1 /* 2 BAREOS® - Backup Archiving REcovery Open Sourced 3 4 Copyright (C) 2011-2012 Planets Communications B.V. 5 Copyright (C) 2013-2013 Bareos GmbH & Co. KG 6 7 This program is Free Software; you can redistribute it and/or 8 modify it under the terms of version three of the GNU Affero General Public 9 License as published by the Free Software Foundation and included 10 in the file LICENSE. 11 12 This program is distributed in the hope that it will be useful, but 13 WITHOUT ANY WARRANTY; without even the implied warranty of 14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 15 Affero General Public License for more details. 16 17 You should have received a copy of the GNU Affero General Public License 18 along with this program; if not, write to the Free Software 19 Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 20 02110-1301, USA. 21 */ 22 23 /* 24 * Marco van Wieringen, March 2012 25 */ 26 27 #ifndef BAREOS_LIB_SCSI_CRYPTO_H_ 28 #define BAREOS_LIB_SCSI_CRYPTO_H_ 1 29 30 /* 31 * Include the SCSI Low Level Interface functions and definitions. 32 */ 33 #include "scsi_lli.h" 34 35 #define SPP_SP_PROTOCOL_TDE 0x20 36 37 #define SPP_KEY_LENGTH 0x20 /* 32 bytes */ 38 #define SPP_DESCRIPTOR_LENGTH 1024 39 #define SPP_PAGE_DES_LENGTH 24 40 #define SPP_PAGE_NBES_LENGTH 16 41 #define SPP_KAD_HEAD_LENGTH 4 42 #define SPP_PAGE_ALLOCATION 8192 43 #define SPP_UKAD_LENGTH 0x1e 44 45 /* 46 * SCSI CDB opcodes 47 */ 48 enum { 49 SCSI_SPIN_OPCODE = 0xa2, 50 SCSI_SPOUT_OPCODE = 0xb5 51 }; 52 53 /* 54 * SCSI SPIN pagecodes. 55 */ 56 enum { 57 SPIN_TAPE_DATA_ENCR_IN_SUP_PAGE = 0x00, /* Tape Data Encryption In Support page */ 58 SPIN_TAPE_DATE_ENCR_OUT_SUP_PAGE = 0x01, /* Tape Data Encryption Out Support page */ 59 SPIN_DATA_ENCR_CAP_PAGE = 0x10, /* Data Encryption Capabilities page */ 60 SPIN_SUP_KEY_FORMATS_PAGE = 0x11, /* Supported Key Formats page */ 61 SPIN_DATA_ENCR_MGMT_CAP_PAGE = 0x12, /* Data Encryption Management Capabilities page */ 62 SPIN_DATA_ENCR_STATUS_PAGE = 0x20, /* Data Encryption Status page */ 63 SPIN_NEXT_BLOCK_ENCR_STATUS_PAGE = 0x21, /* Next Block Encryption Status page */ 64 SPIN_RANDOM_NUM_PAGE = 0x30, /* Random Number page */ 65 SPIN_DEV_SVR_KEY_WRAP_PUB_KEY_PAGE = 0x31 /* Device Server Key Wrapping Public Key page */ 66 }; 67 68 /* 69 * SCSI SPOUT pagecodes. 70 */ 71 enum { 72 SPOUT_SET_DATA_ENCRYPTION_PAGE = 0x10, /* Set Data Encryption page */ 73 SPOUT_SA_ENCAP_PAGE = 0x11 /* SA Encapsulation page */ 74 }; 75 76 /* 77 * SPP SCSI Control Descriptor Block 78 */ 79 typedef struct { 80 uint8_t opcode; /* Operation Code See SCSI_*_OPCODE */ 81 uint8_t scp; /* Security Protocol */ 82 uint8_t scp_specific[2]; /* Security Protocol Specific, 2 bytes MSB/LSB */ 83 uint8_t res_bits_1[2]; /* Reserved, 2 bytes */ 84 uint8_t allocation_length[4]; /* Allocation Length, 4 bytes, 2 bytes MSB and 2 bytes LSB */ 85 uint8_t res_bits_2; /* Reserved, 1 byte */ 86 uint8_t control_byte; /* Control Byte */ 87 } SPP_SCSI_CDB; 88 89 /* 90 * Generic SPP Page Buffer 91 */ 92 typedef struct { 93 uint8_t pageCode[2]; 94 uint8_t length[2]; 95 uint8_t buffer[SPP_PAGE_ALLOCATION]; 96 } SPP_PAGE_BUFFER; 97 98 /* 99 * Nexus Scopes 100 */ 101 enum { 102 SPP_NEXUS_SC_PUBLIC = 0, /* All fields other than the scope field and LOCK bit shall be ignored. 103 The I_T nexus shall use data encryption parameters that are shared 104 by other I_T nexuses. If no I_T nexuses are sharing data encryption 105 parameters, the device server shall use default data encryption parameters. */ 106 SPP_NEXUS_SC_LOCAL = 1, /* The data encryption parameters are unique to the I_T nexus associated 107 with the SECURITY PROTOCOL OUT command and shall not be shared 108 with other I_T nexuses.*/ 109 SPP_NEXUS_SC_ALL_I_T_NEXUS = 2 /* The data encryption parameters shall be shared with all I_T nexuses. */ 110 }; 111 112 /* 113 * Check External Encryption Mode 114 */ 115 enum { 116 SPP_CEEM_VENDOR_SPECIFIC = 0, /* Vendor specific */ 117 SPP_CEEM_NO_ENCR_CHECK = 1, /* Do not check the encryption mode that was in use when the block 118 was written to the medium.*/ 119 SPP_CEEM_CHECK_EXTERNAL = 2, /* On read and verify commands, check the encryption mode that 120 was in use when the block was written to the medium. Report an 121 error if the block was written in EXTERNAL mode */ 122 SPP_CEEM_CHECK_ENCR = 3 /* On read and verify commands, check the encryption mode that 123 was in use when the block was written to the medium. Report 124 an error if the block was written in ENCRYPT mode */ 125 }; 126 127 /* 128 * Raw Decryption Mode Control 129 */ 130 enum { 131 SPP_RDMC_DEFAULT = 0, /* The device server shall mark each encrypted block per the default 132 setting for the algorithm */ 133 SPP_RDMC_UNPROTECT = 2, /* The device server shall mark each encrypted block written to the 134 medium in a format specific manner as enabled for raw decryption 135 mode operations. */ 136 SPP_RDMC_PROTECT = 3 /* The device server shall mark each encrypted block written to the 137 medium in a format specific manner as disabled for raw 138 decryption mode operations. */ 139 }; 140 141 /* 142 * Encryption Modes. 143 */ 144 enum { 145 SPP_ENCR_MODE_DISABLE = 0, /* Data encryption is disabled. */ 146 SPP_ENCR_MODE_EXTERNAL = 1, /* The data associated with the WRITE(6) and WRITE(16) commands has been 147 encrypted by a system that is compatible with the algorithm specified 148 by the ALGORITHM INDEX field. */ 149 SPP_ENCR_MODE_ENCRYPT = 2 /* The device server shall encrypt all data that it receives for a 150 WRITE(6) or WRITE(16) command using the algorithm specified in the 151 ALGORITHM INDEX field and the key specified in the KEY field. */ 152 }; 153 154 /* 155 * Decryption Modes. 156 */ 157 enum { 158 SPP_DECR_MODE_DISABLE = 0, /* Data decryption is disabled. If the device server encounters an 159 encrypted logical block while reading, it shall not allow access 160 to the data. */ 161 SPP_DECR_MODE_RAW = 1, /* Data decryption is disabled. If the device server encounters an 162 encrypted logical block while reading, it shall pass the encrypted 163 block to the host without decrypting it. The encrypted block 164 may contain data that is not user data. */ 165 SPP_DECR_MODE_DECRYPT = 2, /* The device server shall decrypt all data that is read from the medium 166 when processing a READ(6), READ(16), READ REVERSE(6), READ REVERSE(16), 167 or RECOVER BUFFERED DATA command or verified when processing a 168 VERIFY(6) or VERIFY(16) command. The data shall be decrypted 169 using the algorithm specified in the ALGORITHM INDEX field and 170 the key specified in the KEY field */ 171 SPP_DECR_MODE_MIXED = 3 /* The device server shall decrypt all data that is read from the 172 medium that the device server determines was encrypted when processing 173 a READ(6), READ(16), READ REVERSE(6), READ REVERSE(16), or 174 RECOVER BUFFERED DATA command or verified when processing a 175 VERIFY(6) or VERIFY(16) command. The data shall be decrypted 176 using the algorithm specified in the ALGORITHM INDEX 177 field and the key specified in the KEY field. If the device 178 server encounters unencrypted data when processing a READ(6), 179 READ(16), READ REVERSE(6), READ REVERSE(16), RECOVER BUFFERED DATA, 180 VERIFY(6), or VERIFY(16) command, the data shall be processed 181 without decrypting */ 182 }; 183 184 /* 185 * Key Format Types. 