From 1be69c2c660b70ac2f4de2a5326e27e3e60eb82d Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sat, 27 Apr 2024 19:44:12 +0200 Subject: Adding upstream version 2:2.3.7. Signed-off-by: Daniel Baumann --- .gitignore | 55 + .gitlab/issue_templates/Bug.md | 15 + .gitlab/issue_templates/Documentation.md | 5 + .gitlab/issue_templates/Feature.md | 5 + .travis-functions.sh | 166 + .travis.yml | 42 + AUTHORS | 4 + COPYING | 354 ++ COPYING.LGPL | 517 ++ ChangeLog | 6 + FAQ | 3019 ++++++++++ INSTALL | 229 + Makefile.am | 50 + NEWS | 1 + README | 32 + README.md | 80 + TODO | 1 + autogen.sh | 82 + configure.ac | 663 +++ docs/ChangeLog.old | 887 +++ docs/Keyring.txt | 56 + docs/LUKS2-locking.txt | 61 + docs/doxyfile | 313 + docs/doxygen_index.h | 110 + docs/examples/Makefile | 17 + docs/examples/crypt_log_usage.c | 94 + docs/examples/crypt_luks_usage.c | 250 + docs/on-disk-format-luks2.pdf | Bin 0 -> 379656 bytes docs/on-disk-format.pdf | Bin 0 -> 119729 bytes docs/v1.0.7-ReleaseNotes | 92 + docs/v1.1.0-ReleaseNotes | 110 + docs/v1.1.1-ReleaseNotes | 47 + docs/v1.1.2-ReleaseNotes | 33 + docs/v1.1.3-ReleaseNotes | 13 + docs/v1.2.0-ReleaseNotes | 126 + docs/v1.3.0-ReleaseNotes | 101 + docs/v1.3.1-ReleaseNotes | 14 + docs/v1.4.0-ReleaseNotes | 131 + docs/v1.4.1-ReleaseNotes | 25 + docs/v1.4.2-ReleaseNotes | 44 + docs/v1.4.3-ReleaseNotes | 62 + docs/v1.5.0-ReleaseNotes | 241 + docs/v1.5.1-ReleaseNotes | 32 + docs/v1.6.0-ReleaseNotes | 261 + docs/v1.6.1-ReleaseNotes | 32 + docs/v1.6.2-ReleaseNotes | 25 + docs/v1.6.3-ReleaseNotes | 50 + docs/v1.6.4-ReleaseNotes | 57 + docs/v1.6.5-ReleaseNotes | 54 + docs/v1.6.6-ReleaseNotes | 29 + docs/v1.6.7-ReleaseNotes | 84 + docs/v1.6.8-ReleaseNotes | 47 + docs/v1.7.0-ReleaseNotes | 81 + docs/v1.7.1-ReleaseNotes | 36 + docs/v1.7.2-ReleaseNotes | 37 + docs/v1.7.3-ReleaseNotes | 20 + docs/v1.7.4-ReleaseNotes | 22 + docs/v1.7.5-ReleaseNotes | 22 + docs/v2.0.0-ReleaseNotes | 605 ++ docs/v2.0.1-ReleaseNotes | 109 + docs/v2.0.2-ReleaseNotes | 93 + docs/v2.0.3-ReleaseNotes | 121 + docs/v2.0.4-ReleaseNotes | 119 + docs/v2.0.5-ReleaseNotes | 102 + docs/v2.0.6-ReleaseNotes | 97 + docs/v2.1.0-ReleaseNotes | 210 + docs/v2.2.0-ReleaseNotes | 279 + docs/v2.2.1-ReleaseNotes | 36 + docs/v2.2.2-ReleaseNotes | 56 + docs/v2.3.0-ReleaseNotes | 209 + docs/v2.3.1-ReleaseNotes | 45 + docs/v2.3.2-ReleaseNotes | 42 + docs/v2.3.3-ReleaseNotes | 42 + docs/v2.3.4-ReleaseNotes | 112 + docs/v2.3.5-ReleaseNotes | 181 + docs/v2.3.6-ReleaseNotes | 56 + docs/v2.3.7-ReleaseNotes | 95 + lib/Makemodule.am | 116 + lib/base64.c | 605 ++ lib/base64.h | 68 + lib/bitlk/bitlk.c | 1382 +++++ lib/bitlk/bitlk.h | 131 + lib/bitops.h | 123 + lib/crypt_plain.c | 117 + lib/crypto_backend/Makemodule.am | 39 + lib/crypto_backend/argon2/LICENSE | 30 + lib/crypto_backend/argon2/Makemodule.am | 30 + lib/crypto_backend/argon2/README | 5 + lib/crypto_backend/argon2/argon2.c | 458 ++ lib/crypto_backend/argon2/argon2.h | 437 ++ lib/crypto_backend/argon2/blake2/blake2-impl.h | 154 + lib/crypto_backend/argon2/blake2/blake2.h | 89 + lib/crypto_backend/argon2/blake2/blake2b.c | 392 ++ .../argon2/blake2/blamka-round-opt.h | 471 ++ .../argon2/blake2/blamka-round-ref.h | 56 + lib/crypto_backend/argon2/core.c | 641 ++ lib/crypto_backend/argon2/core.h | 228 + lib/crypto_backend/argon2/encoding.c | 462 ++ lib/crypto_backend/argon2/encoding.h | 57 + lib/crypto_backend/argon2/opt.c | 283 + lib/crypto_backend/argon2/ref.c | 194 + lib/crypto_backend/argon2/thread.c | 57 + lib/crypto_backend/argon2/thread.h | 67 + lib/crypto_backend/argon2_generic.c | 79 + lib/crypto_backend/cipher_check.c | 161 + lib/crypto_backend/cipher_generic.c | 90 + lib/crypto_backend/crc32.c | 114 + lib/crypto_backend/crypto_backend.h | 138 + lib/crypto_backend/crypto_backend_internal.h | 63 + lib/crypto_backend/crypto_cipher_kernel.c | 352 ++ lib/crypto_backend/crypto_gcrypt.c | 552 ++ lib/crypto_backend/crypto_kernel.c | 418 ++ lib/crypto_backend/crypto_nettle.c | 444 ++ lib/crypto_backend/crypto_nss.c | 397 ++ lib/crypto_backend/crypto_openssl.c | 576 ++ lib/crypto_backend/crypto_storage.c | 339 ++ lib/crypto_backend/pbkdf2_generic.c | 232 + lib/crypto_backend/pbkdf_check.c | 437 ++ lib/integrity/integrity.c | 378 ++ lib/integrity/integrity.h | 103 + lib/internal.h | 277 + lib/libcryptsetup.h | 2380 ++++++++ lib/libcryptsetup.pc.in | 10 + lib/libcryptsetup.sym | 133 + lib/libdevmapper.c | 3165 ++++++++++ lib/loopaes/loopaes.c | 253 + lib/loopaes/loopaes.h | 46 + lib/luks1/af.c | 170 + lib/luks1/af.h | 64 + lib/luks1/keyencryption.c | 268 + lib/luks1/keymanage.c | 1258 ++++ lib/luks1/luks.h | 194 + lib/luks2/luks2.h | 459 ++ lib/luks2/luks2_digest.c | 459 ++ lib/luks2/luks2_digest_pbkdf2.c | 211 + lib/luks2/luks2_disk_metadata.c | 806 +++ lib/luks2/luks2_internal.h | 330 ++ lib/luks2/luks2_json_format.c | 408 ++ lib/luks2/luks2_json_metadata.c | 2601 +++++++++ lib/luks2/luks2_keyslot.c | 968 ++++ lib/luks2/luks2_keyslot_luks2.c | 785 +++ lib/luks2/luks2_keyslot_reenc.c | 316 + lib/luks2/luks2_luks1_convert.c | 898 +++ lib/luks2/luks2_reencrypt.c | 3703 ++++++++++++ lib/luks2/luks2_reencrypt_digest.c | 381 ++ lib/luks2/luks2_segment.c | 432 ++ lib/luks2/luks2_token.c | 650 +++ lib/luks2/luks2_token_keyring.c | 170 + lib/nls.h | 34 + lib/random.c | 245 + lib/setup.c | 6110 ++++++++++++++++++++ lib/tcrypt/tcrypt.c | 1131 ++++ lib/tcrypt/tcrypt.h | 121 + lib/utils.c | 345 ++ lib/utils_benchmark.c | 215 + lib/utils_blkid.c | 323 ++ lib/utils_blkid.h | 66 + lib/utils_crypt.c | 186 + lib/utils_crypt.h | 44 + lib/utils_device.c | 1022 ++++ lib/utils_device_locking.c | 521 ++ lib/utils_device_locking.h | 49 + lib/utils_devpath.c | 459 ++ lib/utils_dm.h | 236 + lib/utils_fips.c | 46 + lib/utils_fips.h | 26 + lib/utils_io.c | 299 + lib/utils_io.h | 42 + lib/utils_keyring.c | 242 + lib/utils_keyring.h | 55 + lib/utils_loop.c | 277 + lib/utils_loop.h | 34 + lib/utils_pbkdf.c | 333 ++ lib/utils_safe_memory.c | 104 + lib/utils_storage_wrappers.c | 394 ++ lib/utils_storage_wrappers.h | 75 + lib/utils_wipe.c | 266 + lib/verity/rs.h | 63 + lib/verity/rs_decode_char.c | 197 + lib/verity/rs_encode_char.c | 173 + lib/verity/verity.c | 354 ++ lib/verity/verity.h | 80 + lib/verity/verity_fec.c | 316 + lib/verity/verity_hash.c | 410 ++ lib/volumekey.c | 147 + man/Makemodule.am | 15 + man/cryptsetup-reencrypt.8 | 295 + man/cryptsetup.8 | 1777 ++++++ man/integritysetup.8 | 255 + man/veritysetup.8 | 245 + misc/11-dm-crypt.rules | 17 + misc/dict_search/Makefile | 17 + misc/dict_search/README | 22 + misc/dict_search/crypt_dict.c | 158 + misc/dracut_90reencrypt/README | 40 + misc/dracut_90reencrypt/check.old | 5 + misc/dracut_90reencrypt/install.old | 6 + misc/dracut_90reencrypt/module-setup.sh | 32 + misc/dracut_90reencrypt/parse-reencrypt.sh | 38 + misc/dracut_90reencrypt/reencrypt-verbose.sh | 6 + misc/dracut_90reencrypt/reencrypt.sh | 84 + misc/keyslot_checker/Makefile | 14 + misc/keyslot_checker/README | 120 + misc/keyslot_checker/chk_luks_keyslots.c | 371 ++ misc/luks-header-from-active | 59 + misc/luks2_keyslot_example/Makefile | 24 + misc/luks2_keyslot_example/README | 3 + misc/luks2_keyslot_example/keyslot_test.c | 409 ++ .../keyslot_test_remote_pass.c | 264 + po/LINGUAS | 18 + po/Makevars | 44 + po/POTFILES.in | 51 + po/cryptsetup.pot | 3993 +++++++++++++ po/cs.po | 4266 ++++++++++++++ po/da.po | 3893 +++++++++++++ po/de.po | 4136 +++++++++++++ po/es.po | 4219 ++++++++++++++ po/fi.po | 1933 +++++++ po/fr.po | 4262 ++++++++++++++ po/id.po | 815 +++ po/it.po | 3193 ++++++++++ po/ja.po | 3944 +++++++++++++ po/nl.po | 4099 +++++++++++++ po/pl.po | 3950 +++++++++++++ po/pt_BR.po | 3217 +++++++++++ po/ru.po | 4449 ++++++++++++++ po/sr.po | 3999 +++++++++++++ po/sv.po | 4048 +++++++++++++ po/uk.po | 3961 +++++++++++++ po/vi.po | 1958 +++++++ po/zh_CN.po | 3075 ++++++++++ scripts/Makemodule.am | 5 + scripts/cryptsetup.conf.in | 1 + src/Makemodule.am | 136 + src/cryptsetup.c | 4186 ++++++++++++++ src/cryptsetup.h | 130 + src/cryptsetup_reencrypt.c | 1790 ++++++ src/integritysetup.c | 744 +++ src/utils_blockdev.c | 189 + src/utils_luks2.c | 139 + src/utils_password.c | 376 ++ src/utils_tools.c | 626 ++ src/veritysetup.c | 628 ++ tests/00modules-test | 45 + tests/Makefile.am | 130 + tests/Makefile.localtest | 30 + tests/align-test | 320 + tests/align-test2 | 367 ++ tests/api-test-2.c | 4531 +++++++++++++++ tests/api-test.c | 1974 +++++++ tests/api_test.h | 127 + tests/bitlk-compat-test | 162 + tests/bitlk-images.tar.xz | Bin 0 -> 271624 bytes tests/blkid-luks2-pv.img.xz | Bin 0 -> 5236 bytes tests/blockwise-compat | 377 ++ tests/compat-test | 1065 ++++ tests/compat-test2 | 1055 ++++ tests/compatimage.img.xz | Bin 0 -> 66732 bytes tests/compatimage2.img.xz | Bin 0 -> 66356 bytes tests/compatv10image.img.xz | Bin 0 -> 66688 bytes tests/conversion_imgs.tar.xz | Bin 0 -> 8149472 bytes tests/crypto-vectors.c | 1272 ++++ tests/cryptsetup-valg-supps | 14 + tests/device-test | 328 ++ tests/differ.c | 166 + tests/discards-test | 86 + tests/evil_hdr-keyslot_overlap.xz | Bin 0 -> 676 bytes tests/evil_hdr-luks_hdr_damage.xz | Bin 0 -> 612 bytes tests/evil_hdr-payload_overwrite.xz | Bin 0 -> 612 bytes tests/evil_hdr-small_luks_device.xz | Bin 0 -> 452 bytes tests/evil_hdr-stripes_payload_dmg.xz | Bin 0 -> 616 bytes ...erate-luks2-area-in-json-hdr-space-json0.img.sh | 72 + .../generate-luks2-argon2-leftover-params.img.sh | 71 + .../generate-luks2-correct-full-json0.img.sh | 87 + ...e-luks2-corrupted-hdr0-with-correct-chks.img.sh | 65 + ...e-luks2-corrupted-hdr1-with-correct-chks.img.sh | 66 + ...enerate-luks2-invalid-checksum-both-hdrs.img.sh | 52 + .../generate-luks2-invalid-checksum-hdr0.img.sh | 43 + .../generate-luks2-invalid-checksum-hdr1.img.sh | 48 + .../generate-luks2-invalid-json-size-c0.img.sh | 68 + .../generate-luks2-invalid-json-size-c1.img.sh | 68 + .../generate-luks2-invalid-json-size-c2.img.sh | 85 + .../generate-luks2-invalid-keyslots-size-c0.img.sh | 71 + .../generate-luks2-invalid-keyslots-size-c1.img.sh | 67 + .../generate-luks2-invalid-keyslots-size-c2.img.sh | 68 + ...generate-luks2-invalid-object-type-json0.img.sh | 70 + ...enerate-luks2-invalid-opening-char-json0.img.sh | 70 + .../generate-luks2-keyslot-missing-digest.img.sh | 72 + .../generate-luks2-keyslot-too-many-digests.img.sh | 70 + ...erate-luks2-metadata-size-128k-secondary.img.sh | 97 + .../generate-luks2-metadata-size-128k.img.sh | 94 + ...nerate-luks2-metadata-size-16k-secondary.img.sh | 97 + ...enerate-luks2-metadata-size-1m-secondary.img.sh | 97 + .../generate-luks2-metadata-size-1m.img.sh | 94 + ...erate-luks2-metadata-size-256k-secondary.img.sh | 97 + .../generate-luks2-metadata-size-256k.img.sh | 94 + ...enerate-luks2-metadata-size-2m-secondary.img.sh | 96 + .../generate-luks2-metadata-size-2m.img.sh | 94 + ...nerate-luks2-metadata-size-32k-secondary.img.sh | 97 + .../generate-luks2-metadata-size-32k.img.sh | 94 + ...enerate-luks2-metadata-size-4m-secondary.img.sh | 96 + .../generate-luks2-metadata-size-4m.img.sh | 94 + ...erate-luks2-metadata-size-512k-secondary.img.sh | 97 + .../generate-luks2-metadata-size-512k.img.sh | 94 + ...rate-luks2-metadata-size-64k-inv-area-c0.img.sh | 94 + ...rate-luks2-metadata-size-64k-inv-area-c1.img.sh | 96 + ...2-metadata-size-64k-inv-keyslots-size-c0.img.sh | 96 + ...nerate-luks2-metadata-size-64k-secondary.img.sh | 97 + .../generate-luks2-metadata-size-64k.img.sh | 94 + ...ks2-missing-keyslot-referenced-in-digest.img.sh | 74 + ...uks2-missing-keyslot-referenced-in-token.img.sh | 72 + ...ks2-missing-segment-referenced-in-digest.img.sh | 74 + ...e-luks2-missing-trailing-null-byte-json0.img.sh | 89 + ...enerate-luks2-non-null-byte-beyond-json0.img.sh | 72 + ...nerate-luks2-non-null-bytes-beyond-json0.img.sh | 76 + ...enerate-luks2-overlapping-areas-c0-json0.img.sh | 68 + ...enerate-luks2-overlapping-areas-c1-json0.img.sh | 70 + ...enerate-luks2-overlapping-areas-c2-json0.img.sh | 67 + .../generate-luks2-pbkdf2-leftover-params-0.img.sh | 71 + .../generate-luks2-pbkdf2-leftover-params-1.img.sh | 71 + ...e-luks2-segment-crypt-missing-encryption.img.sh | 67 + ...ate-luks2-segment-crypt-missing-ivoffset.img.sh | 67 + ...e-luks2-segment-crypt-missing-sectorsize.img.sh | 67 + ...ate-luks2-segment-crypt-wrong-encryption.img.sh | 67 + ...erate-luks2-segment-crypt-wrong-ivoffset.img.sh | 67 + ...e-luks2-segment-crypt-wrong-sectorsize-0.img.sh | 67 + ...e-luks2-segment-crypt-wrong-sectorsize-1.img.sh | 67 + ...e-luks2-segment-crypt-wrong-sectorsize-2.img.sh | 67 + .../generate-luks2-segment-missing-offset.img.sh | 67 + .../generate-luks2-segment-missing-size.img.sh | 67 + .../generate-luks2-segment-missing-type.img.sh | 67 + tests/generators/generate-luks2-segment-two.img.sh | 67 + .../generate-luks2-segment-unknown-type.img.sh | 68 + ...enerate-luks2-segment-wrong-backup-key-0.img.sh | 67 + ...enerate-luks2-segment-wrong-backup-key-1.img.sh | 67 + ...nerate-luks2-segment-wrong-flags-element.img.sh | 67 + .../generate-luks2-segment-wrong-flags.img.sh | 67 + .../generate-luks2-segment-wrong-offset.img.sh | 67 + .../generate-luks2-segment-wrong-size-0.img.sh | 67 + .../generate-luks2-segment-wrong-size-1.img.sh | 67 + .../generate-luks2-segment-wrong-size-2.img.sh | 67 + .../generate-luks2-segment-wrong-type.img.sh | 67 + .../generate-luks2-uint64-max-segment-size.img.sh | 68 + ...erate-luks2-uint64-overflow-segment-size.img.sh | 66 + ...enerate-luks2-uint64-signed-segment-size.img.sh | 67 + tests/generators/lib.sh | 180 + tests/img_fs_ext4.img.xz | Bin 0 -> 5680 bytes tests/img_fs_vfat.img.xz | Bin 0 -> 6124 bytes tests/img_fs_xfs.img.xz | Bin 0 -> 7676 bytes tests/integrity-compat-test | 484 ++ tests/keyring-compat-test | 211 + tests/keyring-test | 238 + tests/loopaes-test | 174 + tests/luks1-compat-test | 104 + tests/luks1-images.tar.xz | Bin 0 -> 67192 bytes tests/luks2-integrity-test | 166 + tests/luks2-reencryption-mangle-test | 506 ++ tests/luks2-reencryption-test | 1550 +++++ tests/luks2-validation-test | 235 + tests/luks2_header_requirements.xz | Bin 0 -> 130568 bytes tests/luks2_header_requirements_free.xz | Bin 0 -> 130492 bytes tests/luks2_keyslot_unassigned.img.xz | Bin 0 -> 270548 bytes tests/luks2_mda_images.tar.xz | Bin 0 -> 156028 bytes tests/luks2_valid_hdr.img.xz | Bin 0 -> 3684 bytes tests/mode-test | 171 + tests/password-hash-test | 190 + tests/reencryption-compat-test | 397 ++ tests/reencryption-compat-test2 | 473 ++ tests/tcrypt-compat-test | 172 + tests/tcrypt-images.tar.xz | Bin 0 -> 308700 bytes tests/test_utils.c | 637 ++ tests/unit-utils-io.c | 346 ++ tests/valg-api.sh | 11 + tests/valg.sh | 11 + tests/valid_header_file.xz | Bin 0 -> 608 bytes tests/verity-compat-test | 484 ++ 376 files changed, 165191 insertions(+) create mode 100644 .gitignore create mode 100644 .gitlab/issue_templates/Bug.md create mode 100644 .gitlab/issue_templates/Documentation.md create mode 100644 .gitlab/issue_templates/Feature.md create mode 100644 .travis-functions.sh create mode 100644 .travis.yml create mode 100644 AUTHORS create mode 100644 COPYING create mode 100644 COPYING.LGPL create mode 100644 ChangeLog create mode 100644 FAQ create mode 100644 INSTALL create mode 100644 Makefile.am create mode 100644 NEWS create mode 100644 README create mode 100644 README.md create mode 100644 TODO create mode 100755 autogen.sh create mode 100644 configure.ac create mode 100644 docs/ChangeLog.old create mode 100644 docs/Keyring.txt create mode 100644 docs/LUKS2-locking.txt create mode 100644 docs/doxyfile create mode 100644 docs/doxygen_index.h create mode 100644 docs/examples/Makefile create mode 100644 docs/examples/crypt_log_usage.c create mode 100644 docs/examples/crypt_luks_usage.c create mode 100644 docs/on-disk-format-luks2.pdf create mode 100644 docs/on-disk-format.pdf create mode 100644 docs/v1.0.7-ReleaseNotes create mode 100644 docs/v1.1.0-ReleaseNotes create mode 100644 docs/v1.1.1-ReleaseNotes create mode 100644 docs/v1.1.2-ReleaseNotes create mode 100644 docs/v1.1.3-ReleaseNotes create mode 100644 docs/v1.2.0-ReleaseNotes create mode 100644 docs/v1.3.0-ReleaseNotes create mode 100644 docs/v1.3.1-ReleaseNotes create mode 100644 docs/v1.4.0-ReleaseNotes create mode 100644 docs/v1.4.1-ReleaseNotes create mode 100644 docs/v1.4.2-ReleaseNotes create mode 100644 docs/v1.4.3-ReleaseNotes create mode 100644 docs/v1.5.0-ReleaseNotes create mode 100644 docs/v1.5.1-ReleaseNotes create mode 100644 docs/v1.6.0-ReleaseNotes create mode 100644 docs/v1.6.1-ReleaseNotes create mode 100644 docs/v1.6.2-ReleaseNotes create mode 100644 docs/v1.6.3-ReleaseNotes create mode 100644 docs/v1.6.4-ReleaseNotes create mode 100644 docs/v1.6.5-ReleaseNotes create mode 100644 docs/v1.6.6-ReleaseNotes create mode 100644 docs/v1.6.7-ReleaseNotes create mode 100644 docs/v1.6.8-ReleaseNotes create mode 100644 docs/v1.7.0-ReleaseNotes create mode 100644 docs/v1.7.1-ReleaseNotes create mode 100644 docs/v1.7.2-ReleaseNotes create mode 100644 docs/v1.7.3-ReleaseNotes create mode 100644 docs/v1.7.4-ReleaseNotes create mode 100644 docs/v1.7.5-ReleaseNotes create mode 100644 docs/v2.0.0-ReleaseNotes create mode 100644 docs/v2.0.1-ReleaseNotes create mode 100644 docs/v2.0.2-ReleaseNotes create mode 100644 docs/v2.0.3-ReleaseNotes create mode 100644 docs/v2.0.4-ReleaseNotes create mode 100644 docs/v2.0.5-ReleaseNotes create mode 100644 docs/v2.0.6-ReleaseNotes create mode 100644 docs/v2.1.0-ReleaseNotes create mode 100644 docs/v2.2.0-ReleaseNotes create mode 100644 docs/v2.2.1-ReleaseNotes create mode 100644 docs/v2.2.2-ReleaseNotes create mode 100644 docs/v2.3.0-ReleaseNotes create mode 100644 docs/v2.3.1-ReleaseNotes create mode 100644 docs/v2.3.2-ReleaseNotes create mode 100644 docs/v2.3.3-ReleaseNotes create mode 100644 docs/v2.3.4-ReleaseNotes create mode 100644 docs/v2.3.5-ReleaseNotes create mode 100644 docs/v2.3.6-ReleaseNotes create mode 100644 docs/v2.3.7-ReleaseNotes create mode 100644 lib/Makemodule.am create mode 100644 lib/base64.c create mode 100644 lib/base64.h create mode 100644 lib/bitlk/bitlk.c create mode 100644 lib/bitlk/bitlk.h create mode 100644 lib/bitops.h create mode 100644 lib/crypt_plain.c create mode 100644 lib/crypto_backend/Makemodule.am create mode 100644 lib/crypto_backend/argon2/LICENSE create mode 100644 lib/crypto_backend/argon2/Makemodule.am create mode 100644 lib/crypto_backend/argon2/README create mode 100644 lib/crypto_backend/argon2/argon2.c create mode 100644 lib/crypto_backend/argon2/argon2.h create mode 100644 lib/crypto_backend/argon2/blake2/blake2-impl.h create mode 100644 lib/crypto_backend/argon2/blake2/blake2.h create mode 100644 lib/crypto_backend/argon2/blake2/blake2b.c create mode 100644 lib/crypto_backend/argon2/blake2/blamka-round-opt.h create mode 100644 lib/crypto_backend/argon2/blake2/blamka-round-ref.h create mode 100644 lib/crypto_backend/argon2/core.c create mode 100644 lib/crypto_backend/argon2/core.h create mode 100644 lib/crypto_backend/argon2/encoding.c create mode 100644 lib/crypto_backend/argon2/encoding.h create mode 100644 lib/crypto_backend/argon2/opt.c create mode 100644 lib/crypto_backend/argon2/ref.c create mode 100644 lib/crypto_backend/argon2/thread.c create mode 100644 lib/crypto_backend/argon2/thread.h create mode 100644 lib/crypto_backend/argon2_generic.c create mode 100644 lib/crypto_backend/cipher_check.c create mode 100644 lib/crypto_backend/cipher_generic.c create mode 100644 lib/crypto_backend/crc32.c create mode 100644 lib/crypto_backend/crypto_backend.h create mode 100644 lib/crypto_backend/crypto_backend_internal.h create mode 100644 lib/crypto_backend/crypto_cipher_kernel.c create mode 100644 lib/crypto_backend/crypto_gcrypt.c create mode 100644 lib/crypto_backend/crypto_kernel.c create mode 100644 lib/crypto_backend/crypto_nettle.c create mode 100644 lib/crypto_backend/crypto_nss.c create mode 100644 lib/crypto_backend/crypto_openssl.c create mode 100644 lib/crypto_backend/crypto_storage.c create mode 100644 lib/crypto_backend/pbkdf2_generic.c create mode 100644 lib/crypto_backend/pbkdf_check.c create mode 100644 lib/integrity/integrity.c create mode 100644 lib/integrity/integrity.h create mode 100644 lib/internal.h create mode 100644 lib/libcryptsetup.h create mode 100644 lib/libcryptsetup.pc.in create mode 100644 lib/libcryptsetup.sym create mode 100644 lib/libdevmapper.c create mode 100644 lib/loopaes/loopaes.c create mode 100644 lib/loopaes/loopaes.h create mode 100644 lib/luks1/af.c create mode 100644 lib/luks1/af.h create mode 100644 lib/luks1/keyencryption.c create mode 100644 lib/luks1/keymanage.c create mode 100644 lib/luks1/luks.h create mode 100644 lib/luks2/luks2.h create mode 100644 lib/luks2/luks2_digest.c create mode 100644 lib/luks2/luks2_digest_pbkdf2.c create mode 100644 lib/luks2/luks2_disk_metadata.c create mode 100644 lib/luks2/luks2_internal.h create mode 100644 lib/luks2/luks2_json_format.c create mode 100644 lib/luks2/luks2_json_metadata.c create mode 100644 lib/luks2/luks2_keyslot.c create mode 100644 lib/luks2/luks2_keyslot_luks2.c create mode 100644 lib/luks2/luks2_keyslot_reenc.c create mode 100644 lib/luks2/luks2_luks1_convert.c create mode 100644 lib/luks2/luks2_reencrypt.c create mode 100644 lib/luks2/luks2_reencrypt_digest.c create mode 100644 lib/luks2/luks2_segment.c create mode 100644 lib/luks2/luks2_token.c create mode 100644 lib/luks2/luks2_token_keyring.c create mode 100644 lib/nls.h create mode 100644 lib/random.c create mode 100644 lib/setup.c create mode 100644 lib/tcrypt/tcrypt.c create mode 100644 lib/tcrypt/tcrypt.h create mode 100644 lib/utils.c create mode 100644 lib/utils_benchmark.c create mode 100644 lib/utils_blkid.c create mode 100644 lib/utils_blkid.h create mode 100644 lib/utils_crypt.c create mode 100644 lib/utils_crypt.h create mode 100644 lib/utils_device.c create mode 100644 lib/utils_device_locking.c create mode 100644 lib/utils_device_locking.h create mode 100644 lib/utils_devpath.c create mode 100644 lib/utils_dm.h create mode 100644 lib/utils_fips.c create mode 100644 lib/utils_fips.h create mode 100644 lib/utils_io.c create mode 100644 lib/utils_io.h create mode 100644 lib/utils_keyring.c create mode 100644 lib/utils_keyring.h create mode 100644 lib/utils_loop.c create mode 100644 lib/utils_loop.h create mode 100644 lib/utils_pbkdf.c create mode 100644 lib/utils_safe_memory.c create mode 100644 lib/utils_storage_wrappers.c create mode 100644 lib/utils_storage_wrappers.h create mode 100644 lib/utils_wipe.c create mode 100644 lib/verity/rs.h create mode 100644 lib/verity/rs_decode_char.c create mode 100644 lib/verity/rs_encode_char.c create mode 100644 lib/verity/verity.c create mode 100644 lib/verity/verity.h create mode 100644 lib/verity/verity_fec.c create mode 100644 lib/verity/verity_hash.c create mode 100644 lib/volumekey.c create mode 100644 man/Makemodule.am create mode 100644 man/cryptsetup-reencrypt.8 create mode 100644 man/cryptsetup.8 create mode 100644 man/integritysetup.8 create mode 100644 man/veritysetup.8 create mode 100644 misc/11-dm-crypt.rules create mode 100644 misc/dict_search/Makefile create mode 100644 misc/dict_search/README create mode 100644 misc/dict_search/crypt_dict.c create mode 100644 misc/dracut_90reencrypt/README create mode 100755 misc/dracut_90reencrypt/check.old create mode 100755 misc/dracut_90reencrypt/install.old create mode 100755 misc/dracut_90reencrypt/module-setup.sh create mode 100755 misc/dracut_90reencrypt/parse-reencrypt.sh create mode 100755 misc/dracut_90reencrypt/reencrypt-verbose.sh create mode 100755 misc/dracut_90reencrypt/reencrypt.sh create mode 100644 misc/keyslot_checker/Makefile create mode 100644 misc/keyslot_checker/README create mode 100644 misc/keyslot_checker/chk_luks_keyslots.c create mode 100755 misc/luks-header-from-active create mode 100644 misc/luks2_keyslot_example/Makefile create mode 100644 misc/luks2_keyslot_example/README create mode 100644 misc/luks2_keyslot_example/keyslot_test.c create mode 100644 misc/luks2_keyslot_example/keyslot_test_remote_pass.c create mode 100644 po/LINGUAS create mode 100644 po/Makevars create mode 100644 po/POTFILES.in create mode 100644 po/cryptsetup.pot create mode 100644 po/cs.po create mode 100644 po/da.po create mode 100644 po/de.po create mode 100644 po/es.po create mode 100644 po/fi.po create mode 100644 po/fr.po create mode 100644 po/id.po create mode 100644 po/it.po create mode 100644 po/ja.po create mode 100644 po/nl.po create mode 100644 po/pl.po create mode 100644 po/pt_BR.po create mode 100644 po/ru.po create mode 100644 po/sr.po create mode 100644 po/sv.po create mode 100644 po/uk.po create mode 100644 po/vi.po create mode 100644 po/zh_CN.po create mode 100644 scripts/Makemodule.am create mode 100644 scripts/cryptsetup.conf.in create mode 100644 src/Makemodule.am create mode 100644 src/cryptsetup.c create mode 100644 src/cryptsetup.h create mode 100644 src/cryptsetup_reencrypt.c create mode 100644 src/integritysetup.c create mode 100644 src/utils_blockdev.c create mode 100644 src/utils_luks2.c create mode 100644 src/utils_password.c create mode 100644 src/utils_tools.c create mode 100644 src/veritysetup.c create mode 100755 tests/00modules-test create mode 100644 tests/Makefile.am create mode 100644 tests/Makefile.localtest create mode 100755 tests/align-test create mode 100755 tests/align-test2 create mode 100644 tests/api-test-2.c create mode 100644 tests/api-test.c create mode 100644 tests/api_test.h create mode 100755 tests/bitlk-compat-test create mode 100644 tests/bitlk-images.tar.xz create mode 100644 tests/blkid-luks2-pv.img.xz create mode 100755 tests/blockwise-compat create mode 100755 tests/compat-test create mode 100755 tests/compat-test2 create mode 100644 tests/compatimage.img.xz create mode 100644 tests/compatimage2.img.xz create mode 100644 tests/compatv10image.img.xz create mode 100644 tests/conversion_imgs.tar.xz create mode 100644 tests/crypto-vectors.c create mode 100644 tests/cryptsetup-valg-supps create mode 100755 tests/device-test create mode 100644 tests/differ.c create mode 100755 tests/discards-test create mode 100644 tests/evil_hdr-keyslot_overlap.xz create mode 100644 tests/evil_hdr-luks_hdr_damage.xz create mode 100644 tests/evil_hdr-payload_overwrite.xz create mode 100644 tests/evil_hdr-small_luks_device.xz create mode 100644 tests/evil_hdr-stripes_payload_dmg.xz create mode 100755 tests/generators/generate-luks2-area-in-json-hdr-space-json0.img.sh create mode 100755 tests/generators/generate-luks2-argon2-leftover-params.img.sh create mode 100755 tests/generators/generate-luks2-correct-full-json0.img.sh create mode 100755 tests/generators/generate-luks2-corrupted-hdr0-with-correct-chks.img.sh create mode 100755 tests/generators/generate-luks2-corrupted-hdr1-with-correct-chks.img.sh create mode 100755 tests/generators/generate-luks2-invalid-checksum-both-hdrs.img.sh create mode 100755 tests/generators/generate-luks2-invalid-checksum-hdr0.img.sh create mode 100755 tests/generators/generate-luks2-invalid-checksum-hdr1.img.sh create mode 100755 tests/generators/generate-luks2-invalid-json-size-c0.img.sh create mode 100755 tests/generators/generate-luks2-invalid-json-size-c1.img.sh create mode 100755 tests/generators/generate-luks2-invalid-json-size-c2.img.sh create mode 100755 tests/generators/generate-luks2-invalid-keyslots-size-c0.img.sh create mode 100755 tests/generators/generate-luks2-invalid-keyslots-size-c1.img.sh create mode 100755 tests/generators/generate-luks2-invalid-keyslots-size-c2.img.sh create mode 100755 tests/generators/generate-luks2-invalid-object-type-json0.img.sh create mode 100755 tests/generators/generate-luks2-invalid-opening-char-json0.img.sh create mode 100755 tests/generators/generate-luks2-keyslot-missing-digest.img.sh create mode 100755 tests/generators/generate-luks2-keyslot-too-many-digests.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-128k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-128k.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-16k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-1m-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-1m.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-256k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-256k.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-2m-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-2m.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-32k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-32k.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-4m-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-4m.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-512k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-512k.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k-secondary.img.sh create mode 100755 tests/generators/generate-luks2-metadata-size-64k.img.sh create mode 100755 tests/generators/generate-luks2-missing-keyslot-referenced-in-digest.img.sh create mode 100755 tests/generators/generate-luks2-missing-keyslot-referenced-in-token.img.sh create mode 100755 tests/generators/generate-luks2-missing-segment-referenced-in-digest.img.sh create mode 100755 tests/generators/generate-luks2-missing-trailing-null-byte-json0.img.sh create mode 100755 tests/generators/generate-luks2-non-null-byte-beyond-json0.img.sh create mode 100755 tests/generators/generate-luks2-non-null-bytes-beyond-json0.img.sh create mode 100755 tests/generators/generate-luks2-overlapping-areas-c0-json0.img.sh create mode 100755 tests/generators/generate-luks2-overlapping-areas-c1-json0.img.sh create mode 100755 tests/generators/generate-luks2-overlapping-areas-c2-json0.img.sh create mode 100755 tests/generators/generate-luks2-pbkdf2-leftover-params-0.img.sh create mode 100755 tests/generators/generate-luks2-pbkdf2-leftover-params-1.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-missing-encryption.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-missing-ivoffset.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-missing-sectorsize.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-wrong-encryption.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-wrong-ivoffset.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-0.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-1.img.sh create mode 100755 tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-2.img.sh create mode 100755 tests/generators/generate-luks2-segment-missing-offset.img.sh create mode 100755 tests/generators/generate-luks2-segment-missing-size.img.sh create mode 100755 tests/generators/generate-luks2-segment-missing-type.img.sh create mode 100755 tests/generators/generate-luks2-segment-two.img.sh create mode 100755 tests/generators/generate-luks2-segment-unknown-type.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-backup-key-0.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-backup-key-1.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-flags-element.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-flags.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-offset.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-size-0.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-size-1.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-size-2.img.sh create mode 100755 tests/generators/generate-luks2-segment-wrong-type.img.sh create mode 100755 tests/generators/generate-luks2-uint64-max-segment-size.img.sh create mode 100755 tests/generators/generate-luks2-uint64-overflow-segment-size.img.sh create mode 100755 tests/generators/generate-luks2-uint64-signed-segment-size.img.sh create mode 100644 tests/generators/lib.sh create mode 100644 tests/img_fs_ext4.img.xz create mode 100644 tests/img_fs_vfat.img.xz create mode 100644 tests/img_fs_xfs.img.xz create mode 100755 tests/integrity-compat-test create mode 100755 tests/keyring-compat-test create mode 100755 tests/keyring-test create mode 100755 tests/loopaes-test create mode 100755 tests/luks1-compat-test create mode 100644 tests/luks1-images.tar.xz create mode 100755 tests/luks2-integrity-test create mode 100755 tests/luks2-reencryption-mangle-test create mode 100755 tests/luks2-reencryption-test create mode 100755 tests/luks2-validation-test create mode 100644 tests/luks2_header_requirements.xz create mode 100644 tests/luks2_header_requirements_free.xz create mode 100644 tests/luks2_keyslot_unassigned.img.xz create mode 100644 tests/luks2_mda_images.tar.xz create mode 100644 tests/luks2_valid_hdr.img.xz create mode 100755 tests/mode-test create mode 100755 tests/password-hash-test create mode 100755 tests/reencryption-compat-test create mode 100755 tests/reencryption-compat-test2 create mode 100755 tests/tcrypt-compat-test create mode 100644 tests/tcrypt-images.tar.xz create mode 100644 tests/test_utils.c create mode 100644 tests/unit-utils-io.c create mode 100755 tests/valg-api.sh create mode 100755 tests/valg.sh create mode 100644 tests/valid_header_file.xz create mode 100755 tests/verity-compat-test diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e7f2628 --- /dev/null +++ b/.gitignore @@ -0,0 +1,55 @@ +po/*gmo +*~ +Makefile +Makefile.in +Makefile.in.in +*.lo +*.la +*.o +**/*.dirstamp +.deps/ +.libs/ +src/cryptsetup +src/veritysetup +ABOUT-NLS +aclocal.m4 +autom4te.cache/ +compile +config.guess +config.h +config.h.in +config.log +config.rpath +config.status +config.sub +configure +cryptsetup +cryptsetup-reencrypt +depcomp +install-sh +integritysetup +lib/libcryptsetup.pc +libtool +ltmain.sh +m4/ +missing +po/Makevars.template +po/POTFILES +po/Rules-quot +po/*.header +po/*.sed +po/*.sin +po/stamp-po +scripts/cryptsetup.conf +stamp-h1 +veritysetup +tests/valglog.* +*/*.dirstamp +*-debug-luks2-backup* +tests/api-test +tests/api-test-2 +tests/differ +tests/luks1-images +tests/tcrypt-images +tests/unit-utils-io +tests/vectors-test diff --git a/.gitlab/issue_templates/Bug.md b/.gitlab/issue_templates/Bug.md new file mode 100644 index 0000000..f8837aa --- /dev/null +++ b/.gitlab/issue_templates/Bug.md @@ -0,0 +1,15 @@ +### Issue description + + +### Steps for reproducing the issue + + +### Additional info + + +### Debug log + +``` +Output with --debug option: + +``` diff --git a/.gitlab/issue_templates/Documentation.md b/.gitlab/issue_templates/Documentation.md new file mode 100644 index 0000000..b4e47e2 --- /dev/null +++ b/.gitlab/issue_templates/Documentation.md @@ -0,0 +1,5 @@ +### Documentation issue + + +### Additional info + diff --git a/.gitlab/issue_templates/Feature.md b/.gitlab/issue_templates/Feature.md new file mode 100644 index 0000000..fa94c8a --- /dev/null +++ b/.gitlab/issue_templates/Feature.md @@ -0,0 +1,5 @@ +### New feature description + + +### Additional info + diff --git a/.travis-functions.sh b/.travis-functions.sh new file mode 100644 index 0000000..f852b28 --- /dev/null +++ b/.travis-functions.sh @@ -0,0 +1,166 @@ +#!/bin/bash +# +# .travis-functions.sh: +# - helper functions to be sourced from .travis.yml +# - designed to respect travis' environment but testing locally is possible +# - modified copy from util-linux project +# + +if [ ! -f "configure.ac" ]; then + echo ".travis-functions.sh must be sourced from source dir" >&2 + return 1 || exit 1 +fi + +## some config settings +# travis docs say we get 1.5 CPUs +MAKE="make -j2" +DUMP_CONFIG_LOG="short" +export TS_OPT_parsable="yes" + +function configure_travis +{ + ./configure "$@" + err=$? + if [ "$DUMP_CONFIG_LOG" = "short" ]; then + grep -B1 -A10000 "^## Output variables" config.log | grep -v "_FALSE=" + elif [ "$DUMP_CONFIG_LOG" = "full" ]; then + cat config.log + fi + return $err +} + +function check_nonroot +{ + local cfg_opts="$1" + + [ -z "$cfg_opts" ] && return + + configure_travis \ + --enable-cryptsetup-reencrypt \ + --enable-internal-sse-argon2 \ + "$cfg_opts" \ + || return + + $MAKE || return + + make check +} + +function check_root +{ + local cfg_opts="$1" + + [ -z "$cfg_opts" ] && return + + configure_travis \ + --enable-cryptsetup-reencrypt \ + --enable-internal-sse-argon2 \ + "$cfg_opts" \ + || return + + $MAKE || return + + # FIXME: we should use -E option here + sudo make check +} + +function check_nonroot_compile_only +{ + local cfg_opts="$1" + + [ -z "$cfg_opts" ] && return + + configure_travis \ + --enable-cryptsetup-reencrypt \ + --enable-internal-sse-argon2 \ + "$cfg_opts" \ + || return + + $MAKE +} + +function travis_install_script +{ + # install some packages from Ubuntu's default sources + sudo apt-get -qq update + sudo apt-get install -qq >/dev/null \ + sharutils \ + libgcrypt20-dev \ + libssl-dev \ + libdevmapper-dev \ + libpopt-dev \ + uuid-dev \ + libsepol1-dev \ + libtool \ + dmsetup \ + autoconf \ + automake \ + pkg-config \ + autopoint \ + gettext \ + expect \ + keyutils \ + libjson-c-dev \ + libblkid-dev \ + dkms \ + linux-headers-$(uname -r) \ + linux-modules-extra-$(uname -r) \ + || return + + # For VeraCrypt test + sudo apt-get install gost-crypto-dkms +} + +function travis_before_script +{ + set -o xtrace + + ./autogen.sh + ret=$? + + set +o xtrace + return $ret +} + +function travis_script +{ + local ret + set -o xtrace + + case "$MAKE_CHECK" in + gcrypt) + check_nonroot "--with-crypto_backend=gcrypt" && \ + check_root "--with-crypto_backend=gcrypt" + ;; + gcrypt_compile) + check_nonroot_compile_only "--with-crypto_backend=gcrypt" + ;; + openssl) + check_nonroot "--with-crypto_backend=openssl" && \ + check_root "--with-crypto_backend=openssl" + ;; + openssl_compile) + check_nonroot_compile_only "--with-crypto_backend=openssl" + ;; + kernel) + check_nonroot "--with-crypto_backend=kernel" && \ + check_root "--with-crypto_backend=kernel" + ;; + kernel_compile) + check_nonroot_compile_only "--with-crypto_backend=kernel" + ;; + *) + echo "error, check environment (travis.yml)" >&2 + false + ;; + esac + + ret=$? + set +o xtrace + return $ret +} + +function travis_after_script +{ + return 0 +} diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..0bb8c39 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,42 @@ +language: c + +sudo: required +os: linux +dist: focal +group: edge + +compiler: + - gcc + +env: + # MAKE_CHECK="gcrypt" + - MAKE_CHECK="openssl" + # MAKE_CHECK="kernel" + +branches: + only: + - master + - wip-luks2 + - v2.3.x + +before_install: + - uname -a + - $CC --version + - which $CC + # workaround clang not system wide, fail on sudo make install + - export CC=`which $CC` + # workaround travis-ci issue #5301 + - unset PYTHON_CFLAGS + +install: + - source ./.travis-functions.sh + - travis_install_script + +before_script: + - travis_before_script + +script: + - travis_script + +after_script: + - travis_after_script diff --git a/AUTHORS b/AUTHORS new file mode 100644 index 0000000..f4e5175 --- /dev/null +++ b/AUTHORS @@ -0,0 +1,4 @@ +Jana Saout +Clemens Fruhwirth +Milan Broz +Ondrej Kozina diff --git a/COPYING b/COPYING new file mode 100644 index 0000000..86289a1 --- /dev/null +++ b/COPYING @@ -0,0 +1,354 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. + +----- +In addition, as a special exception, the copyright holders give +permission to link the code of portions of this program with the +OpenSSL library under certain conditions as described in each +individual source file, and distribute linked combinations +including the two. + +You must obey the GNU General Public License in all respects +for all of the code used other than OpenSSL. If you modify +file(s) with this exception, you may extend this exception to your +version of the file(s), but you are not obligated to do so. If you +do not wish to do so, delete this exception statement from your +version. If you delete this exception statement from all source +files in the program, then also delete it here. diff --git a/COPYING.LGPL b/COPYING.LGPL new file mode 100644 index 0000000..7e354d5 --- /dev/null +++ b/COPYING.LGPL @@ -0,0 +1,517 @@ + GNU LESSER GENERAL PUBLIC LICENSE + Version 2.1, February 1999 + + Copyright (C) 1991, 1999 Free Software Foundation, Inc. + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Lesser General Public License, applies to some +specially designated software packages--typically libraries--of the +Free Software Foundation and other authors who decide to use it. You +can use it too, but we suggest you first think carefully about whether +this license or the ordinary General Public License is the better +strategy to use in any particular case, based on the explanations below. + + When we speak of free software, we are referring to freedom of use, +not price. Our General Public Licenses are designed to make sure that +you have the freedom to distribute copies of free software (and charge +for this service if you wish); that you receive source code or can get +it if you want it; that you can change the software and use pieces of +it in new free programs; and that you are informed that you can do +these things. + + To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for +you if you distribute copies of the library or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link other code with the library, you must provide +complete object files to the recipients, so that they can relink them +with the library after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + + To protect each distributor, we want to make it very clear that +there is no warranty for the free library. Also, if the library is +modified by someone else and passed on, the recipients should know +that what they have is not the original version, so that the original +author's reputation will not be affected by problems that might be +introduced by others. + + Finally, software patents pose a constant threat to the existence of +any free program. We wish to make sure that a company cannot +effectively restrict the users of a free program by obtaining a +restrictive license from a patent holder. Therefore, we insist that +any patent license obtained for a version of the library must be +consistent with the full freedom of use specified in this license. + + Most GNU software, including some libraries, is covered by the +ordinary GNU General Public License. This license, the GNU Lesser +General Public License, applies to certain designated libraries, and +is quite different from the ordinary General Public License. We use +this license for certain libraries in order to permit linking those +libraries into non-free programs. + + When a program is linked with a library, whether statically or using +a shared library, the combination of the two is legally speaking a +combined work, a derivative of the original library. The ordinary +General Public License therefore permits such linking only if the +entire combination fits its criteria of freedom. The Lesser General +Public License permits more lax criteria for linking other code with +the library. + + We call this license the "Lesser" General Public License because it +does Less to protect the user's freedom than the ordinary General +Public License. It also provides other free software developers Less +of an advantage over competing non-free programs. These disadvantages +are the reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + + For example, on rare occasions, there may be a special need to +encourage the widest possible use of a certain library, so that it becomes +a de-facto standard. To achieve this, non-free programs must be +allowed to use the library. A more frequent case is that a free +library does the same job as widely used non-free libraries. In this +case, there is little to gain by limiting the free library to free +software only, so we use the Lesser General Public License. + + In other cases, permission to use a particular library in non-free +programs enables a greater number of people to use a large body of +free software. For example, permission to use the GNU C Library in +non-free programs enables many more people to use the whole GNU +operating system, as well as its variant, the GNU/Linux operating +system. + + Although the Lesser General Public License is Less protective of the +users' freedom, it does ensure that the user of a program that is +linked with the Library has the freedom and the wherewithal to run +that program using a modified version of the Library. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, whereas the latter must +be combined with the library in order to run. + + GNU LESSER GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License Agreement applies to any software library or other +program which contains a notice placed by the copyright holder or +other authorized party saying it may be distributed under the terms of +this Lesser General Public License (also called "this License"). +Each licensee is addressed as "you". + + A "library" means a collection of software functions and/or data +prepared so as to be conveniently linked with application programs +(which use some of those functions and data) to form executables. + + The "Library", below, refers to any such software library or work +which has been distributed under these terms. A "work based on the +Library" means either the Library or any derivative work under +copyright law: that is to say, a work containing the Library or a +portion of it, either verbatim or with modifications and/or translated +straightforwardly into another language. (Hereinafter, translation is +included without limitation in the term "modification".) + + "Source code" for a work means the preferred form of the work for +making modifications to it. For a library, complete source code means +all the source code for all modules it contains, plus any associated +interface definition files, plus the scripts used to control compilation +and installation of the library. + + Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running a program using the Library is not restricted, and output from +such a program is covered only if its contents constitute a work based +on the Library (independent of the use of the Library in a tool for +writing it). Whether that is true depends on what the Library does +and what the program that uses the Library does. + + 1. You may copy and distribute verbatim copies of the Library's +complete source code as you receive it, in any medium, provided that +you conspicuously and appropriately publish on each copy an +appropriate copyright notice and disclaimer of warranty; keep intact +all the notices that refer to this License and to the absence of any +warranty; and distribute a copy of this License along with the +Library. + + You may charge a fee for the physical act of transferring a copy, +and you may at your option offer warranty protection in exchange for a +fee. + + 2. You may modify your copy or copies of the Library or any portion +of it, thus forming a work based on the Library, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices + stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no + charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a + table of data to be supplied by an application program that uses + the facility, other than as an argument passed when the facility + is invoked, then you must make a good faith effort to ensure that, + in the event an application does not supply such function or + table, the facility still operates, and performs whatever part of + its purpose remains meaningful. + + (For example, a function in a library to compute square roots has + a purpose that is entirely well-defined independent of the + application. Therefore, Subsection 2d requires that any + application-supplied function or table used by this function must + be optional: if the application does not supply it, the square + root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Library, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Library, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote +it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library +with the Library (or with a work based on the Library) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may opt to apply the terms of the ordinary GNU General Public +License instead of this License to a given copy of the Library. To do +this, you must alter all the notices that refer to this License, so +that they refer to the ordinary GNU General Public License, version 2, +instead of to this License. (If a newer version than version 2 of the +ordinary GNU General Public License has appeared, then you can specify +that version instead if you wish.) Do not make any other change in +these notices. + + Once this change is made in a given copy, it is irreversible for +that copy, so the ordinary GNU General Public License applies to all +subsequent copies and derivative works made from that copy. + + This option is useful when you wish to copy part of the code of +the Library into a program that is not a library. + + 4. You may copy and distribute the Library (or a portion or +derivative of it, under Section 2) in object code or executable form +under the terms of Sections 1 and 2 above provided that you accompany +it with the complete corresponding machine-readable source code, which +must be distributed under the terms of Sections 1 and 2 above on a +medium customarily used for software interchange. + + If distribution of object code is made by offering access to copy +from a designated place, then offering equivalent access to copy the +source code from the same place satisfies the requirement to +distribute the source code, even though third parties are not +compelled to copy the source along with the object code. + + 5. A program that contains no derivative of any portion of the +Library, but is designed to work with the Library by being compiled or +linked with it, is called a "work that uses the Library". Such a +work, in isolation, is not a derivative work of the Library, and +therefore falls outside the scope of this License. + + However, linking a "work that uses the Library" with the Library +creates an executable that is a derivative of the Library (because it +contains portions of the Library), rather than a "work that uses the +library". The executable is therefore covered by this License. +Section 6 states terms for distribution of such executables. + + When a "work that uses the Library" uses material from a header file +that is part of the Library, the object code for the work may be a +derivative work of the Library even though the source code is not. +Whether this is true is especially significant if the work can be +linked without the Library, or if the work is itself a library. The +threshold for this to be true is not precisely defined by law. + + If such an object file uses only numerical parameters, data +structure layouts and accessors, and small macros and small inline +functions (ten lines or less in length), then the use of the object +file is unrestricted, regardless of whether it is legally a derivative +work. (Executables containing this object code plus portions of the +Library will still fall under Section 6.) + + Otherwise, if the work is a derivative of the Library, you may +distribute the object code for the work under the terms of Section 6. +Any executables containing that work also fall under Section 6, +whether or not they are linked directly with the Library itself. + + 6. As an exception to the Sections above, you may also combine or +link a "work that uses the Library" with the Library to produce a +work containing portions of the Library, and distribute that work +under terms of your choice, provided that the terms permit +modification of the work for the customer's own use and reverse +engineering for debugging such modifications. + + You must give prominent notice with each copy of the work that the +Library is used in it and that the Library and its use are covered by +this License. You must supply a copy of this License. If the work +during execution displays copyright notices, you must include the +copyright notice for the Library among them, as well as a reference +directing the user to the copy of this License. Also, you must do one +of these things: + + a) Accompany the work with the complete corresponding + machine-readable source code for the Library including whatever + changes were used in the work (which must be distributed under + Sections 1 and 2 above); and, if the work is an executable linked + with the Library, with the complete machine-readable "work that + uses the Library", as object code and/or source code, so that the + user can modify the Library and then relink to produce a modified + executable containing the modified Library. (It is understood + that the user who changes the contents of definitions files in the + Library will not necessarily be able to recompile the application + to use the modified definitions.) + + b) Use a suitable shared library mechanism for linking with the + Library. A suitable mechanism is one that (1) uses at run time a + copy of the library already present on the user's computer system, + rather than copying library functions into the executable, and (2) + will operate properly with a modified version of the library, if + the user installs one, as long as the modified version is + interface-compatible with the version that the work was made with. + + c) Accompany the work with a written offer, valid for at + least three years, to give the same user the materials + specified in Subsection 6a, above, for a charge no more + than the cost of performing this distribution. + + d) If distribution of the work is made by offering access to copy + from a designated place, offer equivalent access to copy the above + specified materials from the same place. + + e) Verify that the user has already received a copy of these + materials or that you have already sent this user a copy. + + For an executable, the required form of the "work that uses the +Library" must include any data and utility programs needed for +reproducing the executable from it. However, as a special exception, +the materials to be distributed need not include anything that is +normally distributed (in either source or binary form) with the major +components (compiler, kernel, and so on) of the operating system on +which the executable runs, unless that component itself accompanies +the executable. + + It may happen that this requirement contradicts the license +restrictions of other proprietary libraries that do not normally +accompany the operating system. Such a contradiction means you cannot +use both them and the Library together in an executable that you +distribute. + + 7. You may place library facilities that are a work based on the +Library side-by-side in a single library together with other library +facilities not covered by this License, and distribute such a combined +library, provided that the separate distribution of the work based on +the Library and of the other library facilities is otherwise +permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work + based on the Library, uncombined with any other library + facilities. This must be distributed under the terms of the + Sections above. + + b) Give prominent notice with the combined library of the fact + that part of it is a work based on the Library, and explaining + where to find the accompanying uncombined form of the same work. + + 8. You may not copy, modify, sublicense, link with, or distribute +the Library except as expressly provided under this License. Any +attempt otherwise to copy, modify, sublicense, link with, or +distribute the Library is void, and will automatically terminate your +rights under this License. However, parties who have received copies, +or rights, from you under this License will not have their licenses +terminated so long as such parties remain in full compliance. + + 9. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Library or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Library (or any work based on the +Library), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Library or works based on it. + + 10. Each time you redistribute the Library (or any work based on the +Library), the recipient automatically receives a license from the +original licensor to copy, distribute, link with or modify the Library +subject to these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties with +this License. + + 11. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Library at all. For example, if a patent +license would not permit royalty-free redistribution of the Library by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any +particular circumstance, the balance of the section is intended to apply, +and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 12. If the distribution and/or use of the Library is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Library under this License may add +an explicit geographical distribution limitation excluding those countries, +so that distribution is permitted only in or among countries not thus +excluded. In such case, this License incorporates the limitation as if +written in the body of this License. + + 13. The Free Software Foundation may publish revised and/or new +versions of the Lesser General Public License from time to time. +Such new versions will be similar in spirit to the present version, +but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library +specifies a version number of this License which applies to it and +"any later version", you have the option of following the terms and +conditions either of that version or of any later version published by +the Free Software Foundation. If the Library does not specify a +license version number, you may choose any version ever published by +the Free Software Foundation. + + 14. If you wish to incorporate parts of the Library into other free +programs whose distribution conditions are incompatible with these, +write to the author to ask for permission. For software which is +copyrighted by the Free Software Foundation, write to the Free +Software Foundation; we sometimes make exceptions for this. Our +decision will be guided by the two goals of preserving the free status +of all derivatives of our free software and of promoting the sharing +and reuse of software generally. + + NO WARRANTY + + 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO +WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. +EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR +OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY +KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE +LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME +THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN +WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY +AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU +FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR +CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE +LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING +RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A +FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF +SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH +DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Libraries + + If you develop a new library, and you want it to be of the greatest +possible use to the public, we recommend making it free software that +everyone can redistribute and change. You can do so by permitting +redistribution under these terms (or, alternatively, under the terms of the +ordinary General Public License). + + To apply these terms, attach the following notices to the library. It is +safest to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with this library; if not, write to the Free Software + Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the library, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the + library `Frob' (a library for tweaking knobs) written by James Random Hacker. + + , 1 April 1990 + Ty Coon, President of Vice + +That's all there is to it! + +----- +In addition, as a special exception, the copyright holders give +permission to link the code of portions of this program with the +OpenSSL library under certain conditions as described in each +individual source file, and distribute linked combinations +including the two. + +You must obey the GNU Lesser General Public License in all respects +for all of the code used other than OpenSSL. If you modify +file(s) with this exception, you may extend this exception to your +version of the file(s), but you are not obligated to do so. If you +do not wish to do so, delete this exception statement from your +version. If you delete this exception statement from all source +files in the program, then also delete it here. diff --git a/ChangeLog b/ChangeLog new file mode 100644 index 0000000..b6c11ba --- /dev/null +++ b/ChangeLog @@ -0,0 +1,6 @@ +Since version 1.6 this file is no longer maintained. + +See docs/*ReleaseNotes for release changes documentation. + +See version control history for full commit messages. + https://gitlab.com/cryptsetup/cryptsetup/commits/master diff --git a/FAQ b/FAQ new file mode 100644 index 0000000..d829ad3 --- /dev/null +++ b/FAQ @@ -0,0 +1,3019 @@ +Frequently Asked Questions Cryptsetup/LUKS + +Sections +1. General Questions +2. Setup +3. Common Problems +4. Troubleshooting +5. Security Aspects +6. Backup and Data Recovery +7. Interoperability with other Disk Encryption Tools +8. Issues with Specific Versions of cryptsetup +9. The Initrd question +10. LUKS2 Questions +11. References and Further Reading +A. Contributors + +1. General Questions + + + * 1.1 What is this? + + This is the FAQ (Frequently Asked Questions) for cryptsetup. It covers + Linux disk encryption with plain dm-crypt (one passphrase, no + management, no metadata on disk) and LUKS (multiple user keys with one + master key, anti-forensic features, metadata block at start of device, + ...). The latest version of this FAQ should usually be available at + https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions + + + * 1.2 WARNINGS + + LUKS2 COMPATIBILITY: This FAQ was originally written for LUKS1, not + LUKS2. Hence regarding LUKS2, some of the answers found here may not + apply. Updates for LUKS2 have been done and anything not applying to + LUKS2 should clearly say LUKS1. However, this is a Frequently Asked + Questions, and questions for LUKS2 are limited at this time or at least + those that have reached me are. In the following, "LUKS" refers to both + LUKS1 and LUKS2. + + The LUKS1 on-disk format specification is at + https://www.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf + The LUKS2 on-disk format specification is at + https://gitlab.com/cryptsetup/LUKS2-docs + + ATTENTION: If you are going to read just one thing, make it the section + on Backup and Data Recovery. By far the most questions on the + cryptsetup mailing list are from people that managed to damage the start + of their LUKS partitions, i.e. the LUKS header. In most cases, there + is nothing that can be done to help these poor souls recover their data. + Make sure you understand the problem and limitations imposed by the LUKS + security model BEFORE you face such a disaster! In particular, make + sure you have a current header backup before doing any potentially + dangerous operations. The LUKS2 header should be a bit more resilient + as critical data starts later and is stored twice, but you can decidedly + still destroy it or a keyslot permanently by accident. + + DEBUG COMMANDS: While the --debug and --debug-json options should not + leak secret data, "strace" and the like can leak your full passphrase. + Do not post an strace output with the correct passphrase to a + mailing-list or online! See Item 4.5 for more explanation. + + SSDs/FLASH DRIVES: SSDs and Flash are different. Currently it is + unclear how to get LUKS or plain dm-crypt to run on them with the full + set of security assurances intact. This may or may not be a problem, + depending on the attacker model. See Section 5.19. + + BACKUP: Yes, encrypted disks die, just as normal ones do. A full backup + is mandatory, see Section "6. Backup and Data Recovery" on options for + doing encrypted backup. + + CLONING/IMAGING: If you clone or image a LUKS container, you make a copy + of the LUKS header and the master key will stay the same! That means + that if you distribute an image to several machines, the same master key + will be used on all of them, regardless of whether you change the + passphrases. Do NOT do this! If you do, a root-user on any of the + machines with a mapped (decrypted) container or a passphrase on that + machine can decrypt all other copies, breaking security. See also Item + 6.15. + + DISTRIBUTION INSTALLERS: Some distribution installers offer to create + LUKS containers in a way that can be mistaken as activation of an + existing container. Creating a new LUKS container on top of an existing + one leads to permanent, complete and irreversible data loss. It is + strongly recommended to only use distribution installers after a + complete backup of all LUKS containers has been made. + + UBUNTU INSTALLER: In particular the Ubuntu installer seems to be quite + willing to kill LUKS containers in several different ways. Those + responsible at Ubuntu seem not to care very much (it is very easy to + recognize a LUKS container), so treat the process of installing Ubuntu + as a severe hazard to any LUKS container you may have. + + NO WARNING ON NON-INTERACTIVE FORMAT: If you feed cryptsetup from STDIN + (e.g. via GnuPG) on LUKS format, it does not give you the warning that + you are about to format (and e.g. will lose any pre-existing LUKS + container on the target), as it assumes it is used from a script. In + this scenario, the responsibility for warning the user and possibly + checking for an existing LUKS header is shifted to the script. This is + a more general form of the previous item. + + LUKS PASSPHRASE IS NOT THE MASTER KEY: The LUKS passphrase is not used + in deriving the master key. It is used in decrypting a master key that + is randomly selected on header creation. This means that if you create + a new LUKS header on top of an old one with exactly the same parameters + and exactly the same passphrase as the old one, it will still have a + different master key and your data will be permanently lost. + + PASSPHRASE CHARACTER SET: Some people have had difficulties with this + when upgrading distributions. It is highly advisable to only use the 95 + printable characters from the first 128 characters of the ASCII table, + as they will always have the same binary representation. Other + characters may have different encoding depending on system configuration + and your passphrase will not work with a different encoding. A table of + the standardized first 128 ASCII characters can, e.g. be found on + https://en.wikipedia.org/wiki/ASCII + + KEYBOARD NUM-PAD: Apparently some pre-boot authentication environments + (these are done by the distro, not by cryptsetup, so complain there) + treat digits entered on the num-pad and ones entered regularly + different. This may be because the BIOS USB keyboard driver is used and + that one may have bugs on some computers. If you cannot open your + device in pre-boot, try entering the digits over the regular digit keys. + + + * 1.3 System specific warnings + + - The Ubuntu Natty uinstaller has a "won't fix" defect that may destroy + LUKS containers. This is quite old an not relevant for most people. + Reference: + https://bugs.launchpad.net/ubuntu/+source/partman-crypto/+bug/420080 + + + * 1.4 My LUKS-device is broken! Help! + + First: Do not panic! In many cases the data is still recoverable. + Do not do anything hasty! Steps: + + - Take some deep breaths. Maybe add some relaxing music. This may + sound funny, but I am completely serious. Often, critical damage is + done only after the initial problem. + + - Do not reboot. The keys may still be in the kernel if the device is + mapped. + + - Make sure others do not reboot the system. + + - Do not write to your disk without a clear understanding why this will + not make matters worse. Do a sector-level backup before any writes. + Often you do not need to write at all to get enough access to make a + backup of the data. + + - Relax some more. + + - Read section 6 of this FAQ. + + - Ask on the mailing-list if you need more help. + + + * 1.5 Who wrote this? + + Current FAQ maintainer is Arno Wagner . If you want + to send me encrypted email, my current PGP key is DSA key CB5D9718, + fingerprint 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718. + + Other contributors are listed at the end. If you want to contribute, + send your article, including a descriptive headline, to the maintainer, + or the dm-crypt mailing list with something like "FAQ ..." + in the subject. You can also send more raw information and have + me write the section. Please note that by contributing to this FAQ, + you accept the license described below. + + This work is under the "Attribution-Share Alike 3.0 Unported" license, + which means distribution is unlimited, you may create derived works, but + attributions to original authors and this license statement must be + retained and the derived work must be under the same license. See + https://creativecommons.org/licenses/by-sa/3.0/ for more details of the + license. + + Side note: I did text license research some time ago and I think this + license is best suited for the purpose at hand and creates the least + problems. + + + * 1.6 Where is the project website? + + There is the project website at + https://gitlab.com/cryptsetup/cryptsetup/ Please do not post + questions there, nobody will read them. Use the mailing-list + instead. + + + * 1.7 Is there a mailing-list? + + Instructions on how to subscribe to the mailing-list are on the + project website. People are generally helpful and friendly on the + list. + + The question of how to unsubscribe from the list does crop up sometimes. + For this you need your list management URL, which is sent to you + initially and once at the start of each month. Go to the URL mentioned + in the email and select "unsubscribe". This page also allows you to + request a password reminder. + + Alternatively, you can send an Email to dm-crypt-request@saout.de with + just the word "help" in the subject or message body. Make sure to send + it from your list address. + + The mailing list archive is here: + https://marc.info/?l=dm-crypt + + + * 1.8 Unsubscribe from the mailing-list + + Send mail to dm-crypt-unsubscribe@saout.de from the subscribed account. + You will get an email with instructions. + + Basically, you just have to respond to it unmodified to get + unsubscribed. The listserver admin functions are not very fast. It can + take 15 minutes or longer for a reply to arrive (I suspect greylisting + is in use), so be patient. + + Also note that nobody on the list can unsubscribe you, sending demands + to be unsubscribed to the list just annoys people that are entirely + blameless for you being subscribed. + + If you are subscribed, a subscription confirmation email was sent to + your email account and it had to be answered before the subscription + went active. The confirmation emails from the listserver have subjects + like these (with other numbers): + + Subject: confirm 9964cf10..... + + and are sent from dm-crypt-request@saout.de. You should check whether + you have anything like it in your sent email folder. If you find + nothing and are sure you did not confirm, then you should look into a + possible compromise of your email account. + + +2. Setup + + * 2.1 LUKS Container Setup mini-HOWTO + + This item tries to give you a very brief list of all the steps you + should go through when creating a new LUKS encrypted container, i.e. + encrypted disk, partition or loop-file. + + 01) All data will be lost, if there is data on the target, make a + backup. + + 02) Make very sure you use the right target disk, partition or + loop-file. + + 03) If the target was in use previously, it is a good idea to wipe it + before creating the LUKS container in order to remove any trace of old + file systems and data. For example, some users have managed to run + e2fsck on a partition containing a LUKS container, possibly because of + residual ext2 superblocks from an earlier use. This can do arbitrary + damage up to complete and permanent loss of all data in the LUKS + container. + + To just quickly wipe file systems (old data may remain), use + + wipefs -a + + To wipe file system and data, use something like + + cat /dev/zero > + + This can take a while. To get a progress indicator, you can use the + tool dd_rescue (->google) instead or use my stream meter "wcs" (source + here: https://www.tansi.org/tools/index.html) in the following fashion: + + cat /dev/zero | wcs > + + Plain "dd" also gives you the progress on a SIGUSR1, see its man-page. + + Be very sure you have the right target, all data will be lost! + + Note that automatic wiping is on the TODO list for cryptsetup, so at + some time in the future this will become unnecessary. + + Alternatively, plain dm-crypt can be used for a very fast wipe with + crypto-grade randomness, see Item 2.19 + + 04) Create the LUKS container. + + LUKS1: + + cryptsetup luksFormat --type luks1 + + LUKS2: + + cryptsetup luksFormat --type luks2 + + + Just follow the on-screen instructions. + + Note: Passphrase iteration count is based on time and hence security + level depends on CPU power of the system the LUKS container is created + on. For example on a Raspberry Pi and LUKS1, I found some time ago that + the iteration count is 15 times lower than for a regular PC (well, for + my old one). Depending on security requirements, this may need + adjustment. For LUKS1, you can just look at the iteration count on + different systems and select one you like. You can also change the + benchmark time with the -i parameter to create a header for a slower + system. + + For LUKS2, the parameters are more complex. ARGON2 has iteration, + parallelism and memory parameter. cryptsetup actually may adjust the + memory parameter for time scaling. Hence to use -i is the easiest way + to get slower or faster opening (default: 2000 = 2sec). Just make sure + to not drop this too low or you may get a memory parameter that is to + small to be secure. The luksDump command lists the memory parameter of + a created LUKS2 keyslot in kB. That parameter should probably be not + much lower than 100000, i.e. 100MB, but don't take my word for it. + + 05) Map the container. Here it will be mapped to /dev/mapper/c1: + + cryptsetup luksOpen c1 + + 06) (Optionally) wipe the container (make sure you have the right + target!): + + cat /dev/zero > /dev/mapper/c1 + + This will take a while. Note that this creates a small information + leak, as an attacker can determine whether a 512 byte block is zero if + the attacker has access to the encrypted container multiple times. + Typically a competent attacker that has access multiple times can + install a passphrase sniffer anyways, so this leakage is not very + significant. For getting a progress indicator, see step 03. + + 07) Create a file system in the mapped container, for example an + ext3 file system (any other file system is possible): + + mke2fs -j /dev/mapper/c1 + + 08) Mount your encrypted file system, here on /mnt: + + mount /dev/mapper/c1 /mnt + + 09) Make a LUKS header backup and plan for a container backup. + See Section 6 for details. + + Done. You can now use the encrypted file system to store data. Be sure + to read through the rest of the FAQ, these are just the very basics. In + particular, there are a number of mistakes that are easy to make, but + will compromise your security. + + + * 2.2 LUKS on partitions or raw disks? What about RAID? + + Also see Item 2.8. + This is a complicated question, and made more so by the availability of + RAID and LVM. I will try to give some scenarios and discuss advantages + and disadvantages. Note that I say LUKS for simplicity, but you can do + all the things described with plain dm-crypt as well. Also note that + your specific scenario may be so special that most or even all things I + say below do not apply. + + Be aware that if you add LVM into the mix, things can get very + complicated. Same with RAID but less so. In particular, data recovery + can get exceedingly difficult. Only add LVM if you have a really good + reason and always remember KISS is what separates an engineer from an + amateur. Of course, if you really need the added complexity, KISS is + satisfied. But be very sure as there is a price to pay for it. In + engineering, complexity is always the enemy and needs to be fought + without mercy when encountered. + + Also consider using RAID instead of LVM, as at least with the old + superblock format 0.90, the RAID superblock is in the place (end of + disk) where the risk of it damaging the LUKS header is smallest and you + can have your array assembled by the RAID controller (i.e. the kernel), + as it should be. Use partition type 0xfd for that. I recommend staying + away from superblock formats 1.0, 1.1 and 1.2 unless you really need + them. + + Scenarios: + + (1) Encrypted partition: Just make a partition to your liking, and put + LUKS on top of it and a filesystem into the LUKS container. This gives + you isolation of differently-tasked data areas, just as ordinary + partitioning does. You can have confidential data, non-confidential + data, data for some specific applications, user-homes, root, etc. + Advantages are simplicity as there is a 1:1 mapping between partitions + and filesystems, clear security functionality and the ability to + separate data into different, independent (!) containers. + + Note that you cannot do this for encrypted root, that requires an + initrd. On the other hand, an initrd is about as vulnerable to a + competent attacker as a non-encrypted root, so there really is no + security advantage to doing it that way. An attacker that wants to + compromise your system will just compromise the initrd or the kernel + itself. The better way to deal with this is to make sure the root + partition does not store any critical data and to move that to + additional encrypted partitions. If you really are concerned your root + partition may be sabotaged by somebody with physical access (who would + however strangely not, say, sabotage your BIOS, keyboard, etc.), protect + it in some other way. The PC is just not set-up for a really secure + boot-chain (whatever some people may claim). + + (2) Fully encrypted raw block device: For this, put LUKS on the raw + device (e.g. /dev/sdb) and put a filesystem into the LUKS container, no + partitioning whatsoever involved. This is very suitable for things like + external USB disks used for backups or offline data-storage. + + (3) Encrypted RAID: Create your RAID from partitions and/or full + devices. Put LUKS on top of the RAID device, just if it were an + ordinary block device. Applications are just the same as above, but you + get redundancy. (Side note as many people seem to be unaware of it: You + can do RAID1 with an arbitrary number of components in Linux.) See also + Item 2.8. + + (4) Now, some people advocate doing the encryption below the RAID layer. + That has several serious problems. One is that suddenly debugging RAID + issues becomes much harder. You cannot do automatic RAID assembly + anymore. You need to keep the encryption keys for the different RAID + components in sync or manage them somehow. The only possible advantage + is that things may run a little faster as more CPUs do the encryption, + but if speed is a priority over security and simplicity, you are doing + this wrong anyways. A good way to mitigate a speed issue is to get a + CPU that does hardware AES as most do today. + + + * 2.3 How do I set up encrypted swap? + + As things that are confidential can end up in swap (keys, passphrases, + etc. are usually protected against being swapped to disk, but other + things may not be), it may be advisable to do something about the issue. + One option is to run without swap, which generally works well in a + desktop-context. It may cause problems in a server-setting or under + special circumstances. The solution to that is to encrypt swap with a + random key at boot-time. + + NOTE: This is for Debian, and should work for Debian-derived + distributions. For others you may have to write your own startup script + or use other mechanisms. + + 01) Add the swap partition to /etc/crypttab. A line like the + following should do it: + + swap /dev/ /dev/urandom swap,noearly + + Warning: While Debian refuses to overwrite partitions with a filesystem + or RAID signature on it, as your disk IDs may change (adding or removing + disks, failure of disk during boot, etc.), you may want to take + additional precautions. Yes, this means that your kernel device names + like sda, sdb, ... can change between reboots! This is not a concern + if you have only one disk. One possibility is to make sure the + partition number is not present on additional disks or also swap there. + Another is to encapsulate the swap partition (by making it a 1-partition + RAID1 or by using LVM), as that gets a persistent identifier. + Specifying it directly by UUID does not work, unfortunately, as the UUID + is part of the swap signature and that is not visible from the outside + due to the encryption and in addition changes on each reboot with this + setup. + + Note: Use /dev/random if you are paranoid or in a potential low-entropy + situation (embedded system, etc.). This may cause the operation to take + a long time during boot however. If you are in a "no entropy" + situation, you cannot encrypt swap securely. In this situation you + should find some entropy, also because nothing else using crypto will be + secure, like ssh, ssl or GnuPG. + + Note: The "noearly" option makes sure things like LVM, RAID, etc. are + running. As swap is non-critical for boot, it is fine to start it late. + + 02) Add the swap partition to /etc/fstab. A line like the following + should do it: + + /dev/mapper/swap none swap sw 0 0 + + That is it. Reboot or start it manually to activate encrypted swap. + Manual start would look like this: + + /etc/init.d/cryptdisks start + swapon /dev/mapper/swap + + + * 2.4 What is the difference between "plain" and LUKS format? + + First, unless you happen to understand the cryptographic background + well, you should use LUKS. It does protect the user from a lot of + common mistakes. Plain dm-crypt is for experts. + + Plain format is just that: It has no metadata on disk, reads all + parameters from the commandline (or the defaults), derives a master-key + from the passphrase and then uses that to de-/encrypt the sectors of the + device, with a direct 1:1 mapping between encrypted and decrypted + sectors. + + Primary advantage is high resilience to damage, as one damaged encrypted + sector results in exactly one damaged decrypted sector. Also, it is not + readily apparent that there even is encrypted data on the device, as an + overwrite with crypto-grade randomness (e.g. from + /dev/urandom) looks exactly the same on disk. + + Side-note: That has limited value against the authorities. In civilized + countries, they cannot force you to give up a crypto-key anyways. In + quite a few countries around the world, they can force you to give up + the keys (using imprisonment or worse to pressure you, sometimes without + due process), and in the worst case, they only need a nebulous + "suspicion" about the presence of encrypted data. Sometimes this + applies to everybody, sometimes only when you are suspected of having + "illicit data" (definition subject to change) and sometimes specifically + when crossing a border. Note that this is going on in countries like + the US and the UK to different degrees and sometimes with courts + restricting what the authorities can actually demand. + + My advice is to either be ready to give up the keys or to not have + encrypted data when traveling to those countries, especially when + crossing the borders. The latter also means not having any high-entropy + (random) data areas on your disk, unless you can explain them and + demonstrate that explanation. Hence doing a zero-wipe of all free + space, including unused space, may be a good idea. + + Disadvantages are that you do not have all the nice features that the + LUKS metadata offers, like multiple passphrases that can be changed, the + cipher being stored in the metadata, anti-forensic properties like + key-slot diffusion and salts, etc.. + + LUKS format uses a metadata header and 8 key-slot areas that are being + placed at the beginning of the disk, see below under "What does the LUKS + on-disk format looks like?". The passphrases are used to decrypt a + single master key that is stored in the anti-forensic stripes. LUKS2 + adds some more flexibility. + + Advantages are a higher usability, automatic configuration of + non-default crypto parameters, defenses against low-entropy passphrases + like salting and iterated PBKDF2 or ARGON 2 passphrase hashing, the + ability to change passphrases, and others. + + Disadvantages are that it is readily obvious there is encrypted data on + disk (but see side note above) and that damage to the header or + key-slots usually results in permanent data-loss. See below under "6. + Backup and Data Recovery" on how to reduce that risk. Also the sector + numbers get shifted by the length of the header and key-slots and there + is a loss of that size in capacity. Unless you have a specific need, + use LUKS2. + + + * 2.5 Can I encrypt an existing, non-empty partition to use LUKS? + + There is no converter, and it is not really needed. The way to do this + is to make a backup of the device in question, securely wipe the device + (as LUKS device initialization does not clear away old data), do a + luksFormat, optionally overwrite the encrypted device, create a new + filesystem and restore your backup on the now encrypted device. Also + refer to sections "Security Aspects" and "Backup and Data Recovery". + + For backup, plain GNU tar works well and backs up anything likely to be + in a filesystem. + + + * 2.6 How do I use LUKS with a loop-device? + + This can be very handy for experiments. Setup is just the same as with + any block device. If you want, for example, to use a 100MiB file as + LUKS container, do something like this: + + head -c 100M /dev/zero > luksfile # create empty file + losetup /dev/loop0 luksfile # map file to /dev/loop0 + cryptsetup luksFormat --type luks2 /dev/loop0 # create LUKS2 container + + Afterwards just use /dev/loop0 as a you would use a LUKS partition. + To unmap the file when done, use "losetup -d /dev/loop0". + + + * 2.7 When I add a new key-slot to LUKS, it asks for a passphrase + but then complains about there not being a key-slot with that + passphrase? + + That is as intended. You are asked a passphrase of an existing key-slot + first, before you can enter the passphrase for the new key-slot. + Otherwise you could break the encryption by just adding a new key-slot. + This way, you have to know the passphrase of one of the already + configured key-slots in order to be able to configure a new key-slot. + + + * 2.8 Encryption on top of RAID or the other way round? + + Also see Item 2.2. + Unless you have special needs, place encryption between RAID and + filesystem, i.e. encryption on top of RAID. You can do it the other + way round, but you have to be aware that you then need to give the + passphrase for each individual disk and RAID auto-detection will not + work anymore. Therefore it is better to encrypt the RAID device, e.g. + /dev/dm0 . + + This means that the typical layering looks like this: + + Filesystem <- top + | + Encryption (LUKS) + | + RAID + | + Raw partitions (optional) + | + Raw disks <- bottom + + The big advantage of this is that you can manage the RAID container just + like any other regular RAID container, it does not care that its content + is encrypted. This strongly cuts down on complexity, something very + valuable with storage encryption. + + + * 2.9 How do I read a dm-crypt key from file? + + Use the --key-file option, like this: + + cryptsetup create --key-file keyfile e1 /dev/loop0 + + This will read the binary key from file, i.e. no hashing or + transformation will be applied to the keyfile before its bits are used + as key. Extra bits (beyond the length of the key) at the end are + ignored. Note that if you read from STDIN, the data will be hashed, + just as a key read interactively from the terminal. See the man-page + sections "NOTES ON PASSPHRASE PROCESSING..." for more detail. + + + * 2.10 How do I read a LUKS slot key from file? + + What you really do here is to read a passphrase from file, just as you + would with manual entry of a passphrase for a key-slot. You can add a + new passphrase to a free key-slot, set the passphrase of an specific + key-slot or put an already configured passphrase into a file. Make sure + no trailing newline (0x0a) is contained in the input key file, or the + passphrase will not work because the whole file is used as input. + + To add a new passphrase to a free key slot from file, use something + like this: + + cryptsetup luksAddKey /dev/loop0 keyfile + + To add a new passphrase to a specific key-slot, use something + like this: + + cryptsetup luksAddKey --key-slot 7 /dev/loop0 keyfile + + To supply a key from file to any LUKS command, use the --key-file + option, e.g. like this: + + cryptsetup luksOpen --key-file keyfile /dev/loop0 e1 + + + + * 2.11 How do I read the LUKS master key from file? + + The question you should ask yourself first is why you would want to do + this. The only legitimate reason I can think of is if you want to have + two LUKS devices with the same master key. Even then, I think it would + be preferable to just use key-slots with the same passphrase, or to use + plain dm-crypt instead. If you really have a good reason, please tell + me. If I am convinced, I will add how to do this here. + + + * 2.12 What are the security requirements for a key read from file? + + A file-stored key or passphrase has the same security requirements as + one entered interactively, however you can use random bytes and thereby + use bytes you cannot type on the keyboard. You can use any file you + like as key file, for example a plain text file with a human readable + passphrase. To generate a file with random bytes, use something like + this: + + head -c 256 /dev/random > keyfile + + + + * 2.13 If I map a journaled file system using dm-crypt/LUKS, does + it still provide its usual transactional guarantees? + + Yes, it does, unless a very old kernel is used. The required flags come + from the filesystem layer and are processed and passed onward by + dm-crypt (regardless of direct key management or LUKS key management). + A bit more information on the process by which transactional guarantees + are implemented can be found here: + + https://lwn.net/Articles/400541/ + + Please note that these "guarantees" are weaker than they appear to be. + One problem is that quite a few disks lie to the OS about having flushed + their buffers. This is likely still true with SSDs. Some other things + can go wrong as well. The filesystem developers are aware of these + problems and typically can make it work anyways. That said, + dm-crypt/LUKS will not make things worse. + + One specific problem you can run into is that you can get short freezes + and other slowdowns due to the encryption layer. Encryption takes time + and forced flushes will block for that time. For example, I did run + into frequent small freezes (1-2 sec) when putting a vmware image on + ext3 over dm-crypt. When I went back to ext2, the problem went away. + This seems to have gotten better with kernel 2.6.36 and the reworking of + filesystem flush locking mechanism (less blocking of CPU activity during + flushes). This should improve further and eventually the problem should + go away. + + + * 2.14 Can I use LUKS or cryptsetup with a more secure (external) + medium for key storage, e.g. TPM or a smartcard? + + Yes, see the answers on using a file-supplied key. You do have to write + the glue-logic yourself though. Basically you can have cryptsetup read + the key from STDIN and write it there with your own tool that in turn + gets the key from the more secure key storage. + + + * 2.15 Can I resize a dm-crypt or LUKS container? + + Yes, you can, as neither dm-crypt nor LUKS1 stores partition size and + LUKS2 uses a generic "whole device" size as default. Note that LUKS2 + can use specified data-area sizes as a non-standard case and that these + may cause issues when resizing a LUKS2 container if set to a specific + value. + + Whether you should do this is a different question. Personally I + recommend backup, recreation of the dm-crypt or LUKS container with new + size, recreation of the filesystem and restore. This gets around the + tricky business of resizing the filesystem. Resizing a dm-crypt or LUKS + container does not resize the filesystem in it. A backup is really + non-optional here, as a lot can go wrong, resulting in partial or + complete data loss. But if you have that backup, you can also just + recreate everything. + + You also need to be aware of size-based limitations. The one currently + relevant is that aes-xts-plain should not be used for encrypted + container sizes larger than 2TiB. Use aes-xts-plain64 for that. + + + * 2.16 How do I Benchmark the Ciphers, Hashes and Modes? + + Since version 1.60 cryptsetup supports the "benchmark" command. + Simply run as root: + + cryptsetup benchmark + + You can get more than the default benchmarks, see the man-page for the + relevant parameters. Note that XTS mode takes two keys, hence the + listed key sizes are double that for other modes and half of it is the + cipher key, the other half is the XTS key. + + + * 2.17 How do I Verify I have an Authentic cryptsetup Source Package? + + Current maintainer is Milan Broz and he signs the release packages with + his PGP key. The key he currently uses is the "RSA key ID D93E98FC", + fingerprint 2A29 1824 3FDE 4664 8D06 86F9 D9B0 577B D93E 98FC. While I + have every confidence this really is his key and that he is who he + claims to be, don't depend on it if your life is at stake. For that + matter, if your life is at stake, don't depend on me being who I claim + to be either. + + That said, as cryptsetup is under good version control and a malicious + change should be noticed sooner or later, but it may take a while. + Also, the attacker model makes compromising the sources in a non-obvious + way pretty hard. Sure, you could put the master-key somewhere on disk, + but that is rather obvious as soon as somebody looks as there would be + data in an empty LUKS container in a place it should not be. Doing this + in a more nefarious way, for example hiding the master-key in the salts, + would need a look at the sources to be discovered, but I think that + somebody would find that sooner or later as well. + + That said, this discussion is really a lot more complicated and longer + as an FAQ can sustain. If in doubt, ask on the mailing list. + + + * 2.18 Is there a concern with 4k Sectors? + + Not from dm-crypt itself. Encryption will be done in 512B blocks, but + if the partition and filesystem are aligned correctly and the filesystem + uses multiples of 4kiB as block size, the dm-crypt layer will just + process 8 x 512B = 4096B at a time with negligible overhead. LUKS does + place data at an offset, which is 2MiB per default and will not break + alignment. See also Item 6.12 of this FAQ for more details. Note that + if your partition or filesystem is misaligned, dm-crypt can make the + effect worse though. Also note that SSDs typically have much larger + blocks internally (e.g. 128kB or even larger). + + + * 2.19 How can I wipe a device with crypto-grade randomness? + + The conventional recommendation if you want to do more than just a + zero-wipe is to use something like + + cat /dev/urandom > + + That used to very slow and painful at 10-20MB/s on a fast computer, but + newer kernels can give you > 200MB/s (depending on hardware). An + alternative is using cryptsetup and a plain dm-crypt device with a + random key, which is fast and on the same level of security. The + defaults are quite enough. + + For device set-up, do the following: + + cryptsetup open --type plain -d /dev/urandom /dev/ target + + This maps the container as plain under /dev/mapper/target with a random + password. For the actual wipe you have several options. Basically, you + pipe zeroes into the opened container that then get encrypted. Simple + wipe without progress-indicator: + + cat /dev/zero > /dev/mapper/to_be_wiped + + Progress-indicator by dd_rescue: + + dd_rescue -w /dev/zero /dev/mapper/to_be_wiped + + Progress-indicator by my "wcs" stream meter (available from + https://www.tansi.org/tools/index.html ): + + cat /dev/zero | wcs > /dev/mapper/to_be_wiped + + Or use plain "dd", which gives you the progress when sent a SIGUSR1, see + the dd man page. + + Remove the mapping at the end and you are done. + + + * 2.20 How do I wipe only the LUKS header? + + This does _not_ describe an emergency wipe procedure, see Item 5.4 for + that. This procedure here is intended to be used when the data should + stay intact, e.g. when you change your LUKS container to use a detached + header and want to remove the old one. Please only do this if you have + a current backup. + + LUKS1: + 01) Determine header size in 512 Byte sectors with luksDump: + + cryptsetup luksDump + +-> ... + Payload offset: + ... + + 02) Take the result number, multiply by 512 zeros and write to + the start of the device, e.g. like this: + + dd bs=512 count= if=/dev/zero of= + + + LUKS2: (warning, untested! Remember that backup?) This assumes the + LUKS2 container uses the defaults, in particular there is only one data + segment. 01) Determine the data-segment offset using luksDump, same + as above for LUKS1: + +-> ... + Data segments: + 0: crypt + offset: [bytes] + ... + + 02) Overwrite the stated number of bytes from the start of the device. + Just to give yet another way to get a defined number of zeros: + + head -c /dev/zero > /dev/ + + +3. Common Problems + + + * 3.1 My dm-crypt/LUKS mapping does not work! What general steps + are there to investigate the problem? + + If you get a specific error message, investigate what it claims first. + If not, you may want to check the following things. + + - Check that "/dev", including "/dev/mapper/control" is there. If it is + missing, you may have a problem with the "/dev" tree itself or you may + have broken udev rules. + + - Check that you have the device mapper and the crypt target in your + kernel. The output of "dmsetup targets" should list a "crypt" target. + If it is not there or the command fails, add device mapper and + crypt-target to the kernel. + + - Check that the hash-functions and ciphers you want to use are in the + kernel. The output of "cat /proc/crypto" needs to list them. + + + * 3.2 My dm-crypt mapping suddenly stopped when upgrading cryptsetup. + + The default cipher, hash or mode may have changed (the mode changed from + 1.0.x to 1.1.x). See under "Issues With Specific Versions of + cryptsetup". + + + * 3.3 When I call cryptsetup from cron/CGI, I get errors about + unknown features? + + If you get errors about unknown parameters or the like that are not + present when cryptsetup is called from the shell, make sure you have no + older version of cryptsetup on your system that then gets called by + cron/CGI. For example some distributions install cryptsetup into + /usr/sbin, while a manual install could go to /usr/local/sbin. As a + debugging aid, call "cryptsetup --version" from cron/CGI or the + non-shell mechanism to be sure the right version gets called. + + + * 3.4 Unlocking a LUKS device takes very long. Why? + + The unlock time for a key-slot (see Section 5 for an explanation what + iteration does) is calculated when setting a passphrase. By default it + is 1 second (2 seconds for LUKS2). If you set a passphrase on a fast + machine and then unlock it on a slow machine, the unlocking time can be + much longer. Also take into account that up to 8 key-slots (LUKS2: up + to 32 key-slots) have to be tried in order to find the right one. + + If this is the problem, you can add another key-slot using the slow + machine with the same passphrase and then remove the old key-slot. The + new key-slot will have the unlock time adjusted to the slow machine. + Use luksKeyAdd and then luksKillSlot or luksRemoveKey. You can also use + the -i option to reduce iteration time (and security level) when setting + a passphrase. Default is 1000 (1 sec) for LUKS1 and 2000 (2sec) for + LUKS2. + + However, this operation will not change volume key iteration count ("MK + iterations" for LUKS1, "Iterations" under "Digests" for LUKS2). In + order to change that, you will have to backup the data in the LUKS + container (i.e. your encrypted data), luksFormat on the slow machine + and restore the data. Note that MK iterations are not very security + relevant. + + + * 3.5 "blkid" sees a LUKS UUID and an ext2/swap UUID on the same + device. What is wrong? + + Some old versions of cryptsetup have a bug where the header does not get + completely wiped during LUKS format and an older ext2/swap signature + remains on the device. This confuses blkid. + + Fix: Wipe the unused header areas by doing a backup and restore of + the header with cryptsetup 1.1.x or later: + + cryptsetup luksHeaderBackup --header-backup-file + cryptsetup luksHeaderRestore --header-backup-file + + + +4. Troubleshooting + + + * 4.1 I get the error "LUKS keyslot x is invalid." What does that mean? + + For LUKS1, this means that the given keyslot has an offset that points + outside the valid keyslot area. Typically, the reason is a corrupted + LUKS1 header because something was written to the start of the device + the LUKS1 container is on. For LUKS2, I do not know when this error can + happen, but I expect it will be something similar. Refer to Section + "Backup and Data Recovery" and ask on the mailing list if you have + trouble diagnosing and (if still possible) repairing this. + + + * 4.2 I cannot unlock my LUKS container! What could be the problem? + + First, make sure you have a correct passphrase. Then make sure you have + the correct key-map and correct keyboard. And then make sure you have + the correct character set and encoding, see also "PASSPHRASE CHARACTER + SET" under Section 1.2. + + If you are sure you are entering the passphrase right, there is the + possibility that the respective key-slot has been damaged. There is no + way to recover a damaged key-slot, except from a header backup (see + Section 6). For security reasons, there is also no checksum in the + key-slots that could tell you whether a key-slot has been damaged. The + only checksum present allows recognition of a correct passphrase, but + that only works with that correct passphrase and a respective key-slot + that is intact. + + In order to find out whether a key-slot is damaged one has to look for + "non-random looking" data in it. There is a tool that automates this + for LUKS1 in the cryptsetup distribution from version 1.6.0 onwards. It + is located in misc/keyslot_checker/. Instructions how to use and how to + interpret results are in the README file. Note that this tool requires + a libcryptsetup from cryptsetup 1.6.0 or later (which means + libcryptsetup.so.4.5.0 or later). If the tool complains about missing + functions in libcryptsetup, you likely have an earlier version from your + distribution still installed. You can either point the symbolic link(s) + from libcryptsetup.so.4 to the new version manually, or you can + uninstall the distribution version of cryptsetup and re-install that + from cryptsetup >= 1.6.0 again to fix this. + + + * 4.3 Can a bad RAM module cause problems? + + LUKS and dm-crypt can give the RAM quite a workout, especially when + combined with software RAID. In particular the combination RAID5 + + LUKS1 + XFS seems to uncover RAM problems that do not cause obvious + problems otherwise. Symptoms vary, but often the problem manifests + itself when copying large amounts of data, typically several times + larger than your main memory. + + Note: One thing you should always do on large data copying or movements + is to run a verify, for example with the "-d" option of "tar" or by + doing a set of MD5 checksums on the source or target with + + find . -type f -exec md5sum \{\} \; > checksum-file + + and then a "md5sum -c checksum-file" on the other side. If you get + mismatches here, RAM is the primary suspect. A lesser suspect is an + overclocked CPU. I have found countless hardware problems in verify + runs after copying data or making backups. Bit errors are much more + common than most people think. + + Some RAM issues are even worse and corrupt structures in one of the + layers. This typically results in lockups, CPU state dumps in the + system logs, kernel panic or other things. It is quite possible to have + a problem with an encrypted device, but not with an otherwise the same + unencrypted device. The reason for that is that encryption has an error + amplification property: If you flip one bit in an encrypted data block, + the decrypted version has half of its bits flipped. This is actually an + important security property for modern ciphers. With the usual modes in + cryptsetup (CBC, ESSIV, XTS), you can get a completely changed 512 byte + block for a bit error. A corrupt block causes a lot more havoc than the + occasionally flipped single bit and can result in various obscure + errors. + + Note that a verify run on copying between encrypted or unencrypted + devices will reliably detect corruption, even when the copying itself + did not report any problems. If you find defect RAM, assume all backups + and copied data to be suspect, unless you did a verify. + + + * 4.4 How do I test RAM? + + First you should know that overclocking often makes memory problems + worse. So if you overclock (which I strongly recommend against in a + system holding data that has any worth), run the tests with the + overclocking active. + + There are two good options. One is Memtest86+ and the other is + "memtester" by Charles Cazabon. Memtest86+ requires a reboot and then + takes over the machine, while memtester runs from a root-shell. Both + use different testing methods and I have found problems fast with either + one that the other needed long to find. I recommend running the + following procedure until the first error is found: + + - Run Memtest86+ for one cycle + + - Run memtester for one cycle (shut down as many other applications + as possible and use the largest memory area you can get) + + - Run Memtest86+ for 24h or more + + - Run memtester for 24h or more + + If all that does not produce error messages, your RAM may be sound, + but I have had one weak bit in the past that Memtest86+ needed around + 60 hours to find. If you can reproduce the original problem reliably, + a good additional test may be to remove half of the RAM (if you have + more than one module) and try whether the problem is still there and if + so, try with the other half. If you just have one module, get a + different one and try with that. If you do overclocking, reduce the + settings to the most conservative ones available and try with that. + + + * 4.5 Is there a risk using debugging tools like strace? + + There most definitely is. A dump from strace and friends can contain + all data entered, including the full passphrase. Example with strace + and passphrase "test": + + > strace cryptsetup luksOpen /dev/sda10 c1 + ... + read(6, "test\n", 512) = 5 + ... + + Depending on different factors and the tool used, the passphrase may + also be encoded and not plainly visible. Hence it is never a good idea + to give such a trace from a live container to anybody. Recreate the + problem with a test container or set a temporary passphrase like "test" + and use that for the trace generation. Item 2.6 explains how to create + a loop-file backed LUKS container that may come in handy for this + purpose. + + See also Item 6.10 for another set of data you should not give to + others. + + +5. Security Aspects + + + * 5.1 How long is a secure passphrase? + + This is just the short answer. For more info and explanation of some of + the terms used in this item, read the rest of Section 5. The actual + recommendation is at the end of this item. + + First, passphrase length is not really the right measure, passphrase + entropy is. If your passphrase is 200 times the letter "a", it is long + but has very low entropy and is pretty insecure. + + For example, a random lowercase letter (a-z) gives you 4.7 bit of + entropy, one element of a-z0-9 gives you 5.2 bits of entropy, an element + of a-zA-Z0-9 gives you 5.9 bits and a-zA-Z0-9!@#$%\^&:-+ gives you 6.2 + bits. On the other hand, a random English word only gives you 0.6...1.3 + bits of entropy per character. Using sentences that make sense gives + lower entropy, series of random words gives higher entropy. Do not use + sentences that can be tied to you or found on your computer. This type + of attack is done routinely today. + + That said, it does not matter too much what scheme you use, but it does + matter how much entropy your passphrase contains, because an attacker + has to try on average + + 1/2 * 2^(bits of entropy in passphrase) + + different passphrases to guess correctly. + + Historically, estimations tended to use computing time estimates, but + more modern approaches try to estimate cost of guessing a passphrase. + + As an example, I will try to get an estimate from the numbers in + https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 This + thing costs 23kUSD and does 68Ghashes/sec for SHA1. This is in 2017. + + Incidentally, my older calculation for a machine around 1000 times + slower was off by a factor of about 1000, but in the right direction, + i.e. I estimated the attack to be too easy. Nobody noticed ;-) On the + plus side, the tables are now (2017) pretty much accurate. + + More references can be found at the end of this document. Note that + these are estimates from the defender side, so assuming something is + easier than it actually is is fine. An attacker may still have + significantly higher cost than estimated here. + + LUKS1 used SHA1 (since version 1.7.0 it uses SHA256) for hashing per + default. We will leave aside the check whether a try actually decrypts + a key-slot. I will assume a useful lifetime of the hardware of 2 years. + (This is on the low side.) Disregarding downtime, the machine can then + break + + N = 68*10^9 * 3600 * 24 * 365 * 2 ~ 4*10^18 + + passphrases for EUR/USD 23k. That is one 62 bit passphrase hashed once + with SHA1 for EUR/USD 23k. This can be parallelized, it can be done + faster than 2 years with several of these machines. + + For LUKS2, things look a bit better, as the advantage of using graphics + cards is massively reduced. Using the recommendations below should + hence be fine for LUKS2 as well and give a better security margin. + + For plain dm-crypt (no hash iteration) this is it. This gives (with + SHA1, plain dm-crypt default is ripemd160 which seems to be slightly + slower than SHA1): + + Passphrase entropy Cost to break + 60 bit EUR/USD 6k + 65 bit EUR/USD 200K + 70 bit EUR/USD 6M + 75 bit EUR/USD 200M + 80 bit EUR/USD 6B + 85 bit EUR/USD 200B + ... ... + + + For LUKS1, you have to take into account hash iteration in PBKDF2. + For a current CPU, there are about 100k iterations (as can be queried + with ''cryptsetup luksDump''. + + The table above then becomes: + + Passphrase entropy Cost to break + 50 bit EUR/USD 600k + 55 bit EUR/USD 20M + 60 bit EUR/USD 600M + 65 bit EUR/USD 20B + 70 bit EUR/USD 600B + 75 bit EUR/USD 20T + ... ... + + + Recommendation: + + To get reasonable security for the next 10 years, it is a good idea + to overestimate by a factor of at least 1000. + + Then there is the question of how much the attacker is willing to spend. + That is up to your own security evaluation. For general use, I will + assume the attacker is willing to spend up to 1 million EUR/USD. Then + we get the following recommendations: + + Plain dm-crypt: Use > 80 bit. That is e.g. 17 random chars from a-z + or a random English sentence of > 135 characters length. + + LUKS1 and LUKS2: Use > 65 bit. That is e.g. 14 random chars from a-z + or a random English sentence of > 108 characters length. + + If paranoid, add at least 20 bit. That is roughly four additional + characters for random passphrases and roughly 32 characters for a + random English sentence. + + + * 5.2 Is LUKS insecure? Everybody can see I have encrypted data! + + In practice it does not really matter. In most civilized countries you + can just refuse to hand over the keys, no harm done. In some countries + they can force you to hand over the keys if they suspect encryption. + The suspicion is enough, they do not have to prove anything. This is + for practical reasons, as even the presence of a header (like the LUKS + header) is not enough to prove that you have any keys. It might have + been an experiment, for example. Or it was used as encrypted swap with + a key from /dev/random. So they make you prove you do not have + encrypted data. Of course, if true, that is impossible and hence the + whole idea is not compatible with fair laws. Note that in this context, + countries like the US or the UK are not civilized and do not have fair + laws. + + This means that if you have a large set of random-looking data, they can + already lock you up. Hidden containers (encryption hidden within + encryption), as possible with Truecrypt, do not help either. They will + just assume the hidden container is there and unless you hand over the + key, you will stay locked up. Don't have a hidden container? Tough + luck. Anybody could claim that. + + Still, if you are concerned about the LUKS header, use plain dm-crypt + with a good passphrase. See also Section 2, "What is the difference + between "plain" and LUKS format?" + + + * 5.3 Should I initialize (overwrite) a new LUKS/dm-crypt partition? + + If you just create a filesystem on it, most of the old data will still + be there. If the old data is sensitive, you should overwrite it before + encrypting. In any case, not initializing will leave the old data there + until the specific sector gets written. That may enable an attacker to + determine how much and where on the partition data was written. If you + think this is a risk, you can prevent this by overwriting the encrypted + device (here assumed to be named "e1") with zeros like this: + + dd_rescue -w /dev/zero /dev/mapper/e1 + + or alternatively with one of the following more standard commands: + + cat /dev/zero > /dev/mapper/e1 + dd if=/dev/zero of=/dev/mapper/e1 + + + + * 5.4 How do I securely erase a LUKS container? + + For LUKS, if you are in a desperate hurry, overwrite the LUKS header and + key-slot area. For LUKS1 and LUKS2, just be generous and overwrite the + first 100MB. A single overwrite with zeros should be enough. If you + anticipate being in a desperate hurry, prepare the command beforehand. + Example with /dev/sde1 as the LUKS partition and default parameters: + + head -c 100000000 /dev/zero > /dev/sde1; sync + + A LUKS header backup or full backup will still grant access to most or + all data, so make sure that an attacker does not have access to backups + or destroy them as well. + + Also note that SSDs and also some HDDs (SMR and hybrid HDDs, for + example) may not actually overwrite the header and only do that an + unspecified and possibly very long time later. The only way to be sure + there is physical destruction. If the situation permits, do both + overwrite and physical destruction. + + If you have time, overwrite the whole drive with a single pass of random + data. This is enough for most HDDs. For SSDs or FLASH (USB sticks) or + SMR or hybrid drives, you may want to overwrite the whole drive several + times to be sure data is not retained. This is possibly still insecure + as the respective technologies are not fully understood in this regard. + Still, due to the anti-forensic properties of the LUKS key-slots, a + single overwrite could be enough. If in doubt, use physical destruction + in addition. Here is a link to some current research results on erasing + SSDs and FLASH drives: + https://www.usenix.org/events/fast11/tech/full_papers/Wei.pdf + + Keep in mind to also erase all backups. + + Example for a random-overwrite erase of partition sde1 done with + dd_rescue: + + dd_rescue -w /dev/urandom /dev/sde1 + + + + * 5.5 How do I securely erase a backup of a LUKS partition or header? + + That depends on the medium it is stored on. For HDD and SSD, use + overwrite with random data. For an SSD, FLASH drive (USB stick) hybrid + HDD or SMR HDD, you may want to overwrite the complete drive several + times and use physical destruction in addition, see last item. For + re-writable CD/DVD, a single overwrite should be enough, due to the + anti-forensic properties of the LUKS keyslots. For write-once media, + use physical destruction. For low security requirements, just cut the + CD/DVD into several parts. For high security needs, shred or burn the + medium. + + If your backup is on magnetic tape, I advise physical destruction by + shredding or burning, after (!) overwriting. The problem with magnetic + tape is that it has a higher dynamic range than HDDs and older data may + well be recoverable after overwrites. Also write-head alignment issues + can lead to data not actually being deleted during overwrites. + + The best option is to actually encrypt the backup, for example with + PGP/GnuPG and then just destroy all copies of the encryption key if + needed. Best keep them on paper, as that has excellent durability and + secure destruction is easy, for example by burning and then crushing the + ashes to a fine powder. A blender and water also works nicely. + + + * 5.6 What about backup? Does it compromise security? + + That depends. See item 6.7. + + + * 5.7 Why is all my data permanently gone if I overwrite the LUKS header? + + Overwriting the LUKS header in part or in full is the most common reason + why access to LUKS containers is lost permanently. Overwriting can be + done in a number of fashions, like creating a new filesystem on the raw + LUKS partition, making the raw partition part of a RAID array and just + writing to the raw partition. + + The LUKS1 header contains a 256 bit "salt" per key-slot and without that + no decryption is possible. While the salts are not secret, they are + key-grade material and cannot be reconstructed. This is a + cryptographically strong "cannot". From observations on the cryptsetup + mailing-list, people typically go though the usual stages of grief + (Denial, Anger, Bargaining, Depression, Acceptance) when this happens to + them. Observed times vary between 1 day and 2 weeks to complete the + cycle. Seeking help on the mailing-list is fine. Even if we usually + cannot help with getting back your data, most people found the feedback + comforting. + + If your header does not contain an intact key-slot salt, best go + directly to the last stage ("Acceptance") and think about what to do + now. There is one exception that I know of: If your LUKS1 container is + still open, then it may be possible to extract the master key from the + running system. See Item "How do I recover the master key from a mapped + LUKS1 container?" in Section "Backup and Data Recovery". + + For LUKS2, things are both better and worse. First, the salts are in a + less vulnerable position now. But, on the other hand, the keys of a + mapped (open) container are now stored in the kernel key-store, and + while there probably is some way to get them out of there, I am not sure + how much effort that needs. + + + * 5.8 What is a "salt"? + + A salt is a random key-grade value added to the passphrase before it is + processed. It is not kept secret. The reason for using salts is as + follows: If an attacker wants to crack the password for a single LUKS + container, then every possible passphrase has to be tried. Typically an + attacker will not try every binary value, but will try words and + sentences from a dictionary. + + If an attacker wants to attack several LUKS containers with the same + dictionary, then a different approach makes sense: Compute the resulting + slot-key for each dictionary element and store it on disk. Then the + test for each entry is just the slow unlocking with the slot key (say + 0.00001 sec) instead of calculating the slot-key first (1 sec). For a + single attack, this does not help. But if you have more than one + container to attack, this helps tremendously, also because you can + prepare your table before you even have the container to attack! The + calculation is also very simple to parallelize. You could, for example, + use the night-time unused CPU power of your desktop PCs for this. + + This is where the salt comes in. If the salt is combined with the + passphrase (in the simplest form, just appended to it), you suddenly + need a separate table for each salt value. With a reasonably-sized salt + value (256 bit, e.g.) this is quite infeasible. + + + * 5.9 Is LUKS secure with a low-entropy (bad) passphrase? + + Short answer: yes. Do not use a low-entropy passphrase. + + Note: For LUKS2, protection for bad passphrases is a bit better + due to the use of Argon2, but that is only a gradual improvement. + + Longer answer: + This needs a bit of theory. The quality of your passphrase is directly + related to its entropy (information theoretic, not thermodynamic). The + entropy says how many bits of "uncertainty" or "randomness" are in you + passphrase. In other words, that is how difficult guessing the + passphrase is. + + Example: A random English sentence has about 1 bit of entropy per + character. A random lowercase (or uppercase) character has about 4.7 + bit of entropy. + + Now, if n is the number of bits of entropy in your passphrase and t + is the time it takes to process a passphrase in order to open the + LUKS container, then an attacker has to spend at maximum + + attack_time_max = 2^n * t + + time for a successful attack and on average half that. There is no way + getting around that relationship. However, there is one thing that does + help, namely increasing t, the time it takes to use a passphrase, see + next FAQ item. + + Still, if you want good security, a high-entropy passphrase is the only + option. For example, a low-entropy passphrase can never be considered + secure against a TLA-level (Three Letter Agency level, i.e. + government-level) attacker, no matter what tricks are used in the + key-derivation function. Use at least 64 bits for secret stuff. That + is 64 characters of English text (but only if randomly chosen) or a + combination of 12 truly random letters and digits. + + For passphrase generation, do not use lines from very well-known texts + (religious texts, Harry Potter, etc.) as they are too easy to guess. + For example, the total Harry Potter has about 1'500'000 words (my + estimation). Trying every 64 character sequence starting and ending at + a word boundary would take only something like 20 days on a single CPU + and is entirely feasible. To put that into perspective, using a number + of Amazon EC2 High-CPU Extra Large instances (each gives about 8 real + cores), this test costs currently about 50USD/EUR, but can be made to + run arbitrarily fast. + + On the other hand, choosing 1.5 lines from, say, the Wheel of Time, is + in itself not more secure, but the book selection adds quite a bit of + entropy. (Now that I have mentioned it here, don't use tWoT either!) If + you add 2 or 3 typos and switch some words around, then this is good + passphrase material. + + + * 5.10 What is "iteration count" and why is decreasing it a bad idea? + + LUKS1: + Iteration count is the number of PBKDF2 iterations a passphrase is put + through before it is used to unlock a key-slot. Iterations are done + with the explicit purpose to increase the time that it takes to unlock a + key-slot. This provides some protection against use of low-entropy + passphrases. + + The idea is that an attacker has to try all possible passphrases. Even + if the attacker knows the passphrase is low-entropy (see last item), it + is possible to make each individual try take longer. The way to do this + is to repeatedly hash the passphrase for a certain time. The attacker + then has to spend the same time (given the same computing power) as the + user per try. With LUKS1, the default is 1 second of PBKDF2 hashing. + + Example 1: Lets assume we have a really bad passphrase (e.g. a + girlfriends name) with 10 bits of entropy. With the same CPU, an + attacker would need to spend around 500 seconds on average to break that + passphrase. Without iteration, it would be more like 0.0001 seconds on + a modern CPU. + + Example 2: The user did a bit better and has 32 chars of English text. + That would be about 32 bits of entropy. With 1 second iteration, that + means an attacker on the same CPU needs around 136 years. That is + pretty impressive for such a weak passphrase. Without the iterations, + it would be more like 50 days on a modern CPU, and possibly far less. + + In addition, the attacker can both parallelize and use special hardware + like GPUs or FPGAs to speed up the attack. The attack can also happen + quite some time after the luksFormat operation and CPUs can have become + faster and cheaper. For that reason you want a bit of extra security. + Anyways, in Example 1 your are screwed. In example 2, not necessarily. + Even if the attack is faster, it still has a certain cost associated + with it, say 10000 EUR/USD with iteration and 1 EUR/USD without + iteration. The first can be prohibitively expensive, while the second + is something you try even without solid proof that the decryption will + yield something useful. + + The numbers above are mostly made up, but show the idea. Of course the + best thing is to have a high-entropy passphrase. + + Would a 100 sec iteration time be even better? Yes and no. + Cryptographically it would be a lot better, namely 100 times better. + However, usability is a very important factor for security technology + and one that gets overlooked surprisingly often. For LUKS, if you have + to wait 2 minutes to unlock the LUKS container, most people will not + bother and use less secure storage instead. It is better to have less + protection against low-entropy passphrases and people actually use LUKS, + than having them do without encryption altogether. + + Now, what about decreasing the iteration time? This is generally a very + bad idea, unless you know and can enforce that the users only use + high-entropy passphrases. If you decrease the iteration time without + ensuring that, then you put your users at increased risk, and + considering how rarely LUKS containers are unlocked in a typical + work-flow, you do so without a good reason. Don't do it. The iteration + time is already low enough that users with low entropy passphrases are + vulnerable. Lowering it even further increases this danger + significantly. + + LUKS2: Pretty much the same reasoning applies. The advantages of using + GPUs or FPGAs in an attack have been significantly reduced, but that + is the only main difference. + + + * 5.11 Some people say PBKDF2 is insecure? + + There is some discussion that a hash-function should have a "large + memory" property, i.e. that it should require a lot of memory to be + computed. This serves to prevent attacks using special programmable + circuits, like FPGAs, and attacks using graphics cards. PBKDF2 does not + need a lot of memory and is vulnerable to these attacks. However, the + publication usually referred in these discussions is not very convincing + in proving that the presented hash really is "large memory" (that may + change, email the FAQ maintainer when it does) and it is of limited + usefulness anyways. Attackers that use clusters of normal PCs will not + be affected at all by a "large memory" property. For example the US + Secret Service is known to use the off-hour time of all the office PCs + of the Treasury for password breaking. The Treasury has about 110'000 + employees. Assuming every one has an office PC, that is significant + computing power, all of it with plenty of memory for computing "large + memory" hashes. Bot-net operators also have all the memory they want. + The only protection against a resourceful attacker is a high-entropy + passphrase, see items 5.9 and 5.10. + + That said, LUKS2 defaults to Argon2, which has a large-memory property + and massively reduces the advantages of GPUs and FPGAs. + + + * 5.12 What about iteration count with plain dm-crypt? + + Simple: There is none. There is also no salting. If you use plain + dm-crypt, the only way to be secure is to use a high entropy passphrase. + If in doubt, use LUKS instead. + + + * 5.13 Is LUKS with default parameters less secure on a slow CPU? + + Unfortunately, yes. However the only aspect affected is the protection + for low-entropy passphrase or master-key. All other security aspects + are independent of CPU speed. + + The master key is less critical, as you really have to work at it to + give it low entropy. One possibility to mess this up is to supply the + master key yourself. If that key is low-entropy, then you get what you + deserve. The other known possibility to create a LUKS container with a + bad master key is to use /dev/urandom for key generation in an + entropy-starved situation (e.g. automatic installation on an embedded + device without network and other entropy sources or installation in a VM + under certain circumstances). + + For the passphrase, don't use a low-entropy passphrase. If your + passphrase is good, then a slow CPU will not matter. If you insist on a + low-entropy passphrase on a slow CPU, use something like + "--iter-time=10000" or higher and wait a long time on each LUKS unlock + and pray that the attacker does not find out in which way exactly your + passphrase is low entropy. This also applies to low-entropy passphrases + on fast CPUs. Technology can do only so much to compensate for problems + in front of the keyboard. + + Also note that power-saving modes will make your CPU slower. This will + reduce iteration count on LUKS container creation. It will keep unlock + times at the expected values though at this CPU speed. + + + * 5.14 Why was the default aes-cbc-plain replaced with aes-cbc-essiv? + + Note: This item applies both to plain dm-crypt and to LUKS + + The problem is that cbc-plain has a fingerprint vulnerability, where a + specially crafted file placed into the crypto-container can be + recognized from the outside. The issue here is that for cbc-plain the + initialization vector (IV) is the sector number. The IV gets XORed to + the first data chunk of the sector to be encrypted. If you make sure + that the first data block to be stored in a sector contains the sector + number as well, the first data block to be encrypted is all zeros and + always encrypted to the same ciphertext. This also works if the first + data chunk just has a constant XOR with the sector number. By having + several shifted patterns you can take care of the case of a + non-power-of-two start sector number of the file. + + This mechanism allows you to create a pattern of sectors that have the + same first ciphertext block and signal one bit per sector to the + outside, allowing you to e.g. mark media files that way for recognition + without decryption. For large files this is a practical attack. For + small ones, you do not have enough blocks to signal and take care of + different file starting offsets. + + In order to prevent this attack, the default was changed to cbc-essiv. + ESSIV uses a keyed hash of the sector number, with the encryption key as + key. This makes the IV unpredictable without knowing the encryption key + and the watermarking attack fails. + + + * 5.15 Are there any problems with "plain" IV? What is "plain64"? + + First, "plain" and "plain64" are both not secure to use with CBC, see + previous FAQ item. + + However there are modes, like XTS, that are secure with "plain" IV. The + next limit is that "plain" is 64 bit, with the upper 32 bit set to zero. + This means that on volumes larger than 2TiB, the IV repeats, creating a + vulnerability that potentially leaks some data. To avoid this, use + "plain64", which uses the full sector number up to 64 bit. Note that + "plain64" requires a kernel 2.6.33 or more recent. Also note that + "plain64" is backwards compatible for volume sizes of maximum size 2TiB, + but not for those > 2TiB. Finally, "plain64" does not cause any + performance penalty compared to "plain". + + + * 5.16 What about XTS mode? + + XTS mode is potentially even more secure than cbc-essiv (but only if + cbc-essiv is insecure in your scenario). It is a NIST standard and + used, e.g. in Truecrypt. From version 1.6.0 of cryptsetup onwards, + aes-xts-plain64 is the default for LUKS. If you want to use it with a + cryptsetup before version 1.6.0 or with plain dm-crypt, you have to + specify it manually as "aes-xts-plain", i.e. + + cryptsetup -c aes-xts-plain luksFormat + + For volumes >2TiB and kernels >= 2.6.33 use "plain64" (see FAQ item + on "plain" and "plain64"): + + cryptsetup -c aes-xts-plain64 luksFormat + + There is a potential security issue with XTS mode and blocks larger + than 2^20 bytes or so. LUKS and dm-crypt always use smaller blocks + and the issue does not apply. + + + * 5.17 Is LUKS FIPS-140-2 certified? + + No. But that is more a problem of FIPS-140-2 than of LUKS. From a + technical point-of-view, LUKS with the right parameters would be + FIPS-140-2 compliant, but in order to make it certified, somebody has to + pay real money for that. And then, whenever cryptsetup is changed or + extended, the certification lapses and has to be obtained again. + + From the aspect of actual security, LUKS with default parameters should + be as good as most things that are FIPS-140-2 certified, although you + may want to make sure to use /dev/random (by specifying --use-random on + luksFormat) as randomness source for the master key to avoid being + potentially insecure in an entropy-starved situation. + + + * 5.18 What about Plausible Deniability? + + First let me attempt a definition for the case of encrypted filesystems: + Plausible deniability is when you store data inside an encrypted + container and it is not possible to prove it is there without having a + special passphrase. And at the same time it must be "plausible" that + there actually is no hidden data there. + + As a simple entropy-analysis will show that here may be data there, the + second part is what makes it tricky. + + There seem to be a lot of misunderstandings about this idea, so let me + make it clear that this refers to the situation where the attackers can + prove that there is data that either may be random or may be part of a + plausible-deniability scheme, they just cannot prove which one it is. + Hence a plausible-deniability scheme must hold up when the attackers + know there is something potentially fishy. If you just hide data and + rely on it not being found, that is just simple deniability, not + "plausible" deniability and I am not talking about that in the + following. Simple deniability against a low-competence attacker may be + as simple as renaming a file or putting data into an unused part of a + disk. Simple deniability against a high-skill attacker with time to + invest is usually pointless unless you go for advanced steganographic + techniques, which have their own drawbacks, such as low data capacity. + + Now, the idea of plausible deniability is compelling and on a first + glance it seems possible to do it. And from a cryptographic point of + view, it actually is possible. + + So, does the idea work in practice? No, unfortunately. The reasoning + used by its proponents is fundamentally flawed in several ways and the + cryptographic properties fail fatally when colliding with the real + world. + + First, why should "I do not have a hidden partition" be any more + plausible than "I forgot my crypto key" or "I wiped that partition with + random data, nothing in there"? I do not see any reason. + + Second, there are two types of situations: Either they cannot force you + to give them the key (then you simply do not) or they can. In the + second case, they can always do bad things to you, because they cannot + prove that you have the key in the first place! This means they do not + have to prove you have the key, or that this random looking data on your + disk is actually encrypted data. So the situation will allow them to + waterboard/lock-up/deport you anyways, regardless of how "plausible" + your deniability is. Do not have a hidden partition you could show to + them, but there are indications you may? Too bad for you. + Unfortunately "plausible deniability" also means you cannot prove there + is no hidden data. + + Third, hidden partitions are not that hidden. There are basically just + two possibilities: a) Make a large crypto container, but put a smaller + filesystem in there and put the hidden partition into the free space. + Unfortunately this is glaringly obvious and can be detected in an + automated fashion. This means that the initial suspicion to put you + under duress in order to make you reveal your hidden data is given. b) + Make a filesystem that spans the whole encrypted partition, and put the + hidden partition into space not currently used by that filesystem. + Unfortunately that is also glaringly obvious, as you then cannot write + to the filesystem without a high risk of destroying data in the hidden + container. Have not written anything to the encrypted filesystem in a + while? Too bad, they have the suspicion they need to do unpleasant + things to you. + + To be fair, if you prepare option b) carefully and directly before going + into danger, it may work. But then, the mere presence of encrypted data + may already be enough to get you into trouble in those places were they + can demand encryption keys. + + Here is an additional reference for some problems with plausible + deniability: + https://www.schneier.com/academic/paperfiles/paper-truecrypt-dfs.pdf + I strongly suggest you read it. + + So, no, I will not provide any instructions on how to do it with plain + dm-crypt or LUKS. If you insist on shooting yourself in the foot, you + can figure out how to do it yourself. + + + * 5.19 What about SSDs, Flash, Hybrid and SMR Drives? + + The problem is that you cannot reliably erase parts of these devices, + mainly due to wear-leveling and possibly defect management and delayed + writes to the main data area. + + For example for SSDs, when overwriting a sector, what the device does is + to move an internal sector (may be 128kB or even larger) to some pool of + discarded, not-yet erased unused sectors, take a fresh empty sector from + the empty-sector pool and copy the old sector over with the changes to + the small part you wrote. This is done in some fashion so that larger + writes do not cause a lot of small internal updates. + + The thing is that the mappings between outside-addressable sectors and + inside sectors is arbitrary (and the vendors are not talking). Also the + discarded sectors are not necessarily erased immediately. They may + linger a long time. + + For plain dm-crypt, the consequences are that older encrypted data may + be lying around in some internal pools of the device. Thus may or may + not be a problem and depends on the application. Remember the same can + happen with a filesystem if consecutive writes to the same area of a + file can go to different sectors. + + However, for LUKS, the worst case is that key-slots and LUKS header may + end up in these internal pools. This means that password management + functionality is compromised (the old passwords may still be around, + potentially for a very long time) and that fast erase by overwriting the + header and key-slot area is insecure. + + Also keep in mind that the discarded/used pool may be large. For + example, a 240GB SSD has about 16GB of spare area in the chips that it + is free to do with as it likes. You would need to make each individual + key-slot larger than that to allow reliable overwriting. And that + assumes the disk thinks all other space is in use. Reading the internal + pools using forensic tools is not that hard, but may involve some + soldering. + + What to do? + + If you trust the device vendor (you probably should not...) you can try + an ATA "secure erase" command. That is not present in USB keys though + and may or may not be secure for a hybrid drive. + + If you can do without password management and are fine with doing + physical destruction for permanently deleting data (always after one or + several full overwrites!), you can use plain dm-crypt. + + If you want or need all the original LUKS security features to work, you + can use a detached LUKS header and put that on a conventional, magnetic + disk. That leaves potentially old encrypted data in the pools on the + main disk, but otherwise you get LUKS with the same security as on a + traditional magnetic disk. Note however that storage vendors are prone + to lying to their customers. For example, it recently came out that + HDDs sold without any warning or mentioning in the data-sheets were + actually using SMR and that will write data first to a faster area and + only overwrite the original data area some time later when things are + quiet. + + If you are concerned about your laptop being stolen, you are likely fine + using LUKS on an SSD or hybrid drive. An attacker would need to have + access to an old passphrase (and the key-slot for this old passphrase + would actually need to still be somewhere in the SSD) for your data to + be at risk. So unless you pasted your old passphrase all over the + Internet or the attacker has knowledge of it from some other source and + does a targeted laptop theft to get at your data, you should be fine. + + + * 5.20 LUKS1 is broken! It uses SHA-1! + + No, it is not. SHA-1 is (academically) broken for finding collisions, + but not for using it in a key-derivation function. And that collision + vulnerability is for non-iterated use only. And you need the hash-value + in verbatim. + + This basically means that if you already have a slot-key, and you have + set the PBKDF2 iteration count to 1 (it is > 10'000 normally), you could + (maybe) derive a different passphrase that gives you the the same + slot-key. But if you have the slot-key, you can already unlock the + key-slot and get the master key, breaking everything. So basically, + this SHA-1 vulnerability allows you to open a LUKS1 container with high + effort when you already have it open. + + The real problem here is people that do not understand crypto and claim + things are broken just because some mechanism is used that has been + broken for a specific different use. The way the mechanism is used + matters very much. A hash that is broken for one use can be completely + secure for other uses and here it is. + + Since version 1.7.0, cryptsetup uses SHA-256 as default to ensure that + it will be compatible in the future. There are already some systems + where SHA-1 is completely phased out or disabled by a security policy. + + + * 5.21 Why is there no "Nuke-Option"? + + A "Nuke-Option" or "Kill-switch" is a password that when entered upon + unlocking instead wipes the header and all passwords. So when somebody + forces you to enter your password, you can destroy the data instead. + + While this sounds attractive at first glance, it does not make sense + once a real security analysis is done. One problem is that you have to + have some kind of HSM (Hardware Security Module) in order to implement + it securely. In the movies, a HSM starts to smoke and melt once the + Nuke-Option has been activated. In actual reality, it just wipes some + battery-backed RAM cells. A proper HSM costs something like + 20'000...100'000 EUR/USD and there a Nuke-Option may make some sense. + BTW, a chipcard or a TPM is not a HSM, although some vendors are + promoting that myth. + + Now, a proper HSMs will have a wipe option but not a Nuke-Option, i.e. + you can explicitly wipe the HSM, but by a different process than + unlocking it takes. Why is that? Simple: If somebody can force you to + reveal passwords, then they can also do bad things to you if you do not + or if you enter a nuke password instead. Think locking you up for a few + years for "destroying evidence" or for far longer and without trial for + being a "terrorist suspect". No HSM maker will want to expose its + customers to that risk. + + Now think of the typical LUKS application scenario, i.e. disk + encryption. Usually the ones forcing you to hand over your password + will have access to the disk as well, and, if they have any real + suspicion, they will mirror your disk before entering anything supplied + by you. This neatly negates any Nuke-Option. If they have no suspicion + (just harassing people that cross some border for example), the + Nuke-Option would work, but see above about likely negative consequences + and remember that a Nuke-Option may not work reliably on SSD and hybrid + drives anyways. + + Hence my advice is to never take data that you do not want to reveal + into any such situation in the first place. There is no need to + transfer data on physical carriers today. The Internet makes it quite + possible to transfer data between arbitrary places and modern encryption + makes it secure. If you do it right, nobody will even be able to + identify source or destination. (How to do that is out of scope of this + document. It does require advanced skills in this age of pervasive + surveillance.) + + Hence, LUKS has no kill option because it would do much more harm than + good. + + Still, if you have a good use-case (i.e. non-abstract real-world + situation) where a Nuke-Option would actually be beneficial, please let + me know. + + + * 5.22 Does cryptsetup open network connections to websites, etc. ? + + This question seems not to make much sense at first glance, but here is + an example form the real world: The TrueCrypt GUI has a "Donation" + button. Press it, and a web-connection to the TrueCrypt website is + opened via the default browser, telling everybody that listens that you + use TrueCrypt. In the worst case, things like this can get people + tortured or killed. + + So: Cryptsetup will never open any network connections except the + local netlink socket it needs to talk to the kernel crypto API. + + In addition, the installation package should contain all documentation, + including this FAQ, so that you do not have to go to a web-site to read + it. (If your distro cuts the docu, please complain to them.) In + security software, any connection initiated to anywhere outside your + machine should always be the result of an explicit request for such a + connection by the user and cryptsetup will stay true to that principle. + + +6. Backup and Data Recovery + + + * 6.1 Why do I need Backup? + + First, disks die. The rate for well-treated (!) disk is about 5% per + year, which is high enough to worry about. There is some indication + that this may be even worse for some SSDs. This applies both to LUKS + and plain dm-crypt partitions. + + Second, for LUKS, if anything damages the LUKS header or the key-stripe + area then decrypting the LUKS device can become impossible. This is a + frequent occurrence. For example an accidental format as FAT or some + software overwriting the first sector where it suspects a partition boot + sector typically makes a LUKS1 partition permanently inaccessible. See + more below on LUKS header damage. + + So, data-backup in some form is non-optional. For LUKS, you may also + want to store a header backup in some secure location. This only needs + an update if you change passphrases. + + + * 6.2 How do I backup a LUKS header? + + While you could just copy the appropriate number of bytes from the start + of the LUKS partition, the best way is to use command option + "luksHeaderBackup" of cryptsetup. This protects also against errors + when non-standard parameters have been used in LUKS partition creation. + Example: + + cryptsetup luksHeaderBackup --header-backup-file + + To restore, use the inverse command, i.e. + + cryptsetup luksHeaderRestore --header-backup-file + + If you are unsure about a header to be restored, make a backup of the + current one first! You can also test the header-file without restoring + it by using the --header option for a detached header like this: + + cryptsetup --header luksOpen + + If that unlocks your key-slot, you are good. Do not forget to close + the device again. + + Under some circumstances (damaged header), this fails. Then use the + following steps in case it is LUKS1: + + First determine the master-key size: + + cryptsetup luksDump + + gives a line of the form + + MK bits: + + with bits equal to 256 for the old defaults and 512 for the new + defaults. 256 bits equals a total header size of 1'052'672 Bytes and + 512 bits one of 2MiB. (See also Item 6.12) If luksDump fails, assume + 2MiB, but be aware that if you restore that, you may also restore the + first 1M or so of the filesystem. Do not change the filesystem if you + were unable to determine the header size! With that, restoring a + too-large header backup is still safe. + + Second, dump the header to file. There are many ways to do it, I + prefer the following: + + head -c 1052672 > header_backup.dmp + + or + + head -c 2M > header_backup.dmp + + for a 2MiB header. Verify the size of the dump-file to be sure. + + To restore such a backup, you can try luksHeaderRestore or do a more + basic + + cat header_backup.dmp > + + + + * 6.3 How do I test for a LUKS header? + + Use + + cryptsetup -v isLuks + + on the device. Without the "-v" it just signals its result via + exit-status. You can also use the more general test + + blkid -p + + which will also detect other types and give some more info. Omit + "-p" for old versions of blkid that do not support it. + + + * 6.4 How do I backup a LUKS or dm-crypt partition? + + There are two options, a sector-image and a plain file or filesystem + backup of the contents of the partition. The sector image is already + encrypted, but cannot be compressed and contains all empty space. The + filesystem backup can be compressed, can contain only part of the + encrypted device, but needs to be encrypted separately if so desired. + + A sector-image will contain the whole partition in encrypted form, for + LUKS the LUKS header, the keys-slots and the data area. It can be done + under Linux e.g. with dd_rescue (for a direct image copy) and with + "cat" or "dd". Examples: + + cat /dev/sda10 > sda10.img + dd_rescue /dev/sda10 sda10.img + + You can also use any other backup software that is capable of making a + sector image of a partition. Note that compression is ineffective for + encrypted data, hence it does not make sense to use it. + + For a filesystem backup, you decrypt and mount the encrypted partition + and back it up as you would a normal filesystem. In this case the + backup is not encrypted, unless your encryption method does that. For + example you can encrypt a backup with "tar" as follows with GnuPG: + + tar cjf - | gpg --cipher-algo AES -c - > backup.tbz2.gpg + + And verify the backup like this if you are at "path": + + cat backup.tbz2.gpg | gpg - | tar djf - + + Note: Always verify backups, especially encrypted ones! + + There is one problem with verifying like this: The kernel may still have + some files cached and in fact verify them against RAM or may even verify + RAM against RAM, which defeats the purpose of the exercise. The + following command empties the kernel caches: + + echo 3 > /proc/sys/vm/drop_caches + + Run it after backup and before verify. + + In both cases GnuPG will ask you interactively for your symmetric key. + The verify will only output errors. Use "tar dvjf -" to get all + comparison results. To make sure no data is written to disk + unencrypted, turn off swap if it is not encrypted before doing the + backup. + + Restore works like certification with the 'd' ('difference') replaced + by 'x' ('eXtract'). Refer to the man-page of tar for more explanations + and instructions. Note that with default options tar will overwrite + already existing files without warning. If you are unsure about how + to use tar, experiment with it in a location where you cannot do damage. + + You can of course use different or no compression and you can use an + asymmetric key if you have one and have a backup of the secret key that + belongs to it. + + A second option for a filesystem-level backup that can be used when the + backup is also on local disk (e.g. an external USB drive) is to use a + LUKS container there and copy the files to be backed up between both + mounted containers. Also see next item. + + + * 6.5 Do I need a backup of the full partition? Would the header + and key-slots not be enough? + + Backup protects you against two things: Disk loss or corruption and user + error. By far the most questions on the dm-crypt mailing list about how + to recover a damaged LUKS partition are related to user error. For + example, if you create a new filesystem on a non-mapped LUKS container, + chances are good that all data is lost permanently. + + For this case, a header+key-slot backup would often be enough. But keep + in mind that a well-treated (!) HDD has roughly a failure risk of 5% per + year. It is highly advisable to have a complete backup to protect + against this case. + + + * 6.6 What do I need to backup if I use "decrypt_derived"? + + This is a script in Debian, intended for mounting /tmp or swap with a + key derived from the master key of an already decrypted device. If you + use this for an device with data that should be persistent, you need to + make sure you either do not lose access to that master key or have a + backup of the data. If you derive from a LUKS device, a header backup + of that device would cover backing up the master key. Keep in mind that + this does not protect against disk loss. + + Note: If you recreate the LUKS header of the device you derive from + (using luksFormat), the master key changes even if you use the same + passphrase(s) and you will not be able to decrypt the derived device + with the new LUKS header. + + + * 6.7 Does a backup compromise security? + + Depends on how you do it. However if you do not have one, you are going + to eventually lose your encrypted data. + + There are risks introduced by backups. For example if you + change/disable a key-slot in LUKS, a binary backup of the partition will + still have the old key-slot. To deal with this, you have to be able to + change the key-slot on the backup as well, securely erase the backup or + do a filesystem-level backup instead of a binary one. + + If you use dm-crypt, backup is simpler: As there is no key management, + the main risk is that you cannot wipe the backup when wiping the + original. However wiping the original for dm-crypt should consist of + forgetting the passphrase and that you can do without actual access to + the backup. + + In both cases, there is an additional (usually small) risk with binary + backups: An attacker can see how many sectors and which ones have been + changed since the backup. To prevent this, use a filesystem level + backup method that encrypts the whole backup in one go, e.g. as + described above with tar and GnuPG. + + My personal advice is to use one USB disk (low value data) or three + disks (high value data) in rotating order for backups, and either use + independent LUKS partitions on them, or use encrypted backup with tar + and GnuPG. + + If you do network-backup or tape-backup, I strongly recommend to go + the filesystem backup path with independent encryption, as you + typically cannot reliably delete data in these scenarios, especially + in a cloud setting. (Well, you can burn the tape if it is under your + control...) + + + * 6.8 What happens if I overwrite the start of a LUKS partition or + damage the LUKS header or key-slots? + + There are two critical components for decryption: The salt values in the + key-slot descriptors of the header and the key-slots. For LUKS2 they + are a bit better protected. but for LUKS1, these are right in the first + sector. If the salt values are overwritten or changed, nothing (in the + cryptographically strong sense) can be done to access the data, unless + there is a backup of the LUKS header. If a key-slot is damaged, the + data can still be read with a different key-slot, if there is a + remaining undamaged and used key-slot. Note that in order to make a + key-slot completely unrecoverable, changing about 4-6 bits in random + locations of its 128kiB size is quite enough. + + + * 6.9 What happens if I (quick) format a LUKS partition? + + I have not tried the different ways to do this, but very likely you will + have written a new boot-sector, which in turn overwrites the LUKS + header, including the salts, making your data permanently irretrievable, + unless you have a LUKS header backup. For LUKS2 this may still be + recoverable without that header backup, for LUKS1 it is not. You may + also damage the key-slots in part or in full. See also last item. + + + * 6.10 How do I recover the master key from a mapped LUKS1 container? + + Note: LUKS2 uses the kernel keyring to store keys and hence this + procedure does not work unless you have explicitly disabled the use of + the keyring with "--disable-keyring" on opening. + + This is typically only needed if you managed to damage your LUKS1 + header, but the container is still mapped, i.e. "luksOpen"ed. It also + helps if you have a mapped container that you forgot or do not know a + passphrase for (e.g. on a long running server.) + + WARNING: Things go wrong, do a full backup before trying this! + + WARNING: This exposes the master key of the LUKS1 container. Note that + both ways to recreate a LUKS header with the old master key described + below will write the master key to disk. Unless you are sure you have + securely erased it afterwards, e.g. by writing it to an encrypted + partition, RAM disk or by erasing the filesystem you wrote it to by a + complete overwrite, you should change the master key afterwards. + Changing the master key requires a full data backup, luksFormat and then + restore of the backup. Alternatively the tool cryptsetup-reencrypt from + the cryptsetup package can be used to change the master key (see its + man-page), but a full backup is still highly recommended. + + First, there is a script by Milan that automates the whole process, + except generating a new LUKS1 header with the old master key (it prints + the command for that though): + + https://gitlab.com/cryptsetup/cryptsetup/blob/master/misc/luks-header-from-active + + You can also do this manually. Here is how: + + - Get the master key from the device mapper. This is done by the + following command. Substitute c5 for whatever you mapped to: + + # dmsetup table --target crypt --showkey /dev/mapper/c5 + + Result: + 0 200704 crypt aes-cbc-essiv:sha256 + a1704d9715f73a1bb4db581dcacadaf405e700d591e93e2eaade13ba653d0d09 + 0 7:0 4096 + + The result is actually one line, wrapped here for clarity. The long + hex string is the master key. + + - Convert the master key to a binary file representation. You can do + this manually, e.g. with hexedit. You can also use the tool "xxd" + from vim like this: + + echo "a1704d9....53d0d09" | xxd -r -p > + + + - Do a luksFormat to create a new LUKS1 header. + + NOTE: If your header is intact and you just forgot the passphrase, + you can just set a new passphrase, see next sub-item. + + Unmap the device before you do that (luksClose). Then do + + cryptsetup luksFormat --master-key-file= + + Note that if the container was created with other than the default + settings of the cryptsetup version you are using, you need to give + additional parameters specifying the deviations. If in doubt, try the + script by Milan. It does recover the other parameters as well. + + Side note: This is the way the decrypt_derived script gets at the master + key. It just omits the conversion and hashes the master key string. + + - If the header is intact and you just forgot the passphrase, just + set a new passphrase like this: + + cryptsetup luksAddKey --master-key-file= + + You may want to disable the old one afterwards. + + + * 6.11 What does the on-disk structure of dm-crypt look like? + + There is none. dm-crypt takes a block device and gives encrypted access + to each of its blocks with a key derived from the passphrase given. If + you use a cipher different than the default, you have to specify that as + a parameter to cryptsetup too. If you want to change the password, you + basically have to create a second encrypted device with the new + passphrase and copy your data over. On the plus side, if you + accidentally overwrite any part of a dm-crypt device, the damage will be + limited to the area you overwrote. + + + * 6.12 What does the on-disk structure of LUKS1 look like? + + Note: For LUKS2, refer to the LUKS2 document referenced in Item 1.2 + + A LUKS1 partition consists of a header, followed by 8 key-slot + descriptors, followed by 8 key slots, followed by the encrypted data + area. + + Header and key-slot descriptors fill the first 592 bytes. The key-slot + size depends on the creation parameters, namely on the number of + anti-forensic stripes, key material offset and master key size. + + With the default parameters, each key-slot is a bit less than 128kiB in + size. Due to sector alignment of the key-slot start, that means the key + block 0 is at offset 0x1000-0x20400, key block 1 at offset + 0x21000-0x40400, and key block 7 at offset 0xc1000-0xe0400. The space + to the next full sector address is padded with zeros. Never used + key-slots are filled with what the disk originally contained there, a + key-slot removed with "luksRemoveKey" or "luksKillSlot" gets filled with + 0xff. Due to 2MiB default alignment, start of the data area for + cryptsetup 1.3 and later is at 2MiB, i.e. at 0x200000. For older + versions, it is at 0x101000, i.e. at 1'052'672 bytes, i.e. at 1MiB + + 4096 bytes from the start of the partition. Incidentally, + "luksHeaderBackup" for a LUKS container created with default parameters + dumps exactly the first 2MiB (or 1'052'672 bytes for headers created + with cryptsetup versions < 1.3) to file and "luksHeaderRestore" restores + them. + + For non-default parameters, you have to figure out placement yourself. + "luksDump" helps. See also next item. For the most common non-default + settings, namely aes-xts-plain with 512 bit key, the offsets are: 1st + keyslot 0x1000-0x3f800, 2nd keyslot 0x40000-0x7e000, 3rd keyslot + 0x7e000-0xbd800, ..., and start of bulk data at 0x200000. + + The exact specification of the format is here: + https://gitlab.com/cryptsetup/cryptsetup/wikis/Specification + + For your convenience, here is the LUKS1 header with hex offsets. + NOTE: + The spec counts key-slots from 1 to 8, but the cryptsetup tool counts + from 0 to 7. The numbers here refer to the cryptsetup numbers. + + +Refers to LUKS1 On-Disk Format Specification Version 1.2.3 + +LUKS1 header: + +offset length name data type description +----------------------------------------------------------------------- +0x0000 0x06 magic byte[] 'L','U','K','S', 0xba, 0xbe + 0 6 +0x0006 0x02 version uint16_t LUKS version + 6 3 +0x0008 0x20 cipher-name char[] cipher name spec. + 8 32 +0x0028 0x20 cipher-mode char[] cipher mode spec. + 40 32 +0x0048 0x20 hash-spec char[] hash spec. + 72 32 +0x0068 0x04 payload-offset uint32_t bulk data offset in sectors + 104 4 (512 bytes per sector) +0x006c 0x04 key-bytes uint32_t number of bytes in key + 108 4 +0x0070 0x14 mk-digest byte[] master key checksum + 112 20 calculated with PBKDF2 +0x0084 0x20 mk-digest-salt byte[] salt for PBKDF2 when + 132 32 calculating mk-digest +0x00a4 0x04 mk-digest-iter uint32_t iteration count for PBKDF2 + 164 4 when calculating mk-digest +0x00a8 0x28 uuid char[] partition UUID + 168 40 +0x00d0 0x30 key-slot-0 key slot key slot 0 + 208 48 +0x0100 0x30 key-slot-1 key slot key slot 1 + 256 48 +0x0130 0x30 key-slot-2 key slot key slot 2 + 304 48 +0x0160 0x30 key-slot-3 key slot key slot 3 + 352 48 +0x0190 0x30 key-slot-4 key slot key slot 4 + 400 48 +0x01c0 0x30 key-slot-5 key slot key slot 5 + 448 48 +0x01f0 0x30 key-slot-6 key slot key slot 6 + 496 48 +0x0220 0x30 key-slot-7 key slot key slot 7 + 544 48 + + +Key slot: + +offset length name data type description +------------------------------------------------------------------------- +0x0000 0x04 active uint32_t key slot enabled/disabled + 0 4 +0x0004 0x04 iterations uint32_t PBKDF2 iteration count + 4 4 +0x0008 0x20 salt byte[] PBKDF2 salt + 8 32 +0x0028 0x04 key-material-offset uint32_t key start sector + 40 4 (512 bytes/sector) +0x002c 0x04 stripes uint32_t number of anti-forensic + 44 4 stripes + + + + * 6.13 What is the smallest possible LUKS1 container? + + Note: From cryptsetup 1.3 onwards, alignment is set to 1MB. With modern + Linux partitioning tools that also align to 1MB, this will result in + alignment to 2k sectors and typical Flash/SSD sectors, which is highly + desirable for a number of reasons. Changing the alignment is not + recommended. + + That said, with default parameters, the data area starts at exactly 2MB + offset (at 0x101000 for cryptsetup versions before 1.3). The smallest + data area you can have is one sector of 512 bytes. Data areas of 0 + bytes can be created, but fail on mapping. + + While you cannot put a filesystem into something this small, it may + still be used to contain, for example, key. Note that with current + formatting tools, a partition for a container this size will be 3MiB + anyways. If you put the LUKS container into a file (via losetup and a + loopback device), the file needs to be 2097664 bytes in size, i.e. 2MiB + + 512B. + + The two ways to influence the start of the data area are key-size and + alignment. + + For alignment, you can go down to 1 on the parameter. This will still + leave you with a data-area starting at 0x101000, i.e. 1MiB+4096B + (default parameters) as alignment will be rounded up to the next + multiple of 8 (i.e. 4096 bytes) If in doubt, do a dry-run on a larger + file and dump the LUKS header to get actual information. + + For key-size, you can use 128 bit (e.g. AES-128 with CBC), 256 bit + (e.g. AES-256 with CBC) or 512 bit (e.g. AES-256 with XTS mode). You + can do 64 bit (e.g. blowfish-64 with CBC), but anything below 128 bit + has to be considered insecure today. + + Example 1 - AES 128 bit with CBC: + + cryptsetup luksFormat -s 128 --align-payload=8 + + This results in a data offset of 0x81000, i.e. 516KiB or 528384 + bytes. Add one 512 byte sector and the smallest LUKS container size + with these parameters is 516KiB + 512B or 528896 bytes. + + Example 2 - Blowfish 64 bit with CBC (WARNING: insecure): + + cryptsetup luksFormat -c blowfish -s 64 --align-payload=8 /dev/loop0 + + This results in a data offset of 0x41000, i.e. 260kiB or 266240 + bytes, with a minimal LUKS1 container size of 260kiB + 512B or 266752 + bytes. + + + * 6.14 I think this is overly complicated. Is there an alternative? + + Not really. Encryption comes at a price. You can use plain dm-crypt to + simplify things a bit. It does not allow multiple passphrases, but on + the plus side, it has zero on disk description and if you overwrite some + part of a plain dm-crypt partition, exactly the overwritten parts are + lost (rounded up to full sectors). + + * 6.15 Can I clone a LUKS container? + + You can, but it breaks security, because the cloned container has the + same header and hence the same master key. Even if you change the + passphrase(s), the master key stays the same. That means whoever has + access to one of the clones can decrypt them all, completely bypassing + the passphrases. + + While you can use cryptsetup-reencrypt to change the master key, + this is probably more effort than to create separate LUKS containers + in the first place. + + The right way to do this is to first luksFormat the target container, + then to clone the contents of the source container, with both containers + mapped, i.e. decrypted. You can clone the decrypted contents of a LUKS + container in binary mode, although you may run into secondary issues + with GUIDs in filesystems, partition tables, RAID-components and the + like. These are just the normal problems binary cloning causes. + + Note that if you need to ship (e.g.) cloned LUKS containers with a + default passphrase, that is fine as long as each container was + individually created (and hence has its own master key). In this case, + changing the default passphrase will make it secure again. + + +7. Interoperability with other Disk Encryption Tools + + + * 7.1 What is this section about? + + Cryptsetup for plain dm-crypt can be used to access a number of on-disk + formats created by tools like loop-aes patched into losetup. This + sometimes works and sometimes does not. This section collects insights + into what works, what does not and where more information is required. + + Additional information may be found in the mailing-list archives, + mentioned at the start of this FAQ document. If you have a solution + working that is not yet documented here and think a wider audience may + be interested, please email the FAQ maintainer. + + + * 7.2 loop-aes: General observations. + + One problem is that there are different versions of losetup around. + loop-aes is a patch for losetup. Possible problems and deviations + from cryptsetup option syntax include: + + - Offsets specified in bytes (cryptsetup: 512 byte sectors) + + - The need to specify an IV offset + + - Encryption mode needs specifying (e.g. "-c twofish-cbc-plain") + + - Key size needs specifying (e.g. "-s 128" for 128 bit keys) + + - Passphrase hash algorithm needs specifying + + Also note that because plain dm-crypt and loop-aes format does not have + metadata, and while the loopAES extension for cryptsetup tries + autodetection (see command loopaesOpen), it may not always work. If you + still have the old set-up, using a verbosity option (-v) on mapping with + the old tool or having a look into the system logs after setup could + give you the information you need. Below, there are also some things + that worked for somebody. + + + * 7.3 loop-aes patched into losetup on Debian 5.x, kernel 2.6.32 + + In this case, the main problem seems to be that this variant of + losetup takes the offset (-o option) in bytes, while cryptsetup takes + it in sectors of 512 bytes each. + + Example: The losetup command + + losetup -e twofish -o 2560 /dev/loop0 /dev/sdb1 + mount /dev/loop0 mount-point + + translates to + + cryptsetup create -c twofish -o 5 --skip 5 e1 /dev/sdb1 + mount /dev/mapper/e1 mount-point + + + + * 7.4 loop-aes with 160 bit key + + This seems to be sometimes used with twofish and blowfish and represents + a 160 bit ripemed160 hash output padded to 196 bit key length. It seems + the corresponding options for cryptsetup are + + --cipher twofish-cbc-null -s 192 -h ripemd160:20 + + + + * 7.5 loop-aes v1 format OpenSUSE + + Apparently this is done by older OpenSUSE distros and stopped working + from OpenSUSE 12.1 to 12.2. One user had success with the following: + + cryptsetup create -c aes -s 128 -h sha256 + + + + * 7.6 Kernel encrypted loop device (cryptoloop) + + There are a number of different losetup implementations for using + encrypted loop devices so getting this to work may need a bit of + experimentation. + + NOTE: Do NOT use this for new containers! Some of the existing + implementations are insecure and future support is uncertain. + + Example for a compatible mapping: + + losetup -e twofish -N /dev/loop0 /image.img + + translates to + + cryptsetup create image_plain /image.img -c twofish-cbc-plain -H plain + + with the mapping being done to /dev/mapper/image_plain instead of + to /dev/loop0. + + More details: + + Cipher, mode and password hash (or no hash): + + -e cipher [-N] => -c cipher-cbc-plain -H plain [-s 256] + -e cipher => -c cipher-cbc-plain -H ripemd160 [-s 256] + + + Key size and offsets (losetup: bytes, cryptsetuop: sectors of 512 bytes): + + -k 128 => -s 128 + -o 2560 => -o 5 -p 5 # 2560/512 = 5 + + + There is no replacement for --pass-fd, it has to be emulated using + keyfiles, see the cryptsetup man-page. + + +8. Issues with Specific Versions of cryptsetup + + + * 8.1 When using the create command for plain dm-crypt with + cryptsetup 1.1.x, the mapping is incompatible and my data is not + accessible anymore! + + With cryptsetup 1.1.x, the distro maintainer can define different + default encryption modes. You can check the compiled-in defaults using + "cryptsetup --help". Moreover, the plain device default changed because + the old IV mode was vulnerable to a watermarking attack. + + If you are using a plain device and you need a compatible mode, just + specify cipher, key size and hash algorithm explicitly. For + compatibility with cryptsetup 1.0.x defaults, simple use the following: + + cryptsetup create -c aes-cbc-plain -s 256 -h ripemd160 + + LUKS stores cipher and mode in the metadata on disk, avoiding this + problem. + + + * 8.2 cryptsetup on SLED 10 has problems... + + SLED 10 is missing an essential kernel patch for dm-crypt, which is + broken in its kernel as a result. There may be a very old version of + cryptsetup (1.0.x) provided by SLED, which should also not be used + anymore as well. My advice would be to drop SLED 10. + + + * 8.3 Gcrypt 1.6.x and later break Whirlpool + + It is the other way round: In gcrypt 1.5.x, Whirlpool is broken and it + was fixed in 1.6.0 and later. If you selected whirlpool as hash on + creation of a LUKS container, it does not work anymore with the fixed + library. This shows one serious risk of using rarely used settings. + + Note that at the time this FAQ item was written, 1.5.4 was the latest + 1.5.x version and it has the flaw, i.e. works with the old Whirlpool + version. Possibly later 1.5.x versions will work as well. If not, + please let me know. + + The only two ways to access older LUKS containers created with Whirlpool + are to either decrypt with an old gcrypt version that has the flaw or to + use a compatibility feature introduced in cryptsetup 1.6.4 and gcrypt + 1.6.1 or later. Version 1.6.0 cannot be used. + + Steps: + + - Make at least a header backup or better, refresh your full backup. + (You have a full backup, right? See Item 6.1 and following.) + + - Make sure you have cryptsetup 1.6.4 or later and check the gcrypt + version: + + cryptsetup luksDump --debug | grep backend + + If gcrypt is at version 1.5.x or before: + + - Reencrypt the LUKS header with a different hash. (Requires entering + all keyslot passphrases. If you do not have all, remove the ones you + do not have before.): + + cryptsetup-reencrypt --keep-key --hash sha256 + + If gcrypt is at version 1.6.1 or later: + + - Patch the hash name in the LUKS header from "whirlpool" to + "whirlpool_gcryptbug". This activates the broken implementation. + The detailed header layout is in Item 6.12 of this FAQ and in the + LUKS on-disk format specification. One way to change the hash is + with the following command: + + echo -n -e 'whirlpool_gcryptbug\0' | dd of= bs=1 seek=72 conv=notrunc + + - You can now open the device again. It is highly advisable to change + the hash now with cryptsetup-reencrypt as described above. While you + can reencrypt to use the fixed whirlpool, that may not be a good idea + as almost nobody seems to use it and hence the long time until the + bug was discovered. + + +9. The Initrd question + + + * 9.1 My initrd is broken with cryptsetup + + That is not nice! However the initrd is supplied by your distribution, + not by the cryptsetup project and hence you should complain to them. We + cannot really do anything about it. + + + * 9.2 CVE-2016-4484 says cryptsetup is broken! + + Not really. It says the initrd in some Debian versions have a behavior + that under some very special and unusual conditions may be considered + a vulnerability. + + What happens is that you can trick the initrd to go to a rescue-shell if + you enter the LUKS password wrongly in a specific way. But falling back + to a rescue shell on initrd errors is a sensible default behavior in the + first place. It gives you about as much access as booting a rescue + system from CD or USB-Stick or as removing the disk would give you. So + this only applies when an attacker has physical access, but cannot boot + anything else or remove the disk. These will be rare circumstances + indeed, and if you rely on the default distribution initrd to keep you + safe under these circumstances, then you have bigger problems than this + somewhat expected behavior. + + The CVE was exaggerated and should not be assigned to upstream + cryptsetup in the first place (it is a distro specific initrd issue). + It was driven more by a try to make a splash for self-aggrandizement, + than by any actual security concerns. Ignore it. + + + * 9.3 How do I do my own initrd with cryptsetup? + + Note: The instructions here apply to an initrd in initramfs format, not + to an initrd in initrd format. The latter is a filesystem image, not a + cpio-archive, and seems to not be widely used anymore. + + It depends on the distribution. Below, I give a very simple example and + step-by-step instructions for Debian. With a bit of work, it should be + possible to adapt this to other distributions. Note that the + description is pretty general, so if you want to do other things with an + initrd it provides a useful starting point for that too. + + 01) Unpacking an existing initrd to use as template + + A Linux initrd is in gzip'ed cpio format. To unpack it, use something + like this: + + md tmp; cd tmp; cat ../initrd | gunzip | cpio -id + + After this, you have the full initrd content in tmp/ + + 02) Inspecting the init-script + + The init-script is the only thing the kernel cares about. All activity + starts there. Its traditional location is /sbin/init on disk, but /init + in an initrd. In an initrd unpacked as above it is tmp/init. + + While init can be a binary despite usually being called "init script", + in Debian the main init on the root partition is a binary, but the init + in the initrd (and only that one is called by the kernel) is a script + and starts like this: + + #!/bin/sh + .... + + The "sh" used here is in tmp/bin/sh as just unpacked, and in Debian it + currently is a busybox. + + 03) Creating your own initrd + + The two examples below should give you most of what is needed. This is + tested with LUKS1 and should work with LUKS2 as well. If not, please + let me know. + + Here is a really minimal example. It does nothing but set up some + things and then drop to an interactive shell. It is perfect to try out + things that you want to go into the init-script. + + #!/bin/sh + export PATH=/sbin:/bin + [ -d /sys ] || mkdir /sys + [ -d /proc ] || mkdir /proc + [ -d /tmp ] || mkdir /tmp + mount -t sysfs -o nodev,noexec,nosuid sysfs /sys + mount -t proc -o nodev,noexec,nosuid proc /proc + echo "initrd is running, starting BusyBox..." + exec /bin/sh --login + + + Here is an example that opens the first LUKS-partition it finds with the + hard-coded password "test2" and then mounts it as root-filesystem. This + is intended to be used on an USB-stick that after boot goes into a safe, + as it contains the LUKS-passphrase in plain text and is not secure to be + left in the system. The script contains debug-output that should make it + easier to see what is going on. Note that the final hand-over to the init + on the encrypted root-partition is done by "exec switch_root /mnt/root + /sbin/init", after mounting the decrypted LUKS container with "mount + /dev/mapper/c1 /mnt/root". The second argument of switch_root is relative + to the first argument, i.e. the init started with this command is really + /mnt/sbin/init before switch_root runs. + + #!/bin/sh + export PATH=/sbin:/bin + [ -d /sys ] || mkdir /sys + [ -d /proc ] || mkdir /proc + [ -d /tmp ] || mkdir /tmp + mount -t sysfs -o nodev,noexec,nosuid sysfs /sys + mount -t proc -o nodev,noexec,nosuid proc /proc + echo "detecting LUKS containers in sda1-10, sdb1-10"; sleep 1 + for i in a b + do + for j in 1 2 3 4 5 6 7 8 9 10 + do + sleep 0.5 + d="/dev/sd"$i""$j + echo -n $d + cryptsetup isLuks $d >/dev/null 2>&1 + r=$? + echo -n " result: "$r"" + # 0 = is LUKS, 1 = is not LUKS, 4 = other error + if expr $r = 0 > /dev/null + then + echo " is LUKS, attempting unlock" + echo -n "test2" | cryptsetup luksOpen --key-file=- $d c1 + r=$? + echo " result of unlock attempt: "$r"" + sleep 2 + if expr $r = 0 > /dev/null + then + echo "*** LUKS partition unlocked, switching root *** + echo " (waiting 30 seconds before doing that)" + mount /dev/mapper/c1 /mnt/root + sleep 30 + exec switch_root /mnt/root /sbin/init + fi + else + echo " is not LUKS" + fi + done + done + echo "FAIL finding root on LUKS, loading BusyBox..."; sleep 5 + exec /bin/sh --login + + + 04) What if I want a binary in the initrd, but libraries are missing? + + That is a bit tricky. One option is to compile statically, but that + does not work for everything. Debian puts some libraries into lib/ and + lib64/ which are usually enough. If you need more, you can add the + libraries you need there. That may or may not need a configuration + change for the dynamic linker "ld" as well. Refer to standard Linux + documentation on how to add a library to a Linux system. A running + initrd is just a running Linux system after all, it is not special in + any way. + + 05) How do I repack the initrd? + + Simply repack the changed directory. While in tmp/, do + the following: + ``` + find . | cpio --create --format='newc' | gzip > ../new_initrd + ``` + Rename "new_initrd" to however you want it called (the name of + the initrd is a kernel-parameter) and move to /boot. That is it. + + +10. LUKS2 Questions + + + * 10.1 Is the cryptography of LUKS2 different? + + Mostly not. The header has changed in its structure, but the + crytpgraphy is the same. The one exception is that PBKDF2 has been + replaced by Argon2 to give better resilience against attacks by + graphics cards and other hardware with lots of computing power but + limited local memory per computing element. + + + * 10.2 What new features does LUKS2 have? + + There are quite a few. I recommend reading the man-page and the on-disk + format specification, see Item 1.2. + + To list just some: + - A lot of the metadata is JSON, allowing for easier extension + - Max 32 key-slots per default + - Better protection for bad passphrases now available with Argon2 + - Authenticated encryption + - The LUKS2 header is less vulnerable to corruption and has a 2nd copy + + + * 10.3 Why does LUKS2 need so much memory? + + LUKS2 uses Argon2 instead of PBKDF2. That causes the increase in memory. + See next item. + + + * 10.4 Why use Argon2 in LUKS 2 instead of PBKDF2? + + LUKS tries to be secure with not-so-good passwords. Bad passwords need to + be protected in some way against an attacker that just tries all possible + combinations. (For good passwords, you can just wait for the attacker to + die of old age...) The situation with LUKS is not quite the same as with a + password stored in a database, but there are similarities. + + LUKS does not store passwords on disk. Instead, the passwords are used to + decrypt the master-key with it and that one is stored on disk in encrypted + form. If you have a good password, with, say, more than 80 bits of + entropy, you could just put the password through a single crypto-hash (to + turn it into something that can be used as a key) and that would be secure. + This is what plain dm-crypt does. + + If the password has lower entropy, you want to make this process cost some + effort, so that each try takes time and resources and slows the attacker + down. LUKS1 uses PBKDF2 for that, adding an iteration count and a salt. + The iteration count is per default set to that it takes 1 second per try on + the CPU of the device where the respective passphrase was set. The salt is + there to prevent precomputation. + + The problem with that is that if you use a graphics card, you can massively + speed up these computations as PBKDF2 needs very little memory to compute + it. A graphics card is (grossly simplified) a mass of small CPUs with some + small very fast local memory per CPU and a large slow memory (the 4/6/8 GB + a current card may have). If you can keep a computation in the small, + CPU-local memory, you can gain a speed factor of 1000 or more when trying + passwords with PBKDF2. + + Argon2 was created to address this problem. It adds a "large memory + property" where computing the result with less memory than the memory + parameter requires is massively (exponentially) slowed down. That means, + if you set, for example, 4GB of memory, computing Argon2 on a graphics card + with around 100kB of memory per "CPU" makes no sense at all because it is + far too slow. An attacker has hence to use real CPUs and furthermore is + limited by main memory bandwidth. + + Hence the large amount of memory used is a security feature and should not + be turned off or reduced. If you really (!) understand what you are doing + and can assure good passwords, you can either go back to PBKDF2 or set a + low amount of memory used for Argon2 when creating the header. + + + * 10.5 LUKS2 is insecure! It uses less memory than the Argon2 RFC say! + + Well, not really. The RFC recommends 6GiB of memory for use with disk + encryption. That is a bit insane and something clearly went wrong in the + standardization process here. First, that makes Argon2 unusable on any 32 + bit Linux and that is clearly a bad thing. Second, there are many small + Linux devices around that do not have 6GiB of RAM in the first place. For + example, the current Raspberry Pi has 1GB, 2GB or 4GB of RAM, and with the + RFC recommendations, none of these could compute Argon2 hashes. + + Hence LUKS2 uses a more real-world approach. Iteration is set to a + minimum of 4 because there are some theoretical attacks that work up to an + iteration count of 3. The thread parameter is set to 4. To achieve 2 + second/slot unlock time, LUKS2 adjusts the memory parameter down if + needed. In the other direction, it will respect available memory and not + exceed it. On a current PC, the memory parameter will be somewhere around + 1GB, which should be quite generous. The minimum I was able to set in an + experiment with "-i 1" was 400kB of memory and that is too low to be + secure. A Raspberry Pi would probably end up somewhere around 50MB (have + not tried it) and that should still be plenty. + + That said, if you have a good, high-entropy passphrase, LUKS2 is secure + with any memory parameter. + + + * 10.6 How does re-encryption store data while it is running? + + All metadata necessary to perform a recovery of said segment (in case of + crash) is stored in the LUKS2 metadata area. No matter if the LUKS2 + reencryption was run in online or offline mode. + + + * 10.7 What do I do if re-encryption crashes? + + In case of a reencryption application crash, try to close the original + device via following command first: + + cryptsetup close . + + Cryptsetup assesses if it's safe to teardown the reencryption device stack + or not. It will also cut off I/O (via dm-error mapping) to current + hotzone segment (to make later recovery possible). If it can't be torn + down, i.e. due to a mounted fs, you must unmount the filesystem first. + Never try to tear down reencryption dm devices manually using e.g. + dmsetup tool, at least not unless cryptsetup says it's safe to do so. It + could damage the data beyond repair. + + + * 10.8 Do I need to enter two passphrases to recover a crashed + re-encryption? + + Cryptsetup (command line utility) expects the passphrases to be identical + for the keyslot containing old volume key and for the keyslot containing + new one. So the recovery happens during normal the "cryptsetup open" + operation or the equivalent during boot. + + Re-encryption recovery can be also performed in offline mode by + the "cryptsetup repair" command. + + + * 10.9 What is an unbound keyslot and what is it used for? + + Quite simply, an 'unbound key' is an independent 'key' stored in a luks2 + keyslot that cannot be used to unlock a LUKS2 data device. More specifically, + an 'unbound key' or 'unbound luks2 keyslot' contains a secret that is not + currently associated with any data/crypt segment (encrypted area) in the + LUKS2 'Segments' section (displayed by luksDump). + + This is a bit of a more general idea. It basically allows to use a keyslot + as a container for a key to be used in other things than decrypting a + data segment. + + As of April 2020, the following uses are defined: + + 1) LUKS2 re-encryption. The new volume key is stored in an unbound keyslot + which becomes a regular LUKS2 keyslot later when re-encryption is + finished. + + 2) Somewhat similar is the use with a wrapped key scheme (e.g. with the + paes cipher). In this case, the VK (Volume Key) stored in a keyslot + is an encrypted binary binary blob. The KEK (Key Encryption Key) for + that blob may be refreshed (Note that this KEK is not managed by + cryptsetup!) and the binary blob gets changed. The KEK refresh process + uses an 'unbound keyslot'. First the future effective VK is placed + in the unbound keyslot and later it gets turned into the new real VK + (and bound to the respective crypt segment). + + + * 10.10 What about the size of the LUKS2 header? + + While the LUKS1 header has a fixed size that is determined by the cipher + spec (see Item 6.12), LUKS2 is more variable. The default size is 16MB, + but it can be adjusted on creation by using the --luks2-metadata-size + and --luks2-keyslots-size options. Refer to the man-page for details. + While adjusting the size in an existing LUKS2 container is possible, + it is somewhat complicated and risky. My advice is to do a backup, + recreate the container with changed parameters and restore that backup. + + + * 10.11 Does LUKS2 store metadata anywhere except in the header? + + It does not. But note that if you use the experimental integrity support, + there will be an integrity header as well at the start of the data area + and things get a bit more complicated. All metadata will still be at the + start of the device, nothing gets stored somewhere in the middle or at + the end. + + +11. References and Further Reading + + * Purpose of this Section + + The purpose of this section is to collect references to all materials + that do not fit the FAQ but are relevant in some fashion. This can be + core topics like the LUKS spec or disk encryption, but it can also be + more tangential, like secure storage management or cryptography used in + LUKS. It should still have relevance to cryptsetup and its + applications. + + If you want to see something added here, send email to the maintainer + (or the cryptsetup mailing list) giving an URL, a description (1-3 lines + preferred) and a section to put it in. You can also propose new + sections. + + At this time I would like to limit the references to things that are + available on the web. + + * Specifications + + - LUKS on-disk format spec: See Item 1.2 + + * Other Documentation + + - Arch Linux on LUKS, LVM and full-disk encryption: + https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system + + * Code Examples + + - Some code examples are in the source package under docs/examples + + - LUKS AF Splitter in Ruby by John Lane: https://rubygems.org/gems/afsplitter + + * Brute-forcing passphrases + + - http://news.electricalchemy.net/2009/10/password-cracking-in-cloud-part-5.html + + - https://it.slashdot.org/story/12/12/05/0623215/new-25-gpu-monster-devours-strong-passwords-in-minutes + + * Tools + + * SSD and Flash Disk Related + + * Disk Encryption + + * Attacks Against Disk Encryption + + * Risk Management as Relevant for Disk Encryption + + * Cryptography + + * Secure Storage + + +A. Contributors +In no particular order: + + - Arno Wagner + + - Milan Broz + +___ diff --git a/INSTALL b/INSTALL new file mode 100644 index 0000000..45ff9bb --- /dev/null +++ b/INSTALL @@ -0,0 +1,229 @@ +Copyright 1994, 1995, 1996, 1999, 2000, 2001, 2002 Free Software +Foundation, Inc. + + This file is free documentation; the Free Software Foundation gives +unlimited permission to copy, distribute and modify it. + +Basic Installation +================== + + These are generic installation instructions. + + The `configure' shell script attempts to guess correct values for +various system-dependent variables used during compilation. It uses +those values to create a `Makefile' in each directory of the package. +It may also create one or more `.h' files containing system-dependent +definitions. Finally, it creates a shell script `config.status' that +you can run in the future to recreate the current configuration, and a +file `config.log' containing compiler output (useful mainly for +debugging `configure'). + + It can also use an optional file (typically called `config.cache' +and enabled with `--cache-file=config.cache' or simply `-C') that saves +the results of its tests to speed up reconfiguring. (Caching is +disabled by default to prevent problems with accidental use of stale +cache files.) + + If you need to do unusual things to compile the package, please try +to figure out how `configure' could check whether to do them, and mail +diffs or instructions to the address given in the `README' so they can +be considered for the next release. If you are using the cache, and at +some point `config.cache' contains results you don't want to keep, you +may remove or edit it. + + The file `configure.ac' (or `configure.in') is used to create +`configure' by a program called `autoconf'. You only need +`configure.ac' if you want to change it or regenerate `configure' using +a newer version of `autoconf'. + +The simplest way to compile this package is: + + 1. `cd' to the directory containing the package's source code and type + `./configure' to configure the package for your system. If you're + using `csh' on an old version of System V, you might need to type + `sh ./configure' instead to prevent `csh' from trying to execute + `configure' itself. + + Running `configure' takes a while. While running, it prints some + messages telling which features it is checking for. + + 2. Type `make' to compile the package. + + 3. Optionally, type `make check' to run any self-tests that come with + the package. + + 4. Type `make install' to install the programs and any data files and + documentation. + + 5. You can remove the program binaries and object files from the + source code directory by typing `make clean'. To also remove the + files that `configure' created (so you can compile the package for + a different kind of computer), type `make distclean'. There is + also a `make maintainer-clean' target, but that is intended mainly + for the package's developers. If you use it, you may have to get + all sorts of other programs in order to regenerate files that came + with the distribution. + +Compilers and Options +===================== + + Some systems require unusual options for compilation or linking that +the `configure' script does not know about. Run `./configure --help' +for details on some of the pertinent environment variables. + + You can give `configure' initial values for configuration parameters +by setting variables in the command line or in the environment. Here +is an example: + + ./configure CC=c89 CFLAGS=-O2 LIBS=-lposix + + *Note Defining Variables::, for more details. + +Compiling For Multiple Architectures +==================================== + + You can compile the package for more than one kind of computer at the +same time, by placing the object files for each architecture in their +own directory. To do this, you must use a version of `make' that +supports the `VPATH' variable, such as GNU `make'. `cd' to the +directory where you want the object files and executables to go and run +the `configure' script. `configure' automatically checks for the +source code in the directory that `configure' is in and in `..'. + + If you have to use a `make' that does not support the `VPATH' +variable, you have to compile the package for one architecture at a +time in the source code directory. After you have installed the +package for one architecture, use `make distclean' before reconfiguring +for another architecture. + +Installation Names +================== + + By default, `make install' will install the package's files in +`/usr/local/bin', `/usr/local/man', etc. You can specify an +installation prefix other than `/usr/local' by giving `configure' the +option `--prefix=PATH'. + + You can specify separate installation prefixes for +architecture-specific files and architecture-independent files. If you +give `configure' the option `--exec-prefix=PATH', the package will use +PATH as the prefix for installing programs and libraries. +Documentation and other data files will still use the regular prefix. + + In addition, if you use an unusual directory layout you can give +options like `--bindir=PATH' to specify different values for particular +kinds of files. Run `configure --help' for a list of the directories +you can set and what kinds of files go in them. + + If the package supports it, you can cause programs to be installed +with an extra prefix or suffix on their names by giving `configure' the +option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. + +Optional Features +================= + + Some packages pay attention to `--enable-FEATURE' options to +`configure', where FEATURE indicates an optional part of the package. +They may also pay attention to `--with-PACKAGE' options, where PACKAGE +is something like `gnu-as' or `x' (for the X Window System). The +`README' should mention any `--enable-' and `--with-' options that the +package recognizes. + + For packages that use the X Window System, `configure' can usually +find the X include and library files automatically, but if it doesn't, +you can use the `configure' options `--x-includes=DIR' and +`--x-libraries=DIR' to specify their locations. + +Specifying the System Type +========================== + + There may be some features `configure' cannot figure out +automatically, but needs to determine by the type of machine the package +will run on. Usually, assuming the package is built to be run on the +_same_ architectures, `configure' can figure that out, but if it prints +a message saying it cannot guess the machine type, give it the +`--build=TYPE' option. TYPE can either be a short name for the system +type, such as `sun4', or a canonical name which has the form: + + CPU-COMPANY-SYSTEM + +where SYSTEM can have one of these forms: + + OS KERNEL-OS + + See the file `config.sub' for the possible values of each field. If +`config.sub' isn't included in this package, then this package doesn't +need to know the machine type. + + If you are _building_ compiler tools for cross-compiling, you should +use the `--target=TYPE' option to select the type of system they will +produce code for. + + If you want to _use_ a cross compiler, that generates code for a +platform different from the build platform, you should specify the +"host" platform (i.e., that on which the generated programs will +eventually be run) with `--host=TYPE'. + +Sharing Defaults +================ + + If you want to set default values for `configure' scripts to share, +you can create a site shell script called `config.site' that gives +default values for variables like `CC', `cache_file', and `prefix'. +`configure' looks for `PREFIX/share/config.site' if it exists, then +`PREFIX/etc/config.site' if it exists. Or, you can set the +`CONFIG_SITE' environment variable to the location of the site script. +A warning: not all `configure' scripts look for a site script. + +Defining Variables +================== + + Variables not defined in a site shell script can be set in the +environment passed to `configure'. However, some packages may run +configure again during the build, and the customized values of these +variables may be lost. In order to avoid this problem, you should set +them in the `configure' command line, using `VAR=value'. For example: + + ./configure CC=/usr/local2/bin/gcc + +will cause the specified gcc to be used as the C compiler (unless it is +overridden in the site shell script). + +`configure' Invocation +====================== + + `configure' recognizes the following options to control how it +operates. + +`--help' +`-h' + Print a summary of the options to `configure', and exit. + +`--version' +`-V' + Print the version of Autoconf used to generate the `configure' + script, and exit. + +`--cache-file=FILE' + Enable the cache: use and save the results of the tests in FILE, + traditionally `config.cache'. FILE defaults to `/dev/null' to + disable caching. + +`--config-cache' +`-C' + Alias for `--cache-file=config.cache'. + +`--quiet' +`--silent' +`-q' + Do not print messages saying which checks are being made. To + suppress all normal output, redirect it to `/dev/null' (any error + messages will still be shown). + +`--srcdir=DIR' + Look for the package's source code in directory DIR. Usually + `configure' can determine that directory automatically. + +`configure' also accepts some other, not widely useful, options. Run +`configure --help' for more details. + diff --git a/Makefile.am b/Makefile.am new file mode 100644 index 0000000..de0d2a2 --- /dev/null +++ b/Makefile.am @@ -0,0 +1,50 @@ +EXTRA_DIST = COPYING.LGPL FAQ docs misc +SUBDIRS = po tests +CLEANFILES = +DISTCLEAN_TARGETS = + +AM_CPPFLAGS = \ + -include config.h \ + -I$(top_srcdir)/lib \ + -DDATADIR=\""$(datadir)"\" \ + -DLOCALEDIR=\""$(datadir)/locale"\" \ + -DLIBDIR=\""$(libdir)"\" \ + -DPREFIX=\""$(prefix)"\" \ + -DSYSCONFDIR=\""$(sysconfdir)"\" \ + -DVERSION=\""$(VERSION)"\" +AM_CFLAGS = -Wall +AM_LDFLAGS = + +LDADD = $(LTLIBINTL) -lm + +tmpfilesddir = @DEFAULT_TMPFILESDIR@ + +noinst_LTLIBRARIES = +sbin_PROGRAMS = +man8_MANS = +tmpfilesd_DATA = + +include man/Makemodule.am + +include scripts/Makemodule.am + +if CRYPTO_INTERNAL_ARGON2 +include lib/crypto_backend/argon2/Makemodule.am +endif +include lib/crypto_backend/Makemodule.am +include lib/Makemodule.am + +include src/Makemodule.am + +ACLOCAL_AMFLAGS = -I m4 + +DISTCHECK_CONFIGURE_FLAGS = \ + --with-tmpfilesdir=$$dc_install_base/usr/lib/tmpfiles.d \ + --enable-internal-argon2 --enable-internal-sse-argon2 + +distclean-local: + -find . -name \*~ -o -name \*.orig -o -name \*.rej | xargs rm -f + rm -rf autom4te.cache + +clean-local: + -rm -rf docs/doxygen_api_docs libargon2.la diff --git a/NEWS b/NEWS new file mode 100644 index 0000000..168617a --- /dev/null +++ b/NEWS @@ -0,0 +1 @@ +See docs/* directory for Release Notes. diff --git a/README b/README new file mode 100644 index 0000000..1e7973f --- /dev/null +++ b/README @@ -0,0 +1,32 @@ + + cryptsetup + +setup cryptographic volumes for dm-crypt (including LUKS extension) + +WEB PAGE: + + https://gitlab.com/cryptsetup/cryptsetup/ + +FAQ: + + https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions + +MAILING LIST: + + E-MAIL: dm-crypt@saout.de + URL: https://www.saout.de/mailman/listinfo/dm-crypt + ARCHIVE: https://lore.kernel.org/dm-crypt/ + +DOWNLOAD: + + https://www.kernel.org/pub/linux/utils/cryptsetup/ + +SOURCE CODE: + + URL: https://gitlab.com/cryptsetup/cryptsetup/tree/master + Checkout: git clone https://gitlab.com/cryptsetup/cryptsetup.git + +NLS (PO TRANSLATIONS): + + PO files are maintained by: + https://translationproject.org/domain/cryptsetup.html diff --git a/README.md b/README.md new file mode 100644 index 0000000..b28ddee --- /dev/null +++ b/README.md @@ -0,0 +1,80 @@ +![LUKS logo](https://gitlab.com/cryptsetup/cryptsetup/wikis/luks-logo.png) + +What the ...? +============= +**Cryptsetup** is a utility used to conveniently set up disk encryption based +on the [DMCrypt](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt) kernel module. + +These include **plain** **dm-crypt** volumes, **LUKS** volumes, **loop-AES**, +**TrueCrypt** (including **VeraCrypt** extension) and **BitLocker** formats. + +The project also includes a **veritysetup** utility used to conveniently setup +[DMVerity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity) block integrity checking kernel module +and, since version 2.0, **integritysetup** to setup +[DMIntegrity](https://gitlab.com/cryptsetup/cryptsetup/wikis/DMIntegrity) block integrity kernel module. + + +LUKS Design +----------- +**LUKS** is the standard for Linux hard disk encryption. By providing a standard on-disk-format, it does not +only facilitate compatibility among distributions, but also provides secure management of multiple user passwords. +LUKS stores all necessary setup information in the partition header, enabling to transport or migrate data seamlessly. + +Last version of the LUKS2 format specification is +[available here](https://gitlab.com/cryptsetup/LUKS2-docs). + +Last version of the LUKS1 format specification is +[available here](https://www.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf). + +Why LUKS? +--------- + * compatibility via standardization, + * secure against low entropy attacks, + * support for multiple keys, + * effective passphrase revocation, + * free. + +[Project home page](https://gitlab.com/cryptsetup/cryptsetup/). +----------------- + +[Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions) +-------------------------------- + +Download +-------- +All release tarballs and release notes are hosted on [kernel.org](https://www.kernel.org/pub/linux/utils/cryptsetup/). + +**The latest stable cryptsetup version is 2.4.3** + * [cryptsetup-2.4.3.tar.xz](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/cryptsetup-2.4.3.tar.xz) + * Signature [cryptsetup-2.4.3.tar.sign](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/cryptsetup-2.4.3.tar.sign) + _(You need to decompress file first to check signature.)_ + * [Cryptsetup 2.4.3 Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes). + +Previous versions + * [Version 2.3.7](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/cryptsetup-2.3.7.tar.xz) - + [Signature](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/cryptsetup-2.3.7.tar.sign) - + [Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/v2.3.7-ReleaseNotes). + * [Version 1.7.5](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/cryptsetup-1.7.5.tar.xz) - + [Signature](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/cryptsetup-1.7.5.tar.sign) - + [Release Notes](https://www.kernel.org/pub/linux/utils/cryptsetup/v1.7/v1.7.5-ReleaseNotes). + +Source and API docs +------------------- +For development version code, please refer to [source](https://gitlab.com/cryptsetup/cryptsetup/tree/master) page, +mirror on [kernel.org](https://git.kernel.org/cgit/utils/cryptsetup/cryptsetup.git/) or [GitHub](https://github.com/mbroz/cryptsetup). + +For libcryptsetup documentation see [libcryptsetup API](https://mbroz.fedorapeople.org/libcryptsetup_API/) page. + +The libcryptsetup API/ABI changes are tracked in [compatibility report](https://abi-laboratory.pro/tracker/timeline/cryptsetup/). + +NLS PO files are maintained by [TranslationProject](https://translationproject.org/domain/cryptsetup.html). + +Help! +----- +Please always read [FAQ](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions) first. +For cryptsetup and LUKS related questions, please use the dm-crypt mailing list, [dm-crypt@saout.de](mailto:dm-crypt@saout.de). + +If you want to subscribe just send an empty mail to [dm-crypt-subscribe@saout.de](mailto:dm-crypt-subscribe@saout.de). + +You can also browse [list archive](https://www.saout.de/pipermail/dm-crypt/) or read and search it through +[web interface on lore.kernel.org](https://lore.kernel.org/dm-crypt/) or alternatively on [marc.info](https://marc.info/?l=dm-crypt). diff --git a/TODO b/TODO new file mode 100644 index 0000000..58e5cc9 --- /dev/null +++ b/TODO @@ -0,0 +1 @@ +Please see issues tracked at https://gitlab.com/cryptsetup/cryptsetup/issues. diff --git a/autogen.sh b/autogen.sh new file mode 100755 index 0000000..ffe5a9e --- /dev/null +++ b/autogen.sh @@ -0,0 +1,82 @@ +#!/bin/sh +# Run this to generate all the initial makefiles, etc. + +srcdir=`dirname $0` +PKG_NAME="cryptsetup" + +DIE=0 + +(autopoint --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Error**: You must have autopoint installed." + echo "Download the appropriate package for your distribution." + DIE=1 +} + + +(msgfmt --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Warning**: You should have gettext installed." + echo "Download the appropriate package for your distribution." + echo "To disable translation, you can also use --disable-nls" + echo "configure option." +} + +(autoconf --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Error**: You must have autoconf installed." + echo "Download the appropriate package for your distribution." + DIE=1 +} + +(grep "^AM_PROG_LIBTOOL" $srcdir/configure.ac >/dev/null) && { + (libtool --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Error**: You must have libtool installed." + echo "Download the appropriate package for your distribution." + DIE=1 + } +} + +(automake --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Error**: You must have automake installed." + echo "Download the appropriate package for your distribution." + DIE=1 + NO_AUTOMAKE=yes +} + + +# if no automake, don't bother testing for aclocal +test -n "$NO_AUTOMAKE" || (aclocal --version) < /dev/null > /dev/null 2>&1 || { + echo + echo "**Error**: Missing aclocal. The version of automake" + echo "installed doesn't appear recent enough." + DIE=1 +} + +if test "$DIE" -eq 1; then + exit 1 +fi + +echo +echo "Generate build-system by:" +echo " autopoint: $(autopoint --version | head -1)" +echo " aclocal: $(aclocal --version | head -1)" +echo " autoconf: $(autoconf --version | head -1)" +echo " automake: $(automake --version | head -1)" +echo " libtoolize: $(libtoolize --version | head -1)" +echo + + +set -e +autopoint --force $AP_OPTS +libtoolize --force --copy +aclocal -I m4 $AL_OPTS +autoheader $AH_OPTS +automake --add-missing --copy --gnu $AM_OPTS +autoconf $AC_OPTS + +echo +echo "Now type '$srcdir/configure' and 'make' to compile." +echo diff --git a/configure.ac b/configure.ac new file mode 100644 index 0000000..e88be7a --- /dev/null +++ b/configure.ac @@ -0,0 +1,663 @@ +AC_PREREQ([2.67]) +AC_INIT([cryptsetup],[2.3.7]) + +dnl library version from ..[-] +LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-) +LIBCRYPTSETUP_VERSION_INFO=18:0:6 + +AM_SILENT_RULES([yes]) +AC_CONFIG_SRCDIR(src/cryptsetup.c) +AC_CONFIG_MACRO_DIR([m4]) + +AC_CONFIG_HEADERS([config.h:config.h.in]) + +# We do not want to run test in parallel. Really. +# http://lists.gnu.org/archive/html/automake/2013-01/msg00060.html + +# For old automake use this +#AM_INIT_AUTOMAKE(dist-xz subdir-objects) +AM_INIT_AUTOMAKE([dist-xz 1.12 serial-tests subdir-objects]) + +if test "x$prefix" = "xNONE"; then + sysconfdir=/etc +fi +AC_PREFIX_DEFAULT(/usr) + +AC_CANONICAL_HOST +AC_USE_SYSTEM_EXTENSIONS +AC_PROG_CC +AM_PROG_CC_C_O +AC_PROG_CPP +AC_PROG_INSTALL +AC_PROG_MAKE_SET +AC_ENABLE_STATIC(no) +LT_INIT +PKG_PROG_PKG_CONFIG +AM_ICONV + +dnl ========================================================================== +dnl define PKG_CHECK_VAR for old pkg-config <= 0.28 +m4_ifndef([AS_VAR_COPY], +[m4_define([AS_VAR_COPY], +[AS_LITERAL_IF([$1[]$2], [$1=$$2], [eval $1=\$$2])]) +]) +m4_ifndef([PKG_CHECK_VAR], [ +AC_DEFUN([PKG_CHECK_VAR], +[AC_REQUIRE([PKG_PROG_PKG_CONFIG]) +AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config]) + +_PKG_CONFIG([$1], [variable="][$3]["], [$2]) +AS_VAR_COPY([$1], [pkg_cv_][$1]) + +AS_VAR_IF([$1], [""], [$5], [$4]) +]) +]) +dnl ========================================================================== + +AC_C_RESTRICT + +AC_HEADER_DIRENT +AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h sys/ioctl.h sys/mman.h \ + sys/sysmacros.h sys/statvfs.h ctype.h unistd.h locale.h byteswap.h endian.h stdint.h) +AC_CHECK_DECLS([O_CLOEXEC],,[AC_DEFINE([O_CLOEXEC],[0], [Defined to 0 if not provided])], +[[ +#ifdef HAVE_FCNTL_H +# include +#endif +]]) + +AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])]) +AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])]) + +AC_ARG_ENABLE([keyring], + AS_HELP_STRING([--disable-keyring], [disable kernel keyring support and builtin kernel keyring token]), + [], [enable_keyring=yes]) +if test "x$enable_keyring" = "xyes"; then + AC_CHECK_HEADERS(linux/keyctl.h,,[AC_MSG_ERROR([You need Linux kernel headers with kernel keyring service compiled.])]) + + dnl ========================================================================== + dnl check whether kernel is compiled with kernel keyring service syscalls + AC_CHECK_DECL(__NR_add_key,,[AC_MSG_ERROR([The kernel is missing add_key syscall.])], [#include ]) + AC_CHECK_DECL(__NR_keyctl,,[AC_MSG_ERROR([The kernel is missing keyctl syscall.])], [#include ]) + AC_CHECK_DECL(__NR_request_key,,[AC_MSG_ERROR([The kernel is missing request_key syscall.])], [#include ]) + + dnl ========================================================================== + dnl check that key_serial_t hasn't been adopted yet in stdlib + AC_CHECK_TYPES([key_serial_t], [], [], [ + AC_INCLUDES_DEFAULT + #ifdef HAVE_LINUX_KEYCTL_H + # include + #endif + ]) + + AC_DEFINE(KERNEL_KEYRING, 1, [Enable kernel keyring service support]) +fi +AM_CONDITIONAL(KERNEL_KEYRING, test "x$enable_keyring" = "xyes") + +saved_LIBS=$LIBS +AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR([You need the uuid library.])]) +AC_SUBST(UUID_LIBS, $LIBS) +LIBS=$saved_LIBS + +AC_SEARCH_LIBS([clock_gettime],[rt posix4]) +AC_CHECK_FUNCS([posix_memalign clock_gettime posix_fallocate explicit_bzero]) + +if test "x$enable_largefile" = "xno"; then + AC_MSG_ERROR([Building with --disable-largefile is not supported, it can cause data corruption.]) +fi + +AC_C_CONST +AC_C_BIGENDIAN +AC_TYPE_OFF_T +AC_SYS_LARGEFILE +AC_FUNC_FSEEKO +AC_PROG_GCC_TRADITIONAL +AC_FUNC_STRERROR_R + +dnl ========================================================================== + +AM_GNU_GETTEXT([external],[need-ngettext]) +AM_GNU_GETTEXT_VERSION([0.18.3]) + +dnl ========================================================================== + +saved_LIBS=$LIBS +AC_CHECK_LIB(popt, poptConfigFileToString,, + [AC_MSG_ERROR([You need popt 1.7 or newer to compile.])]) +AC_SUBST(POPT_LIBS, $LIBS) +LIBS=$saved_LIBS + +dnl ========================================================================== +dnl FIPS extensions +AC_ARG_ENABLE([fips], + AS_HELP_STRING([--enable-fips], [enable FIPS mode restrictions])) +if test "x$enable_fips" = "xyes"; then + AC_DEFINE(ENABLE_FIPS, 1, [Enable FIPS mode restrictions]) + + if test "x$enable_static" = "xyes" -o "x$enable_static_cryptsetup" = "xyes" ; then + AC_MSG_ERROR([Static build is not compatible with FIPS.]) + fi +fi + +AC_DEFUN([NO_FIPS], [ + if test "x$enable_fips" = "xyes"; then + AC_MSG_ERROR([This option is not compatible with FIPS.]) + fi +]) + +dnl LUKS2 online reencryption +AC_ARG_ENABLE([luks2-reencryption], + AS_HELP_STRING([--disable-luks2-reencryption], [disable LUKS2 online reencryption extension]), + [], [enable_luks2_reencryption=yes]) +if test "x$enable_luks2_reencryption" = "xyes"; then + AC_DEFINE(USE_LUKS2_REENCRYPTION, 1, [Use LUKS2 online reencryption extension]) +fi + +dnl ========================================================================== +dnl pwquality library (cryptsetup CLI only) +AC_ARG_ENABLE([pwquality], + AS_HELP_STRING([--enable-pwquality], [enable password quality checking using pwquality library])) + +if test "x$enable_pwquality" = "xyes"; then + AC_DEFINE(ENABLE_PWQUALITY, 1, [Enable password quality checking using pwquality library]) + PKG_CHECK_MODULES([PWQUALITY], [pwquality >= 1.0.0],, + AC_MSG_ERROR([You need pwquality library.])) + + dnl FIXME: this is really hack for now + PWQUALITY_STATIC_LIBS="$PWQUALITY_LIBS -lcrack -lz" +fi + +dnl ========================================================================== +dnl passwdqc library (cryptsetup CLI only) +AC_ARG_ENABLE([passwdqc], + AS_HELP_STRING([--enable-passwdqc@<:@=CONFIG_PATH@:>@], + [enable password quality checking using passwdqc library (optionally with CONFIG_PATH)])) + +case "$enable_passwdqc" in + ""|yes|no) use_passwdqc_config="" ;; + /*) use_passwdqc_config="$enable_passwdqc"; enable_passwdqc=yes ;; + *) AC_MSG_ERROR([Unrecognized --enable-passwdqc parameter.]) ;; +esac +AC_DEFINE_UNQUOTED([PASSWDQC_CONFIG_FILE], ["$use_passwdqc_config"], [passwdqc library config file]) + +if test "x$enable_passwdqc" = "xyes"; then + AC_DEFINE(ENABLE_PASSWDQC, 1, [Enable password quality checking using passwdqc library]) + + saved_LIBS="$LIBS" + AC_SEARCH_LIBS([passwdqc_check], [passwdqc]) + case "$ac_cv_search_passwdqc_check" in + no) AC_MSG_ERROR([failed to find passwdqc_check]) ;; + -l*) PASSWDQC_LIBS="$ac_cv_search_passwdqc_check" ;; + *) PASSWDQC_LIBS= ;; + esac + AC_CHECK_FUNCS([passwdqc_params_free]) + LIBS="$saved_LIBS" +fi + +if test "x$enable_pwquality$enable_passwdqc" = "xyesyes"; then + AC_MSG_ERROR([--enable-pwquality and --enable-passwdqc are mutually incompatible.]) +fi + +dnl ========================================================================== +dnl Crypto backend functions + +AC_DEFUN([CONFIGURE_GCRYPT], [ + if test "x$enable_fips" = "xyes"; then + GCRYPT_REQ_VERSION=1.4.5 + else + GCRYPT_REQ_VERSION=1.1.42 + fi + + dnl libgcrypt rejects to use pkgconfig, use AM_PATH_LIBGCRYPT from gcrypt-devel here. + dnl Do not require gcrypt-devel if other crypto backend is used. + m4_ifdef([AM_PATH_LIBGCRYPT],[ + AC_ARG_ENABLE([gcrypt-pbkdf2], + dnl Check if we can use gcrypt PBKDF2 (1.6.0 supports empty password) + AS_HELP_STRING([--enable-gcrypt-pbkdf2], [force enable internal gcrypt PBKDF2]), + if test "x$enableval" = "xyes"; then + [use_internal_pbkdf2=0] + else + [use_internal_pbkdf2=1] + fi, + [AM_PATH_LIBGCRYPT([1.6.1], [use_internal_pbkdf2=0], [use_internal_pbkdf2=1])]) + AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])], + AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.])) + + AC_MSG_CHECKING([if internal cryptsetup PBKDF2 is compiled-in]) + if test $use_internal_pbkdf2 = 0; then + AC_MSG_RESULT([no]) + else + AC_MSG_RESULT([yes]) + NO_FIPS([]) + fi + + AC_CHECK_DECLS([GCRY_CIPHER_MODE_XTS], [], [], [#include ]) + + if test "x$enable_static_cryptsetup" = "xyes"; then + saved_LIBS=$LIBS + LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static" + AC_CHECK_LIB(gcrypt, gcry_check_version,, + AC_MSG_ERROR([Cannot find static gcrypt library.]), + [-lgpg-error]) + LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error" + LIBS=$saved_LIBS + fi + + CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS + CRYPTO_LIBS=$LIBGCRYPT_LIBS + CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS + + AC_DEFINE_UNQUOTED(GCRYPT_REQ_VERSION, ["$GCRYPT_REQ_VERSION"], [Requested gcrypt version]) +]) + +AC_DEFUN([CONFIGURE_OPENSSL], [ + PKG_CHECK_MODULES([OPENSSL], [openssl >= 0.9.8],, + AC_MSG_ERROR([You need openssl library.])) + CRYPTO_CFLAGS=$OPENSSL_CFLAGS + CRYPTO_LIBS=$OPENSSL_LIBS + use_internal_pbkdf2=0 + + if test "x$enable_static_cryptsetup" = "xyes"; then + saved_PKG_CONFIG=$PKG_CONFIG + PKG_CONFIG="$PKG_CONFIG --static" + PKG_CHECK_MODULES([OPENSSL_STATIC], [openssl]) + CRYPTO_STATIC_LIBS=$OPENSSL_STATIC_LIBS + PKG_CONFIG=$saved_PKG_CONFIG + fi +]) + +AC_DEFUN([CONFIGURE_NSS], [ + if test "x$enable_static_cryptsetup" = "xyes"; then + AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.]) + fi + + AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).]) + + PKG_CHECK_MODULES([NSS], [nss],, + AC_MSG_ERROR([You need nss library.])) + + saved_CFLAGS=$CFLAGS + CFLAGS="$CFLAGS $NSS_CFLAGS" + AC_CHECK_DECLS([NSS_GetVersion], [], [], [#include ]) + CFLAGS=$saved_CFLAGS + + CRYPTO_CFLAGS=$NSS_CFLAGS + CRYPTO_LIBS=$NSS_LIBS + use_internal_pbkdf2=1 + NO_FIPS([]) +]) + +AC_DEFUN([CONFIGURE_KERNEL], [ + AC_CHECK_HEADERS(linux/if_alg.h,, + [AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface.])]) +# AC_CHECK_DECLS([AF_ALG],, +# [AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])], +# [#include ]) + use_internal_pbkdf2=1 + NO_FIPS([]) +]) + +AC_DEFUN([CONFIGURE_NETTLE], [ + AC_CHECK_HEADERS(nettle/sha.h,, + [AC_MSG_ERROR([You need Nettle cryptographic library.])]) + AC_CHECK_HEADERS(nettle/version.h) + + saved_LIBS=$LIBS + AC_CHECK_LIB(nettle, nettle_pbkdf2_hmac_sha256,, + [AC_MSG_ERROR([You need Nettle library version 2.6 or more recent.])]) + CRYPTO_LIBS=$LIBS + LIBS=$saved_LIBS + + CRYPTO_STATIC_LIBS=$CRYPTO_LIBS + use_internal_pbkdf2=0 + NO_FIPS([]) +]) + +dnl ========================================================================== +saved_LIBS=$LIBS + +AC_ARG_ENABLE([static-cryptsetup], + AS_HELP_STRING([--enable-static-cryptsetup], [enable build of static version of tools])) +if test "x$enable_static_cryptsetup" = "xyes"; then + if test "x$enable_static" = "xno"; then + AC_MSG_WARN([Requested static cryptsetup build, enabling static library.]) + enable_static=yes + fi +fi +AM_CONDITIONAL(STATIC_TOOLS, test "x$enable_static_cryptsetup" = "xyes") + +AC_ARG_ENABLE([cryptsetup], + AS_HELP_STRING([--disable-cryptsetup], [disable cryptsetup support]), + [], [enable_cryptsetup=yes]) +AM_CONDITIONAL(CRYPTSETUP, test "x$enable_cryptsetup" = "xyes") + +AC_ARG_ENABLE([veritysetup], + AS_HELP_STRING([--disable-veritysetup], [disable veritysetup support]), + [], [enable_veritysetup=yes]) +AM_CONDITIONAL(VERITYSETUP, test "x$enable_veritysetup" = "xyes") + +AC_ARG_ENABLE([cryptsetup-reencrypt], + AS_HELP_STRING([--disable-cryptsetup-reencrypt], [disable cryptsetup-reencrypt tool]), + [], [enable_cryptsetup_reencrypt=yes]) +AM_CONDITIONAL(REENCRYPT, test "x$enable_cryptsetup_reencrypt" = "xyes") + +AC_ARG_ENABLE([integritysetup], + AS_HELP_STRING([--disable-integritysetup], [disable integritysetup support]), + [], [enable_integritysetup=yes]) +AM_CONDITIONAL(INTEGRITYSETUP, test "x$enable_integritysetup" = "xyes") + +AC_ARG_ENABLE([selinux], + AS_HELP_STRING([--disable-selinux], [disable selinux support [default=auto]]), + [], [enable_selinux=yes]) + +AC_ARG_ENABLE([udev], + AS_HELP_STRING([--disable-udev], [disable udev support]), + [], [enable_udev=yes]) + +dnl Try to use pkg-config for devmapper, but fallback to old detection +PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [ + AC_CHECK_LIB(devmapper, dm_task_set_name,, + [AC_MSG_ERROR([You need the device-mapper library.])]) + AC_CHECK_LIB(devmapper, dm_task_set_message,, + [AC_MSG_ERROR([The device-mapper library on your system is too old.])]) + DEVMAPPER_LIBS=$LIBS +]) +LIBS=$saved_LIBS + +LIBS="$LIBS $DEVMAPPER_LIBS" +AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include ]) +AC_CHECK_DECLS([dm_task_retry_remove], [], [], [#include ]) +AC_CHECK_DECLS([dm_task_deferred_remove], [], [], [#include ]) +AC_CHECK_DECLS([dm_device_has_mounted_fs], [], [], [#include ]) +AC_CHECK_DECLS([dm_device_has_holders], [], [], [#include ]) +AC_CHECK_DECLS([dm_device_get_name], [], [], [#include ]) +AC_CHECK_DECLS([DM_DEVICE_GET_TARGET_VERSION], [], [], [#include ]) +AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include ]) +if test "x$enable_udev" = xyes; then + if test "x$have_cookie" = xno; then + AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.]) + else + AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?]) + fi +fi +LIBS=$saved_LIBS + +dnl Check for JSON-C used in LUKS2 +PKG_CHECK_MODULES([JSON_C], [json-c]) +AC_CHECK_DECLS([json_object_object_add_ex], [], [], [#include ]) +AC_CHECK_DECLS([json_object_deep_copy], [], [], [#include ]) + +dnl Crypto backend configuration. +AC_ARG_WITH([crypto_backend], + AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle) [openssl]]), + [], [with_crypto_backend=openssl]) + +dnl Kernel crypto API backend needed for benchmark and tcrypt +AC_ARG_ENABLE([kernel_crypto], + AS_HELP_STRING([--disable-kernel_crypto], [disable kernel userspace crypto (no benchmark and tcrypt)]), + [], [enable_kernel_crypto=yes]) + +if test "x$enable_kernel_crypto" = "xyes"; then + AC_CHECK_HEADERS(linux/if_alg.h,, + [AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface. (Or use --disable-kernel_crypto.)])]) + AC_DEFINE(ENABLE_AF_ALG, 1, [Enable using of kernel userspace crypto]) +fi + +case $with_crypto_backend in + gcrypt) CONFIGURE_GCRYPT([]) ;; + openssl) CONFIGURE_OPENSSL([]) ;; + nss) CONFIGURE_NSS([]) ;; + kernel) CONFIGURE_KERNEL([]) ;; + nettle) CONFIGURE_NETTLE([]) ;; + *) AC_MSG_ERROR([Unknown crypto backend.]) ;; +esac +AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT, test "$with_crypto_backend" = "gcrypt") +AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test "$with_crypto_backend" = "openssl") +AM_CONDITIONAL(CRYPTO_BACKEND_NSS, test "$with_crypto_backend" = "nss") +AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL, test "$with_crypto_backend" = "kernel") +AM_CONDITIONAL(CRYPTO_BACKEND_NETTLE, test "$with_crypto_backend" = "nettle") + +AM_CONDITIONAL(CRYPTO_INTERNAL_PBKDF2, test $use_internal_pbkdf2 = 1) +AC_DEFINE_UNQUOTED(USE_INTERNAL_PBKDF2, [$use_internal_pbkdf2], [Use internal PBKDF2]) + +dnl Argon2 implementation +AC_ARG_ENABLE([internal-argon2], + AS_HELP_STRING([--disable-internal-argon2], [disable internal implementation of Argon2 PBKDF]), + [], [enable_internal_argon2=yes]) + +AC_ARG_ENABLE([libargon2], + AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)])) + +if test "x$enable_libargon2" = "xyes" ; then + AC_CHECK_HEADERS(argon2.h,, + [AC_MSG_ERROR([You need libargon2 development library installed.])]) + AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include ]) + PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"]) + enable_internal_argon2=no +else + AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.]) + + AC_ARG_ENABLE([internal-sse-argon2], + AS_HELP_STRING([--enable-internal-sse-argon2], [enable internal SSE implementation of Argon2 PBKDF])) + + if test "x$enable_internal_sse_argon2" = "xyes"; then + AC_MSG_CHECKING(if Argon2 SSE optimization can be used) + AC_LINK_IFELSE([AC_LANG_PROGRAM([[ + #include + __m128i testfunc(__m128i *a, __m128i *b) { + return _mm_xor_si128(_mm_loadu_si128(a), _mm_loadu_si128(b)); + } + ]])],,[enable_internal_sse_argon2=no]) + AC_MSG_RESULT($enable_internal_sse_argon2) + fi +fi + +if test "x$enable_internal_argon2" = "xyes"; then + AC_DEFINE(USE_INTERNAL_ARGON2, 1, [Use internal Argon2]) +fi +AM_CONDITIONAL(CRYPTO_INTERNAL_ARGON2, test "x$enable_internal_argon2" = "xyes") +AM_CONDITIONAL(CRYPTO_INTERNAL_SSE_ARGON2, test "x$enable_internal_sse_argon2" = "xyes") + +dnl Link with blkid to check for other device types +AC_ARG_ENABLE([blkid], + AS_HELP_STRING([--disable-blkid], [disable use of blkid for device signature detection and wiping]), + [], [enable_blkid=yes]) + +if test "x$enable_blkid" = "xyes"; then + PKG_CHECK_MODULES([BLKID], [blkid],[AC_DEFINE([HAVE_BLKID], 1, [Define to 1 to use blkid for detection of disk signatures.])],[LIBBLKID_LIBS="-lblkid"]) + + AC_CHECK_HEADERS(blkid/blkid.h,,[AC_MSG_ERROR([You need blkid development library installed.])]) + AC_CHECK_DECL([blkid_do_wipe], + [ AC_DEFINE([HAVE_BLKID_WIPE], 1, [Define to 1 to use blkid_do_wipe.]) + enable_blkid_wipe=yes + ],, + [#include ]) + AC_CHECK_DECL([blkid_probe_step_back], + [ AC_DEFINE([HAVE_BLKID_STEP_BACK], 1, [Define to 1 to use blkid_probe_step_back.]) + enable_blkid_step_back=yes + ],, + [#include ]) + AC_CHECK_DECLS([ blkid_reset_probe, + blkid_probe_set_device, + blkid_probe_filter_superblocks_type, + blkid_do_safeprobe, + blkid_do_probe, + blkid_probe_lookup_value + ],, + [AC_MSG_ERROR([Can not compile with blkid support, disable it by --disable-blkid.])], + [#include ]) +fi +AM_CONDITIONAL(HAVE_BLKID, test "x$enable_blkid" = "xyes") +AM_CONDITIONAL(HAVE_BLKID_WIPE, test "x$enable_blkid_wipe" = "xyes") +AM_CONDITIONAL(HAVE_BLKID_STEP_BACK, test "x$enable_blkid_step_back" = "xyes") + +dnl Magic for cryptsetup.static build. +if test "x$enable_static_cryptsetup" = "xyes"; then + saved_PKG_CONFIG=$PKG_CONFIG + PKG_CONFIG="$PKG_CONFIG --static" + + LIBS="$saved_LIBS -static" + AC_CHECK_LIB(popt, poptGetContext,, + AC_MSG_ERROR([Cannot find static popt library.])) + + dnl Try to detect needed device-mapper static libraries, try pkg-config first. + LIBS="$saved_LIBS -static" + PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[ + DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS + if test "x$enable_selinux" = "xyes"; then + AC_CHECK_LIB(sepol, sepol_bool_set) + AC_CHECK_LIB(selinux, is_selinux_enabled) + DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS" + fi + ]) + LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS" + AC_CHECK_LIB(devmapper, dm_task_set_uuid,, + AC_MSG_ERROR([Cannot link with static device-mapper library.])) + + dnl Try to detect uuid static library. + LIBS="$saved_LIBS -static" + AC_CHECK_LIB(uuid, uuid_generate,, + AC_MSG_ERROR([Cannot find static uuid library.])) + + LIBS=$saved_LIBS + PKG_CONFIG=$saved_PKG_CONFIG +fi + +AC_MSG_CHECKING([for systemd tmpfiles config directory]) +PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no]) +AC_MSG_RESULT([$systemd_tmpfilesdir]) + +AC_SUBST([DEVMAPPER_LIBS]) +AC_SUBST([DEVMAPPER_STATIC_LIBS]) + +AC_SUBST([PWQUALITY_LIBS]) +AC_SUBST([PWQUALITY_STATIC_LIBS]) + +AC_SUBST([PASSWDQC_LIBS]) + +AC_SUBST([CRYPTO_CFLAGS]) +AC_SUBST([CRYPTO_LIBS]) +AC_SUBST([CRYPTO_STATIC_LIBS]) + +AC_SUBST([JSON_C_LIBS]) +AC_SUBST([LIBARGON2_LIBS]) +AC_SUBST([BLKID_LIBS]) + +AC_SUBST([LIBCRYPTSETUP_VERSION]) +AC_SUBST([LIBCRYPTSETUP_VERSION_INFO]) + +dnl ========================================================================== +AC_ARG_ENABLE([dev-random], + AS_HELP_STRING([--enable-dev-random], [use /dev/random by default for key generation (otherwise use /dev/urandom)])) +if test "x$enable_dev_random" = "xyes"; then + default_rng=/dev/random +else + default_rng=/dev/urandom +fi +AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator]) + +dnl ========================================================================== +AC_DEFUN([CS_DEFINE], + [AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3]) +]) + +AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1], + [AS_HELP_STRING(--with-[$1], [default $2 [$3]])], + [CS_DEFINE([$1], ["$withval"], [$2])], + [CS_DEFINE([$1], ["$3"], [$2])] +)]) + +AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1], + [AS_HELP_STRING(--with-[$1], [default $2 [$3]])], + [CS_DEFINE([$1], [$withval], [$2])], + [CS_DEFINE([$1], [$3], [$2])] +)]) + +AC_DEFUN([CS_ABSPATH], [ + case "$1" in + /*) ;; + *) AC_MSG_ERROR([$2 argument must be an absolute path.]);; + esac +]) + +dnl ========================================================================== +CS_STR_WITH([plain-hash], [password hashing function for plain mode], [ripemd160]) +CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes]) +CS_STR_WITH([plain-mode], [cipher mode for plain mode], [cbc-essiv:sha256]) +CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256]) + +CS_STR_WITH([luks1-hash], [hash function for LUKS1 header], [sha256]) +CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes]) +CS_STR_WITH([luks1-mode], [cipher mode for LUKS1], [xts-plain64]) +CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256]) + +AC_ARG_ENABLE([luks_adjust_xts_keysize], AS_HELP_STRING([--disable-luks-adjust-xts-keysize], + [XTS mode requires two keys, double default LUKS keysize if needed]), + [], [enable_luks_adjust_xts_keysize=yes]) +if test "x$enable_luks_adjust_xts_keysize" = "xyes"; then + AC_DEFINE(ENABLE_LUKS_ADJUST_XTS_KEYSIZE, 1, [XTS mode - double default LUKS keysize if needed]) +fi + +CS_STR_WITH([luks2-pbkdf], [Default PBKDF algorithm (pbkdf2 or argon2i/argon2id) for LUKS2], [argon2i]) +CS_NUM_WITH([luks1-iter-time], [PBKDF2 iteration time for LUKS1 (in ms)], [2000]) +CS_NUM_WITH([luks2-iter-time], [Argon2 PBKDF iteration time for LUKS2 (in ms)], [2000]) +CS_NUM_WITH([luks2-memory-kb], [Argon2 PBKDF memory cost for LUKS2 (in kB)], [1048576]) +CS_NUM_WITH([luks2-parallel-threads],[Argon2 PBKDF max parallel cost for LUKS2 (if CPUs available)], [4]) + +CS_STR_WITH([luks2-keyslot-cipher], [fallback cipher for LUKS2 keyslot (if data encryption is incompatible)], [aes-xts-plain64]) +CS_NUM_WITH([luks2-keyslot-keybits],[fallback key size for LUKS2 keyslot (if data encryption is incompatible)], [512]) + +CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes]) +CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256]) + +CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in KiB)], [8192]) +CS_NUM_WITH([integrity-keyfile-size-maxkb],[maximum integritysetup keyfile size (in KiB)], [4]) +CS_NUM_WITH([passphrase-size-max],[maximum passphrase size (in characters)], [512]) + +CS_STR_WITH([verity-hash], [hash function for verity mode], [sha256]) +CS_NUM_WITH([verity-data-block], [data block size for verity mode], [4096]) +CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096]) +CS_NUM_WITH([verity-salt-size], [salt size for verity mode], [32]) +CS_NUM_WITH([verity-fec-roots], [parity bytes for verity FEC], [2]) + +CS_STR_WITH([tmpfilesdir], [override default path to directory with systemd temporary files], []) +test -z "$with_tmpfilesdir" && with_tmpfilesdir=$systemd_tmpfilesdir +test "x$with_tmpfilesdir" = "xno" || { + CS_ABSPATH([${with_tmpfilesdir}],[with-tmpfilesdir]) + DEFAULT_TMPFILESDIR=$with_tmpfilesdir + AC_SUBST(DEFAULT_TMPFILESDIR) +} +AM_CONDITIONAL(CRYPTSETUP_TMPFILE, test -n "$DEFAULT_TMPFILESDIR") + +CS_STR_WITH([luks2-lock-path], [path to directory for LUKSv2 locks], [/run/cryptsetup]) +test -z "$with_luks2_lock_path" && with_luks2_lock_path=/run/cryptsetup +CS_ABSPATH([${with_luks2_lock_path}],[with-luks2-lock-path]) +DEFAULT_LUKS2_LOCK_PATH=$with_luks2_lock_path +AC_SUBST(DEFAULT_LUKS2_LOCK_PATH) + +CS_NUM_WITH([luks2-lock-dir-perms], [default luks2 locking directory permissions], [0700]) +test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700 +DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms +AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS) + +dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only). +AC_ARG_WITH([default_luks_format], + AS_HELP_STRING([--with-default-luks-format=FORMAT], [default LUKS format version (LUKS1/LUKS2) [LUKS2]]), + [], [with_default_luks_format=LUKS2]) + +case $with_default_luks_format in + LUKS1) default_luks=CRYPT_LUKS1 ;; + LUKS2) default_luks=CRYPT_LUKS2 ;; + *) AC_MSG_ERROR([Unknown default LUKS format. Use LUKS1 or LUKS2 only.]) ;; +esac +AC_DEFINE_UNQUOTED([DEFAULT_LUKS_FORMAT], [$default_luks], [default LUKS format version]) + +dnl ========================================================================== + +AC_CONFIG_FILES([ Makefile +lib/libcryptsetup.pc +po/Makefile.in +scripts/cryptsetup.conf +tests/Makefile +]) +AC_OUTPUT diff --git a/docs/ChangeLog.old b/docs/ChangeLog.old new file mode 100644 index 0000000..7a4027c --- /dev/null +++ b/docs/ChangeLog.old @@ -0,0 +1,887 @@ +2012-12-21 Milan Broz + * Since version 1.6 This file is no longer maintained. + * See version control log http://code.google.com/p/cryptsetup/source/list + +2012-10-11 Milan Broz + * Added keyslot checker (by Arno Wagner). + * Version 1.5.1. + +2012-09-11 Milan Broz + * Add crypt_keyslot_area() API call. + +2012-08-27 Milan Broz + * Optimize seek to keyfile-offset (Issue #135, thx to dreisner). + * Fix luksHeaderBackup for very old v1.0 unaligned LUKS headers. + +2012-08-12 Milan Broz + * Allocate loop device late (only when real block device needed). + * Rework underlying device/file access functions. + * Create hash image if doesn't exist in veritysetup format. + * Provide better error message if running as non-root user (device-mapper, loop). + +2012-07-10 Milan Broz + * Version 1.5.0. + +2012-06-25 Milan Broz + * Add --device-size option for reencryption tool. + * Switch to use unit suffix for --reduce-device-size option. + * Remove open device debugging feature (no longer needed). + * Fix library name for FIPS check. + +2012-06-20 Milan Broz + * Version 1.5.0-rc2. + +2012-06-18 Milan Broz + * Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool. + * Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID). + * Add --test-passphrase option for luksOpen (check passphrase only). + +2012-06-11 Milan Broz + * Introduce veritysetup for dm-verity target management. + * Version 1.5.0-rc1. + +2012-06-10 Milan Broz + * Both data and header device can now be a file. + * Loop is automatically allocated in crypt_set_data_device(). + * Require only up to last keyslot area for header device (ignore data offset). + * Fix header backup and restore to work on files with large data offset. + +2012-05-27 Milan Broz + * Fix readonly activation if underlying device is readonly (1.4.0). + * Include stddef.h in libdevmapper.h (size_t definition). + * Version 1.4.3. + +2012-05-21 Milan Broz + * Add --enable-fips for linking with fipscheck library. + * Initialize binary and library selfcheck if running in FIPS mode. + * Use FIPS RNG in FIPS mode for KEY and SALT (only gcrypt backend supported). + +2012-05-09 Milan Broz + * Fix keyslot removal (wipe keyslot) for device with 4k hw block (1.4.0). + * Allow empty cipher (cipher_null) for testing. + +2012-05-02 Milan Broz + * Fix loop mapping on readonly file. + * Relax --shared test, allow mapping even for overlapping segments. + * Support shared flag for LUKS devices (dangerous). + * Switch on retry on device remove for libdevmapper. + * Allow "private" activation (skip some udev global rules) flag. + +2012-04-09 Milan Broz + * Fix header check to support old (cryptsetup 1.0.0) header alignment. (1.4.0) + * Version 1.4.2. + +2012-03-16 Milan Broz + * Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI. + * Add repair command and crypt_repair() for known LUKS metadata problems repair. + * Allow to specify --align-payload only for luksFormat. + +2012-03-16 Milan Broz + * Unify password verification option. + * Support password verification with quiet flag if possible. (1.2.0) + * Fix retry if entered passphrases (with verify option) do not match. + * Support UUID= format for device specification. + +2012-02-11 Milan Broz + * Add --master-key-file option to luksOpen (open using volume key). + +2012-01-12 Milan Broz + * Fix use of empty keyfile. + +2011-11-13 Milan Broz + * Fix error message for luksClose and detached LUKS header. + * Allow --header for status command to get full info with detached header. + +2011-11-09 Milan Broz + * Version 1.4.1. + +2011-11-05 Milan Broz + * Merge pycryptsetup (Python libcryptsetup bindings). + * Fix stupid typo in set_iteration_time API call. + * Fix cryptsetup status output if parameter is device path. + +2011-10-27 Milan Broz + * Fix crypt_get_volume_key_size() for plain device. + * Fix FSF address in license text. + +2011-10-25 Milan Broz + * Print informative message in isLuks only in verbose mode. + * Version 1.4.0. + +2011-10-10 Milan Broz + * Version 1.4.0-rc1. + +2011-10-05 Milan Broz + * Support Nettle 2.4 crypto backend (for ripemd160). + * If device is not rotational, do not use Gutmann wipe method. + * Add crypt_last_error() API call. + * Fix luksKillSLot exit code if slot is inactive or invalid. + * Fix exit code if passphrases do not match in luksAddKey. + * Add LUKS on-disk format description into package. + +2011-09-22 Milan Broz + * Support key-slot option for luksOpen (use only explicit keyslot). + +2011-08-22 Milan Broz + * Add more paranoid checks for LUKS header and keyslot attributes. + * Fix crypt_load to properly check device size. + * Use new /dev/loop-control (kernel 3.1) if possible. + * Enhance check of device size before writing LUKS header. + * Do not allow context format of already formatted device. + +2011-07-25 Milan Broz + * Remove hash/hmac restart from crypto backend and make it part of hash/hmac final. + * Improve check for invalid offset and size values. + +2011-07-19 Milan Broz + * Revert default initialisation of volume key in crypt_init_by_name(). + * Do not allow key retrieval while suspended (key could be wiped). + * Do not allow suspend for non-LUKS devices. + * Support retries and timeout parameters for luksSuspend. + * Add --header option for detached metadata (on-disk LUKS header) device. + * Add crypt_init_by_name_and_header() and crypt_set_data_device() to API. + * Allow different data offset setting for detached header. + +2011-07-07 Milan Broz + * Remove old API functions (all functions using crypt_options). + * Add --enable-discards option to allow discards/TRIM requests. + * Add crypt_get_iv_offset() function to API. + +2011-07-01 Milan Broz + * Add --shared option for creating non-overlapping crypt segments. + * Add shared flag to libcryptsetup api. + * Fix plain crypt format parameters to include size option (API change). + +2011-06-08 Milan Broz + * