eda14cbcSMatt Macy #include <sys/zil.h> 25eda14cbcSMatt Macy #include <sys/dsl_dir.h> 26eda14cbcSMatt Macy #include <sys/dsl_prop.h> 27eda14cbcSMatt Macy #include <sys/spa_impl.h> 28eda14cbcSMatt Macy #include <sys/dmu_objset.h> 29eda14cbcSMatt Macy #include <sys/zvol.h> 30eda14cbcSMatt Macy 31eda14cbcSMatt Macy /* 32eda14cbcSMatt Macy * This file's primary purpose is for managing master encryption keys in 33eda14cbcSMatt Macy * memory and on disk. For more info on how these keys are used, see the 34eda14cbcSMatt Macy * block comment in zio_crypt.c. 35eda14cbcSMatt Macy * 36eda14cbcSMatt Macy * All master keys are stored encrypted on disk in the form of the DSL 37eda14cbcSMatt Macy * Crypto Key ZAP object. The binary key data in this object is always 38eda14cbcSMatt Macy * randomly generated and is encrypted with the user's wrapping key. This 39eda14cbcSMatt Macy * layer of indirection allows the user to change their key without 40eda14cbcSMatt Macy * needing to re-encrypt the entire dataset. The ZAP also holds on to the 41eda14cbcSMatt Macy * (non-encrypted) encryption algorithm identifier, IV, and MAC needed to 42eda14cbcSMatt Macy * safely decrypt the master key. For more info on the user's key see the 43eda14cbcSMatt Macy * block comment in libzfs_crypto.c 44eda14cbcSMatt Macy * 45eda14cbcSMatt Macy * In-memory encryption keys are managed through the spa_keystore. The 46eda14cbcSMatt Macy * keystore consists of 3 AVL trees, which are as follows: 47eda14cbcSMatt Macy * 48eda14cbcSMatt Macy * The Wrapping Key Tree: 49eda14cbcSMatt Macy * The wrapping key (wkey) tree stores the user's keys that are fed into the 50eda14cbcSMatt Macy * kernel through 'zfs load-key' and related commands. Datasets inherit their 51eda14cbcSMatt Macy * parent's wkey by default, so these structures are refcounted. The wrapping 52eda14cbcSMatt Macy * keys remain in memory until they are explicitly unloaded (with 53eda14cbcSMatt Macy * "zfs unload-key"). Unloading is only possible when no datasets are using 54eda14cbcSMatt Macy * them (refcount=0). 55eda14cbcSMatt Macy * 56eda14cbcSMatt Macy * The DSL Crypto Key Tree: 57eda14cbcSMatt Macy * The DSL Crypto Keys (DCK) are the in-memory representation of decrypted 58eda14cbcSMatt Macy * master keys. They are used by the functions in zio_crypt.c to perform 59eda14cbcSMatt Macy * encryption, decryption, and authentication. Snapshots and clones of a given 60eda14cbcSMatt Macy * dataset will share a DSL Crypto Key, so they are also refcounted. Once the 61eda14cbcSMatt Macy * refcount on a key hits zero, it is immediately zeroed out and freed. 62eda14cbcSMatt Macy * 63eda14cbcSMatt Macy * The Crypto Key Mapping Tree: 64eda14cbcSMatt Macy * The zio layer needs to lookup master keys by their dataset object id. Since 65eda14cbcSMatt Macy * the DSL Crypto Keys can belong to multiple datasets, we maintain a tree of 66eda14cbcSMatt Macy * dsl_key_mapping_t's which essentially just map the dataset object id to its 67eda14cbcSMatt Macy * appropriate DSL Crypto Key. The management for creating and destroying these 68eda14cbcSMatt Macy * mappings hooks into the code for owning and disowning datasets. Usually, 69eda14cbcSMatt Macy * there will only be one active dataset owner, but there are times 70eda14cbcSMatt Macy * (particularly during dataset creation and destruction) when this may not be 71eda14cbcSMatt Macy * true or the dataset may not be initialized enough to own. As a result, this 72eda14cbcSMatt Macy * object is also refcounted. 73eda14cbcSMatt Macy */ 74eda14cbcSMatt Macy 75eda14cbcSMatt Macy /* 76eda14cbcSMatt Macy * This tunable allows datasets to be raw received even if the stream does 77eda14cbcSMatt Macy * not include IVset guids or if the guids don't match. This is used as part 78eda14cbcSMatt Macy * of the resolution for ZPOOL_ERRATA_ZOL_8308_ENCRYPTION. 79eda14cbcSMatt Macy */ 80eda14cbcSMatt Macy int zfs_disable_ivset_guid_check = 0; 81eda14cbcSMatt Macy 82eda14cbcSMatt Macy static void 83a0b956f5SMartin Matuska dsl_wrapping_key_hold(dsl_wrapping_key_t *wkey, const void *tag) 84eda14cbcSMatt Macy { 85eda14cbcSMatt Macy (void) zfs_refcount_add(&wkey->wk_refcnt, tag); 86eda14cbcSMatt Macy } 87eda14cbcSMatt Macy 88eda14cbcSMatt Macy static void 89a0b956f5SMartin Matuska dsl_wrapping_key_rele(dsl_wrapping_key_t *wkey, const void *tag) 90eda14cbcSMatt Macy { 91eda14cbcSMatt Macy (void) zfs_refcount_remove(&wkey->wk_refcnt, tag); 92eda14cbcSMatt Macy } 93eda14cbcSMatt Macy 94eda14cbcSMatt Macy static void 95eda14cbcSMatt Macy dsl_wrapping_key_free(dsl_wrapping_key_t *wkey) 96eda14cbcSMatt Macy { 97eda14cbcSMatt Macy ASSERT0(zfs_refcount_count(&wkey->wk_refcnt)); 98eda14cbcSMatt Macy 99eda14cbcSMatt Macy if (wkey->wk_key.ck_data) { 100da5137abSMartin Matuska memset(wkey->wk_key.ck_data, 0, 101eda14cbcSMatt Macy CRYPTO_BITS2BYTES(wkey->wk_key.ck_length)); 102eda14cbcSMatt Macy kmem_free(wkey->wk_key.ck_data, 103eda14cbcSMatt Macy CRYPTO_BITS2BYTES(wkey->wk_key.ck_length)); 104eda14cbcSMatt Macy } 105eda14cbcSMatt Macy 106eda14cbcSMatt Macy zfs_refcount_destroy(&wkey->wk_refcnt); 107eda14cbcSMatt Macy kmem_free(wkey, sizeof (dsl_wrapping_key_t)); 108eda14cbcSMatt Macy } 109eda14cbcSMatt Macy 110eda14cbcSMatt Macy static void 111eda14cbcSMatt Macy dsl_wrapping_key_create(uint8_t *wkeydata, zfs_keyformat_t keyformat, 112eda14cbcSMatt Macy uint64_t salt, uint64_t iters, dsl_wrapping_key_t **wkey_out) 113eda14cbcSMatt Macy { 114eda14cbcSMatt Macy dsl_wrapping_key_t *wkey; 115eda14cbcSMatt Macy 116eda14cbcSMatt Macy /* allocate the wrapping key */ 117eda14cbcSMatt Macy wkey = kmem_alloc(sizeof (dsl_wrapping_key_t), KM_SLEEP); 118eda14cbcSMatt Macy 119eda14cbcSMatt Macy /* allocate and initialize the underlying crypto key */ 120eda14cbcSMatt Macy wkey->wk_key.ck_data = kmem_alloc(WRAPPING_KEY_LEN, KM_SLEEP); 121eda14cbcSMatt Macy 122eda14cbcSMatt Macy wkey->wk_key.ck_length = CRYPTO_BYTES2BITS(WRAPPING_KEY_LEN); 123da5137abSMartin Matuska memcpy(wkey->wk_key.ck_data, wkeydata, WRAPPING_KEY_LEN); 124eda14cbcSMatt Macy 125eda14cbcSMatt Macy /* initialize the rest of the struct */ 126eda14cbcSMatt Macy zfs_refcount_create(&wkey->wk_refcnt); 127eda14cbcSMatt Macy wkey->wk_keyformat = keyformat; 128eda14cbcSMatt Macy wkey->wk_salt = salt; 129eda14cbcSMatt Macy wkey->wk_iters = iters; 130eda14cbcSMatt Macy 131eda14cbcSMatt Macy *wkey_out = wkey; 132eda14cbcSMatt Macy } 133eda14cbcSMatt Macy 134eda14cbcSMatt Macy int 135eda14cbcSMatt Macy dsl_crypto_params_create_nvlist(dcp_cmd_t cmd, nvlist_t *props, 136eda14cbcSMatt Macy nvlist_t *crypto_args, dsl_crypto_params_t **dcp_out) 137eda14cbcSMatt Macy { 138eda14cbcSMatt Macy int ret; 139eda14cbcSMatt Macy uint64_t crypt = ZIO_CRYPT_INHERIT; 140eda14cbcSMatt Macy uint64_t keyformat = ZFS_KEYFORMAT_NONE; 141eda14cbcSMatt Macy uint64_t salt = 0, iters = 0; 142eda14cbcSMatt Macy dsl_crypto_params_t *dcp = NULL; 143eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = NULL; 144eda14cbcSMatt Macy uint8_t *wkeydata = NULL; 145eda14cbcSMatt Macy uint_t wkeydata_len = 0; 1462a58b312SMartin Matuska const char *keylocation = NULL; 147eda14cbcSMatt Macy 148eda14cbcSMatt Macy dcp = kmem_zalloc(sizeof (dsl_crypto_params_t), KM_SLEEP); 149eda14cbcSMatt Macy dcp->cp_cmd = cmd; 150eda14cbcSMatt Macy 151eda14cbcSMatt Macy /* get relevant arguments from the nvlists */ 152eda14cbcSMatt Macy if (props != NULL) { 153eda14cbcSMatt Macy (void) nvlist_lookup_uint64(props, 154eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_ENCRYPTION), &crypt); 155eda14cbcSMatt Macy (void) nvlist_lookup_uint64(props, 156eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYFORMAT), &keyformat); 157eda14cbcSMatt Macy (void) nvlist_lookup_string(props, 158eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation); 159eda14cbcSMatt Macy (void) nvlist_lookup_uint64(props, 160eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), &salt); 161eda14cbcSMatt Macy (void) nvlist_lookup_uint64(props, 162eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), &iters); 163eda14cbcSMatt Macy 164eda14cbcSMatt Macy dcp->cp_crypt = crypt; 165eda14cbcSMatt Macy } 166eda14cbcSMatt Macy 167eda14cbcSMatt Macy if (crypto_args != NULL) { 168eda14cbcSMatt Macy (void) nvlist_lookup_uint8_array(crypto_args, "wkeydata", 169eda14cbcSMatt Macy &wkeydata, &wkeydata_len); 170eda14cbcSMatt Macy } 171eda14cbcSMatt Macy 172eda14cbcSMatt Macy /* check for valid command */ 173eda14cbcSMatt Macy if (dcp->cp_cmd >= DCP_CMD_MAX) { 174eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 175eda14cbcSMatt Macy goto error; 176eda14cbcSMatt Macy } else { 177eda14cbcSMatt Macy dcp->cp_cmd = cmd; 178eda14cbcSMatt Macy } 179eda14cbcSMatt Macy 180eda14cbcSMatt Macy /* check for valid crypt */ 181eda14cbcSMatt Macy if (dcp->cp_crypt >= ZIO_CRYPT_FUNCTIONS) { 182eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 183eda14cbcSMatt Macy goto error; 184eda14cbcSMatt Macy } else { 185eda14cbcSMatt Macy dcp->cp_crypt = crypt; 186eda14cbcSMatt Macy } 187eda14cbcSMatt Macy 188eda14cbcSMatt Macy /* check for valid keyformat */ 189eda14cbcSMatt Macy if (keyformat >= ZFS_KEYFORMAT_FORMATS) { 190eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 191eda14cbcSMatt Macy goto error; 192eda14cbcSMatt Macy } 193eda14cbcSMatt Macy 194eda14cbcSMatt Macy /* check for a valid keylocation (of any kind) and copy it in */ 195eda14cbcSMatt Macy if (keylocation != NULL) { 196eda14cbcSMatt Macy if (!zfs_prop_valid_keylocation(keylocation, B_FALSE)) { 197eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 198eda14cbcSMatt Macy goto error; 199eda14cbcSMatt Macy } 200eda14cbcSMatt Macy 201eda14cbcSMatt Macy dcp->cp_keylocation = spa_strdup(keylocation); 202eda14cbcSMatt Macy } 203eda14cbcSMatt Macy 204eda14cbcSMatt Macy /* check wrapping key length, if given */ 205eda14cbcSMatt Macy if (wkeydata != NULL && wkeydata_len != WRAPPING_KEY_LEN) { 206eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 207eda14cbcSMatt Macy goto error; 208eda14cbcSMatt Macy } 209eda14cbcSMatt Macy 210eda14cbcSMatt Macy /* if the user asked for the default crypt, determine that now */ 211eda14cbcSMatt Macy if (dcp->cp_crypt == ZIO_CRYPT_ON) 212eda14cbcSMatt Macy dcp->cp_crypt = ZIO_CRYPT_ON_VALUE; 213eda14cbcSMatt Macy 214eda14cbcSMatt Macy /* create the wrapping key from the raw data */ 215eda14cbcSMatt Macy if (wkeydata != NULL) { 216eda14cbcSMatt Macy /* create the wrapping key with the verified parameters */ 217eda14cbcSMatt Macy dsl_wrapping_key_create(wkeydata, keyformat, salt, 218eda14cbcSMatt Macy iters, &wkey); 219eda14cbcSMatt Macy dcp->cp_wkey = wkey; 220eda14cbcSMatt Macy } 221eda14cbcSMatt Macy 222eda14cbcSMatt Macy /* 223eda14cbcSMatt Macy * Remove the encryption properties from the nvlist since they are not 224eda14cbcSMatt Macy * maintained through the DSL. 225eda14cbcSMatt Macy */ 226eda14cbcSMatt Macy (void) nvlist_remove_all(props, zfs_prop_to_name(ZFS_PROP_ENCRYPTION)); 227eda14cbcSMatt Macy (void) nvlist_remove_all(props, zfs_prop_to_name(ZFS_PROP_KEYFORMAT)); 228eda14cbcSMatt Macy (void) nvlist_remove_all(props, zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT)); 229eda14cbcSMatt Macy (void) nvlist_remove_all(props, 230eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS)); 231eda14cbcSMatt Macy 232eda14cbcSMatt Macy *dcp_out = dcp; 233eda14cbcSMatt Macy 234eda14cbcSMatt Macy return (0); 235eda14cbcSMatt Macy 236eda14cbcSMatt Macy error: 237eda14cbcSMatt Macy kmem_free(dcp, sizeof (dsl_crypto_params_t)); 238eda14cbcSMatt Macy *dcp_out = NULL; 239eda14cbcSMatt Macy return (ret); 240eda14cbcSMatt Macy } 241eda14cbcSMatt Macy 242eda14cbcSMatt Macy void 243eda14cbcSMatt Macy dsl_crypto_params_free(dsl_crypto_params_t *dcp, boolean_t unload) 244eda14cbcSMatt Macy { 245eda14cbcSMatt Macy if (dcp == NULL) 246eda14cbcSMatt Macy return; 247eda14cbcSMatt Macy 248eda14cbcSMatt Macy if (dcp->cp_keylocation != NULL) 249eda14cbcSMatt Macy spa_strfree(dcp->cp_keylocation); 250eda14cbcSMatt Macy if (unload && dcp->cp_wkey != NULL) 251eda14cbcSMatt Macy dsl_wrapping_key_free(dcp->cp_wkey); 252eda14cbcSMatt Macy 253eda14cbcSMatt Macy kmem_free(dcp, sizeof (dsl_crypto_params_t)); 254eda14cbcSMatt Macy } 255eda14cbcSMatt Macy 256eda14cbcSMatt Macy static int 257eda14cbcSMatt Macy spa_crypto_key_compare(const void *a, const void *b) 258eda14cbcSMatt Macy { 259eda14cbcSMatt Macy const dsl_crypto_key_t *dcka = a; 260eda14cbcSMatt Macy const dsl_crypto_key_t *dckb = b; 261eda14cbcSMatt Macy 262eda14cbcSMatt Macy if (dcka->dck_obj < dckb->dck_obj) 263eda14cbcSMatt Macy return (-1); 264eda14cbcSMatt Macy if (dcka->dck_obj > dckb->dck_obj) 265eda14cbcSMatt Macy return (1); 266eda14cbcSMatt Macy return (0); 267eda14cbcSMatt Macy } 268eda14cbcSMatt Macy 2693494f7c0SMartin Matuska /* 2703494f7c0SMartin Matuska * this compares a crypto key based on zk_guid. See comment on 2713494f7c0SMartin Matuska * spa_crypto_key_compare for more information. 2723494f7c0SMartin Matuska */ 2733494f7c0SMartin Matuska boolean_t 2743494f7c0SMartin Matuska dmu_objset_crypto_key_equal(objset_t *osa, objset_t *osb) 2753494f7c0SMartin Matuska { 2763494f7c0SMartin Matuska dsl_crypto_key_t *dcka = NULL; 2773494f7c0SMartin Matuska dsl_crypto_key_t *dckb = NULL; 2783494f7c0SMartin Matuska uint64_t obja, objb; 2793494f7c0SMartin Matuska boolean_t equal; 2803494f7c0SMartin Matuska spa_t *spa; 2813494f7c0SMartin Matuska 2823494f7c0SMartin Matuska spa = dmu_objset_spa(osa); 2833494f7c0SMartin Matuska if (spa != dmu_objset_spa(osb)) 2843494f7c0SMartin Matuska return (B_FALSE); 2853494f7c0SMartin Matuska obja = dmu_objset_ds(osa)->ds_object; 2863494f7c0SMartin Matuska objb = dmu_objset_ds(osb)->ds_object; 2873494f7c0SMartin Matuska 2883494f7c0SMartin Matuska if (spa_keystore_lookup_key(spa, obja, FTAG, &dcka) != 0) 2893494f7c0SMartin Matuska return (B_FALSE); 2903494f7c0SMartin Matuska if (spa_keystore_lookup_key(spa, objb, FTAG, &dckb) != 0) { 2913494f7c0SMartin Matuska spa_keystore_dsl_key_rele(spa, dcka, FTAG); 2923494f7c0SMartin Matuska return (B_FALSE); 2933494f7c0SMartin Matuska } 2943494f7c0SMartin Matuska 2953494f7c0SMartin Matuska equal = (dcka->dck_key.zk_guid == dckb->dck_key.zk_guid); 2963494f7c0SMartin Matuska 2973494f7c0SMartin Matuska spa_keystore_dsl_key_rele(spa, dcka, FTAG); 2983494f7c0SMartin Matuska spa_keystore_dsl_key_rele(spa, dckb, FTAG); 2993494f7c0SMartin Matuska 3003494f7c0SMartin Matuska return (equal); 3013494f7c0SMartin Matuska } 3023494f7c0SMartin Matuska 303eda14cbcSMatt Macy static int 304eda14cbcSMatt Macy spa_key_mapping_compare(const void *a, const void *b) 305eda14cbcSMatt Macy { 306eda14cbcSMatt Macy const dsl_key_mapping_t *kma = a; 307eda14cbcSMatt Macy const dsl_key_mapping_t *kmb = b; 308eda14cbcSMatt Macy 309eda14cbcSMatt Macy if (kma->km_dsobj < kmb->km_dsobj) 310eda14cbcSMatt Macy return (-1); 311eda14cbcSMatt Macy if (kma->km_dsobj > kmb->km_dsobj) 312eda14cbcSMatt Macy return (1); 313eda14cbcSMatt Macy return (0); 314eda14cbcSMatt Macy } 315eda14cbcSMatt Macy 316eda14cbcSMatt Macy static int 317eda14cbcSMatt Macy spa_wkey_compare(const void *a, const void *b) 318eda14cbcSMatt Macy { 319eda14cbcSMatt Macy const dsl_wrapping_key_t *wka = a; 320eda14cbcSMatt Macy const dsl_wrapping_key_t *wkb = b; 321eda14cbcSMatt Macy 322eda14cbcSMatt Macy if (wka->wk_ddobj < wkb->wk_ddobj) 323eda14cbcSMatt Macy return (-1); 324eda14cbcSMatt Macy if (wka->wk_ddobj > wkb->wk_ddobj) 325eda14cbcSMatt Macy return (1); 326eda14cbcSMatt Macy return (0); 327eda14cbcSMatt Macy } 328eda14cbcSMatt Macy 329eda14cbcSMatt Macy void 330eda14cbcSMatt Macy spa_keystore_init(spa_keystore_t *sk) 331eda14cbcSMatt Macy { 332eda14cbcSMatt Macy rw_init(&sk->sk_dk_lock, NULL, RW_DEFAULT, NULL); 333eda14cbcSMatt Macy rw_init(&sk->sk_km_lock, NULL, RW_DEFAULT, NULL); 334eda14cbcSMatt Macy rw_init(&sk->sk_wkeys_lock, NULL, RW_DEFAULT, NULL); 335eda14cbcSMatt Macy avl_create(&sk->sk_dsl_keys, spa_crypto_key_compare, 336eda14cbcSMatt Macy sizeof (dsl_crypto_key_t), 337eda14cbcSMatt Macy offsetof(dsl_crypto_key_t, dck_avl_link)); 338eda14cbcSMatt Macy avl_create(&sk->sk_key_mappings, spa_key_mapping_compare, 339eda14cbcSMatt Macy sizeof (dsl_key_mapping_t), 340eda14cbcSMatt Macy offsetof(dsl_key_mapping_t, km_avl_link)); 341eda14cbcSMatt Macy avl_create(&sk->sk_wkeys, spa_wkey_compare, sizeof (dsl_wrapping_key_t), 342eda14cbcSMatt Macy offsetof(dsl_wrapping_key_t, wk_avl_link)); 343eda14cbcSMatt Macy } 344eda14cbcSMatt Macy 345eda14cbcSMatt Macy void 346eda14cbcSMatt Macy spa_keystore_fini(spa_keystore_t *sk) 347eda14cbcSMatt Macy { 348eda14cbcSMatt Macy dsl_wrapping_key_t *wkey; 349eda14cbcSMatt Macy void *cookie = NULL; 350eda14cbcSMatt Macy 351eda14cbcSMatt Macy ASSERT(avl_is_empty(&sk->sk_dsl_keys)); 352eda14cbcSMatt Macy ASSERT(avl_is_empty(&sk->sk_key_mappings)); 353eda14cbcSMatt Macy 354eda14cbcSMatt Macy while ((wkey = avl_destroy_nodes(&sk->sk_wkeys, &cookie)) != NULL) 355eda14cbcSMatt Macy dsl_wrapping_key_free(wkey); 356eda14cbcSMatt Macy 357eda14cbcSMatt Macy avl_destroy(&sk->sk_wkeys); 358eda14cbcSMatt Macy avl_destroy(&sk->sk_key_mappings); 359eda14cbcSMatt Macy avl_destroy(&sk->sk_dsl_keys); 360eda14cbcSMatt Macy rw_destroy(&sk->sk_wkeys_lock); 361eda14cbcSMatt Macy rw_destroy(&sk->sk_km_lock); 362eda14cbcSMatt Macy rw_destroy(&sk->sk_dk_lock); 363eda14cbcSMatt Macy } 364eda14cbcSMatt Macy 365eda14cbcSMatt Macy static int 366eda14cbcSMatt Macy dsl_dir_get_encryption_root_ddobj(dsl_dir_t *dd, uint64_t *rddobj) 367eda14cbcSMatt Macy { 368eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) 369eda14cbcSMatt Macy return (SET_ERROR(ENOENT)); 370eda14cbcSMatt Macy 371eda14cbcSMatt Macy return (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 372eda14cbcSMatt Macy DSL_CRYPTO_KEY_ROOT_DDOBJ, 8, 1, rddobj)); 373eda14cbcSMatt Macy } 374eda14cbcSMatt Macy 375eda14cbcSMatt Macy static int 376eda14cbcSMatt Macy dsl_dir_get_encryption_version(dsl_dir_t *dd, uint64_t *version) 377eda14cbcSMatt Macy { 378eda14cbcSMatt Macy *version = 0; 379eda14cbcSMatt Macy 380eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) 381eda14cbcSMatt Macy return (SET_ERROR(ENOENT)); 382eda14cbcSMatt Macy 383eda14cbcSMatt Macy /* version 0 is implied by ENOENT */ 384eda14cbcSMatt Macy (void) zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 385eda14cbcSMatt Macy DSL_CRYPTO_KEY_VERSION, 8, 1, version); 386eda14cbcSMatt Macy 387eda14cbcSMatt Macy return (0); 388eda14cbcSMatt Macy } 389eda14cbcSMatt Macy 390eda14cbcSMatt Macy boolean_t 391eda14cbcSMatt Macy dsl_dir_incompatible_encryption_version(dsl_dir_t *dd) 392eda14cbcSMatt Macy { 393eda14cbcSMatt Macy int ret; 394eda14cbcSMatt Macy uint64_t version = 0; 395eda14cbcSMatt Macy 396eda14cbcSMatt Macy ret = dsl_dir_get_encryption_version(dd, &version); 397eda14cbcSMatt Macy if (ret != 0) 398eda14cbcSMatt Macy return (B_FALSE); 399eda14cbcSMatt Macy 400eda14cbcSMatt Macy return (version != ZIO_CRYPT_KEY_CURRENT_VERSION); 401eda14cbcSMatt Macy } 402eda14cbcSMatt Macy 403eda14cbcSMatt Macy static int 404eda14cbcSMatt Macy spa_keystore_wkey_hold_ddobj_impl(spa_t *spa, uint64_t ddobj, 405a0b956f5SMartin Matuska const void *tag, dsl_wrapping_key_t **wkey_out) 406eda14cbcSMatt Macy { 407eda14cbcSMatt Macy int ret; 408eda14cbcSMatt Macy dsl_wrapping_key_t search_wkey; 409eda14cbcSMatt Macy dsl_wrapping_key_t *found_wkey; 410eda14cbcSMatt Macy 411eda14cbcSMatt Macy ASSERT(RW_LOCK_HELD(&spa->spa_keystore.sk_wkeys_lock)); 412eda14cbcSMatt Macy 413eda14cbcSMatt Macy /* init the search wrapping key */ 414eda14cbcSMatt Macy search_wkey.wk_ddobj = ddobj; 415eda14cbcSMatt Macy 416eda14cbcSMatt Macy /* lookup the wrapping key */ 417eda14cbcSMatt Macy found_wkey = avl_find(&spa->spa_keystore.sk_wkeys, &search_wkey, NULL); 418eda14cbcSMatt Macy if (!found_wkey) { 419eda14cbcSMatt Macy ret = SET_ERROR(ENOENT); 420eda14cbcSMatt Macy goto error; 421eda14cbcSMatt Macy } 422eda14cbcSMatt Macy 423eda14cbcSMatt Macy /* increment the refcount */ 424eda14cbcSMatt Macy dsl_wrapping_key_hold(found_wkey, tag); 425eda14cbcSMatt Macy 426eda14cbcSMatt Macy *wkey_out = found_wkey; 427eda14cbcSMatt Macy return (0); 428eda14cbcSMatt Macy 429eda14cbcSMatt Macy error: 430eda14cbcSMatt Macy *wkey_out = NULL; 431eda14cbcSMatt Macy return (ret); 432eda14cbcSMatt Macy } 433eda14cbcSMatt Macy 434eda14cbcSMatt Macy static int 435a0b956f5SMartin Matuska spa_keystore_wkey_hold_dd(spa_t *spa, dsl_dir_t *dd, const void *tag, 436eda14cbcSMatt Macy dsl_wrapping_key_t **wkey_out) 437eda14cbcSMatt Macy { 438eda14cbcSMatt Macy int ret; 439eda14cbcSMatt Macy dsl_wrapping_key_t *wkey; 440eda14cbcSMatt Macy uint64_t rddobj; 441eda14cbcSMatt Macy boolean_t locked = B_FALSE; 442eda14cbcSMatt Macy 443eda14cbcSMatt Macy if (!RW_WRITE_HELD(&spa->spa_keystore.sk_wkeys_lock)) { 444eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_wkeys_lock, RW_READER); 445eda14cbcSMatt Macy locked = B_TRUE; 446eda14cbcSMatt Macy } 447eda14cbcSMatt Macy 448eda14cbcSMatt Macy /* get the ddobj that the keylocation property was inherited from */ 449eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &rddobj); 450eda14cbcSMatt Macy if (ret != 0) 451eda14cbcSMatt Macy goto error; 452eda14cbcSMatt Macy 453eda14cbcSMatt Macy /* lookup the wkey in the avl tree */ 454eda14cbcSMatt Macy ret = spa_keystore_wkey_hold_ddobj_impl(spa, rddobj, tag, &wkey); 455eda14cbcSMatt Macy if (ret != 0) 456eda14cbcSMatt Macy goto error; 457eda14cbcSMatt Macy 458eda14cbcSMatt Macy /* unlock the wkey tree if we locked it */ 459eda14cbcSMatt Macy if (locked) 460eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 461eda14cbcSMatt Macy 462eda14cbcSMatt Macy *wkey_out = wkey; 463eda14cbcSMatt Macy return (0); 464eda14cbcSMatt Macy 465eda14cbcSMatt Macy error: 466eda14cbcSMatt Macy if (locked) 467eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 468eda14cbcSMatt Macy 469eda14cbcSMatt Macy *wkey_out = NULL; 470eda14cbcSMatt Macy return (ret); 471eda14cbcSMatt Macy } 472eda14cbcSMatt Macy 473eda14cbcSMatt Macy int 474eda14cbcSMatt Macy dsl_crypto_can_set_keylocation(const char *dsname, const char *keylocation) 475eda14cbcSMatt Macy { 476eda14cbcSMatt Macy int ret = 0; 477eda14cbcSMatt Macy dsl_dir_t *dd = NULL; 478eda14cbcSMatt Macy dsl_pool_t *dp = NULL; 479eda14cbcSMatt Macy uint64_t rddobj; 480eda14cbcSMatt Macy 481eda14cbcSMatt Macy /* hold the dsl dir */ 482eda14cbcSMatt Macy ret = dsl_pool_hold(dsname, FTAG, &dp); 483eda14cbcSMatt Macy if (ret != 0) 484eda14cbcSMatt Macy goto out; 485eda14cbcSMatt Macy 486eda14cbcSMatt Macy ret = dsl_dir_hold(dp, dsname, FTAG, &dd, NULL); 487eda14cbcSMatt Macy if (ret != 0) { 488eda14cbcSMatt Macy dd = NULL; 489eda14cbcSMatt Macy goto out; 490eda14cbcSMatt Macy } 491eda14cbcSMatt Macy 492eda14cbcSMatt Macy /* if dd is not encrypted, the value may only be "none" */ 493eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) { 494eda14cbcSMatt Macy if (strcmp(keylocation, "none") != 0) { 495eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 496eda14cbcSMatt Macy goto out; 497eda14cbcSMatt Macy } 498eda14cbcSMatt Macy 499eda14cbcSMatt Macy ret = 0; 500eda14cbcSMatt Macy goto out; 501eda14cbcSMatt Macy } 502eda14cbcSMatt Macy 503eda14cbcSMatt Macy /* check for a valid keylocation for encrypted datasets */ 504eda14cbcSMatt Macy if (!zfs_prop_valid_keylocation(keylocation, B_TRUE)) { 505eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 506eda14cbcSMatt Macy goto out; 507eda14cbcSMatt Macy } 508eda14cbcSMatt Macy 509eda14cbcSMatt Macy /* check that this is an encryption root */ 510eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &rddobj); 511eda14cbcSMatt Macy if (ret != 0) 512eda14cbcSMatt Macy goto out; 513eda14cbcSMatt Macy 514eda14cbcSMatt Macy if (rddobj != dd->dd_object) { 515eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 516eda14cbcSMatt Macy goto out; 517eda14cbcSMatt Macy } 518eda14cbcSMatt Macy 519eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 520eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 521eda14cbcSMatt Macy 522eda14cbcSMatt Macy return (0); 523eda14cbcSMatt Macy 524eda14cbcSMatt Macy out: 525eda14cbcSMatt Macy if (dd != NULL) 526eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 527eda14cbcSMatt Macy if (dp != NULL) 528eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 529eda14cbcSMatt Macy 530eda14cbcSMatt Macy return (ret); 531eda14cbcSMatt Macy } 532eda14cbcSMatt Macy 533eda14cbcSMatt Macy static void 534eda14cbcSMatt Macy dsl_crypto_key_free(dsl_crypto_key_t *dck) 535eda14cbcSMatt Macy { 536eda14cbcSMatt Macy ASSERT(zfs_refcount_count(&dck->dck_holds) == 0); 537eda14cbcSMatt Macy 538eda14cbcSMatt Macy /* destroy the zio_crypt_key_t */ 539eda14cbcSMatt Macy zio_crypt_key_destroy(&dck->dck_key); 540eda14cbcSMatt Macy 541eda14cbcSMatt Macy /* free the refcount, wrapping key, and lock */ 542eda14cbcSMatt Macy zfs_refcount_destroy(&dck->dck_holds); 543eda14cbcSMatt Macy if (dck->dck_wkey) 544eda14cbcSMatt Macy dsl_wrapping_key_rele(dck->dck_wkey, dck); 545eda14cbcSMatt Macy 546eda14cbcSMatt Macy /* free the key */ 547eda14cbcSMatt Macy kmem_free(dck, sizeof (dsl_crypto_key_t)); 548eda14cbcSMatt Macy } 549eda14cbcSMatt Macy 550eda14cbcSMatt Macy static void 551a0b956f5SMartin Matuska dsl_crypto_key_rele(dsl_crypto_key_t *dck, const void *tag) 552eda14cbcSMatt Macy { 553eda14cbcSMatt Macy if (zfs_refcount_remove(&dck->dck_holds, tag) == 0) 554eda14cbcSMatt Macy dsl_crypto_key_free(dck); 555eda14cbcSMatt Macy } 556eda14cbcSMatt Macy 557eda14cbcSMatt Macy static int 558eda14cbcSMatt Macy dsl_crypto_key_open(objset_t *mos, dsl_wrapping_key_t *wkey, 559a0b956f5SMartin Matuska uint64_t dckobj, const void *tag, dsl_crypto_key_t **dck_out) 560eda14cbcSMatt Macy { 561eda14cbcSMatt Macy int ret; 562eda14cbcSMatt Macy uint64_t crypt = 0, guid = 0, version = 0; 563eda14cbcSMatt Macy uint8_t raw_keydata[MASTER_KEY_MAX_LEN]; 564eda14cbcSMatt Macy uint8_t raw_hmac_keydata[SHA512_HMAC_KEYLEN]; 565eda14cbcSMatt Macy uint8_t iv[WRAPPING_IV_LEN]; 566eda14cbcSMatt Macy uint8_t mac[WRAPPING_MAC_LEN]; 567eda14cbcSMatt Macy dsl_crypto_key_t *dck; 568eda14cbcSMatt Macy 569eda14cbcSMatt Macy /* allocate and initialize the key */ 570eda14cbcSMatt Macy dck = kmem_zalloc(sizeof (dsl_crypto_key_t), KM_SLEEP); 571eda14cbcSMatt Macy 572eda14cbcSMatt Macy /* fetch all of the values we need from the ZAP */ 573eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_CRYPTO_SUITE, 8, 1, 574eda14cbcSMatt Macy &crypt); 575eda14cbcSMatt Macy if (ret != 0) 576eda14cbcSMatt Macy goto error; 577eda14cbcSMatt Macy 5782a58b312SMartin Matuska /* handle a future crypto suite that we don't support */ 5792a58b312SMartin Matuska if (crypt >= ZIO_CRYPT_FUNCTIONS) { 5802a58b312SMartin Matuska ret = (SET_ERROR(ZFS_ERR_CRYPTO_NOTSUP)); 5812a58b312SMartin Matuska goto error; 5822a58b312SMartin Matuska } 5832a58b312SMartin Matuska 584eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_GUID, 8, 1, &guid); 585eda14cbcSMatt Macy if (ret != 0) 586eda14cbcSMatt Macy goto error; 587eda14cbcSMatt Macy 588eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_MASTER_KEY, 1, 589eda14cbcSMatt Macy MASTER_KEY_MAX_LEN, raw_keydata); 590eda14cbcSMatt Macy if (ret != 0) 591eda14cbcSMatt Macy goto error; 592eda14cbcSMatt Macy 593eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_HMAC_KEY, 1, 594eda14cbcSMatt Macy SHA512_HMAC_KEYLEN, raw_hmac_keydata); 595eda14cbcSMatt Macy if (ret != 0) 596eda14cbcSMatt Macy goto error; 597eda14cbcSMatt Macy 598eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_IV, 1, WRAPPING_IV_LEN, 599eda14cbcSMatt Macy iv); 600eda14cbcSMatt Macy if (ret != 0) 601eda14cbcSMatt Macy goto error; 602eda14cbcSMatt Macy 603eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_MAC, 1, WRAPPING_MAC_LEN, 604eda14cbcSMatt Macy mac); 605eda14cbcSMatt Macy if (ret != 0) 606eda14cbcSMatt Macy goto error; 607eda14cbcSMatt Macy 608eda14cbcSMatt Macy /* the initial on-disk format for encryption did not have a version */ 609eda14cbcSMatt Macy (void) zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_VERSION, 8, 1, &version); 610eda14cbcSMatt Macy 611eda14cbcSMatt Macy /* 612eda14cbcSMatt Macy * Unwrap the keys. If there is an error return EACCES to indicate 613eda14cbcSMatt Macy * an authentication failure. 614eda14cbcSMatt Macy */ 615eda14cbcSMatt Macy ret = zio_crypt_key_unwrap(&wkey->wk_key, crypt, version, guid, 616eda14cbcSMatt Macy raw_keydata, raw_hmac_keydata, iv, mac, &dck->dck_key); 617eda14cbcSMatt Macy if (ret != 0) { 618eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 619eda14cbcSMatt Macy goto error; 620eda14cbcSMatt Macy } 621eda14cbcSMatt Macy 622eda14cbcSMatt Macy /* finish initializing the dsl_crypto_key_t */ 623eda14cbcSMatt Macy zfs_refcount_create(&dck->dck_holds); 624eda14cbcSMatt Macy dsl_wrapping_key_hold(wkey, dck); 625eda14cbcSMatt Macy dck->dck_wkey = wkey; 626eda14cbcSMatt Macy dck->dck_obj = dckobj; 627eda14cbcSMatt Macy zfs_refcount_add(&dck->dck_holds, tag); 628eda14cbcSMatt Macy 629eda14cbcSMatt Macy *dck_out = dck; 630eda14cbcSMatt Macy return (0); 631eda14cbcSMatt Macy 632eda14cbcSMatt Macy error: 633eda14cbcSMatt Macy if (dck != NULL) { 634da5137abSMartin Matuska memset(dck, 0, sizeof (dsl_crypto_key_t)); 635eda14cbcSMatt Macy kmem_free(dck, sizeof (dsl_crypto_key_t)); 636eda14cbcSMatt Macy } 637eda14cbcSMatt Macy 638eda14cbcSMatt Macy *dck_out = NULL; 639eda14cbcSMatt Macy return (ret); 640eda14cbcSMatt Macy } 641eda14cbcSMatt Macy 642eda14cbcSMatt Macy static int 643a0b956f5SMartin Matuska spa_keystore_dsl_key_hold_impl(spa_t *spa, uint64_t dckobj, const void *tag, 644eda14cbcSMatt Macy dsl_crypto_key_t **dck_out) 645eda14cbcSMatt Macy { 646eda14cbcSMatt Macy int ret; 647eda14cbcSMatt Macy dsl_crypto_key_t search_dck; 648eda14cbcSMatt Macy dsl_crypto_key_t *found_dck; 649eda14cbcSMatt Macy 650eda14cbcSMatt Macy ASSERT(RW_LOCK_HELD(&spa->spa_keystore.sk_dk_lock)); 651eda14cbcSMatt Macy 652eda14cbcSMatt Macy /* init the search key */ 653eda14cbcSMatt Macy search_dck.dck_obj = dckobj; 654eda14cbcSMatt Macy 655eda14cbcSMatt Macy /* find the matching key in the keystore */ 656eda14cbcSMatt Macy found_dck = avl_find(&spa->spa_keystore.sk_dsl_keys, &search_dck, NULL); 657eda14cbcSMatt Macy if (!found_dck) { 658eda14cbcSMatt Macy ret = SET_ERROR(ENOENT); 659eda14cbcSMatt Macy goto error; 660eda14cbcSMatt Macy } 661eda14cbcSMatt Macy 662eda14cbcSMatt Macy /* increment the refcount */ 663eda14cbcSMatt Macy zfs_refcount_add(&found_dck->dck_holds, tag); 664eda14cbcSMatt Macy 665eda14cbcSMatt Macy *dck_out = found_dck; 666eda14cbcSMatt Macy return (0); 667eda14cbcSMatt Macy 668eda14cbcSMatt Macy error: 669eda14cbcSMatt Macy *dck_out = NULL; 670eda14cbcSMatt Macy return (ret); 671eda14cbcSMatt Macy } 672eda14cbcSMatt Macy 673eda14cbcSMatt Macy static int 674a0b956f5SMartin Matuska spa_keystore_dsl_key_hold_dd(spa_t *spa, dsl_dir_t *dd, const void *tag, 675eda14cbcSMatt Macy dsl_crypto_key_t **dck_out) 676eda14cbcSMatt Macy { 677eda14cbcSMatt Macy int ret; 678eda14cbcSMatt Macy avl_index_t where; 679eda14cbcSMatt Macy dsl_crypto_key_t *dck_io = NULL, *dck_ks = NULL; 680eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = NULL; 681eda14cbcSMatt Macy uint64_t dckobj = dd->dd_crypto_obj; 682eda14cbcSMatt Macy 683eda14cbcSMatt Macy /* Lookup the key in the tree of currently loaded keys */ 684eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_dk_lock, RW_READER); 685eda14cbcSMatt Macy ret = spa_keystore_dsl_key_hold_impl(spa, dckobj, tag, &dck_ks); 686eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_dk_lock); 687eda14cbcSMatt Macy if (ret == 0) { 688eda14cbcSMatt Macy *dck_out = dck_ks; 689eda14cbcSMatt Macy return (0); 690eda14cbcSMatt Macy } 691eda14cbcSMatt Macy 692eda14cbcSMatt Macy /* Lookup the wrapping key from the keystore */ 693eda14cbcSMatt Macy ret = spa_keystore_wkey_hold_dd(spa, dd, FTAG, &wkey); 694eda14cbcSMatt Macy if (ret != 0) { 695eda14cbcSMatt Macy *dck_out = NULL; 696eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 697eda14cbcSMatt Macy } 698eda14cbcSMatt Macy 699eda14cbcSMatt Macy /* Read the key from disk */ 700eda14cbcSMatt Macy ret = dsl_crypto_key_open(spa->spa_meta_objset, wkey, dckobj, 701eda14cbcSMatt Macy tag, &dck_io); 702eda14cbcSMatt Macy if (ret != 0) { 703eda14cbcSMatt Macy dsl_wrapping_key_rele(wkey, FTAG); 704eda14cbcSMatt Macy *dck_out = NULL; 705eda14cbcSMatt Macy return (ret); 706eda14cbcSMatt Macy } 707eda14cbcSMatt Macy 708eda14cbcSMatt Macy /* 709eda14cbcSMatt Macy * Add the key to the keystore. It may already exist if it was 710eda14cbcSMatt Macy * added while performing the read from disk. In this case discard 711eda14cbcSMatt Macy * it and return the key from the keystore. 712eda14cbcSMatt Macy */ 713eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_dk_lock, RW_WRITER); 714eda14cbcSMatt Macy ret = spa_keystore_dsl_key_hold_impl(spa, dckobj, tag, &dck_ks); 715eda14cbcSMatt Macy if (ret != 0) { 716eda14cbcSMatt Macy avl_find(&spa->spa_keystore.sk_dsl_keys, dck_io, &where); 717eda14cbcSMatt Macy avl_insert(&spa->spa_keystore.sk_dsl_keys, dck_io, where); 718eda14cbcSMatt Macy *dck_out = dck_io; 719eda14cbcSMatt Macy } else { 720*7a7741afSMartin Matuska dsl_crypto_key_rele(dck_io, tag); 721eda14cbcSMatt Macy *dck_out = dck_ks; 722eda14cbcSMatt Macy } 723eda14cbcSMatt Macy 724eda14cbcSMatt Macy /* Release the wrapping key (the dsl key now has a reference to it) */ 725eda14cbcSMatt Macy dsl_wrapping_key_rele(wkey, FTAG); 726eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_dk_lock); 727eda14cbcSMatt Macy 728eda14cbcSMatt Macy return (0); 729eda14cbcSMatt Macy } 730eda14cbcSMatt Macy 731eda14cbcSMatt Macy void 732a0b956f5SMartin Matuska spa_keystore_dsl_key_rele(spa_t *spa, dsl_crypto_key_t *dck, const void *tag) 733eda14cbcSMatt Macy { 734eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_dk_lock, RW_WRITER); 735eda14cbcSMatt Macy 736eda14cbcSMatt Macy if (zfs_refcount_remove(&dck->dck_holds, tag) == 0) { 737eda14cbcSMatt Macy avl_remove(&spa->spa_keystore.sk_dsl_keys, dck); 738eda14cbcSMatt Macy dsl_crypto_key_free(dck); 739eda14cbcSMatt Macy } 740eda14cbcSMatt Macy 741eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_dk_lock); 742eda14cbcSMatt Macy } 743eda14cbcSMatt Macy 744eda14cbcSMatt Macy int 745eda14cbcSMatt Macy spa_keystore_load_wkey_impl(spa_t *spa, dsl_wrapping_key_t *wkey) 746eda14cbcSMatt Macy { 747eda14cbcSMatt Macy int ret; 748eda14cbcSMatt Macy avl_index_t where; 749eda14cbcSMatt Macy dsl_wrapping_key_t *found_wkey; 750eda14cbcSMatt Macy 751eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_wkeys_lock, RW_WRITER); 752eda14cbcSMatt Macy 753eda14cbcSMatt Macy /* insert the wrapping key into the keystore */ 754eda14cbcSMatt Macy found_wkey = avl_find(&spa->spa_keystore.sk_wkeys, wkey, &where); 755eda14cbcSMatt Macy if (found_wkey != NULL) { 756eda14cbcSMatt Macy ret = SET_ERROR(EEXIST); 757eda14cbcSMatt Macy goto error_unlock; 758eda14cbcSMatt Macy } 759eda14cbcSMatt Macy avl_insert(&spa->spa_keystore.sk_wkeys, wkey, where); 760eda14cbcSMatt Macy 761eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 762eda14cbcSMatt Macy 763eda14cbcSMatt Macy return (0); 764eda14cbcSMatt Macy 765eda14cbcSMatt Macy error_unlock: 766eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 767eda14cbcSMatt Macy return (ret); 768eda14cbcSMatt Macy } 769eda14cbcSMatt Macy 770eda14cbcSMatt Macy int 771eda14cbcSMatt Macy spa_keystore_load_wkey(const char *dsname, dsl_crypto_params_t *dcp, 772eda14cbcSMatt Macy boolean_t noop) 773eda14cbcSMatt Macy { 774eda14cbcSMatt Macy int ret; 775eda14cbcSMatt Macy dsl_dir_t *dd = NULL; 776eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 777eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = dcp->cp_wkey; 778eda14cbcSMatt Macy dsl_pool_t *dp = NULL; 779eda14cbcSMatt Macy uint64_t rddobj, keyformat, salt, iters; 780eda14cbcSMatt Macy 781eda14cbcSMatt Macy /* 782eda14cbcSMatt Macy * We don't validate the wrapping key's keyformat, salt, or iters 783eda14cbcSMatt Macy * since they will never be needed after the DCK has been wrapped. 784eda14cbcSMatt Macy */ 785eda14cbcSMatt Macy if (dcp->cp_wkey == NULL || 786eda14cbcSMatt Macy dcp->cp_cmd != DCP_CMD_NONE || 787eda14cbcSMatt Macy dcp->cp_crypt != ZIO_CRYPT_INHERIT || 788eda14cbcSMatt Macy dcp->cp_keylocation != NULL) 789eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 790eda14cbcSMatt Macy 791eda14cbcSMatt Macy ret = dsl_pool_hold(dsname, FTAG, &dp); 792eda14cbcSMatt Macy if (ret != 0) 793eda14cbcSMatt Macy goto error; 794eda14cbcSMatt Macy 795eda14cbcSMatt Macy if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_ENCRYPTION)) { 796eda14cbcSMatt Macy ret = SET_ERROR(ENOTSUP); 797eda14cbcSMatt Macy goto error; 798eda14cbcSMatt Macy } 799eda14cbcSMatt Macy 800eda14cbcSMatt Macy /* hold the dsl dir */ 801eda14cbcSMatt Macy ret = dsl_dir_hold(dp, dsname, FTAG, &dd, NULL); 802eda14cbcSMatt Macy if (ret != 0) { 803eda14cbcSMatt Macy dd = NULL; 804eda14cbcSMatt Macy goto error; 805eda14cbcSMatt Macy } 806eda14cbcSMatt Macy 807eda14cbcSMatt Macy /* confirm that dd is the encryption root */ 808eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &rddobj); 809eda14cbcSMatt Macy if (ret != 0 || rddobj != dd->dd_object) { 810eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 811eda14cbcSMatt Macy goto error; 812eda14cbcSMatt Macy } 813eda14cbcSMatt Macy 814eda14cbcSMatt Macy /* initialize the wkey's ddobj */ 815eda14cbcSMatt Macy wkey->wk_ddobj = dd->dd_object; 816eda14cbcSMatt Macy 817eda14cbcSMatt Macy /* verify that the wkey is correct by opening its dsl key */ 818eda14cbcSMatt Macy ret = dsl_crypto_key_open(dp->dp_meta_objset, wkey, 819eda14cbcSMatt Macy dd->dd_crypto_obj, FTAG, &dck); 820eda14cbcSMatt Macy if (ret != 0) 821eda14cbcSMatt Macy goto error; 822eda14cbcSMatt Macy 823eda14cbcSMatt Macy /* initialize the wkey encryption parameters from the DSL Crypto Key */ 824eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, dd->dd_crypto_obj, 825eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYFORMAT), 8, 1, &keyformat); 826eda14cbcSMatt Macy if (ret != 0) 827eda14cbcSMatt Macy goto error; 828eda14cbcSMatt Macy 829eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, dd->dd_crypto_obj, 830eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), 8, 1, &salt); 831eda14cbcSMatt Macy if (ret != 0) 832eda14cbcSMatt Macy goto error; 833eda14cbcSMatt Macy 834eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, dd->dd_crypto_obj, 835eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), 8, 1, &iters); 836eda14cbcSMatt Macy if (ret != 0) 837eda14cbcSMatt Macy goto error; 838eda14cbcSMatt Macy 839eda14cbcSMatt Macy ASSERT3U(keyformat, <, ZFS_KEYFORMAT_FORMATS); 840eda14cbcSMatt Macy ASSERT3U(keyformat, !=, ZFS_KEYFORMAT_NONE); 841eda14cbcSMatt Macy IMPLY(keyformat == ZFS_KEYFORMAT_PASSPHRASE, iters != 0); 842eda14cbcSMatt Macy IMPLY(keyformat == ZFS_KEYFORMAT_PASSPHRASE, salt != 0); 843eda14cbcSMatt Macy IMPLY(keyformat != ZFS_KEYFORMAT_PASSPHRASE, iters == 0); 844eda14cbcSMatt Macy IMPLY(keyformat != ZFS_KEYFORMAT_PASSPHRASE, salt == 0); 845eda14cbcSMatt Macy 846eda14cbcSMatt Macy wkey->wk_keyformat = keyformat; 847eda14cbcSMatt Macy wkey->wk_salt = salt; 848eda14cbcSMatt Macy wkey->wk_iters = iters; 849eda14cbcSMatt Macy 850eda14cbcSMatt Macy /* 851eda14cbcSMatt Macy * At this point we have verified the wkey and confirmed that it can 852eda14cbcSMatt Macy * be used to decrypt a DSL Crypto Key. We can simply cleanup and 853eda14cbcSMatt Macy * return if this is all the user wanted to do. 854eda14cbcSMatt Macy */ 855eda14cbcSMatt Macy if (noop) 856eda14cbcSMatt Macy goto error; 857eda14cbcSMatt Macy 858eda14cbcSMatt Macy /* insert the wrapping key into the keystore */ 859eda14cbcSMatt Macy ret = spa_keystore_load_wkey_impl(dp->dp_spa, wkey); 860eda14cbcSMatt Macy if (ret != 0) 861eda14cbcSMatt Macy goto error; 862eda14cbcSMatt Macy 863eda14cbcSMatt Macy dsl_crypto_key_rele(dck, FTAG); 864eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 865eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 866eda14cbcSMatt Macy 867eda14cbcSMatt Macy /* create any zvols under this ds */ 868eda14cbcSMatt Macy zvol_create_minors_recursive(dsname); 869eda14cbcSMatt Macy 870eda14cbcSMatt Macy return (0); 871eda14cbcSMatt Macy 872eda14cbcSMatt Macy error: 873eda14cbcSMatt Macy if (dck != NULL) 874eda14cbcSMatt Macy dsl_crypto_key_rele(dck, FTAG); 875eda14cbcSMatt Macy if (dd != NULL) 876eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 877eda14cbcSMatt Macy if (dp != NULL) 878eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 879eda14cbcSMatt Macy 880eda14cbcSMatt Macy return (ret); 881eda14cbcSMatt Macy } 882eda14cbcSMatt Macy 883eda14cbcSMatt Macy int 884eda14cbcSMatt Macy spa_keystore_unload_wkey_impl(spa_t *spa, uint64_t ddobj) 885eda14cbcSMatt Macy { 886eda14cbcSMatt Macy int ret; 887eda14cbcSMatt Macy dsl_wrapping_key_t search_wkey; 888eda14cbcSMatt Macy dsl_wrapping_key_t *found_wkey; 889eda14cbcSMatt Macy 890eda14cbcSMatt Macy /* init the search wrapping key */ 891eda14cbcSMatt Macy search_wkey.wk_ddobj = ddobj; 892eda14cbcSMatt Macy 893eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_wkeys_lock, RW_WRITER); 894eda14cbcSMatt Macy 895eda14cbcSMatt Macy /* remove the wrapping key from the keystore */ 896eda14cbcSMatt Macy found_wkey = avl_find(&spa->spa_keystore.sk_wkeys, 897eda14cbcSMatt Macy &search_wkey, NULL); 898eda14cbcSMatt Macy if (!found_wkey) { 899eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 900eda14cbcSMatt Macy goto error_unlock; 901eda14cbcSMatt Macy } else if (zfs_refcount_count(&found_wkey->wk_refcnt) != 0) { 902eda14cbcSMatt Macy ret = SET_ERROR(EBUSY); 903eda14cbcSMatt Macy goto error_unlock; 904eda14cbcSMatt Macy } 905eda14cbcSMatt Macy avl_remove(&spa->spa_keystore.sk_wkeys, found_wkey); 906eda14cbcSMatt Macy 907eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 908eda14cbcSMatt Macy 909eda14cbcSMatt Macy /* free the wrapping key */ 910eda14cbcSMatt Macy dsl_wrapping_key_free(found_wkey); 911eda14cbcSMatt Macy 912eda14cbcSMatt Macy return (0); 913eda14cbcSMatt Macy 914eda14cbcSMatt Macy error_unlock: 915eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 916eda14cbcSMatt Macy return (ret); 917eda14cbcSMatt Macy } 918eda14cbcSMatt Macy 919eda14cbcSMatt Macy int 920eda14cbcSMatt Macy spa_keystore_unload_wkey(const char *dsname) 921eda14cbcSMatt Macy { 922eda14cbcSMatt Macy int ret = 0; 923eda14cbcSMatt Macy dsl_dir_t *dd = NULL; 924eda14cbcSMatt Macy dsl_pool_t *dp = NULL; 925eda14cbcSMatt Macy spa_t *spa = NULL; 926eda14cbcSMatt Macy 927eda14cbcSMatt Macy ret = spa_open(dsname, &spa, FTAG); 928eda14cbcSMatt Macy if (ret != 0) 929eda14cbcSMatt Macy return (ret); 930eda14cbcSMatt Macy 931eda14cbcSMatt Macy /* 932eda14cbcSMatt Macy * Wait for any outstanding txg IO to complete, releasing any 933eda14cbcSMatt Macy * remaining references on the wkey. 934eda14cbcSMatt Macy */ 935eda14cbcSMatt Macy if (spa_mode(spa) != SPA_MODE_READ) 936eda14cbcSMatt Macy txg_wait_synced(spa->spa_dsl_pool, 0); 937eda14cbcSMatt Macy 938eda14cbcSMatt Macy spa_close(spa, FTAG); 939eda14cbcSMatt Macy 940eda14cbcSMatt Macy /* hold the dsl dir */ 941eda14cbcSMatt Macy ret = dsl_pool_hold(dsname, FTAG, &dp); 942eda14cbcSMatt Macy if (ret != 0) 943eda14cbcSMatt Macy goto error; 944eda14cbcSMatt Macy 945eda14cbcSMatt Macy if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_ENCRYPTION)) { 946eda14cbcSMatt Macy ret = (SET_ERROR(ENOTSUP)); 947eda14cbcSMatt Macy goto error; 948eda14cbcSMatt Macy } 949eda14cbcSMatt Macy 950eda14cbcSMatt Macy ret = dsl_dir_hold(dp, dsname, FTAG, &dd, NULL); 951eda14cbcSMatt Macy if (ret != 0) { 952eda14cbcSMatt Macy dd = NULL; 953eda14cbcSMatt Macy goto error; 954eda14cbcSMatt Macy } 955eda14cbcSMatt Macy 956eda14cbcSMatt Macy /* unload the wkey */ 957eda14cbcSMatt Macy ret = spa_keystore_unload_wkey_impl(dp->dp_spa, dd->dd_object); 958eda14cbcSMatt Macy if (ret != 0) 959eda14cbcSMatt Macy goto error; 960eda14cbcSMatt Macy 961eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 962eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 963eda14cbcSMatt Macy 964eda14cbcSMatt Macy /* remove any zvols under this ds */ 965eda14cbcSMatt Macy zvol_remove_minors(dp->dp_spa, dsname, B_TRUE); 966eda14cbcSMatt Macy 967eda14cbcSMatt Macy return (0); 968eda14cbcSMatt Macy 969eda14cbcSMatt Macy error: 970eda14cbcSMatt Macy if (dd != NULL) 971eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 972eda14cbcSMatt Macy if (dp != NULL) 973eda14cbcSMatt Macy dsl_pool_rele(dp, FTAG); 974eda14cbcSMatt Macy 975eda14cbcSMatt Macy return (ret); 976eda14cbcSMatt Macy } 977eda14cbcSMatt Macy 978eda14cbcSMatt Macy void 979a0b956f5SMartin Matuska key_mapping_add_ref(dsl_key_mapping_t *km, const void *tag) 980eda14cbcSMatt Macy { 981eda14cbcSMatt Macy ASSERT3U(zfs_refcount_count(&km->km_refcnt), >=, 1); 982eda14cbcSMatt Macy zfs_refcount_add(&km->km_refcnt, tag); 983eda14cbcSMatt Macy } 984eda14cbcSMatt Macy 985eda14cbcSMatt Macy /* 986eda14cbcSMatt Macy * The locking here is a little tricky to ensure we don't cause unnecessary 987eda14cbcSMatt Macy * performance problems. We want to release a key mapping whenever someone 988eda14cbcSMatt Macy * decrements the refcount to 0, but freeing the mapping requires removing 989eda14cbcSMatt Macy * it from the spa_keystore, which requires holding sk_km_lock as a writer. 990eda14cbcSMatt Macy * Most of the time we don't want to hold this lock as a writer, since the 991eda14cbcSMatt Macy * same lock is held as a reader for each IO that needs to encrypt / decrypt 992eda14cbcSMatt Macy * data for any dataset and in practice we will only actually free the 993eda14cbcSMatt Macy * mapping after unmounting a dataset. 994eda14cbcSMatt Macy */ 995eda14cbcSMatt Macy void 996a0b956f5SMartin Matuska key_mapping_rele(spa_t *spa, dsl_key_mapping_t *km, const void *tag) 997eda14cbcSMatt Macy { 998eda14cbcSMatt Macy ASSERT3U(zfs_refcount_count(&km->km_refcnt), >=, 1); 999eda14cbcSMatt Macy 1000eda14cbcSMatt Macy if (zfs_refcount_remove(&km->km_refcnt, tag) != 0) 1001eda14cbcSMatt Macy return; 1002eda14cbcSMatt Macy 1003eda14cbcSMatt Macy /* 1004eda14cbcSMatt Macy * We think we are going to need to free the mapping. Add a 1005eda14cbcSMatt Macy * reference to prevent most other releasers from thinking 1006eda14cbcSMatt Macy * this might be their responsibility. This is inherently 1007eda14cbcSMatt Macy * racy, so we will confirm that we are legitimately the 1008eda14cbcSMatt Macy * last holder once we have the sk_km_lock as a writer. 1009eda14cbcSMatt Macy */ 1010eda14cbcSMatt Macy zfs_refcount_add(&km->km_refcnt, FTAG); 1011eda14cbcSMatt Macy 1012eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_km_lock, RW_WRITER); 1013eda14cbcSMatt Macy if (zfs_refcount_remove(&km->km_refcnt, FTAG) != 0) { 1014eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1015eda14cbcSMatt Macy return; 1016eda14cbcSMatt Macy } 1017eda14cbcSMatt Macy 1018eda14cbcSMatt Macy avl_remove(&spa->spa_keystore.sk_key_mappings, km); 1019eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1020eda14cbcSMatt Macy 1021eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, km->km_key, km); 1022eda14cbcSMatt Macy zfs_refcount_destroy(&km->km_refcnt); 1023eda14cbcSMatt Macy kmem_free(km, sizeof (dsl_key_mapping_t)); 1024eda14cbcSMatt Macy } 1025eda14cbcSMatt Macy 1026eda14cbcSMatt Macy int 1027a0b956f5SMartin Matuska spa_keystore_create_mapping(spa_t *spa, dsl_dataset_t *ds, const void *tag, 1028eda14cbcSMatt Macy dsl_key_mapping_t **km_out) 1029eda14cbcSMatt Macy { 1030eda14cbcSMatt Macy int ret; 1031eda14cbcSMatt Macy avl_index_t where; 1032eda14cbcSMatt Macy dsl_key_mapping_t *km, *found_km; 1033eda14cbcSMatt Macy boolean_t should_free = B_FALSE; 1034eda14cbcSMatt Macy 1035eda14cbcSMatt Macy /* Allocate and initialize the mapping */ 1036eda14cbcSMatt Macy km = kmem_zalloc(sizeof (dsl_key_mapping_t), KM_SLEEP); 1037eda14cbcSMatt Macy zfs_refcount_create(&km->km_refcnt); 1038eda14cbcSMatt Macy 1039eda14cbcSMatt Macy ret = spa_keystore_dsl_key_hold_dd(spa, ds->ds_dir, km, &km->km_key); 1040eda14cbcSMatt Macy if (ret != 0) { 1041eda14cbcSMatt Macy zfs_refcount_destroy(&km->km_refcnt); 1042eda14cbcSMatt Macy kmem_free(km, sizeof (dsl_key_mapping_t)); 1043eda14cbcSMatt Macy 1044eda14cbcSMatt Macy if (km_out != NULL) 1045eda14cbcSMatt Macy *km_out = NULL; 1046eda14cbcSMatt Macy return (ret); 1047eda14cbcSMatt Macy } 1048eda14cbcSMatt Macy 1049eda14cbcSMatt Macy km->km_dsobj = ds->ds_object; 1050eda14cbcSMatt Macy 1051eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_km_lock, RW_WRITER); 1052eda14cbcSMatt Macy 1053eda14cbcSMatt Macy /* 1054eda14cbcSMatt Macy * If a mapping already exists, simply increment its refcount and 1055eda14cbcSMatt Macy * cleanup the one we made. We want to allocate / free outside of 1056eda14cbcSMatt Macy * the lock because this lock is also used by the zio layer to lookup 1057eda14cbcSMatt Macy * key mappings. Otherwise, use the one we created. Normally, there will 1058eda14cbcSMatt Macy * only be one active reference at a time (the objset owner), but there 1059eda14cbcSMatt Macy * are times when there could be multiple async users. 1060eda14cbcSMatt Macy */ 1061eda14cbcSMatt Macy found_km = avl_find(&spa->spa_keystore.sk_key_mappings, km, &where); 1062eda14cbcSMatt Macy if (found_km != NULL) { 1063eda14cbcSMatt Macy should_free = B_TRUE; 1064eda14cbcSMatt Macy zfs_refcount_add(&found_km->km_refcnt, tag); 1065eda14cbcSMatt Macy if (km_out != NULL) 1066eda14cbcSMatt Macy *km_out = found_km; 1067eda14cbcSMatt Macy } else { 1068eda14cbcSMatt Macy zfs_refcount_add(&km->km_refcnt, tag); 1069eda14cbcSMatt Macy avl_insert(&spa->spa_keystore.sk_key_mappings, km, where); 1070eda14cbcSMatt Macy if (km_out != NULL) 1071eda14cbcSMatt Macy *km_out = km; 1072eda14cbcSMatt Macy } 1073eda14cbcSMatt Macy 1074eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1075eda14cbcSMatt Macy 1076eda14cbcSMatt Macy if (should_free) { 1077eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, km->km_key, km); 1078eda14cbcSMatt Macy zfs_refcount_destroy(&km->km_refcnt); 1079eda14cbcSMatt Macy kmem_free(km, sizeof (dsl_key_mapping_t)); 1080eda14cbcSMatt Macy } 1081eda14cbcSMatt Macy 1082eda14cbcSMatt Macy return (0); 1083eda14cbcSMatt Macy } 1084eda14cbcSMatt Macy 1085eda14cbcSMatt Macy int 1086a0b956f5SMartin Matuska spa_keystore_remove_mapping(spa_t *spa, uint64_t dsobj, const void *tag) 1087eda14cbcSMatt Macy { 1088eda14cbcSMatt Macy int ret; 1089eda14cbcSMatt Macy dsl_key_mapping_t search_km; 1090eda14cbcSMatt Macy dsl_key_mapping_t *found_km; 1091eda14cbcSMatt Macy 1092eda14cbcSMatt Macy /* init the search key mapping */ 1093eda14cbcSMatt Macy search_km.km_dsobj = dsobj; 1094eda14cbcSMatt Macy 1095eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_km_lock, RW_READER); 1096eda14cbcSMatt Macy 1097eda14cbcSMatt Macy /* find the matching mapping */ 1098eda14cbcSMatt Macy found_km = avl_find(&spa->spa_keystore.sk_key_mappings, 1099eda14cbcSMatt Macy &search_km, NULL); 1100eda14cbcSMatt Macy if (found_km == NULL) { 1101eda14cbcSMatt Macy ret = SET_ERROR(ENOENT); 1102eda14cbcSMatt Macy goto error_unlock; 1103eda14cbcSMatt Macy } 1104eda14cbcSMatt Macy 1105eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1106eda14cbcSMatt Macy 1107eda14cbcSMatt Macy key_mapping_rele(spa, found_km, tag); 1108eda14cbcSMatt Macy 1109eda14cbcSMatt Macy return (0); 1110eda14cbcSMatt Macy 1111eda14cbcSMatt Macy error_unlock: 1112eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1113eda14cbcSMatt Macy return (ret); 1114eda14cbcSMatt Macy } 1115eda14cbcSMatt Macy 1116eda14cbcSMatt Macy /* 1117eda14cbcSMatt Macy * This function is primarily used by the zio and arc layer to lookup 1118eda14cbcSMatt Macy * DSL Crypto Keys for encryption. Callers must release the key with 1119eda14cbcSMatt Macy * spa_keystore_dsl_key_rele(). The function may also be called with 1120eda14cbcSMatt Macy * dck_out == NULL and tag == NULL to simply check that a key exists 1121eda14cbcSMatt Macy * without getting a reference to it. 1122eda14cbcSMatt Macy */ 1123eda14cbcSMatt Macy int 1124a0b956f5SMartin Matuska spa_keystore_lookup_key(spa_t *spa, uint64_t dsobj, const void *tag, 1125eda14cbcSMatt Macy dsl_crypto_key_t **dck_out) 1126eda14cbcSMatt Macy { 1127eda14cbcSMatt Macy int ret; 1128eda14cbcSMatt Macy dsl_key_mapping_t search_km; 1129eda14cbcSMatt Macy dsl_key_mapping_t *found_km; 1130eda14cbcSMatt Macy 1131eda14cbcSMatt Macy ASSERT((tag != NULL && dck_out != NULL) || 1132eda14cbcSMatt Macy (tag == NULL && dck_out == NULL)); 1133eda14cbcSMatt Macy 1134eda14cbcSMatt Macy /* init the search key mapping */ 1135eda14cbcSMatt Macy search_km.km_dsobj = dsobj; 1136eda14cbcSMatt Macy 1137eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_km_lock, RW_READER); 1138eda14cbcSMatt Macy 1139eda14cbcSMatt Macy /* remove the mapping from the tree */ 1140eda14cbcSMatt Macy found_km = avl_find(&spa->spa_keystore.sk_key_mappings, &search_km, 1141eda14cbcSMatt Macy NULL); 1142eda14cbcSMatt Macy if (found_km == NULL) { 1143eda14cbcSMatt Macy ret = SET_ERROR(ENOENT); 1144eda14cbcSMatt Macy goto error_unlock; 1145eda14cbcSMatt Macy } 1146eda14cbcSMatt Macy 1147eda14cbcSMatt Macy if (found_km && tag) 1148eda14cbcSMatt Macy zfs_refcount_add(&found_km->km_key->dck_holds, tag); 1149eda14cbcSMatt Macy 1150eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1151eda14cbcSMatt Macy 1152eda14cbcSMatt Macy if (dck_out != NULL) 1153eda14cbcSMatt Macy *dck_out = found_km->km_key; 1154eda14cbcSMatt Macy return (0); 1155eda14cbcSMatt Macy 1156eda14cbcSMatt Macy error_unlock: 1157eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_km_lock); 1158eda14cbcSMatt Macy 1159eda14cbcSMatt Macy if (dck_out != NULL) 1160eda14cbcSMatt Macy *dck_out = NULL; 1161eda14cbcSMatt Macy return (ret); 1162eda14cbcSMatt Macy } 1163eda14cbcSMatt Macy 1164eda14cbcSMatt Macy static int 1165eda14cbcSMatt Macy dmu_objset_check_wkey_loaded(dsl_dir_t *dd) 1166eda14cbcSMatt Macy { 1167eda14cbcSMatt Macy int ret; 1168eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = NULL; 1169eda14cbcSMatt Macy 1170eda14cbcSMatt Macy ret = spa_keystore_wkey_hold_dd(dd->dd_pool->dp_spa, dd, FTAG, 1171eda14cbcSMatt Macy &wkey); 1172eda14cbcSMatt Macy if (ret != 0) 1173eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 1174eda14cbcSMatt Macy 1175eda14cbcSMatt Macy dsl_wrapping_key_rele(wkey, FTAG); 1176eda14cbcSMatt Macy 1177eda14cbcSMatt Macy return (0); 1178eda14cbcSMatt Macy } 1179eda14cbcSMatt Macy 118008aba0aeSMartin Matuska zfs_keystatus_t 1181eda14cbcSMatt Macy dsl_dataset_get_keystatus(dsl_dir_t *dd) 1182eda14cbcSMatt Macy { 1183eda14cbcSMatt Macy /* check if this dd has a has a dsl key */ 1184eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) 1185eda14cbcSMatt Macy return (ZFS_KEYSTATUS_NONE); 1186eda14cbcSMatt Macy 1187eda14cbcSMatt Macy return (dmu_objset_check_wkey_loaded(dd) == 0 ? 1188eda14cbcSMatt Macy ZFS_KEYSTATUS_AVAILABLE : ZFS_KEYSTATUS_UNAVAILABLE); 1189eda14cbcSMatt Macy } 1190eda14cbcSMatt Macy 1191eda14cbcSMatt Macy static int 1192eda14cbcSMatt Macy dsl_dir_get_crypt(dsl_dir_t *dd, uint64_t *crypt) 1193eda14cbcSMatt Macy { 1194eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) { 1195eda14cbcSMatt Macy *crypt = ZIO_CRYPT_OFF; 1196eda14cbcSMatt Macy return (0); 1197eda14cbcSMatt Macy } 1198eda14cbcSMatt Macy 1199eda14cbcSMatt Macy return (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 1200eda14cbcSMatt Macy DSL_CRYPTO_KEY_CRYPTO_SUITE, 8, 1, crypt)); 1201eda14cbcSMatt Macy } 1202eda14cbcSMatt Macy 1203eda14cbcSMatt Macy static void 1204eda14cbcSMatt Macy dsl_crypto_key_sync_impl(objset_t *mos, uint64_t dckobj, uint64_t crypt, 1205eda14cbcSMatt Macy uint64_t root_ddobj, uint64_t guid, uint8_t *iv, uint8_t *mac, 1206eda14cbcSMatt Macy uint8_t *keydata, uint8_t *hmac_keydata, uint64_t keyformat, 1207eda14cbcSMatt Macy uint64_t salt, uint64_t iters, dmu_tx_t *tx) 1208eda14cbcSMatt Macy { 1209eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_CRYPTO_SUITE, 8, 1, 1210eda14cbcSMatt Macy &crypt, tx)); 1211eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_ROOT_DDOBJ, 8, 1, 1212eda14cbcSMatt Macy &root_ddobj, tx)); 1213eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_GUID, 8, 1, 1214eda14cbcSMatt Macy &guid, tx)); 1215eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_IV, 1, WRAPPING_IV_LEN, 1216eda14cbcSMatt Macy iv, tx)); 1217eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_MAC, 1, WRAPPING_MAC_LEN, 1218eda14cbcSMatt Macy mac, tx)); 1219eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_MASTER_KEY, 1, 1220eda14cbcSMatt Macy MASTER_KEY_MAX_LEN, keydata, tx)); 1221eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, DSL_CRYPTO_KEY_HMAC_KEY, 1, 1222eda14cbcSMatt Macy SHA512_HMAC_KEYLEN, hmac_keydata, tx)); 1223eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, zfs_prop_to_name(ZFS_PROP_KEYFORMAT), 1224eda14cbcSMatt Macy 8, 1, &keyformat, tx)); 1225eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), 1226eda14cbcSMatt Macy 8, 1, &salt, tx)); 1227eda14cbcSMatt Macy VERIFY0(zap_update(mos, dckobj, zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), 1228eda14cbcSMatt Macy 8, 1, &iters, tx)); 1229eda14cbcSMatt Macy } 1230eda14cbcSMatt Macy 1231eda14cbcSMatt Macy static void 1232eda14cbcSMatt Macy dsl_crypto_key_sync(dsl_crypto_key_t *dck, dmu_tx_t *tx) 1233eda14cbcSMatt Macy { 1234eda14cbcSMatt Macy zio_crypt_key_t *key = &dck->dck_key; 1235eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = dck->dck_wkey; 1236eda14cbcSMatt Macy uint8_t keydata[MASTER_KEY_MAX_LEN]; 1237eda14cbcSMatt Macy uint8_t hmac_keydata[SHA512_HMAC_KEYLEN]; 1238eda14cbcSMatt Macy uint8_t iv[WRAPPING_IV_LEN]; 1239eda14cbcSMatt Macy uint8_t mac[WRAPPING_MAC_LEN]; 1240eda14cbcSMatt Macy 1241eda14cbcSMatt Macy ASSERT(dmu_tx_is_syncing(tx)); 1242eda14cbcSMatt Macy ASSERT3U(key->zk_crypt, <, ZIO_CRYPT_FUNCTIONS); 1243eda14cbcSMatt Macy 1244eda14cbcSMatt Macy /* encrypt and store the keys along with the IV and MAC */ 1245eda14cbcSMatt Macy VERIFY0(zio_crypt_key_wrap(&dck->dck_wkey->wk_key, key, iv, mac, 1246eda14cbcSMatt Macy keydata, hmac_keydata)); 1247eda14cbcSMatt Macy 1248eda14cbcSMatt Macy /* update the ZAP with the obtained values */ 1249eda14cbcSMatt Macy dsl_crypto_key_sync_impl(tx->tx_pool->dp_meta_objset, dck->dck_obj, 1250eda14cbcSMatt Macy key->zk_crypt, wkey->wk_ddobj, key->zk_guid, iv, mac, keydata, 1251eda14cbcSMatt Macy hmac_keydata, wkey->wk_keyformat, wkey->wk_salt, wkey->wk_iters, 1252eda14cbcSMatt Macy tx); 1253eda14cbcSMatt Macy } 1254eda14cbcSMatt Macy 1255eda14cbcSMatt Macy typedef struct spa_keystore_change_key_args { 1256eda14cbcSMatt Macy const char *skcka_dsname; 1257eda14cbcSMatt Macy dsl_crypto_params_t *skcka_cp; 1258eda14cbcSMatt Macy } spa_keystore_change_key_args_t; 1259eda14cbcSMatt Macy 1260eda14cbcSMatt Macy static int 1261eda14cbcSMatt Macy spa_keystore_change_key_check(void *arg, dmu_tx_t *tx) 1262eda14cbcSMatt Macy { 1263eda14cbcSMatt Macy int ret; 1264eda14cbcSMatt Macy dsl_dir_t *dd = NULL; 1265eda14cbcSMatt Macy dsl_pool_t *dp = dmu_tx_pool(tx); 1266eda14cbcSMatt Macy spa_keystore_change_key_args_t *skcka = arg; 1267eda14cbcSMatt Macy dsl_crypto_params_t *dcp = skcka->skcka_cp; 1268eda14cbcSMatt Macy uint64_t rddobj; 1269eda14cbcSMatt Macy 1270eda14cbcSMatt Macy /* check for the encryption feature */ 1271eda14cbcSMatt Macy if (!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_ENCRYPTION)) { 1272eda14cbcSMatt Macy ret = SET_ERROR(ENOTSUP); 1273eda14cbcSMatt Macy goto error; 1274eda14cbcSMatt Macy } 1275eda14cbcSMatt Macy 1276eda14cbcSMatt Macy /* check for valid key change command */ 1277eda14cbcSMatt Macy if (dcp->cp_cmd != DCP_CMD_NEW_KEY && 1278eda14cbcSMatt Macy dcp->cp_cmd != DCP_CMD_INHERIT && 1279eda14cbcSMatt Macy dcp->cp_cmd != DCP_CMD_FORCE_NEW_KEY && 1280eda14cbcSMatt Macy dcp->cp_cmd != DCP_CMD_FORCE_INHERIT) { 1281eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1282eda14cbcSMatt Macy goto error; 1283eda14cbcSMatt Macy } 1284eda14cbcSMatt Macy 1285eda14cbcSMatt Macy /* hold the dd */ 1286eda14cbcSMatt Macy ret = dsl_dir_hold(dp, skcka->skcka_dsname, FTAG, &dd, NULL); 1287eda14cbcSMatt Macy if (ret != 0) { 1288eda14cbcSMatt Macy dd = NULL; 1289eda14cbcSMatt Macy goto error; 1290eda14cbcSMatt Macy } 1291eda14cbcSMatt Macy 1292eda14cbcSMatt Macy /* verify that the dataset is encrypted */ 1293eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) { 1294eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1295eda14cbcSMatt Macy goto error; 1296eda14cbcSMatt Macy } 1297eda14cbcSMatt Macy 1298eda14cbcSMatt Macy /* clones must always use their origin's key */ 1299eda14cbcSMatt Macy if (dsl_dir_is_clone(dd)) { 1300eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1301eda14cbcSMatt Macy goto error; 1302eda14cbcSMatt Macy } 1303eda14cbcSMatt Macy 1304eda14cbcSMatt Macy /* lookup the ddobj we are inheriting the keylocation from */ 1305eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &rddobj); 1306eda14cbcSMatt Macy if (ret != 0) 1307eda14cbcSMatt Macy goto error; 1308eda14cbcSMatt Macy 1309eda14cbcSMatt Macy /* Handle inheritance */ 1310eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_INHERIT || 1311eda14cbcSMatt Macy dcp->cp_cmd == DCP_CMD_FORCE_INHERIT) { 1312eda14cbcSMatt Macy /* no other encryption params should be given */ 1313eda14cbcSMatt Macy if (dcp->cp_crypt != ZIO_CRYPT_INHERIT || 1314eda14cbcSMatt Macy dcp->cp_keylocation != NULL || 1315eda14cbcSMatt Macy dcp->cp_wkey != NULL) { 1316eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1317eda14cbcSMatt Macy goto error; 1318eda14cbcSMatt Macy } 1319eda14cbcSMatt Macy 1320eda14cbcSMatt Macy /* check that this is an encryption root */ 1321eda14cbcSMatt Macy if (dd->dd_object != rddobj) { 1322eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1323eda14cbcSMatt Macy goto error; 1324eda14cbcSMatt Macy } 1325eda14cbcSMatt Macy 1326eda14cbcSMatt Macy /* check that the parent is encrypted */ 1327eda14cbcSMatt Macy if (dd->dd_parent->dd_crypto_obj == 0) { 1328eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1329eda14cbcSMatt Macy goto error; 1330eda14cbcSMatt Macy } 1331eda14cbcSMatt Macy 1332eda14cbcSMatt Macy /* if we are rewrapping check that both keys are loaded */ 1333eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_INHERIT) { 1334eda14cbcSMatt Macy ret = dmu_objset_check_wkey_loaded(dd); 1335eda14cbcSMatt Macy if (ret != 0) 1336eda14cbcSMatt Macy goto error; 1337eda14cbcSMatt Macy 1338eda14cbcSMatt Macy ret = dmu_objset_check_wkey_loaded(dd->dd_parent); 1339eda14cbcSMatt Macy if (ret != 0) 1340eda14cbcSMatt Macy goto error; 1341eda14cbcSMatt Macy } 1342eda14cbcSMatt Macy 1343eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1344eda14cbcSMatt Macy return (0); 1345eda14cbcSMatt Macy } 1346eda14cbcSMatt Macy 1347eda14cbcSMatt Macy /* handle forcing an encryption root without rewrapping */ 1348eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_FORCE_NEW_KEY) { 1349eda14cbcSMatt Macy /* no other encryption params should be given */ 1350eda14cbcSMatt Macy if (dcp->cp_crypt != ZIO_CRYPT_INHERIT || 1351eda14cbcSMatt Macy dcp->cp_keylocation != NULL || 1352eda14cbcSMatt Macy dcp->cp_wkey != NULL) { 1353eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1354eda14cbcSMatt Macy goto error; 1355eda14cbcSMatt Macy } 1356eda14cbcSMatt Macy 1357eda14cbcSMatt Macy /* check that this is not an encryption root */ 1358eda14cbcSMatt Macy if (dd->dd_object == rddobj) { 1359eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1360eda14cbcSMatt Macy goto error; 1361eda14cbcSMatt Macy } 1362eda14cbcSMatt Macy 1363eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1364eda14cbcSMatt Macy return (0); 1365eda14cbcSMatt Macy } 1366eda14cbcSMatt Macy 1367eda14cbcSMatt Macy /* crypt cannot be changed after creation */ 1368eda14cbcSMatt Macy if (dcp->cp_crypt != ZIO_CRYPT_INHERIT) { 1369eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1370eda14cbcSMatt Macy goto error; 1371eda14cbcSMatt Macy } 1372eda14cbcSMatt Macy 1373eda14cbcSMatt Macy /* we are not inheritting our parent's wkey so we need one ourselves */ 1374eda14cbcSMatt Macy if (dcp->cp_wkey == NULL) { 1375eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1376eda14cbcSMatt Macy goto error; 1377eda14cbcSMatt Macy } 1378eda14cbcSMatt Macy 1379eda14cbcSMatt Macy /* check for a valid keyformat for the new wrapping key */ 1380eda14cbcSMatt Macy if (dcp->cp_wkey->wk_keyformat >= ZFS_KEYFORMAT_FORMATS || 1381eda14cbcSMatt Macy dcp->cp_wkey->wk_keyformat == ZFS_KEYFORMAT_NONE) { 1382eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1383eda14cbcSMatt Macy goto error; 1384eda14cbcSMatt Macy } 1385eda14cbcSMatt Macy 1386eda14cbcSMatt Macy /* 1387eda14cbcSMatt Macy * If this dataset is not currently an encryption root we need a new 1388eda14cbcSMatt Macy * keylocation for this dataset's new wrapping key. Otherwise we can 1389eda14cbcSMatt Macy * just keep the one we already had. 1390eda14cbcSMatt Macy */ 1391eda14cbcSMatt Macy if (dd->dd_object != rddobj && dcp->cp_keylocation == NULL) { 1392eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1393eda14cbcSMatt Macy goto error; 1394eda14cbcSMatt Macy } 1395eda14cbcSMatt Macy 1396eda14cbcSMatt Macy /* check that the keylocation is valid if it is not NULL */ 1397eda14cbcSMatt Macy if (dcp->cp_keylocation != NULL && 1398eda14cbcSMatt Macy !zfs_prop_valid_keylocation(dcp->cp_keylocation, B_TRUE)) { 1399eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1400eda14cbcSMatt Macy goto error; 1401eda14cbcSMatt Macy } 1402eda14cbcSMatt Macy 1403eda14cbcSMatt Macy /* passphrases require pbkdf2 salt and iters */ 1404eda14cbcSMatt Macy if (dcp->cp_wkey->wk_keyformat == ZFS_KEYFORMAT_PASSPHRASE) { 1405eda14cbcSMatt Macy if (dcp->cp_wkey->wk_salt == 0 || 1406eda14cbcSMatt Macy dcp->cp_wkey->wk_iters < MIN_PBKDF2_ITERATIONS) { 1407eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1408eda14cbcSMatt Macy goto error; 1409eda14cbcSMatt Macy } 1410eda14cbcSMatt Macy } else { 1411eda14cbcSMatt Macy if (dcp->cp_wkey->wk_salt != 0 || dcp->cp_wkey->wk_iters != 0) { 1412eda14cbcSMatt Macy ret = SET_ERROR(EINVAL); 1413eda14cbcSMatt Macy goto error; 1414eda14cbcSMatt Macy } 1415eda14cbcSMatt Macy } 1416eda14cbcSMatt Macy 1417eda14cbcSMatt Macy /* make sure the dd's wkey is loaded */ 1418eda14cbcSMatt Macy ret = dmu_objset_check_wkey_loaded(dd); 1419eda14cbcSMatt Macy if (ret != 0) 1420eda14cbcSMatt Macy goto error; 1421eda14cbcSMatt Macy 1422eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1423eda14cbcSMatt Macy 1424eda14cbcSMatt Macy return (0); 1425eda14cbcSMatt Macy 1426eda14cbcSMatt Macy error: 1427eda14cbcSMatt Macy if (dd != NULL) 1428eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1429eda14cbcSMatt Macy 1430eda14cbcSMatt Macy return (ret); 1431eda14cbcSMatt Macy } 1432eda14cbcSMatt Macy 1433eda14cbcSMatt Macy /* 1434eda14cbcSMatt Macy * This function deals with the intricacies of updating wrapping 1435eda14cbcSMatt Macy * key references and encryption roots recursively in the event 1436eda14cbcSMatt Macy * of a call to 'zfs change-key' or 'zfs promote'. The 'skip' 1437eda14cbcSMatt Macy * parameter should always be set to B_FALSE when called 1438eda14cbcSMatt Macy * externally. 1439eda14cbcSMatt Macy */ 1440eda14cbcSMatt Macy static void 1441eda14cbcSMatt Macy spa_keystore_change_key_sync_impl(uint64_t rddobj, uint64_t ddobj, 1442eda14cbcSMatt Macy uint64_t new_rddobj, dsl_wrapping_key_t *wkey, boolean_t skip, 1443eda14cbcSMatt Macy dmu_tx_t *tx) 1444eda14cbcSMatt Macy { 1445eda14cbcSMatt Macy int ret; 1446eda14cbcSMatt Macy zap_cursor_t *zc; 1447eda14cbcSMatt Macy zap_attribute_t *za; 1448eda14cbcSMatt Macy dsl_pool_t *dp = dmu_tx_pool(tx); 1449eda14cbcSMatt Macy dsl_dir_t *dd = NULL; 1450eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 1451eda14cbcSMatt Macy uint64_t curr_rddobj; 1452eda14cbcSMatt Macy 1453eda14cbcSMatt Macy ASSERT(RW_WRITE_HELD(&dp->dp_spa->spa_keystore.sk_wkeys_lock)); 1454eda14cbcSMatt Macy 1455eda14cbcSMatt Macy /* hold the dd */ 1456eda14cbcSMatt Macy VERIFY0(dsl_dir_hold_obj(dp, ddobj, NULL, FTAG, &dd)); 1457eda14cbcSMatt Macy 1458eda14cbcSMatt Macy /* ignore special dsl dirs */ 1459eda14cbcSMatt Macy if (dd->dd_myname[0] == '$' || dd->dd_myname[0] == '%') { 1460eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1461eda14cbcSMatt Macy return; 1462eda14cbcSMatt Macy } 1463eda14cbcSMatt Macy 1464eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &curr_rddobj); 1465eda14cbcSMatt Macy VERIFY(ret == 0 || ret == ENOENT); 1466eda14cbcSMatt Macy 1467eda14cbcSMatt Macy /* 1468eda14cbcSMatt Macy * Stop recursing if this dsl dir didn't inherit from the root 1469eda14cbcSMatt Macy * or if this dd is a clone. 1470eda14cbcSMatt Macy */ 1471eda14cbcSMatt Macy if (ret == ENOENT || 1472eda14cbcSMatt Macy (!skip && (curr_rddobj != rddobj || dsl_dir_is_clone(dd)))) { 1473eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1474eda14cbcSMatt Macy return; 1475eda14cbcSMatt Macy } 1476eda14cbcSMatt Macy 1477eda14cbcSMatt Macy /* 1478eda14cbcSMatt Macy * If we don't have a wrapping key just update the dck to reflect the 1479eda14cbcSMatt Macy * new encryption root. Otherwise rewrap the entire dck and re-sync it 1480eda14cbcSMatt Macy * to disk. If skip is set, we don't do any of this work. 1481eda14cbcSMatt Macy */ 1482eda14cbcSMatt Macy if (!skip) { 1483eda14cbcSMatt Macy if (wkey == NULL) { 1484eda14cbcSMatt Macy VERIFY0(zap_update(dp->dp_meta_objset, 1485eda14cbcSMatt Macy dd->dd_crypto_obj, 1486eda14cbcSMatt Macy DSL_CRYPTO_KEY_ROOT_DDOBJ, 8, 1, 1487eda14cbcSMatt Macy &new_rddobj, tx)); 1488eda14cbcSMatt Macy } else { 1489eda14cbcSMatt Macy VERIFY0(spa_keystore_dsl_key_hold_dd(dp->dp_spa, dd, 1490eda14cbcSMatt Macy FTAG, &dck)); 1491eda14cbcSMatt Macy dsl_wrapping_key_hold(wkey, dck); 1492eda14cbcSMatt Macy dsl_wrapping_key_rele(dck->dck_wkey, dck); 1493eda14cbcSMatt Macy dck->dck_wkey = wkey; 1494eda14cbcSMatt Macy dsl_crypto_key_sync(dck, tx); 1495eda14cbcSMatt Macy spa_keystore_dsl_key_rele(dp->dp_spa, dck, FTAG); 1496eda14cbcSMatt Macy } 1497eda14cbcSMatt Macy } 1498eda14cbcSMatt Macy 1499eda14cbcSMatt Macy zc = kmem_alloc(sizeof (zap_cursor_t), KM_SLEEP); 1500*7a7741afSMartin Matuska za = zap_attribute_alloc(); 1501eda14cbcSMatt Macy 1502eda14cbcSMatt Macy /* Recurse into all child dsl dirs. */ 1503eda14cbcSMatt Macy for (zap_cursor_init(zc, dp->dp_meta_objset, 1504eda14cbcSMatt Macy dsl_dir_phys(dd)->dd_child_dir_zapobj); 1505eda14cbcSMatt Macy zap_cursor_retrieve(zc, za) == 0; 1506eda14cbcSMatt Macy zap_cursor_advance(zc)) { 1507eda14cbcSMatt Macy spa_keystore_change_key_sync_impl(rddobj, 1508eda14cbcSMatt Macy za->za_first_integer, new_rddobj, wkey, B_FALSE, tx); 1509eda14cbcSMatt Macy } 1510eda14cbcSMatt Macy zap_cursor_fini(zc); 1511eda14cbcSMatt Macy 1512eda14cbcSMatt Macy /* 1513eda14cbcSMatt Macy * Recurse into all dsl dirs of clones. We utilize the skip parameter 1514eda14cbcSMatt Macy * here so that we don't attempt to process the clones directly. This 1515eda14cbcSMatt Macy * is because the clone and its origin share the same dck, which has 1516eda14cbcSMatt Macy * already been updated. 1517eda14cbcSMatt Macy */ 1518eda14cbcSMatt Macy for (zap_cursor_init(zc, dp->dp_meta_objset, 1519eda14cbcSMatt Macy dsl_dir_phys(dd)->dd_clones); 1520eda14cbcSMatt Macy zap_cursor_retrieve(zc, za) == 0; 1521eda14cbcSMatt Macy zap_cursor_advance(zc)) { 1522eda14cbcSMatt Macy dsl_dataset_t *clone; 1523eda14cbcSMatt Macy 1524eda14cbcSMatt Macy VERIFY0(dsl_dataset_hold_obj(dp, za->za_first_integer, 1525eda14cbcSMatt Macy FTAG, &clone)); 1526eda14cbcSMatt Macy spa_keystore_change_key_sync_impl(rddobj, 1527eda14cbcSMatt Macy clone->ds_dir->dd_object, new_rddobj, wkey, B_TRUE, tx); 1528eda14cbcSMatt Macy dsl_dataset_rele(clone, FTAG); 1529eda14cbcSMatt Macy } 1530eda14cbcSMatt Macy zap_cursor_fini(zc); 1531eda14cbcSMatt Macy 1532*7a7741afSMartin Matuska zap_attribute_free(za); 1533eda14cbcSMatt Macy kmem_free(zc, sizeof (zap_cursor_t)); 1534eda14cbcSMatt Macy 1535eda14cbcSMatt Macy dsl_dir_rele(dd, FTAG); 1536eda14cbcSMatt Macy } 1537eda14cbcSMatt Macy 1538eda14cbcSMatt Macy static void 1539eda14cbcSMatt Macy spa_keystore_change_key_sync(void *arg, dmu_tx_t *tx) 1540eda14cbcSMatt Macy { 1541eda14cbcSMatt Macy dsl_dataset_t *ds; 1542eda14cbcSMatt Macy avl_index_t where; 1543eda14cbcSMatt Macy dsl_pool_t *dp = dmu_tx_pool(tx); 1544eda14cbcSMatt Macy spa_t *spa = dp->dp_spa; 1545eda14cbcSMatt Macy spa_keystore_change_key_args_t *skcka = arg; 1546eda14cbcSMatt Macy dsl_crypto_params_t *dcp = skcka->skcka_cp; 1547eda14cbcSMatt Macy dsl_wrapping_key_t *wkey = NULL, *found_wkey; 1548eda14cbcSMatt Macy dsl_wrapping_key_t wkey_search; 1549a0b956f5SMartin Matuska const char *keylocation = dcp->cp_keylocation; 1550eda14cbcSMatt Macy uint64_t rddobj, new_rddobj; 1551eda14cbcSMatt Macy 1552eda14cbcSMatt Macy /* create and initialize the wrapping key */ 1553eda14cbcSMatt Macy VERIFY0(dsl_dataset_hold(dp, skcka->skcka_dsname, FTAG, &ds)); 1554eda14cbcSMatt Macy ASSERT(!ds->ds_is_snapshot); 1555eda14cbcSMatt Macy 1556eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_NEW_KEY || 1557eda14cbcSMatt Macy dcp->cp_cmd == DCP_CMD_FORCE_NEW_KEY) { 1558eda14cbcSMatt Macy /* 1559eda14cbcSMatt Macy * We are changing to a new wkey. Set additional properties 1560eda14cbcSMatt Macy * which can be sent along with this ioctl. Note that this 1561eda14cbcSMatt Macy * command can set keylocation even if it can't normally be 1562eda14cbcSMatt Macy * set via 'zfs set' due to a non-local keylocation. 1563eda14cbcSMatt Macy */ 1564eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_NEW_KEY) { 1565eda14cbcSMatt Macy wkey = dcp->cp_wkey; 1566eda14cbcSMatt Macy wkey->wk_ddobj = ds->ds_dir->dd_object; 1567eda14cbcSMatt Macy } else { 1568eda14cbcSMatt Macy keylocation = "prompt"; 1569eda14cbcSMatt Macy } 1570eda14cbcSMatt Macy 1571eda14cbcSMatt Macy if (keylocation != NULL) { 1572eda14cbcSMatt Macy dsl_prop_set_sync_impl(ds, 1573eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYLOCATION), 1574eda14cbcSMatt Macy ZPROP_SRC_LOCAL, 1, strlen(keylocation) + 1, 1575eda14cbcSMatt Macy keylocation, tx); 1576eda14cbcSMatt Macy } 1577eda14cbcSMatt Macy 1578eda14cbcSMatt Macy VERIFY0(dsl_dir_get_encryption_root_ddobj(ds->ds_dir, &rddobj)); 1579eda14cbcSMatt Macy new_rddobj = ds->ds_dir->dd_object; 1580eda14cbcSMatt Macy } else { 1581eda14cbcSMatt Macy /* 1582eda14cbcSMatt Macy * We are inheritting the parent's wkey. Unset any local 1583eda14cbcSMatt Macy * keylocation and grab a reference to the wkey. 1584eda14cbcSMatt Macy */ 1585eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_INHERIT) { 1586eda14cbcSMatt Macy VERIFY0(spa_keystore_wkey_hold_dd(spa, 1587eda14cbcSMatt Macy ds->ds_dir->dd_parent, FTAG, &wkey)); 1588eda14cbcSMatt Macy } 1589eda14cbcSMatt Macy 1590eda14cbcSMatt Macy dsl_prop_set_sync_impl(ds, 1591eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYLOCATION), ZPROP_SRC_NONE, 1592eda14cbcSMatt Macy 0, 0, NULL, tx); 1593eda14cbcSMatt Macy 1594eda14cbcSMatt Macy rddobj = ds->ds_dir->dd_object; 1595eda14cbcSMatt Macy VERIFY0(dsl_dir_get_encryption_root_ddobj(ds->ds_dir->dd_parent, 1596eda14cbcSMatt Macy &new_rddobj)); 1597eda14cbcSMatt Macy } 1598eda14cbcSMatt Macy 1599eda14cbcSMatt Macy if (wkey == NULL) { 1600eda14cbcSMatt Macy ASSERT(dcp->cp_cmd == DCP_CMD_FORCE_INHERIT || 1601eda14cbcSMatt Macy dcp->cp_cmd == DCP_CMD_FORCE_NEW_KEY); 1602eda14cbcSMatt Macy } 1603eda14cbcSMatt Macy 1604eda14cbcSMatt Macy rw_enter(&spa->spa_keystore.sk_wkeys_lock, RW_WRITER); 1605eda14cbcSMatt Macy 1606eda14cbcSMatt Macy /* recurse through all children and rewrap their keys */ 1607eda14cbcSMatt Macy spa_keystore_change_key_sync_impl(rddobj, ds->ds_dir->dd_object, 1608eda14cbcSMatt Macy new_rddobj, wkey, B_FALSE, tx); 1609eda14cbcSMatt Macy 1610eda14cbcSMatt Macy /* 1611eda14cbcSMatt Macy * All references to the old wkey should be released now (if it 1612eda14cbcSMatt Macy * existed). Replace the wrapping key. 1613eda14cbcSMatt Macy */ 1614eda14cbcSMatt Macy wkey_search.wk_ddobj = ds->ds_dir->dd_object; 1615eda14cbcSMatt Macy found_wkey = avl_find(&spa->spa_keystore.sk_wkeys, &wkey_search, NULL); 1616eda14cbcSMatt Macy if (found_wkey != NULL) { 1617eda14cbcSMatt Macy ASSERT0(zfs_refcount_count(&found_wkey->wk_refcnt)); 1618eda14cbcSMatt Macy avl_remove(&spa->spa_keystore.sk_wkeys, found_wkey); 1619eda14cbcSMatt Macy dsl_wrapping_key_free(found_wkey); 1620eda14cbcSMatt Macy } 1621eda14cbcSMatt Macy 1622eda14cbcSMatt Macy if (dcp->cp_cmd == DCP_CMD_NEW_KEY) { 1623eda14cbcSMatt Macy avl_find(&spa->spa_keystore.sk_wkeys, wkey, &where); 1624eda14cbcSMatt Macy avl_insert(&spa->spa_keystore.sk_wkeys, wkey, where); 1625eda14cbcSMatt Macy } else if (wkey != NULL) { 1626eda14cbcSMatt Macy dsl_wrapping_key_rele(wkey, FTAG); 1627eda14cbcSMatt Macy } 1628eda14cbcSMatt Macy 1629eda14cbcSMatt Macy rw_exit(&spa->spa_keystore.sk_wkeys_lock); 1630eda14cbcSMatt Macy 1631eda14cbcSMatt Macy dsl_dataset_rele(ds, FTAG); 1632eda14cbcSMatt Macy } 1633eda14cbcSMatt Macy 1634eda14cbcSMatt Macy int 1635eda14cbcSMatt Macy spa_keystore_change_key(const char *dsname, dsl_crypto_params_t *dcp) 1636eda14cbcSMatt Macy { 1637eda14cbcSMatt Macy spa_keystore_change_key_args_t skcka; 1638eda14cbcSMatt Macy 1639eda14cbcSMatt Macy /* initialize the args struct */ 1640eda14cbcSMatt Macy skcka.skcka_dsname = dsname; 1641eda14cbcSMatt Macy skcka.skcka_cp = dcp; 1642eda14cbcSMatt Macy 1643eda14cbcSMatt Macy /* 1644eda14cbcSMatt Macy * Perform the actual work in syncing context. The blocks modified 1645eda14cbcSMatt Macy * here could be calculated but it would require holding the pool 1646eda14cbcSMatt Macy * lock and traversing all of the datasets that will have their keys 1647eda14cbcSMatt Macy * changed. 1648eda14cbcSMatt Macy */ 1649eda14cbcSMatt Macy return (dsl_sync_task(dsname, spa_keystore_change_key_check, 1650eda14cbcSMatt Macy spa_keystore_change_key_sync, &skcka, 15, 1651eda14cbcSMatt Macy ZFS_SPACE_CHECK_RESERVED)); 1652eda14cbcSMatt Macy } 1653eda14cbcSMatt Macy 1654eda14cbcSMatt Macy int 1655eda14cbcSMatt Macy dsl_dir_rename_crypt_check(dsl_dir_t *dd, dsl_dir_t *newparent) 1656eda14cbcSMatt Macy { 1657eda14cbcSMatt Macy int ret; 1658eda14cbcSMatt Macy uint64_t curr_rddobj, parent_rddobj; 1659eda14cbcSMatt Macy 1660eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) 1661eda14cbcSMatt Macy return (0); 1662eda14cbcSMatt Macy 1663eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(dd, &curr_rddobj); 1664eda14cbcSMatt Macy if (ret != 0) 1665eda14cbcSMatt Macy goto error; 1666eda14cbcSMatt Macy 1667eda14cbcSMatt Macy /* 1668eda14cbcSMatt Macy * if this is not an encryption root, we must make sure we are not 1669eda14cbcSMatt Macy * moving dd to a new encryption root 1670eda14cbcSMatt Macy */ 1671eda14cbcSMatt Macy if (dd->dd_object != curr_rddobj) { 1672eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(newparent, 1673eda14cbcSMatt Macy &parent_rddobj); 1674eda14cbcSMatt Macy if (ret != 0) 1675eda14cbcSMatt Macy goto error; 1676eda14cbcSMatt Macy 1677eda14cbcSMatt Macy if (parent_rddobj != curr_rddobj) { 1678eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 1679eda14cbcSMatt Macy goto error; 1680eda14cbcSMatt Macy } 1681eda14cbcSMatt Macy } 1682eda14cbcSMatt Macy 1683eda14cbcSMatt Macy return (0); 1684eda14cbcSMatt Macy 1685eda14cbcSMatt Macy error: 1686eda14cbcSMatt Macy return (ret); 1687eda14cbcSMatt Macy } 1688eda14cbcSMatt Macy 1689eda14cbcSMatt Macy /* 1690eda14cbcSMatt Macy * Check to make sure that a promote from targetdd to origindd will not require 1691eda14cbcSMatt Macy * any key rewraps. 1692eda14cbcSMatt Macy */ 1693eda14cbcSMatt Macy int 1694eda14cbcSMatt Macy dsl_dataset_promote_crypt_check(dsl_dir_t *target, dsl_dir_t *origin) 1695eda14cbcSMatt Macy { 1696eda14cbcSMatt Macy int ret; 1697eda14cbcSMatt Macy uint64_t rddobj, op_rddobj, tp_rddobj; 1698eda14cbcSMatt Macy 1699eda14cbcSMatt Macy /* If the dataset is not encrypted we don't need to check anything */ 1700eda14cbcSMatt Macy if (origin->dd_crypto_obj == 0) 1701eda14cbcSMatt Macy return (0); 1702eda14cbcSMatt Macy 1703eda14cbcSMatt Macy /* 1704eda14cbcSMatt Macy * If we are not changing the first origin snapshot in a chain 1705eda14cbcSMatt Macy * the encryption root won't change either. 1706eda14cbcSMatt Macy */ 1707eda14cbcSMatt Macy if (dsl_dir_is_clone(origin)) 1708eda14cbcSMatt Macy return (0); 1709eda14cbcSMatt Macy 1710eda14cbcSMatt Macy /* 1711eda14cbcSMatt Macy * If the origin is the encryption root we will update 1712eda14cbcSMatt Macy * the DSL Crypto Key to point to the target instead. 1713eda14cbcSMatt Macy */ 1714eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(origin, &rddobj); 1715eda14cbcSMatt Macy if (ret != 0) 1716eda14cbcSMatt Macy return (ret); 1717eda14cbcSMatt Macy 1718eda14cbcSMatt Macy if (rddobj == origin->dd_object) 1719eda14cbcSMatt Macy return (0); 1720eda14cbcSMatt Macy 1721eda14cbcSMatt Macy /* 1722eda14cbcSMatt Macy * The origin is inheriting its encryption root from its parent. 1723eda14cbcSMatt Macy * Check that the parent of the target has the same encryption root. 1724eda14cbcSMatt Macy */ 1725eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(origin->dd_parent, &op_rddobj); 1726eda14cbcSMatt Macy if (ret == ENOENT) 1727eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 1728eda14cbcSMatt Macy else if (ret != 0) 1729eda14cbcSMatt Macy return (ret); 1730eda14cbcSMatt Macy 1731eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(target->dd_parent, &tp_rddobj); 1732eda14cbcSMatt Macy if (ret == ENOENT) 1733eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 1734eda14cbcSMatt Macy else if (ret != 0) 1735eda14cbcSMatt Macy return (ret); 1736eda14cbcSMatt Macy 1737eda14cbcSMatt Macy if (op_rddobj != tp_rddobj) 1738eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 1739eda14cbcSMatt Macy 1740eda14cbcSMatt Macy return (0); 1741eda14cbcSMatt Macy } 1742eda14cbcSMatt Macy 1743eda14cbcSMatt Macy void 1744eda14cbcSMatt Macy dsl_dataset_promote_crypt_sync(dsl_dir_t *target, dsl_dir_t *origin, 1745eda14cbcSMatt Macy dmu_tx_t *tx) 1746eda14cbcSMatt Macy { 1747eda14cbcSMatt Macy uint64_t rddobj; 1748eda14cbcSMatt Macy dsl_pool_t *dp = target->dd_pool; 1749eda14cbcSMatt Macy dsl_dataset_t *targetds; 1750eda14cbcSMatt Macy dsl_dataset_t *originds; 1751eda14cbcSMatt Macy char *keylocation; 1752eda14cbcSMatt Macy 1753eda14cbcSMatt Macy if (origin->dd_crypto_obj == 0) 1754eda14cbcSMatt Macy return; 1755eda14cbcSMatt Macy if (dsl_dir_is_clone(origin)) 1756eda14cbcSMatt Macy return; 1757eda14cbcSMatt Macy 1758eda14cbcSMatt Macy VERIFY0(dsl_dir_get_encryption_root_ddobj(origin, &rddobj)); 1759eda14cbcSMatt Macy 1760eda14cbcSMatt Macy if (rddobj != origin->dd_object) 1761eda14cbcSMatt Macy return; 1762eda14cbcSMatt Macy 1763eda14cbcSMatt Macy /* 1764eda14cbcSMatt Macy * If the target is being promoted to the encryption root update the 1765eda14cbcSMatt Macy * DSL Crypto Key and keylocation to reflect that. We also need to 1766eda14cbcSMatt Macy * update the DSL Crypto Keys of all children inheritting their 1767eda14cbcSMatt Macy * encryption root to point to the new target. Otherwise, the check 1768eda14cbcSMatt Macy * function ensured that the encryption root will not change. 1769eda14cbcSMatt Macy */ 1770eda14cbcSMatt Macy keylocation = kmem_alloc(ZAP_MAXVALUELEN, KM_SLEEP); 1771eda14cbcSMatt Macy 1772eda14cbcSMatt Macy VERIFY0(dsl_dataset_hold_obj(dp, 1773eda14cbcSMatt Macy dsl_dir_phys(target)->dd_head_dataset_obj, FTAG, &targetds)); 1774eda14cbcSMatt Macy VERIFY0(dsl_dataset_hold_obj(dp, 1775eda14cbcSMatt Macy dsl_dir_phys(origin)->dd_head_dataset_obj, FTAG, &originds)); 1776eda14cbcSMatt Macy 1777eda14cbcSMatt Macy VERIFY0(dsl_prop_get_dd(origin, zfs_prop_to_name(ZFS_PROP_KEYLOCATION), 1778eda14cbcSMatt Macy 1, ZAP_MAXVALUELEN, keylocation, NULL, B_FALSE)); 1779eda14cbcSMatt Macy dsl_prop_set_sync_impl(targetds, zfs_prop_to_name(ZFS_PROP_KEYLOCATION), 1780eda14cbcSMatt Macy ZPROP_SRC_LOCAL, 1, strlen(keylocation) + 1, keylocation, tx); 1781eda14cbcSMatt Macy dsl_prop_set_sync_impl(originds, zfs_prop_to_name(ZFS_PROP_KEYLOCATION), 1782eda14cbcSMatt Macy ZPROP_SRC_NONE, 0, 0, NULL, tx); 1783eda14cbcSMatt Macy 1784eda14cbcSMatt Macy rw_enter(&dp->dp_spa->spa_keystore.sk_wkeys_lock, RW_WRITER); 1785eda14cbcSMatt Macy spa_keystore_change_key_sync_impl(rddobj, origin->dd_object, 1786eda14cbcSMatt Macy target->dd_object, NULL, B_FALSE, tx); 1787eda14cbcSMatt Macy rw_exit(&dp->dp_spa->spa_keystore.sk_wkeys_lock); 1788eda14cbcSMatt Macy 1789eda14cbcSMatt Macy dsl_dataset_rele(targetds, FTAG); 1790eda14cbcSMatt Macy dsl_dataset_rele(originds, FTAG); 1791eda14cbcSMatt Macy kmem_free(keylocation, ZAP_MAXVALUELEN); 1792eda14cbcSMatt Macy } 1793eda14cbcSMatt Macy 1794eda14cbcSMatt Macy int 1795eda14cbcSMatt Macy dmu_objset_create_crypt_check(dsl_dir_t *parentdd, dsl_crypto_params_t *dcp, 1796eda14cbcSMatt Macy boolean_t *will_encrypt) 1797eda14cbcSMatt Macy { 1798eda14cbcSMatt Macy int ret; 1799eda14cbcSMatt Macy uint64_t pcrypt, crypt; 1800eda14cbcSMatt Macy dsl_crypto_params_t dummy_dcp = { 0 }; 1801eda14cbcSMatt Macy 1802eda14cbcSMatt Macy if (will_encrypt != NULL) 1803eda14cbcSMatt Macy *will_encrypt = B_FALSE; 1804eda14cbcSMatt Macy 1805eda14cbcSMatt Macy if (dcp == NULL) 1806eda14cbcSMatt Macy dcp = &dummy_dcp; 1807eda14cbcSMatt Macy 1808eda14cbcSMatt Macy if (dcp->cp_cmd != DCP_CMD_NONE) 1809eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1810eda14cbcSMatt Macy 1811eda14cbcSMatt Macy if (parentdd != NULL) { 1812eda14cbcSMatt Macy ret = dsl_dir_get_crypt(parentdd, &pcrypt); 1813eda14cbcSMatt Macy if (ret != 0) 1814eda14cbcSMatt Macy return (ret); 1815eda14cbcSMatt Macy } else { 1816eda14cbcSMatt Macy pcrypt = ZIO_CRYPT_OFF; 1817eda14cbcSMatt Macy } 1818eda14cbcSMatt Macy 1819eda14cbcSMatt Macy crypt = (dcp->cp_crypt == ZIO_CRYPT_INHERIT) ? pcrypt : dcp->cp_crypt; 1820eda14cbcSMatt Macy 1821eda14cbcSMatt Macy ASSERT3U(pcrypt, !=, ZIO_CRYPT_INHERIT); 1822eda14cbcSMatt Macy ASSERT3U(crypt, !=, ZIO_CRYPT_INHERIT); 1823eda14cbcSMatt Macy 1824eda14cbcSMatt Macy /* check for valid dcp with no encryption (inherited or local) */ 1825eda14cbcSMatt Macy if (crypt == ZIO_CRYPT_OFF) { 1826eda14cbcSMatt Macy /* Must not specify encryption params */ 1827eda14cbcSMatt Macy if (dcp->cp_wkey != NULL || 1828eda14cbcSMatt Macy (dcp->cp_keylocation != NULL && 1829eda14cbcSMatt Macy strcmp(dcp->cp_keylocation, "none") != 0)) 1830eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1831eda14cbcSMatt Macy 1832eda14cbcSMatt Macy return (0); 1833eda14cbcSMatt Macy } 1834eda14cbcSMatt Macy 1835eda14cbcSMatt Macy if (will_encrypt != NULL) 1836eda14cbcSMatt Macy *will_encrypt = B_TRUE; 1837eda14cbcSMatt Macy 1838eda14cbcSMatt Macy /* 1839eda14cbcSMatt Macy * We will now definitely be encrypting. Check the feature flag. When 1840eda14cbcSMatt Macy * creating the pool the caller will check this for us since we won't 1841eda14cbcSMatt Macy * technically have the feature activated yet. 1842eda14cbcSMatt Macy */ 1843eda14cbcSMatt Macy if (parentdd != NULL && 1844eda14cbcSMatt Macy !spa_feature_is_enabled(parentdd->dd_pool->dp_spa, 1845eda14cbcSMatt Macy SPA_FEATURE_ENCRYPTION)) { 1846eda14cbcSMatt Macy return (SET_ERROR(EOPNOTSUPP)); 1847eda14cbcSMatt Macy } 1848eda14cbcSMatt Macy 1849eda14cbcSMatt Macy /* Check for errata #4 (encryption enabled, bookmark_v2 disabled) */ 1850eda14cbcSMatt Macy if (parentdd != NULL && 1851eda14cbcSMatt Macy !spa_feature_is_enabled(parentdd->dd_pool->dp_spa, 1852eda14cbcSMatt Macy SPA_FEATURE_BOOKMARK_V2)) { 1853eda14cbcSMatt Macy return (SET_ERROR(EOPNOTSUPP)); 1854eda14cbcSMatt Macy } 1855eda14cbcSMatt Macy 1856eda14cbcSMatt Macy /* handle inheritance */ 1857eda14cbcSMatt Macy if (dcp->cp_wkey == NULL) { 1858eda14cbcSMatt Macy ASSERT3P(parentdd, !=, NULL); 1859eda14cbcSMatt Macy 1860eda14cbcSMatt Macy /* key must be fully unspecified */ 1861eda14cbcSMatt Macy if (dcp->cp_keylocation != NULL) 1862eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1863eda14cbcSMatt Macy 1864eda14cbcSMatt Macy /* parent must have a key to inherit */ 1865eda14cbcSMatt Macy if (pcrypt == ZIO_CRYPT_OFF) 1866eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1867eda14cbcSMatt Macy 1868eda14cbcSMatt Macy /* check for parent key */ 1869eda14cbcSMatt Macy ret = dmu_objset_check_wkey_loaded(parentdd); 1870eda14cbcSMatt Macy if (ret != 0) 1871eda14cbcSMatt Macy return (ret); 1872eda14cbcSMatt Macy 1873eda14cbcSMatt Macy return (0); 1874eda14cbcSMatt Macy } 1875eda14cbcSMatt Macy 1876eda14cbcSMatt Macy /* At this point we should have a fully specified key. Check location */ 1877eda14cbcSMatt Macy if (dcp->cp_keylocation == NULL || 1878eda14cbcSMatt Macy !zfs_prop_valid_keylocation(dcp->cp_keylocation, B_TRUE)) 1879eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1880eda14cbcSMatt Macy 1881eda14cbcSMatt Macy /* Must have fully specified keyformat */ 1882eda14cbcSMatt Macy switch (dcp->cp_wkey->wk_keyformat) { 1883eda14cbcSMatt Macy case ZFS_KEYFORMAT_HEX: 1884eda14cbcSMatt Macy case ZFS_KEYFORMAT_RAW: 1885eda14cbcSMatt Macy /* requires no pbkdf2 iters and salt */ 1886eda14cbcSMatt Macy if (dcp->cp_wkey->wk_salt != 0 || dcp->cp_wkey->wk_iters != 0) 1887eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1888eda14cbcSMatt Macy break; 1889eda14cbcSMatt Macy case ZFS_KEYFORMAT_PASSPHRASE: 1890eda14cbcSMatt Macy /* requires pbkdf2 iters and salt */ 1891eda14cbcSMatt Macy if (dcp->cp_wkey->wk_salt == 0 || 1892eda14cbcSMatt Macy dcp->cp_wkey->wk_iters < MIN_PBKDF2_ITERATIONS) 1893eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1894eda14cbcSMatt Macy break; 1895eda14cbcSMatt Macy case ZFS_KEYFORMAT_NONE: 1896eda14cbcSMatt Macy default: 1897eda14cbcSMatt Macy /* keyformat must be specified and valid */ 1898eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 1899eda14cbcSMatt Macy } 1900eda14cbcSMatt Macy 1901eda14cbcSMatt Macy return (0); 1902eda14cbcSMatt Macy } 1903eda14cbcSMatt Macy 1904eda14cbcSMatt Macy void 1905eda14cbcSMatt Macy dsl_dataset_create_crypt_sync(uint64_t dsobj, dsl_dir_t *dd, 1906eda14cbcSMatt Macy dsl_dataset_t *origin, dsl_crypto_params_t *dcp, dmu_tx_t *tx) 1907eda14cbcSMatt Macy { 1908eda14cbcSMatt Macy dsl_pool_t *dp = dd->dd_pool; 1909eda14cbcSMatt Macy uint64_t crypt; 1910eda14cbcSMatt Macy dsl_wrapping_key_t *wkey; 1911eda14cbcSMatt Macy 1912eda14cbcSMatt Macy /* clones always use their origin's wrapping key */ 1913eda14cbcSMatt Macy if (dsl_dir_is_clone(dd)) { 1914eda14cbcSMatt Macy ASSERT3P(dcp, ==, NULL); 1915eda14cbcSMatt Macy 1916eda14cbcSMatt Macy /* 1917eda14cbcSMatt Macy * If this is an encrypted clone we just need to clone the 1918eda14cbcSMatt Macy * dck into dd. Zapify the dd so we can do that. 1919eda14cbcSMatt Macy */ 1920eda14cbcSMatt Macy if (origin->ds_dir->dd_crypto_obj != 0) { 1921eda14cbcSMatt Macy dmu_buf_will_dirty(dd->dd_dbuf, tx); 1922eda14cbcSMatt Macy dsl_dir_zapify(dd, tx); 1923eda14cbcSMatt Macy 1924eda14cbcSMatt Macy dd->dd_crypto_obj = 1925eda14cbcSMatt Macy dsl_crypto_key_clone_sync(origin->ds_dir, tx); 1926eda14cbcSMatt Macy VERIFY0(zap_add(dp->dp_meta_objset, dd->dd_object, 1927eda14cbcSMatt Macy DD_FIELD_CRYPTO_KEY_OBJ, sizeof (uint64_t), 1, 1928eda14cbcSMatt Macy &dd->dd_crypto_obj, tx)); 1929eda14cbcSMatt Macy } 1930eda14cbcSMatt Macy 1931eda14cbcSMatt Macy return; 1932eda14cbcSMatt Macy } 1933eda14cbcSMatt Macy 1934eda14cbcSMatt Macy /* 1935eda14cbcSMatt Macy * A NULL dcp at this point indicates this is the origin dataset 1936eda14cbcSMatt Macy * which does not have an objset to encrypt. Raw receives will handle 1937eda14cbcSMatt Macy * encryption separately later. In both cases we can simply return. 1938eda14cbcSMatt Macy */ 1939eda14cbcSMatt Macy if (dcp == NULL || dcp->cp_cmd == DCP_CMD_RAW_RECV) 1940eda14cbcSMatt Macy return; 1941eda14cbcSMatt Macy 1942eda14cbcSMatt Macy crypt = dcp->cp_crypt; 1943eda14cbcSMatt Macy wkey = dcp->cp_wkey; 1944eda14cbcSMatt Macy 1945eda14cbcSMatt Macy /* figure out the effective crypt */ 1946eda14cbcSMatt Macy if (crypt == ZIO_CRYPT_INHERIT && dd->dd_parent != NULL) 1947eda14cbcSMatt Macy VERIFY0(dsl_dir_get_crypt(dd->dd_parent, &crypt)); 1948eda14cbcSMatt Macy 1949eda14cbcSMatt Macy /* if we aren't doing encryption just return */ 1950eda14cbcSMatt Macy if (crypt == ZIO_CRYPT_OFF || crypt == ZIO_CRYPT_INHERIT) 1951eda14cbcSMatt Macy return; 1952eda14cbcSMatt Macy 1953eda14cbcSMatt Macy /* zapify the dd so that we can add the crypto key obj to it */ 1954eda14cbcSMatt Macy dmu_buf_will_dirty(dd->dd_dbuf, tx); 1955eda14cbcSMatt Macy dsl_dir_zapify(dd, tx); 1956eda14cbcSMatt Macy 1957eda14cbcSMatt Macy /* use the new key if given or inherit from the parent */ 1958eda14cbcSMatt Macy if (wkey == NULL) { 1959eda14cbcSMatt Macy VERIFY0(spa_keystore_wkey_hold_dd(dp->dp_spa, 1960eda14cbcSMatt Macy dd->dd_parent, FTAG, &wkey)); 1961eda14cbcSMatt Macy } else { 1962eda14cbcSMatt Macy wkey->wk_ddobj = dd->dd_object; 1963eda14cbcSMatt Macy } 1964eda14cbcSMatt Macy 1965eda14cbcSMatt Macy ASSERT3P(wkey, !=, NULL); 1966eda14cbcSMatt Macy 1967eda14cbcSMatt Macy /* Create or clone the DSL crypto key and activate the feature */ 1968eda14cbcSMatt Macy dd->dd_crypto_obj = dsl_crypto_key_create_sync(crypt, wkey, tx); 1969eda14cbcSMatt Macy VERIFY0(zap_add(dp->dp_meta_objset, dd->dd_object, 1970eda14cbcSMatt Macy DD_FIELD_CRYPTO_KEY_OBJ, sizeof (uint64_t), 1, &dd->dd_crypto_obj, 1971eda14cbcSMatt Macy tx)); 1972eda14cbcSMatt Macy dsl_dataset_activate_feature(dsobj, SPA_FEATURE_ENCRYPTION, 1973eda14cbcSMatt Macy (void *)B_TRUE, tx); 1974eda14cbcSMatt Macy 1975eda14cbcSMatt Macy /* 1976eda14cbcSMatt Macy * If we inherited the wrapping key we release our reference now. 1977eda14cbcSMatt Macy * Otherwise, this is a new key and we need to load it into the 1978eda14cbcSMatt Macy * keystore. 1979eda14cbcSMatt Macy */ 1980eda14cbcSMatt Macy if (dcp->cp_wkey == NULL) { 1981eda14cbcSMatt Macy dsl_wrapping_key_rele(wkey, FTAG); 1982eda14cbcSMatt Macy } else { 1983eda14cbcSMatt Macy VERIFY0(spa_keystore_load_wkey_impl(dp->dp_spa, wkey)); 1984eda14cbcSMatt Macy } 1985eda14cbcSMatt Macy } 1986eda14cbcSMatt Macy 1987eda14cbcSMatt Macy typedef struct dsl_crypto_recv_key_arg { 1988eda14cbcSMatt Macy uint64_t dcrka_dsobj; 1989eda14cbcSMatt Macy uint64_t dcrka_fromobj; 1990eda14cbcSMatt Macy dmu_objset_type_t dcrka_ostype; 1991eda14cbcSMatt Macy nvlist_t *dcrka_nvl; 1992eda14cbcSMatt Macy boolean_t dcrka_do_key; 1993eda14cbcSMatt Macy } dsl_crypto_recv_key_arg_t; 1994eda14cbcSMatt Macy 1995eda14cbcSMatt Macy static int 1996eda14cbcSMatt Macy dsl_crypto_recv_raw_objset_check(dsl_dataset_t *ds, dsl_dataset_t *fromds, 1997eda14cbcSMatt Macy dmu_objset_type_t ostype, nvlist_t *nvl, dmu_tx_t *tx) 1998eda14cbcSMatt Macy { 1999eda14cbcSMatt Macy int ret; 2000eda14cbcSMatt Macy objset_t *os; 2001eda14cbcSMatt Macy dnode_t *mdn; 2002eda14cbcSMatt Macy uint8_t *buf = NULL; 2003eda14cbcSMatt Macy uint_t len; 2004eda14cbcSMatt Macy uint64_t intval, nlevels, blksz, ibs; 2005eda14cbcSMatt Macy uint64_t nblkptr, maxblkid; 2006eda14cbcSMatt Macy 2007eda14cbcSMatt Macy if (ostype != DMU_OST_ZFS && ostype != DMU_OST_ZVOL) 2008eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2009eda14cbcSMatt Macy 2010eda14cbcSMatt Macy /* raw receives also need info about the structure of the metadnode */ 2011eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_compress", &intval); 2012eda14cbcSMatt Macy if (ret != 0 || intval >= ZIO_COMPRESS_LEGACY_FUNCTIONS) 2013eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2014eda14cbcSMatt Macy 2015eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_checksum", &intval); 2016eda14cbcSMatt Macy if (ret != 0 || intval >= ZIO_CHECKSUM_LEGACY_FUNCTIONS) 2017eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2018eda14cbcSMatt Macy 2019eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_nlevels", &nlevels); 2020eda14cbcSMatt Macy if (ret != 0 || nlevels > DN_MAX_LEVELS) 2021eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2022eda14cbcSMatt Macy 2023eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_blksz", &blksz); 2024eda14cbcSMatt Macy if (ret != 0 || blksz < SPA_MINBLOCKSIZE) 2025eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2026eda14cbcSMatt Macy else if (blksz > spa_maxblocksize(tx->tx_pool->dp_spa)) 2027eda14cbcSMatt Macy return (SET_ERROR(ENOTSUP)); 2028eda14cbcSMatt Macy 2029eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_indblkshift", &ibs); 2030eda14cbcSMatt Macy if (ret != 0 || ibs < DN_MIN_INDBLKSHIFT || ibs > DN_MAX_INDBLKSHIFT) 2031eda14cbcSMatt Macy return (SET_ERROR(ENOTSUP)); 2032eda14cbcSMatt Macy 2033eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_nblkptr", &nblkptr); 2034eda14cbcSMatt Macy if (ret != 0 || nblkptr != DN_MAX_NBLKPTR) 2035eda14cbcSMatt Macy return (SET_ERROR(ENOTSUP)); 2036eda14cbcSMatt Macy 2037eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, "mdn_maxblkid", &maxblkid); 2038eda14cbcSMatt Macy if (ret != 0) 2039eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2040eda14cbcSMatt Macy 2041eda14cbcSMatt Macy ret = nvlist_lookup_uint8_array(nvl, "portable_mac", &buf, &len); 2042eda14cbcSMatt Macy if (ret != 0 || len != ZIO_OBJSET_MAC_LEN) 2043eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2044eda14cbcSMatt Macy 2045eda14cbcSMatt Macy ret = dmu_objset_from_ds(ds, &os); 2046eda14cbcSMatt Macy if (ret != 0) 2047eda14cbcSMatt Macy return (ret); 2048eda14cbcSMatt Macy 2049eda14cbcSMatt Macy mdn = DMU_META_DNODE(os); 2050eda14cbcSMatt Macy 2051eda14cbcSMatt Macy /* 2052eda14cbcSMatt Macy * If we already created the objset, make sure its unchangeable 2053eda14cbcSMatt Macy * properties match the ones received in the nvlist. 2054eda14cbcSMatt Macy */ 2055eda14cbcSMatt Macy rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG); 2056eda14cbcSMatt Macy if (!BP_IS_HOLE(dsl_dataset_get_blkptr(ds)) && 2057eda14cbcSMatt Macy (mdn->dn_nlevels != nlevels || mdn->dn_datablksz != blksz || 2058eda14cbcSMatt Macy mdn->dn_indblkshift != ibs || mdn->dn_nblkptr != nblkptr)) { 2059eda14cbcSMatt Macy rrw_exit(&ds->ds_bp_rwlock, FTAG); 2060eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2061eda14cbcSMatt Macy } 2062eda14cbcSMatt Macy rrw_exit(&ds->ds_bp_rwlock, FTAG); 2063eda14cbcSMatt Macy 2064eda14cbcSMatt Macy /* 2065eda14cbcSMatt Macy * Check that the ivset guid of the fromds matches the one from the 2066eda14cbcSMatt Macy * send stream. Older versions of the encryption code did not have 2067eda14cbcSMatt Macy * an ivset guid on the from dataset and did not send one in the 2068eda14cbcSMatt Macy * stream. For these streams we provide the 2069eda14cbcSMatt Macy * zfs_disable_ivset_guid_check tunable to allow these datasets to 2070eda14cbcSMatt Macy * be received with a generated ivset guid. 2071eda14cbcSMatt Macy */ 2072eda14cbcSMatt Macy if (fromds != NULL && !zfs_disable_ivset_guid_check) { 2073eda14cbcSMatt Macy uint64_t from_ivset_guid = 0; 2074eda14cbcSMatt Macy intval = 0; 2075eda14cbcSMatt Macy 2076eda14cbcSMatt Macy (void) nvlist_lookup_uint64(nvl, "from_ivset_guid", &intval); 2077eda14cbcSMatt Macy (void) zap_lookup(tx->tx_pool->dp_meta_objset, 2078eda14cbcSMatt Macy fromds->ds_object, DS_FIELD_IVSET_GUID, 2079eda14cbcSMatt Macy sizeof (from_ivset_guid), 1, &from_ivset_guid); 2080eda14cbcSMatt Macy 2081eda14cbcSMatt Macy if (intval == 0 || from_ivset_guid == 0) 2082eda14cbcSMatt Macy return (SET_ERROR(ZFS_ERR_FROM_IVSET_GUID_MISSING)); 2083eda14cbcSMatt Macy 2084eda14cbcSMatt Macy if (intval != from_ivset_guid) 2085eda14cbcSMatt Macy return (SET_ERROR(ZFS_ERR_FROM_IVSET_GUID_MISMATCH)); 2086eda14cbcSMatt Macy } 2087eda14cbcSMatt Macy 2088eda14cbcSMatt Macy return (0); 2089eda14cbcSMatt Macy } 2090eda14cbcSMatt Macy 2091eda14cbcSMatt Macy static void 2092eda14cbcSMatt Macy dsl_crypto_recv_raw_objset_sync(dsl_dataset_t *ds, dmu_objset_type_t ostype, 2093eda14cbcSMatt Macy nvlist_t *nvl, dmu_tx_t *tx) 2094eda14cbcSMatt Macy { 2095eda14cbcSMatt Macy dsl_pool_t *dp = tx->tx_pool; 2096eda14cbcSMatt Macy objset_t *os; 2097eda14cbcSMatt Macy dnode_t *mdn; 2098eda14cbcSMatt Macy zio_t *zio; 2099eda14cbcSMatt Macy uint8_t *portable_mac; 2100eda14cbcSMatt Macy uint_t len; 2101eda14cbcSMatt Macy uint64_t compress, checksum, nlevels, blksz, ibs, maxblkid; 2102eda14cbcSMatt Macy boolean_t newds = B_FALSE; 2103eda14cbcSMatt Macy 2104eda14cbcSMatt Macy VERIFY0(dmu_objset_from_ds(ds, &os)); 2105eda14cbcSMatt Macy mdn = DMU_META_DNODE(os); 2106eda14cbcSMatt Macy 2107eda14cbcSMatt Macy /* 2108eda14cbcSMatt Macy * Fetch the values we need from the nvlist. "to_ivset_guid" must 2109eda14cbcSMatt Macy * be set on the snapshot, which doesn't exist yet. The receive 2110eda14cbcSMatt Macy * code will take care of this for us later. 2111eda14cbcSMatt Macy */ 2112eda14cbcSMatt Macy compress = fnvlist_lookup_uint64(nvl, "mdn_compress"); 2113eda14cbcSMatt Macy checksum = fnvlist_lookup_uint64(nvl, "mdn_checksum"); 2114eda14cbcSMatt Macy nlevels = fnvlist_lookup_uint64(nvl, "mdn_nlevels"); 2115eda14cbcSMatt Macy blksz = fnvlist_lookup_uint64(nvl, "mdn_blksz"); 2116eda14cbcSMatt Macy ibs = fnvlist_lookup_uint64(nvl, "mdn_indblkshift"); 2117eda14cbcSMatt Macy maxblkid = fnvlist_lookup_uint64(nvl, "mdn_maxblkid"); 2118eda14cbcSMatt Macy VERIFY0(nvlist_lookup_uint8_array(nvl, "portable_mac", &portable_mac, 2119eda14cbcSMatt Macy &len)); 2120eda14cbcSMatt Macy 2121eda14cbcSMatt Macy /* if we haven't created an objset for the ds yet, do that now */ 2122eda14cbcSMatt Macy rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG); 2123eda14cbcSMatt Macy if (BP_IS_HOLE(dsl_dataset_get_blkptr(ds))) { 2124eda14cbcSMatt Macy (void) dmu_objset_create_impl_dnstats(dp->dp_spa, ds, 2125eda14cbcSMatt Macy dsl_dataset_get_blkptr(ds), ostype, nlevels, blksz, 2126eda14cbcSMatt Macy ibs, tx); 2127eda14cbcSMatt Macy newds = B_TRUE; 2128eda14cbcSMatt Macy } 2129eda14cbcSMatt Macy rrw_exit(&ds->ds_bp_rwlock, FTAG); 2130eda14cbcSMatt Macy 2131eda14cbcSMatt Macy /* 2132eda14cbcSMatt Macy * Set the portable MAC. The local MAC will always be zero since the 2133eda14cbcSMatt Macy * incoming data will all be portable and user accounting will be 2134eda14cbcSMatt Macy * deferred until the next mount. Afterwards, flag the os to be 2135eda14cbcSMatt Macy * written out raw next time. 2136eda14cbcSMatt Macy */ 2137eda14cbcSMatt Macy arc_release(os->os_phys_buf, &os->os_phys_buf); 2138da5137abSMartin Matuska memcpy(os->os_phys->os_portable_mac, portable_mac, ZIO_OBJSET_MAC_LEN); 2139da5137abSMartin Matuska memset(os->os_phys->os_local_mac, 0, ZIO_OBJSET_MAC_LEN); 2140e92ffd9bSMartin Matuska os->os_flags &= ~OBJSET_FLAG_USERACCOUNTING_COMPLETE; 2141eda14cbcSMatt Macy os->os_next_write_raw[tx->tx_txg & TXG_MASK] = B_TRUE; 2142eda14cbcSMatt Macy 2143eda14cbcSMatt Macy /* set metadnode compression and checksum */ 2144eda14cbcSMatt Macy mdn->dn_compress = compress; 2145eda14cbcSMatt Macy mdn->dn_checksum = checksum; 2146eda14cbcSMatt Macy 2147eda14cbcSMatt Macy rw_enter(&mdn->dn_struct_rwlock, RW_WRITER); 2148eda14cbcSMatt Macy dnode_new_blkid(mdn, maxblkid, tx, B_FALSE, B_TRUE); 2149eda14cbcSMatt Macy rw_exit(&mdn->dn_struct_rwlock); 2150eda14cbcSMatt Macy 2151eda14cbcSMatt Macy /* 2152eda14cbcSMatt Macy * We can't normally dirty the dataset in syncing context unless 2153eda14cbcSMatt Macy * we are creating a new dataset. In this case, we perform a 2154eda14cbcSMatt Macy * pseudo txg sync here instead. 2155eda14cbcSMatt Macy */ 2156eda14cbcSMatt Macy if (newds) { 2157eda14cbcSMatt Macy dsl_dataset_dirty(ds, tx); 2158eda14cbcSMatt Macy } else { 2159eda14cbcSMatt Macy zio = zio_root(dp->dp_spa, NULL, NULL, ZIO_FLAG_MUSTSUCCEED); 2160eda14cbcSMatt Macy dsl_dataset_sync(ds, zio, tx); 2161eda14cbcSMatt Macy VERIFY0(zio_wait(zio)); 2162eda14cbcSMatt Macy dsl_dataset_sync_done(ds, tx); 2163eda14cbcSMatt Macy } 2164eda14cbcSMatt Macy } 2165eda14cbcSMatt Macy 2166eda14cbcSMatt Macy int 2167eda14cbcSMatt Macy dsl_crypto_recv_raw_key_check(dsl_dataset_t *ds, nvlist_t *nvl, dmu_tx_t *tx) 2168eda14cbcSMatt Macy { 2169eda14cbcSMatt Macy int ret; 2170eda14cbcSMatt Macy objset_t *mos = tx->tx_pool->dp_meta_objset; 2171eda14cbcSMatt Macy uint8_t *buf = NULL; 2172eda14cbcSMatt Macy uint_t len; 2173eda14cbcSMatt Macy uint64_t intval, key_guid, version; 2174eda14cbcSMatt Macy boolean_t is_passphrase = B_FALSE; 2175eda14cbcSMatt Macy 2176eda14cbcSMatt Macy ASSERT(dsl_dataset_phys(ds)->ds_flags & DS_FLAG_INCONSISTENT); 2177eda14cbcSMatt Macy 2178eda14cbcSMatt Macy /* 2179eda14cbcSMatt Macy * Read and check all the encryption values from the nvlist. We need 2180eda14cbcSMatt Macy * all of the fields of a DSL Crypto Key, as well as a fully specified 2181eda14cbcSMatt Macy * wrapping key. 2182eda14cbcSMatt Macy */ 2183eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, DSL_CRYPTO_KEY_CRYPTO_SUITE, &intval); 21842a58b312SMartin Matuska if (ret != 0 || intval <= ZIO_CRYPT_OFF) 2185eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2186eda14cbcSMatt Macy 21872a58b312SMartin Matuska /* 21882a58b312SMartin Matuska * Flag a future crypto suite that we don't support differently, so 21892a58b312SMartin Matuska * we can return a more useful error to the user. 21902a58b312SMartin Matuska */ 21912a58b312SMartin Matuska if (intval >= ZIO_CRYPT_FUNCTIONS) 21922a58b312SMartin Matuska return (SET_ERROR(ZFS_ERR_CRYPTO_NOTSUP)); 21932a58b312SMartin Matuska 2194eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, DSL_CRYPTO_KEY_GUID, &intval); 2195eda14cbcSMatt Macy if (ret != 0) 2196eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2197eda14cbcSMatt Macy 2198eda14cbcSMatt Macy /* 2199eda14cbcSMatt Macy * If this is an incremental receive make sure the given key guid 2200eda14cbcSMatt Macy * matches the one we already have. 2201eda14cbcSMatt Macy */ 2202eda14cbcSMatt Macy if (ds->ds_dir->dd_crypto_obj != 0) { 2203eda14cbcSMatt Macy ret = zap_lookup(mos, ds->ds_dir->dd_crypto_obj, 2204eda14cbcSMatt Macy DSL_CRYPTO_KEY_GUID, 8, 1, &key_guid); 2205eda14cbcSMatt Macy if (ret != 0) 2206eda14cbcSMatt Macy return (ret); 2207eda14cbcSMatt Macy if (intval != key_guid) 2208eda14cbcSMatt Macy return (SET_ERROR(EACCES)); 2209eda14cbcSMatt Macy } 2210eda14cbcSMatt Macy 2211eda14cbcSMatt Macy ret = nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_MASTER_KEY, 2212eda14cbcSMatt Macy &buf, &len); 2213eda14cbcSMatt Macy if (ret != 0 || len != MASTER_KEY_MAX_LEN) 2214eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2215eda14cbcSMatt Macy 2216eda14cbcSMatt Macy ret = nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_HMAC_KEY, 2217eda14cbcSMatt Macy &buf, &len); 2218eda14cbcSMatt Macy if (ret != 0 || len != SHA512_HMAC_KEYLEN) 2219eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2220eda14cbcSMatt Macy 2221eda14cbcSMatt Macy ret = nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_IV, &buf, &len); 2222eda14cbcSMatt Macy if (ret != 0 || len != WRAPPING_IV_LEN) 2223eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2224eda14cbcSMatt Macy 2225eda14cbcSMatt Macy ret = nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_MAC, &buf, &len); 2226eda14cbcSMatt Macy if (ret != 0 || len != WRAPPING_MAC_LEN) 2227eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2228eda14cbcSMatt Macy 2229eda14cbcSMatt Macy /* 2230eda14cbcSMatt Macy * We don't support receiving old on-disk formats. The version 0 2231eda14cbcSMatt Macy * implementation protected several fields in an objset that were 2232eda14cbcSMatt Macy * not always portable during a raw receive. As a result, we call 2233eda14cbcSMatt Macy * the old version an on-disk errata #3. 2234eda14cbcSMatt Macy */ 2235eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, DSL_CRYPTO_KEY_VERSION, &version); 2236eda14cbcSMatt Macy if (ret != 0 || version != ZIO_CRYPT_KEY_CURRENT_VERSION) 2237eda14cbcSMatt Macy return (SET_ERROR(ENOTSUP)); 2238eda14cbcSMatt Macy 2239eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, zfs_prop_to_name(ZFS_PROP_KEYFORMAT), 2240eda14cbcSMatt Macy &intval); 2241eda14cbcSMatt Macy if (ret != 0 || intval >= ZFS_KEYFORMAT_FORMATS || 2242eda14cbcSMatt Macy intval == ZFS_KEYFORMAT_NONE) 2243eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2244eda14cbcSMatt Macy 2245eda14cbcSMatt Macy is_passphrase = (intval == ZFS_KEYFORMAT_PASSPHRASE); 2246eda14cbcSMatt Macy 2247eda14cbcSMatt Macy /* 2248eda14cbcSMatt Macy * for raw receives we allow any number of pbkdf2iters since there 2249eda14cbcSMatt Macy * won't be a chance for the user to change it. 2250eda14cbcSMatt Macy */ 2251eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), 2252eda14cbcSMatt Macy &intval); 2253eda14cbcSMatt Macy if (ret != 0 || (is_passphrase == (intval == 0))) 2254eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2255eda14cbcSMatt Macy 2256eda14cbcSMatt Macy ret = nvlist_lookup_uint64(nvl, zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), 2257eda14cbcSMatt Macy &intval); 2258eda14cbcSMatt Macy if (ret != 0 || (is_passphrase == (intval == 0))) 2259eda14cbcSMatt Macy return (SET_ERROR(EINVAL)); 2260eda14cbcSMatt Macy 2261eda14cbcSMatt Macy return (0); 2262eda14cbcSMatt Macy } 2263eda14cbcSMatt Macy 2264eda14cbcSMatt Macy void 2265eda14cbcSMatt Macy dsl_crypto_recv_raw_key_sync(dsl_dataset_t *ds, nvlist_t *nvl, dmu_tx_t *tx) 2266eda14cbcSMatt Macy { 2267eda14cbcSMatt Macy dsl_pool_t *dp = tx->tx_pool; 2268eda14cbcSMatt Macy objset_t *mos = dp->dp_meta_objset; 2269eda14cbcSMatt Macy dsl_dir_t *dd = ds->ds_dir; 2270eda14cbcSMatt Macy uint_t len; 2271eda14cbcSMatt Macy uint64_t rddobj, one = 1; 2272eda14cbcSMatt Macy uint8_t *keydata, *hmac_keydata, *iv, *mac; 2273eda14cbcSMatt Macy uint64_t crypt, key_guid, keyformat, iters, salt; 2274eda14cbcSMatt Macy uint64_t version = ZIO_CRYPT_KEY_CURRENT_VERSION; 2275a0b956f5SMartin Matuska const char *keylocation = "prompt"; 2276eda14cbcSMatt Macy 2277eda14cbcSMatt Macy /* lookup the values we need to create the DSL Crypto Key */ 2278eda14cbcSMatt Macy crypt = fnvlist_lookup_uint64(nvl, DSL_CRYPTO_KEY_CRYPTO_SUITE); 2279eda14cbcSMatt Macy key_guid = fnvlist_lookup_uint64(nvl, DSL_CRYPTO_KEY_GUID); 2280eda14cbcSMatt Macy keyformat = fnvlist_lookup_uint64(nvl, 2281eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYFORMAT)); 2282eda14cbcSMatt Macy iters = fnvlist_lookup_uint64(nvl, 2283eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS)); 2284eda14cbcSMatt Macy salt = fnvlist_lookup_uint64(nvl, 2285eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT)); 2286eda14cbcSMatt Macy VERIFY0(nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_MASTER_KEY, 2287eda14cbcSMatt Macy &keydata, &len)); 2288eda14cbcSMatt Macy VERIFY0(nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_HMAC_KEY, 2289eda14cbcSMatt Macy &hmac_keydata, &len)); 2290eda14cbcSMatt Macy VERIFY0(nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_IV, &iv, &len)); 2291eda14cbcSMatt Macy VERIFY0(nvlist_lookup_uint8_array(nvl, DSL_CRYPTO_KEY_MAC, &mac, &len)); 2292eda14cbcSMatt Macy 2293eda14cbcSMatt Macy /* if this is a new dataset setup the DSL Crypto Key. */ 2294eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) { 2295eda14cbcSMatt Macy /* zapify the dsl dir so we can add the key object to it */ 2296eda14cbcSMatt Macy dmu_buf_will_dirty(dd->dd_dbuf, tx); 2297eda14cbcSMatt Macy dsl_dir_zapify(dd, tx); 2298eda14cbcSMatt Macy 2299eda14cbcSMatt Macy /* create the DSL Crypto Key on disk and activate the feature */ 2300eda14cbcSMatt Macy dd->dd_crypto_obj = zap_create(mos, 2301eda14cbcSMatt Macy DMU_OTN_ZAP_METADATA, DMU_OT_NONE, 0, tx); 2302eda14cbcSMatt Macy VERIFY0(zap_update(tx->tx_pool->dp_meta_objset, 2303eda14cbcSMatt Macy dd->dd_crypto_obj, DSL_CRYPTO_KEY_REFCOUNT, 2304eda14cbcSMatt Macy sizeof (uint64_t), 1, &one, tx)); 2305eda14cbcSMatt Macy VERIFY0(zap_update(tx->tx_pool->dp_meta_objset, 2306eda14cbcSMatt Macy dd->dd_crypto_obj, DSL_CRYPTO_KEY_VERSION, 2307eda14cbcSMatt Macy sizeof (uint64_t), 1, &version, tx)); 2308eda14cbcSMatt Macy 2309eda14cbcSMatt Macy dsl_dataset_activate_feature(ds->ds_object, 2310eda14cbcSMatt Macy SPA_FEATURE_ENCRYPTION, (void *)B_TRUE, tx); 2311eda14cbcSMatt Macy ds->ds_feature[SPA_FEATURE_ENCRYPTION] = (void *)B_TRUE; 2312eda14cbcSMatt Macy 2313eda14cbcSMatt Macy /* save the dd_crypto_obj on disk */ 2314eda14cbcSMatt Macy VERIFY0(zap_add(mos, dd->dd_object, DD_FIELD_CRYPTO_KEY_OBJ, 2315eda14cbcSMatt Macy sizeof (uint64_t), 1, &dd->dd_crypto_obj, tx)); 2316eda14cbcSMatt Macy 2317eda14cbcSMatt Macy /* 2318eda14cbcSMatt Macy * Set the keylocation to prompt by default. If keylocation 2319eda14cbcSMatt Macy * has been provided via the properties, this will be overridden 2320eda14cbcSMatt Macy * later. 2321eda14cbcSMatt Macy */ 2322eda14cbcSMatt Macy dsl_prop_set_sync_impl(ds, 2323eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYLOCATION), 2324eda14cbcSMatt Macy ZPROP_SRC_LOCAL, 1, strlen(keylocation) + 1, 2325eda14cbcSMatt Macy keylocation, tx); 2326eda14cbcSMatt Macy 2327eda14cbcSMatt Macy rddobj = dd->dd_object; 2328eda14cbcSMatt Macy } else { 2329eda14cbcSMatt Macy VERIFY0(dsl_dir_get_encryption_root_ddobj(dd, &rddobj)); 2330eda14cbcSMatt Macy } 2331eda14cbcSMatt Macy 2332eda14cbcSMatt Macy /* sync the key data to the ZAP object on disk */ 2333eda14cbcSMatt Macy dsl_crypto_key_sync_impl(mos, dd->dd_crypto_obj, crypt, 2334eda14cbcSMatt Macy rddobj, key_guid, iv, mac, keydata, hmac_keydata, keyformat, salt, 2335eda14cbcSMatt Macy iters, tx); 2336eda14cbcSMatt Macy } 2337eda14cbcSMatt Macy 2338eda14cbcSMatt Macy static int 2339eda14cbcSMatt Macy dsl_crypto_recv_key_check(void *arg, dmu_tx_t *tx) 2340eda14cbcSMatt Macy { 2341eda14cbcSMatt Macy int ret; 2342eda14cbcSMatt Macy dsl_crypto_recv_key_arg_t *dcrka = arg; 2343eda14cbcSMatt Macy dsl_dataset_t *ds = NULL, *fromds = NULL; 2344eda14cbcSMatt Macy 2345eda14cbcSMatt Macy ret = dsl_dataset_hold_obj(tx->tx_pool, dcrka->dcrka_dsobj, 2346eda14cbcSMatt Macy FTAG, &ds); 2347eda14cbcSMatt Macy if (ret != 0) 2348eda14cbcSMatt Macy goto out; 2349eda14cbcSMatt Macy 2350eda14cbcSMatt Macy if (dcrka->dcrka_fromobj != 0) { 2351eda14cbcSMatt Macy ret = dsl_dataset_hold_obj(tx->tx_pool, dcrka->dcrka_fromobj, 2352eda14cbcSMatt Macy FTAG, &fromds); 2353eda14cbcSMatt Macy if (ret != 0) 2354eda14cbcSMatt Macy goto out; 2355eda14cbcSMatt Macy } 2356eda14cbcSMatt Macy 2357eda14cbcSMatt Macy ret = dsl_crypto_recv_raw_objset_check(ds, fromds, 2358eda14cbcSMatt Macy dcrka->dcrka_ostype, dcrka->dcrka_nvl, tx); 2359eda14cbcSMatt Macy if (ret != 0) 2360eda14cbcSMatt Macy goto out; 2361eda14cbcSMatt Macy 2362eda14cbcSMatt Macy /* 2363eda14cbcSMatt Macy * We run this check even if we won't be doing this part of 2364eda14cbcSMatt Macy * the receive now so that we don't make the user wait until 2365eda14cbcSMatt Macy * the receive finishes to fail. 2366eda14cbcSMatt Macy */ 2367eda14cbcSMatt Macy ret = dsl_crypto_recv_raw_key_check(ds, dcrka->dcrka_nvl, tx); 2368eda14cbcSMatt Macy if (ret != 0) 2369eda14cbcSMatt Macy goto out; 2370eda14cbcSMatt Macy 2371eda14cbcSMatt Macy out: 2372eda14cbcSMatt Macy if (ds != NULL) 2373eda14cbcSMatt Macy dsl_dataset_rele(ds, FTAG); 2374eda14cbcSMatt Macy if (fromds != NULL) 2375eda14cbcSMatt Macy dsl_dataset_rele(fromds, FTAG); 2376eda14cbcSMatt Macy return (ret); 2377eda14cbcSMatt Macy } 2378eda14cbcSMatt Macy 2379eda14cbcSMatt Macy static void 2380eda14cbcSMatt Macy dsl_crypto_recv_key_sync(void *arg, dmu_tx_t *tx) 2381eda14cbcSMatt Macy { 2382eda14cbcSMatt Macy dsl_crypto_recv_key_arg_t *dcrka = arg; 2383eda14cbcSMatt Macy dsl_dataset_t *ds; 2384eda14cbcSMatt Macy 2385eda14cbcSMatt Macy VERIFY0(dsl_dataset_hold_obj(tx->tx_pool, dcrka->dcrka_dsobj, 2386eda14cbcSMatt Macy FTAG, &ds)); 2387eda14cbcSMatt Macy dsl_crypto_recv_raw_objset_sync(ds, dcrka->dcrka_ostype, 2388eda14cbcSMatt Macy dcrka->dcrka_nvl, tx); 2389eda14cbcSMatt Macy if (dcrka->dcrka_do_key) 2390eda14cbcSMatt Macy dsl_crypto_recv_raw_key_sync(ds, dcrka->dcrka_nvl, tx); 2391eda14cbcSMatt Macy dsl_dataset_rele(ds, FTAG); 2392eda14cbcSMatt Macy } 2393eda14cbcSMatt Macy 2394eda14cbcSMatt Macy /* 2395eda14cbcSMatt Macy * This function is used to sync an nvlist representing a DSL Crypto Key and 2396eda14cbcSMatt Macy * the associated encryption parameters. The key will be written exactly as is 2397eda14cbcSMatt Macy * without wrapping it. 2398eda14cbcSMatt Macy */ 2399eda14cbcSMatt Macy int 2400eda14cbcSMatt Macy dsl_crypto_recv_raw(const char *poolname, uint64_t dsobj, uint64_t fromobj, 2401eda14cbcSMatt Macy dmu_objset_type_t ostype, nvlist_t *nvl, boolean_t do_key) 2402eda14cbcSMatt Macy { 2403eda14cbcSMatt Macy dsl_crypto_recv_key_arg_t dcrka; 2404eda14cbcSMatt Macy 2405eda14cbcSMatt Macy dcrka.dcrka_dsobj = dsobj; 2406eda14cbcSMatt Macy dcrka.dcrka_fromobj = fromobj; 2407eda14cbcSMatt Macy dcrka.dcrka_ostype = ostype; 2408eda14cbcSMatt Macy dcrka.dcrka_nvl = nvl; 2409eda14cbcSMatt Macy dcrka.dcrka_do_key = do_key; 2410eda14cbcSMatt Macy 2411eda14cbcSMatt Macy return (dsl_sync_task(poolname, dsl_crypto_recv_key_check, 2412eda14cbcSMatt Macy dsl_crypto_recv_key_sync, &dcrka, 1, ZFS_SPACE_CHECK_NORMAL)); 2413eda14cbcSMatt Macy } 2414eda14cbcSMatt Macy 2415eda14cbcSMatt Macy int 2416eda14cbcSMatt Macy dsl_crypto_populate_key_nvlist(objset_t *os, uint64_t from_ivset_guid, 2417eda14cbcSMatt Macy nvlist_t **nvl_out) 2418eda14cbcSMatt Macy { 2419eda14cbcSMatt Macy int ret; 2420eda14cbcSMatt Macy dsl_dataset_t *ds = os->os_dsl_dataset; 2421eda14cbcSMatt Macy dnode_t *mdn; 2422eda14cbcSMatt Macy uint64_t rddobj; 2423eda14cbcSMatt Macy nvlist_t *nvl = NULL; 2424eda14cbcSMatt Macy uint64_t dckobj = ds->ds_dir->dd_crypto_obj; 2425eda14cbcSMatt Macy dsl_dir_t *rdd = NULL; 2426eda14cbcSMatt Macy dsl_pool_t *dp = ds->ds_dir->dd_pool; 2427eda14cbcSMatt Macy objset_t *mos = dp->dp_meta_objset; 2428eda14cbcSMatt Macy uint64_t crypt = 0, key_guid = 0, format = 0; 2429eda14cbcSMatt Macy uint64_t iters = 0, salt = 0, version = 0; 2430eda14cbcSMatt Macy uint64_t to_ivset_guid = 0; 2431eda14cbcSMatt Macy uint8_t raw_keydata[MASTER_KEY_MAX_LEN]; 2432eda14cbcSMatt Macy uint8_t raw_hmac_keydata[SHA512_HMAC_KEYLEN]; 2433eda14cbcSMatt Macy uint8_t iv[WRAPPING_IV_LEN]; 2434eda14cbcSMatt Macy uint8_t mac[WRAPPING_MAC_LEN]; 2435eda14cbcSMatt Macy 2436eda14cbcSMatt Macy ASSERT(dckobj != 0); 2437eda14cbcSMatt Macy 2438eda14cbcSMatt Macy mdn = DMU_META_DNODE(os); 2439eda14cbcSMatt Macy 2440eda14cbcSMatt Macy nvl = fnvlist_alloc(); 2441eda14cbcSMatt Macy 2442eda14cbcSMatt Macy /* lookup values from the DSL Crypto Key */ 2443eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_CRYPTO_SUITE, 8, 1, 2444eda14cbcSMatt Macy &crypt); 2445eda14cbcSMatt Macy if (ret != 0) 2446eda14cbcSMatt Macy goto error; 2447eda14cbcSMatt Macy 2448eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_GUID, 8, 1, &key_guid); 2449eda14cbcSMatt Macy if (ret != 0) 2450eda14cbcSMatt Macy goto error; 2451eda14cbcSMatt Macy 2452eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_MASTER_KEY, 1, 2453eda14cbcSMatt Macy MASTER_KEY_MAX_LEN, raw_keydata); 2454eda14cbcSMatt Macy if (ret != 0) 2455eda14cbcSMatt Macy goto error; 2456eda14cbcSMatt Macy 2457eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_HMAC_KEY, 1, 2458eda14cbcSMatt Macy SHA512_HMAC_KEYLEN, raw_hmac_keydata); 2459eda14cbcSMatt Macy if (ret != 0) 2460eda14cbcSMatt Macy goto error; 2461eda14cbcSMatt Macy 2462eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_IV, 1, WRAPPING_IV_LEN, 2463eda14cbcSMatt Macy iv); 2464eda14cbcSMatt Macy if (ret != 0) 2465eda14cbcSMatt Macy goto error; 2466eda14cbcSMatt Macy 2467eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_MAC, 1, WRAPPING_MAC_LEN, 2468eda14cbcSMatt Macy mac); 2469eda14cbcSMatt Macy if (ret != 0) 2470eda14cbcSMatt Macy goto error; 2471eda14cbcSMatt Macy 2472eda14cbcSMatt Macy /* see zfs_disable_ivset_guid_check tunable for errata info */ 2473eda14cbcSMatt Macy ret = zap_lookup(mos, ds->ds_object, DS_FIELD_IVSET_GUID, 8, 1, 2474eda14cbcSMatt Macy &to_ivset_guid); 2475eda14cbcSMatt Macy if (ret != 0) 2476eda14cbcSMatt Macy ASSERT3U(dp->dp_spa->spa_errata, !=, 0); 2477eda14cbcSMatt Macy 2478eda14cbcSMatt Macy /* 2479eda14cbcSMatt Macy * We don't support raw sends of legacy on-disk formats. See the 2480eda14cbcSMatt Macy * comment in dsl_crypto_recv_key_check() for details. 2481eda14cbcSMatt Macy */ 2482eda14cbcSMatt Macy ret = zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_VERSION, 8, 1, &version); 2483eda14cbcSMatt Macy if (ret != 0 || version != ZIO_CRYPT_KEY_CURRENT_VERSION) { 2484eda14cbcSMatt Macy dp->dp_spa->spa_errata = ZPOOL_ERRATA_ZOL_6845_ENCRYPTION; 2485eda14cbcSMatt Macy ret = SET_ERROR(ENOTSUP); 2486eda14cbcSMatt Macy goto error; 2487eda14cbcSMatt Macy } 2488eda14cbcSMatt Macy 2489eda14cbcSMatt Macy /* 2490eda14cbcSMatt Macy * Lookup wrapping key properties. An early version of the code did 2491eda14cbcSMatt Macy * not correctly add these values to the wrapping key or the DSL 2492eda14cbcSMatt Macy * Crypto Key on disk for non encryption roots, so to be safe we 2493eda14cbcSMatt Macy * always take the slightly circuitous route of looking it up from 2494eda14cbcSMatt Macy * the encryption root's key. 2495eda14cbcSMatt Macy */ 2496eda14cbcSMatt Macy ret = dsl_dir_get_encryption_root_ddobj(ds->ds_dir, &rddobj); 2497eda14cbcSMatt Macy if (ret != 0) 2498eda14cbcSMatt Macy goto error; 2499eda14cbcSMatt Macy 2500eda14cbcSMatt Macy dsl_pool_config_enter(dp, FTAG); 2501eda14cbcSMatt Macy 2502eda14cbcSMatt Macy ret = dsl_dir_hold_obj(dp, rddobj, NULL, FTAG, &rdd); 2503eda14cbcSMatt Macy if (ret != 0) 2504eda14cbcSMatt Macy goto error_unlock; 2505eda14cbcSMatt Macy 2506eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, rdd->dd_crypto_obj, 2507eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYFORMAT), 8, 1, &format); 2508eda14cbcSMatt Macy if (ret != 0) 2509eda14cbcSMatt Macy goto error_unlock; 2510eda14cbcSMatt Macy 2511eda14cbcSMatt Macy if (format == ZFS_KEYFORMAT_PASSPHRASE) { 2512eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, rdd->dd_crypto_obj, 2513eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), 8, 1, &iters); 2514eda14cbcSMatt Macy if (ret != 0) 2515eda14cbcSMatt Macy goto error_unlock; 2516eda14cbcSMatt Macy 2517eda14cbcSMatt Macy ret = zap_lookup(dp->dp_meta_objset, rdd->dd_crypto_obj, 2518eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), 8, 1, &salt); 2519eda14cbcSMatt Macy if (ret != 0) 2520eda14cbcSMatt Macy goto error_unlock; 2521eda14cbcSMatt Macy } 2522eda14cbcSMatt Macy 2523eda14cbcSMatt Macy dsl_dir_rele(rdd, FTAG); 2524eda14cbcSMatt Macy dsl_pool_config_exit(dp, FTAG); 2525eda14cbcSMatt Macy 2526eda14cbcSMatt Macy fnvlist_add_uint64(nvl, DSL_CRYPTO_KEY_CRYPTO_SUITE, crypt); 2527eda14cbcSMatt Macy fnvlist_add_uint64(nvl, DSL_CRYPTO_KEY_GUID, key_guid); 2528eda14cbcSMatt Macy fnvlist_add_uint64(nvl, DSL_CRYPTO_KEY_VERSION, version); 2529eda14cbcSMatt Macy VERIFY0(nvlist_add_uint8_array(nvl, DSL_CRYPTO_KEY_MASTER_KEY, 2530eda14cbcSMatt Macy raw_keydata, MASTER_KEY_MAX_LEN)); 2531eda14cbcSMatt Macy VERIFY0(nvlist_add_uint8_array(nvl, DSL_CRYPTO_KEY_HMAC_KEY, 2532eda14cbcSMatt Macy raw_hmac_keydata, SHA512_HMAC_KEYLEN)); 2533eda14cbcSMatt Macy VERIFY0(nvlist_add_uint8_array(nvl, DSL_CRYPTO_KEY_IV, iv, 2534eda14cbcSMatt Macy WRAPPING_IV_LEN)); 2535eda14cbcSMatt Macy VERIFY0(nvlist_add_uint8_array(nvl, DSL_CRYPTO_KEY_MAC, mac, 2536eda14cbcSMatt Macy WRAPPING_MAC_LEN)); 2537eda14cbcSMatt Macy VERIFY0(nvlist_add_uint8_array(nvl, "portable_mac", 2538eda14cbcSMatt Macy os->os_phys->os_portable_mac, ZIO_OBJSET_MAC_LEN)); 2539eda14cbcSMatt Macy fnvlist_add_uint64(nvl, zfs_prop_to_name(ZFS_PROP_KEYFORMAT), format); 2540eda14cbcSMatt Macy fnvlist_add_uint64(nvl, zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), iters); 2541eda14cbcSMatt Macy fnvlist_add_uint64(nvl, zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), salt); 2542eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_checksum", mdn->dn_checksum); 2543eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_compress", mdn->dn_compress); 2544eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_nlevels", mdn->dn_nlevels); 2545eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_blksz", mdn->dn_datablksz); 2546eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_indblkshift", mdn->dn_indblkshift); 2547eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_nblkptr", mdn->dn_nblkptr); 2548eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "mdn_maxblkid", mdn->dn_maxblkid); 2549eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "to_ivset_guid", to_ivset_guid); 2550eda14cbcSMatt Macy fnvlist_add_uint64(nvl, "from_ivset_guid", from_ivset_guid); 2551eda14cbcSMatt Macy 2552eda14cbcSMatt Macy *nvl_out = nvl; 2553eda14cbcSMatt Macy return (0); 2554eda14cbcSMatt Macy 2555eda14cbcSMatt Macy error_unlock: 2556eda14cbcSMatt Macy dsl_pool_config_exit(dp, FTAG); 2557eda14cbcSMatt Macy error: 2558eda14cbcSMatt Macy if (rdd != NULL) 2559eda14cbcSMatt Macy dsl_dir_rele(rdd, FTAG); 2560eda14cbcSMatt Macy nvlist_free(nvl); 2561eda14cbcSMatt Macy 2562eda14cbcSMatt Macy *nvl_out = NULL; 2563eda14cbcSMatt Macy return (ret); 2564eda14cbcSMatt Macy } 2565eda14cbcSMatt Macy 2566eda14cbcSMatt Macy uint64_t 2567eda14cbcSMatt Macy dsl_crypto_key_create_sync(uint64_t crypt, dsl_wrapping_key_t *wkey, 2568eda14cbcSMatt Macy dmu_tx_t *tx) 2569eda14cbcSMatt Macy { 2570eda14cbcSMatt Macy dsl_crypto_key_t dck; 2571eda14cbcSMatt Macy uint64_t version = ZIO_CRYPT_KEY_CURRENT_VERSION; 2572eda14cbcSMatt Macy uint64_t one = 1ULL; 2573eda14cbcSMatt Macy 2574eda14cbcSMatt Macy ASSERT(dmu_tx_is_syncing(tx)); 2575eda14cbcSMatt Macy ASSERT3U(crypt, <, ZIO_CRYPT_FUNCTIONS); 2576eda14cbcSMatt Macy ASSERT3U(crypt, >, ZIO_CRYPT_OFF); 2577eda14cbcSMatt Macy 2578eda14cbcSMatt Macy /* create the DSL Crypto Key ZAP object */ 2579eda14cbcSMatt Macy dck.dck_obj = zap_create(tx->tx_pool->dp_meta_objset, 2580eda14cbcSMatt Macy DMU_OTN_ZAP_METADATA, DMU_OT_NONE, 0, tx); 2581eda14cbcSMatt Macy 2582eda14cbcSMatt Macy /* fill in the key (on the stack) and sync it to disk */ 2583eda14cbcSMatt Macy dck.dck_wkey = wkey; 2584eda14cbcSMatt Macy VERIFY0(zio_crypt_key_init(crypt, &dck.dck_key)); 2585eda14cbcSMatt Macy 2586eda14cbcSMatt Macy dsl_crypto_key_sync(&dck, tx); 2587eda14cbcSMatt Macy VERIFY0(zap_update(tx->tx_pool->dp_meta_objset, dck.dck_obj, 2588eda14cbcSMatt Macy DSL_CRYPTO_KEY_REFCOUNT, sizeof (uint64_t), 1, &one, tx)); 2589eda14cbcSMatt Macy VERIFY0(zap_update(tx->tx_pool->dp_meta_objset, dck.dck_obj, 2590eda14cbcSMatt Macy DSL_CRYPTO_KEY_VERSION, sizeof (uint64_t), 1, &version, tx)); 2591eda14cbcSMatt Macy 2592eda14cbcSMatt Macy zio_crypt_key_destroy(&dck.dck_key); 2593da5137abSMartin Matuska memset(&dck.dck_key, 0, sizeof (zio_crypt_key_t)); 2594eda14cbcSMatt Macy 2595eda14cbcSMatt Macy return (dck.dck_obj); 2596eda14cbcSMatt Macy } 2597eda14cbcSMatt Macy 2598eda14cbcSMatt Macy uint64_t 2599eda14cbcSMatt Macy dsl_crypto_key_clone_sync(dsl_dir_t *origindd, dmu_tx_t *tx) 2600eda14cbcSMatt Macy { 2601eda14cbcSMatt Macy objset_t *mos = tx->tx_pool->dp_meta_objset; 2602eda14cbcSMatt Macy 2603eda14cbcSMatt Macy ASSERT(dmu_tx_is_syncing(tx)); 2604eda14cbcSMatt Macy 2605eda14cbcSMatt Macy VERIFY0(zap_increment(mos, origindd->dd_crypto_obj, 2606eda14cbcSMatt Macy DSL_CRYPTO_KEY_REFCOUNT, 1, tx)); 2607eda14cbcSMatt Macy 2608eda14cbcSMatt Macy return (origindd->dd_crypto_obj); 2609eda14cbcSMatt Macy } 2610eda14cbcSMatt Macy 2611eda14cbcSMatt Macy void 2612eda14cbcSMatt Macy dsl_crypto_key_destroy_sync(uint64_t dckobj, dmu_tx_t *tx) 2613eda14cbcSMatt Macy { 2614eda14cbcSMatt Macy objset_t *mos = tx->tx_pool->dp_meta_objset; 2615eda14cbcSMatt Macy uint64_t refcnt; 2616eda14cbcSMatt Macy 2617eda14cbcSMatt Macy /* Decrement the refcount, destroy if this is the last reference */ 2618eda14cbcSMatt Macy VERIFY0(zap_lookup(mos, dckobj, DSL_CRYPTO_KEY_REFCOUNT, 2619eda14cbcSMatt Macy sizeof (uint64_t), 1, &refcnt)); 2620eda14cbcSMatt Macy 2621eda14cbcSMatt Macy if (refcnt != 1) { 2622eda14cbcSMatt Macy VERIFY0(zap_increment(mos, dckobj, DSL_CRYPTO_KEY_REFCOUNT, 2623eda14cbcSMatt Macy -1, tx)); 2624eda14cbcSMatt Macy } else { 2625eda14cbcSMatt Macy VERIFY0(zap_destroy(mos, dckobj, tx)); 2626eda14cbcSMatt Macy } 2627eda14cbcSMatt Macy } 2628eda14cbcSMatt Macy 2629eda14cbcSMatt Macy void 2630eda14cbcSMatt Macy dsl_dataset_crypt_stats(dsl_dataset_t *ds, nvlist_t *nv) 2631eda14cbcSMatt Macy { 2632eda14cbcSMatt Macy uint64_t intval; 2633eda14cbcSMatt Macy dsl_dir_t *dd = ds->ds_dir; 2634eda14cbcSMatt Macy dsl_dir_t *enc_root; 2635eda14cbcSMatt Macy char buf[ZFS_MAX_DATASET_NAME_LEN]; 2636eda14cbcSMatt Macy 2637eda14cbcSMatt Macy if (dd->dd_crypto_obj == 0) 2638eda14cbcSMatt Macy return; 2639eda14cbcSMatt Macy 2640eda14cbcSMatt Macy intval = dsl_dataset_get_keystatus(dd); 2641eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_KEYSTATUS, intval); 2642eda14cbcSMatt Macy 2643eda14cbcSMatt Macy if (dsl_dir_get_crypt(dd, &intval) == 0) 2644eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_ENCRYPTION, intval); 2645eda14cbcSMatt Macy if (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 2646eda14cbcSMatt Macy DSL_CRYPTO_KEY_GUID, 8, 1, &intval) == 0) { 2647eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_KEY_GUID, intval); 2648eda14cbcSMatt Macy } 2649eda14cbcSMatt Macy if (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 2650eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_KEYFORMAT), 8, 1, &intval) == 0) { 2651eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_KEYFORMAT, intval); 2652eda14cbcSMatt Macy } 2653eda14cbcSMatt Macy if (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 2654eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_SALT), 8, 1, &intval) == 0) { 2655eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_PBKDF2_SALT, intval); 2656eda14cbcSMatt Macy } 2657eda14cbcSMatt Macy if (zap_lookup(dd->dd_pool->dp_meta_objset, dd->dd_crypto_obj, 2658eda14cbcSMatt Macy zfs_prop_to_name(ZFS_PROP_PBKDF2_ITERS), 8, 1, &intval) == 0) { 2659eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_PBKDF2_ITERS, intval); 2660eda14cbcSMatt Macy } 2661eda14cbcSMatt Macy if (zap_lookup(dd->dd_pool->dp_meta_objset, ds->ds_object, 2662eda14cbcSMatt Macy DS_FIELD_IVSET_GUID, 8, 1, &intval) == 0) { 2663eda14cbcSMatt Macy dsl_prop_nvlist_add_uint64(nv, ZFS_PROP_IVSET_GUID, intval); 2664eda14cbcSMatt Macy } 2665eda14cbcSMatt Macy 2666eda14cbcSMatt Macy if (dsl_dir_get_encryption_root_ddobj(dd, &intval) == 0) { 2667eda14cbcSMatt Macy if (dsl_dir_hold_obj(dd->dd_pool, intval, NULL, FTAG, 2668eda14cbcSMatt Macy &enc_root) == 0) { 2669eda14cbcSMatt Macy dsl_dir_name(enc_root, buf); 2670eda14cbcSMatt Macy dsl_dir_rele(enc_root, FTAG); 2671eda14cbcSMatt Macy dsl_prop_nvlist_add_string(nv, 2672eda14cbcSMatt Macy ZFS_PROP_ENCRYPTION_ROOT, buf); 2673eda14cbcSMatt Macy } 2674eda14cbcSMatt Macy } 2675eda14cbcSMatt Macy } 2676eda14cbcSMatt Macy 2677eda14cbcSMatt Macy int 2678eda14cbcSMatt Macy spa_crypt_get_salt(spa_t *spa, uint64_t dsobj, uint8_t *salt) 2679eda14cbcSMatt Macy { 2680eda14cbcSMatt Macy int ret; 2681eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 2682eda14cbcSMatt Macy 2683eda14cbcSMatt Macy /* look up the key from the spa's keystore */ 2684eda14cbcSMatt Macy ret = spa_keystore_lookup_key(spa, dsobj, FTAG, &dck); 2685eda14cbcSMatt Macy if (ret != 0) 2686eda14cbcSMatt Macy goto error; 2687eda14cbcSMatt Macy 2688eda14cbcSMatt Macy ret = zio_crypt_key_get_salt(&dck->dck_key, salt); 2689eda14cbcSMatt Macy if (ret != 0) 2690eda14cbcSMatt Macy goto error; 2691eda14cbcSMatt Macy 2692eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2693eda14cbcSMatt Macy return (0); 2694eda14cbcSMatt Macy 2695eda14cbcSMatt Macy error: 2696eda14cbcSMatt Macy if (dck != NULL) 2697eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2698eda14cbcSMatt Macy return (ret); 2699eda14cbcSMatt Macy } 2700eda14cbcSMatt Macy 2701eda14cbcSMatt Macy /* 2702eda14cbcSMatt Macy * Objset blocks are a special case for MAC generation. These blocks have 2 2703eda14cbcSMatt Macy * 256-bit MACs which are embedded within the block itself, rather than a 2704eda14cbcSMatt Macy * single 128 bit MAC. As a result, this function handles encoding and decoding 2705eda14cbcSMatt Macy * the MACs on its own, unlike other functions in this file. 2706eda14cbcSMatt Macy */ 2707eda14cbcSMatt Macy int 2708eda14cbcSMatt Macy spa_do_crypt_objset_mac_abd(boolean_t generate, spa_t *spa, uint64_t dsobj, 2709eda14cbcSMatt Macy abd_t *abd, uint_t datalen, boolean_t byteswap) 2710eda14cbcSMatt Macy { 2711eda14cbcSMatt Macy int ret; 2712eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 2713eda14cbcSMatt Macy void *buf = abd_borrow_buf_copy(abd, datalen); 2714eda14cbcSMatt Macy objset_phys_t *osp = buf; 2715eda14cbcSMatt Macy uint8_t portable_mac[ZIO_OBJSET_MAC_LEN]; 2716eda14cbcSMatt Macy uint8_t local_mac[ZIO_OBJSET_MAC_LEN]; 2717dbd5678dSMartin Matuska const uint8_t zeroed_mac[ZIO_OBJSET_MAC_LEN] = {0}; 2718eda14cbcSMatt Macy 2719eda14cbcSMatt Macy /* look up the key from the spa's keystore */ 2720eda14cbcSMatt Macy ret = spa_keystore_lookup_key(spa, dsobj, FTAG, &dck); 2721eda14cbcSMatt Macy if (ret != 0) 2722eda14cbcSMatt Macy goto error; 2723eda14cbcSMatt Macy 2724eda14cbcSMatt Macy /* calculate both HMACs */ 2725eda14cbcSMatt Macy ret = zio_crypt_do_objset_hmacs(&dck->dck_key, buf, datalen, 2726eda14cbcSMatt Macy byteswap, portable_mac, local_mac); 2727eda14cbcSMatt Macy if (ret != 0) 2728eda14cbcSMatt Macy goto error; 2729eda14cbcSMatt Macy 2730eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2731eda14cbcSMatt Macy 2732eda14cbcSMatt Macy /* if we are generating encode the HMACs in the objset_phys_t */ 2733eda14cbcSMatt Macy if (generate) { 2734da5137abSMartin Matuska memcpy(osp->os_portable_mac, portable_mac, ZIO_OBJSET_MAC_LEN); 2735da5137abSMartin Matuska memcpy(osp->os_local_mac, local_mac, ZIO_OBJSET_MAC_LEN); 2736eda14cbcSMatt Macy abd_return_buf_copy(abd, buf, datalen); 2737eda14cbcSMatt Macy return (0); 2738eda14cbcSMatt Macy } 2739eda14cbcSMatt Macy 2740da5137abSMartin Matuska if (memcmp(portable_mac, osp->os_portable_mac, 2741da5137abSMartin Matuska ZIO_OBJSET_MAC_LEN) != 0 || 2742da5137abSMartin Matuska memcmp(local_mac, osp->os_local_mac, ZIO_OBJSET_MAC_LEN) != 0) { 2743dbd5678dSMartin Matuska /* 2744dbd5678dSMartin Matuska * If the MAC is zeroed out, we failed to decrypt it. 2745dbd5678dSMartin Matuska * This should only arise, at least on Linux, 2746dbd5678dSMartin Matuska * if we hit edge case handling for useraccounting, since we 2747dbd5678dSMartin Matuska * shouldn't get here without bailing out on error earlier 2748dbd5678dSMartin Matuska * otherwise. 2749dbd5678dSMartin Matuska * 2750dbd5678dSMartin Matuska * So if we're in that case, we can just fall through and 2751dbd5678dSMartin Matuska * special-casing noticing that it's zero will handle it 2752dbd5678dSMartin Matuska * elsewhere, since we can just regenerate it. 2753dbd5678dSMartin Matuska */ 2754dbd5678dSMartin Matuska if (memcmp(local_mac, zeroed_mac, ZIO_OBJSET_MAC_LEN) != 0) { 2755eda14cbcSMatt Macy abd_return_buf(abd, buf, datalen); 2756eda14cbcSMatt Macy return (SET_ERROR(ECKSUM)); 2757eda14cbcSMatt Macy } 2758dbd5678dSMartin Matuska } 2759eda14cbcSMatt Macy 2760eda14cbcSMatt Macy abd_return_buf(abd, buf, datalen); 2761eda14cbcSMatt Macy 2762eda14cbcSMatt Macy return (0); 2763eda14cbcSMatt Macy 2764eda14cbcSMatt Macy error: 2765eda14cbcSMatt Macy if (dck != NULL) 2766eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2767eda14cbcSMatt Macy abd_return_buf(abd, buf, datalen); 2768eda14cbcSMatt Macy return (ret); 2769eda14cbcSMatt Macy } 2770eda14cbcSMatt Macy 2771eda14cbcSMatt Macy int 2772eda14cbcSMatt Macy spa_do_crypt_mac_abd(boolean_t generate, spa_t *spa, uint64_t dsobj, abd_t *abd, 2773eda14cbcSMatt Macy uint_t datalen, uint8_t *mac) 2774eda14cbcSMatt Macy { 2775eda14cbcSMatt Macy int ret; 2776eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 2777eda14cbcSMatt Macy uint8_t *buf = abd_borrow_buf_copy(abd, datalen); 2778eda14cbcSMatt Macy uint8_t digestbuf[ZIO_DATA_MAC_LEN]; 2779eda14cbcSMatt Macy 2780eda14cbcSMatt Macy /* look up the key from the spa's keystore */ 2781eda14cbcSMatt Macy ret = spa_keystore_lookup_key(spa, dsobj, FTAG, &dck); 2782eda14cbcSMatt Macy if (ret != 0) 2783eda14cbcSMatt Macy goto error; 2784eda14cbcSMatt Macy 2785eda14cbcSMatt Macy /* perform the hmac */ 2786eda14cbcSMatt Macy ret = zio_crypt_do_hmac(&dck->dck_key, buf, datalen, 2787eda14cbcSMatt Macy digestbuf, ZIO_DATA_MAC_LEN); 2788eda14cbcSMatt Macy if (ret != 0) 2789eda14cbcSMatt Macy goto error; 2790eda14cbcSMatt Macy 2791eda14cbcSMatt Macy abd_return_buf(abd, buf, datalen); 2792eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2793eda14cbcSMatt Macy 2794eda14cbcSMatt Macy /* 2795eda14cbcSMatt Macy * Truncate and fill in mac buffer if we were asked to generate a MAC. 2796eda14cbcSMatt Macy * Otherwise verify that the MAC matched what we expected. 2797eda14cbcSMatt Macy */ 2798eda14cbcSMatt Macy if (generate) { 2799da5137abSMartin Matuska memcpy(mac, digestbuf, ZIO_DATA_MAC_LEN); 2800eda14cbcSMatt Macy return (0); 2801eda14cbcSMatt Macy } 2802eda14cbcSMatt Macy 2803da5137abSMartin Matuska if (memcmp(digestbuf, mac, ZIO_DATA_MAC_LEN) != 0) 2804eda14cbcSMatt Macy return (SET_ERROR(ECKSUM)); 2805eda14cbcSMatt Macy 2806eda14cbcSMatt Macy return (0); 2807eda14cbcSMatt Macy 2808eda14cbcSMatt Macy error: 2809eda14cbcSMatt Macy if (dck != NULL) 2810eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2811eda14cbcSMatt Macy abd_return_buf(abd, buf, datalen); 2812eda14cbcSMatt Macy return (ret); 2813eda14cbcSMatt Macy } 2814eda14cbcSMatt Macy 2815eda14cbcSMatt Macy /* 2816eda14cbcSMatt Macy * This function serves as a multiplexer for encryption and decryption of 2817eda14cbcSMatt Macy * all blocks (except the L2ARC). For encryption, it will populate the IV, 2818eda14cbcSMatt Macy * salt, MAC, and cabd (the ciphertext). On decryption it will simply use 2819eda14cbcSMatt Macy * these fields to populate pabd (the plaintext). 2820eda14cbcSMatt Macy */ 2821eda14cbcSMatt Macy int 2822eda14cbcSMatt Macy spa_do_crypt_abd(boolean_t encrypt, spa_t *spa, const zbookmark_phys_t *zb, 2823eda14cbcSMatt Macy dmu_object_type_t ot, boolean_t dedup, boolean_t bswap, uint8_t *salt, 2824eda14cbcSMatt Macy uint8_t *iv, uint8_t *mac, uint_t datalen, abd_t *pabd, abd_t *cabd, 2825eda14cbcSMatt Macy boolean_t *no_crypt) 2826eda14cbcSMatt Macy { 2827eda14cbcSMatt Macy int ret; 2828eda14cbcSMatt Macy dsl_crypto_key_t *dck = NULL; 2829eda14cbcSMatt Macy uint8_t *plainbuf = NULL, *cipherbuf = NULL; 2830eda14cbcSMatt Macy 2831eda14cbcSMatt Macy ASSERT(spa_feature_is_active(spa, SPA_FEATURE_ENCRYPTION)); 2832eda14cbcSMatt Macy 2833eda14cbcSMatt Macy /* look up the key from the spa's keystore */ 2834eda14cbcSMatt Macy ret = spa_keystore_lookup_key(spa, zb->zb_objset, FTAG, &dck); 2835eda14cbcSMatt Macy if (ret != 0) { 2836eda14cbcSMatt Macy ret = SET_ERROR(EACCES); 2837eda14cbcSMatt Macy return (ret); 2838eda14cbcSMatt Macy } 2839eda14cbcSMatt Macy 2840eda14cbcSMatt Macy if (encrypt) { 2841eda14cbcSMatt Macy plainbuf = abd_borrow_buf_copy(pabd, datalen); 2842eda14cbcSMatt Macy cipherbuf = abd_borrow_buf(cabd, datalen); 2843eda14cbcSMatt Macy } else { 2844eda14cbcSMatt Macy plainbuf = abd_borrow_buf(pabd, datalen); 2845eda14cbcSMatt Macy cipherbuf = abd_borrow_buf_copy(cabd, datalen); 2846eda14cbcSMatt Macy } 2847eda14cbcSMatt Macy 2848eda14cbcSMatt Macy /* 2849eda14cbcSMatt Macy * Both encryption and decryption functions need a salt for key 2850eda14cbcSMatt Macy * generation and an IV. When encrypting a non-dedup block, we 2851eda14cbcSMatt Macy * generate the salt and IV randomly to be stored by the caller. Dedup 2852eda14cbcSMatt Macy * blocks perform a (more expensive) HMAC of the plaintext to obtain 2853eda14cbcSMatt Macy * the salt and the IV. ZIL blocks have their salt and IV generated 2854eda14cbcSMatt Macy * at allocation time in zio_alloc_zil(). On decryption, we simply use 2855eda14cbcSMatt Macy * the provided values. 2856eda14cbcSMatt Macy */ 2857eda14cbcSMatt Macy if (encrypt && ot != DMU_OT_INTENT_LOG && !dedup) { 2858eda14cbcSMatt Macy ret = zio_crypt_key_get_salt(&dck->dck_key, salt); 2859eda14cbcSMatt Macy if (ret != 0) 2860eda14cbcSMatt Macy goto error; 2861eda14cbcSMatt Macy 2862eda14cbcSMatt Macy ret = zio_crypt_generate_iv(iv); 2863eda14cbcSMatt Macy if (ret != 0) 2864eda14cbcSMatt Macy goto error; 2865eda14cbcSMatt Macy } else if (encrypt && dedup) { 2866eda14cbcSMatt Macy ret = zio_crypt_generate_iv_salt_dedup(&dck->dck_key, 2867eda14cbcSMatt Macy plainbuf, datalen, iv, salt); 2868eda14cbcSMatt Macy if (ret != 0) 2869eda14cbcSMatt Macy goto error; 2870eda14cbcSMatt Macy } 2871eda14cbcSMatt Macy 2872eda14cbcSMatt Macy /* call lower level function to perform encryption / decryption */ 2873eda14cbcSMatt Macy ret = zio_do_crypt_data(encrypt, &dck->dck_key, ot, bswap, salt, iv, 2874eda14cbcSMatt Macy mac, datalen, plainbuf, cipherbuf, no_crypt); 2875eda14cbcSMatt Macy 2876eda14cbcSMatt Macy /* 2877eda14cbcSMatt Macy * Handle injected decryption faults. Unfortunately, we cannot inject 2878eda14cbcSMatt Macy * faults for dnode blocks because we might trigger the panic in 2879eda14cbcSMatt Macy * dbuf_prepare_encrypted_dnode_leaf(), which exists because syncing 2880eda14cbcSMatt Macy * context is not prepared to handle malicious decryption failures. 2881eda14cbcSMatt Macy */ 2882eda14cbcSMatt Macy if (zio_injection_enabled && !encrypt && ot != DMU_OT_DNODE && ret == 0) 2883eda14cbcSMatt Macy ret = zio_handle_decrypt_injection(spa, zb, ot, ECKSUM); 2884eda14cbcSMatt Macy if (ret != 0) 2885eda14cbcSMatt Macy goto error; 2886eda14cbcSMatt Macy 2887eda14cbcSMatt Macy if (encrypt) { 2888eda14cbcSMatt Macy abd_return_buf(pabd, plainbuf, datalen); 2889eda14cbcSMatt Macy abd_return_buf_copy(cabd, cipherbuf, datalen); 2890eda14cbcSMatt Macy } else { 2891eda14cbcSMatt Macy abd_return_buf_copy(pabd, plainbuf, datalen); 2892eda14cbcSMatt Macy abd_return_buf(cabd, cipherbuf, datalen); 2893eda14cbcSMatt Macy } 2894eda14cbcSMatt Macy 2895eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2896eda14cbcSMatt Macy 2897eda14cbcSMatt Macy return (0); 2898eda14cbcSMatt Macy 2899eda14cbcSMatt Macy error: 2900eda14cbcSMatt Macy if (encrypt) { 2901eda14cbcSMatt Macy /* zero out any state we might have changed while encrypting */ 2902da5137abSMartin Matuska memset(salt, 0, ZIO_DATA_SALT_LEN); 2903da5137abSMartin Matuska memset(iv, 0, ZIO_DATA_IV_LEN); 2904da5137abSMartin Matuska memset(mac, 0, ZIO_DATA_MAC_LEN); 2905eda14cbcSMatt Macy abd_return_buf(pabd, plainbuf, datalen); 2906eda14cbcSMatt Macy abd_return_buf_copy(cabd, cipherbuf, datalen); 2907eda14cbcSMatt Macy } else { 2908eda14cbcSMatt Macy abd_return_buf_copy(pabd, plainbuf, datalen); 2909eda14cbcSMatt Macy abd_return_buf(cabd, cipherbuf, datalen); 2910eda14cbcSMatt Macy } 2911eda14cbcSMatt Macy 2912eda14cbcSMatt Macy spa_keystore_dsl_key_rele(spa, dck, FTAG); 2913eda14cbcSMatt Macy 2914eda14cbcSMatt Macy return (ret); 2915eda14cbcSMatt Macy } 2916eda14cbcSMatt Macy 2917eda14cbcSMatt Macy ZFS_MODULE_PARAM(zfs, zfs_, disable_ivset_guid_check, INT, ZMOD_RW, 2918eda14cbcSMatt Macy "Set to allow raw receives without IVset guids"); 2919