186 */ 187 enum { 188 SPP_KAD_KEY_FORMAT_NORMAL = 0, /* The KEY field contains the key to be used to encrypt or decrypt data. */ 189 SPP_KAD_KEY_FORMAT_REFERENCE = 1, /* The KEY field contains a vendor-specific key reference. */ 190 SPP_KAD_KEY_FORMAT_WRAPPED = 2, /* The KEY field contains the key wrapped by the device server public key. */ 191 SPP_KAD_KEY_FORMAT_ESP_SCSI = 3 /* The KEY field contains a key that is encrypted using ESP-SCSI. */ 192 }; 193 194 195 /* 196 * Key Descriptor Types 197 */ 198 enum { 199 SPP_KAD_KEY_DESC_UKAD = 0, /* Unauthenticated key-associated data */ 200 SPP_KAD_KEY_DESC_AKAD = 1, /* Authenticated key-associated data */ 201 SPP_KAD_KEY_DESC_NONCE = 2, /* Nonce value */ 202 SPP_KAD_KEY_DESC_META = 3 /* Metadata key-associated data */ 203 }; 204 205 /* 206 * SPOUT Page Set Data Encryption (0x10) 207 */ 208 typedef struct { 209 uint8_t pageCode[2]; /* Page Code, 2 bytes MSB/LSB */ 210 uint8_t length[2]; /* Page Length, 2 bytes MSB/LSB */ 211 #if HAVE_BIG_ENDIAN 212 uint8_t nexusScope:3; /* Scope, See SPP_NEXUS_SC_* */ 213 uint8_t res_bits_1:4; /* Reserved, 4 bits */ 214 uint8_t lock:1; /* Lock bit */ 215 uint8_t CEEM:2; /* Check External Encryption Mode, See SPP_CEEM_* */ 216 uint8_t RDMC:2; /* Raw Decryption Mode Control, See SPP_RDMC_* */ 217 uint8_t SDK:1; /* Supplemental Decryption Key */ 218 uint8_t CKOD:1; /* Clear Key On Demount */ 219 uint8_t CKORP:1; /* Clear Key On Reservation Preempt */ 220 uint8_t CKORL:1; /* Clear Key On Reservation Lost */ 221 #else 222 uint8_t lock:1; /* Lock bit */ 223 uint8_t res_bits_1:4; /* Reserved, 4 bits */ 224 uint8_t nexusScope:3; /* Scope, See SPP_NEXUS_SC_* */ 225 uint8_t CKORL:1; /* Clear Key On Reservation Lost */ 226 uint8_t CKORP:1; /* Clear Key On Reservation Preempt */ 227 uint8_t CKOD:1; /* Clear Key On Demount */ 228 uint8_t SDK:1; /* Supplemental Decryption Key */ 229 uint8_t RDMC:2; /* Raw Decryption Mode Control, See SPP_RDMC_* */ 230 uint8_t CEEM:2; /* Check External Encryption Mode, See SPP_CEEM_* */ 231 #endif 232 uint8_t encryptionMode; /* Encryption Mode, See SPP_ENCR_MODE_* */ 233 uint8_t decryptionMode; /* Decryption Mode, See SPP_DECR_MODE_* */ 234 uint8_t algorithmIndex; /* Algorithm Index */ 235 uint8_t keyFormat; /* Logical Block Encryption Key Format */ 236 uint8_t kadFormat; /* KAD Format, See SPP_KAD_KEY_FORMAT_* */ 237 uint8_t res_bits_2[7]; /* Reserved, 7 bytes */ 238 uint8_t keyLength[2]; /* Logical Block Encryption Key Length, 2 bytes MSB/LSB */ 239 uint8_t keyData[SPP_KEY_LENGTH]; 240 } SPP_PAGE_SDE; 241 242 enum { 243 SPP_PARM_LOG_BLOCK_ENCR_NONE = 0, /* Logical block encryption parameters control is not reported. */ 244 SPP_PARM_LOG_BLOCK_ENCR_AME = 1, /* Logical Block Encryption Parameters are not exclusively 245 controlled by external data encryption control. */ 246 SPP_PARM_LOG_BLOCK_ENCR_DRIVE = 2, /* Logical block encryption parameters are exclusively 247 controlled by the sequential-access device server. */ 248 SPP_PARM_LOG_BLOCK_LME_ADC = 3, /* Logical block encryption parameters are exclusively 249 controlled by the automation/drive interface device server. */ 250 SPP_PARM_LOG_BLOCK_UNSUP = 4 /* Not supported. */ 251 }; 252 253 /* 254 * Device Encryption Status Page (0x20) 255 */ 256 typedef struct { 257 uint8_t pageCode[2]; /* Page Code, 2 bytes MSB/LSB */ 258 uint8_t length[2]; /* Page Length, 2 bytes MSB/LSB */ 259 #if HAVE_BIG_ENDIAN 260 uint8_t nexusScope:3; /* Scope, See SPP_NEXUS_SC_* */ 261 uint8_t res_bits_1:2; /* Reserved, 2 bits */ 262 uint8_t keyScope:3; /* Logical Block Encryption Scope */ 263 #else 264 uint8_t keyScope:3; /* Logical Block Encryption Scope */ 265 uint8_t res_bits_1:2; /* Reserved, 2 bits */ 266 uint8_t nexusScope:3; /* Scope, See SPP_NEXUS_SC_* */ 267 #endif 268 uint8_t encryptionMode; /* Encryption Mode, See SPP_ENCR_MODE_* */ 269 uint8_t decryptionMode; /* Decryption Mode, See SPP_DECR_MODE_* */ 270 uint8_t algorithmIndex; /* Algorithm Index */ 271 uint8_t keyInstance[4]; /* Key Instance Counter MSB/LSB */ 272 #if HAVE_BIG_ENDIAN 273 uint8_t res_bits_2:1; /* Reserved, 1 bit */ 274 uint8_t parametersControl:3; /* Logical Block encryption parameters, See SPP_PARM_LOG_BLOCK_* */ 275 uint8_t VCELB:1; /* Volume Contains Encrypted Logical Blocks */ 276 uint8_t CEEMS:2; /* Check External Encryption Mode Status, See SPP_CEEM_* */ 277 uint8_t RDMD:1; /* Raw Decryption Mode Disabled */ 278 #else 279 uint8_t RDMD:1; /* Raw Decryption Mode Disabled */ 280 uint8_t CEEMS:2; /* Check External Encryption Mode Status, See SPP_CEEM_* */ 281 uint8_t VCELB:1; /* Volume Contains Encrypted Logical Blocks */ 282 uint8_t parametersControl:3; /* Logical Block encryption parameters, See SPP_PARM_LOG_BLOCK_* */ 283 uint8_t res_bits_2:1; /* Reserved, 1 bit */ 284 #endif 285 uint8_t kadFormat; /* KAD Format, See SPP_KAD_KEY_FORMAT_* */ 286 uint8_t ASDKCount[2]; /* Available Supplemental Decryption Key MSB/LSB */ 287 uint8_t res_bits_4[8]; /* Reserved, 8 bytes */ 288 } SPP_PAGE_DES; 289 290 enum { 291 SPP_COMP_STATUS_UNKNOWN = 0, /* The device server is incapable of determining if the logical 292 object referenced by the LOGICAL OBJECT NUMBER field has been 293 compressed. */ 294 SPP_COMP_STATUS_UNAVAIL = 1, /* The device server is capable of determining if the logical 295 object referenced by the LOGICAL OBJECT NUMBER field has 296 been compressed, but is not able to at this time. 297 Possible reasons are: 298 a) the next logical block has not yet been read into the buffer; 299 b) there was an error reading the next logical block; or 300 c) there are no more logical blocks (i.e., end-of-data). */ 301 SPP_COMP_STATUS_ILLEGAL = 2, /* The device server has determined that the logical object referenced 302 by the LOGICAL OBJECT NUMBER field is not a logical block. */ 303 SPP_COMP_STATUS_UNCOMPRESSED = 3, /* The device server has determined that the logical object referenced 304 by the LOGICAL OBJECT NUMBER field is not compressed. */ 305 SPP_COMP_STATUS_COMPRESSED = 4 /* The device server has determined that the logical object referenced 306 by the LOGICAL OBJECT NUMBER field is compressed. */ 307 }; 308 309 enum { 310 SPP_ENCR_STATUS_UNKNOWN = 0, /* The device server is incapable of determining if the logical object 311 referenced by the LOGICAL OBJECT NUMBER field has been encrypted. */ 312 SPP_ENCR_STATUS_UNAVAIL = 1, /* The device server is capable of determining if the logical object 313 referenced by the LOGICAL OBJECT NUMBER field has been encrypted, 314 but is not able to at this time. Possible reasons are: 315 a) the next logical block has not yet been read into the buffer; 316 b) there was an error reading the next logical block; or 317 c) there are no more logical blocks (i.e., end-of-data). */ 318 SPP_ENCR_STATUS_ILLEGAL = 2, /* The device server has determined that the logical object referenced 319 by the LOGICAL OBJECT NUMBER field is not a logical block. */ 320 SPP_ENCR_STATUS_NOT_ENCRYPTED = 3, /* The device server has determined that the logical object referenced 321 by the LOGICAL OBJECT NUMBER field is not encrypted. */ 322 SPP_ENCR_STATUS_ENCR_ALG_NOT_SUPP = 4, /* The device server has determined that the logical object referenced by 323 the LOGICAL OBJECT NUMBER field is encrypted by an algorithm that is 324 not supported by this device server. The values in the KEY-ASSOCIATED 325 DATA DESCRIPTORS field contain information pertaining to the encrypted block. */ 326 SPP_ENCR_STATUS_ENCRYPTED = 5, /* The device server has determined that the logical object referenced by 327 the LOGICAL OBJECT NUMBER field is encrypted by an algorithm that is 328 supported by this device server. The values in the ALGORITHM INDEX and 329 KEY-ASSOCIATED DATA DESCRIPTORS fields contain information pertaining 330 to the encrypted block. */ 331 SPP_ENCR_STATUS_ENCR_NOT_AVAIL = 6 /* The device server has determined that the logical object referenced by 332 the LOGICAL OBJECT NUMBER field is encrypted by an algorithm that is 333 supported by this device server, but the device server is either not 334 enabled to decrypt or does not have the correct key or nonce value to 335 decrypt the encrypted block. */ 336 }; 337 338 /* 339 * Next Block Encryption Status Page (0x21) 340 */ 341 typedef struct { 342 uint8_t pageCode[2]; /* Page Code, 2 bytes MSB/LSB */ 343 uint8_t length[2]; /* Page Length, 2 bytes MSB/LSB */ 344 uint8_t log_obj_num[8]; /* Logical Object Number */ 345 #if HAVE_BIG_ENDIAN 346 uint8_t compressionStatus:4; /* Compression Status, See SPP_COMPRESS_STATUS_* */ 347 uint8_t encryptionStatus:4; /* Encryption Status, See SPP_ENCR_STATUS_* */ 348 #else 349 uint8_t encryptionStatus:4; /* Encryption Status, See SPP_ENCR_STATUS_* */ 350 uint8_t compressionStatus:4; /* Compression Status, See SPP_COMPRESS_STATUS_* */ 351 #endif 352 uint8_t algorithmIndex; /* Algorithm Index */ 353 #if HAVE_BIG_ENDIAN 354 uint8_t res_bits_1:6; /* Reserved, 6 bits */ 355 uint8_t EMES:1; /* Encryption Mode External Status */ 356 uint8_t RDMDS:1; /* Raw Decryption Mode Disabled Status */ 357 #else 358 uint8_t RDMDS:1; /* Raw Decryption Mode Disabled Status */ 359 uint8_t EMES:1; /* Encryption Mode External Status */ 360 uint8_t res_bits_1:6; /* Reserved, 6 bits */ 361 #endif 362 uint8_t nextBlockKADFormat; /* Next Block KAD Format, See SPP_KAD_KEY_FORMAT_* */ 363 } SPP_PAGE_NBES; 364 365 /* 366 * Key Associated Data (KAD) Descriptors 367 */ 368 typedef struct { 369 uint8_t type; /* Key Descriptor Type, See SPP_KAD_KEY_DESC_* */ 370 #if HAVE_BIG_ENDIAN 371 uint8_t res_bits_1:5; /* Reserved, 5 bits */ 372 uint8_t authenticated:3; 373 #else 374 uint8_t authenticated:3; 375 uint8_t res_bits_1:5; /* Reserved, 5 bits */ 376 #endif 377 uint8_t descriptorLength[2]; /* Key Descriptor Length MSB/LSB */ 378 uint8_t descriptor[SPP_DESCRIPTOR_LENGTH]; 379 } SPP_KAD; 380 381 bool ClearScsiEncryptionKey(int fd, const char *device); 382 bool SetScsiEncryptionKey(int fd, const char *device, char *encryption_key); 383 int GetScsiDriveEncryptionStatus(int fd, const char *device_name, 384 POOLMEM *&status, int indent); 385 int GetScsiVolumeEncryptionStatus(int fd, const char *device_name, 386 POOLMEM *&status, int indent); 387 bool NeedScsiCryptoKey(int fd, const char *device_name, bool use_drive_status); 388 bool IsScsiEncryptionEnabled(int fd, const char *device_name); 389 390 #endif /* BAREOS_LIB_SCSI_CRYPTO_H_ */ 391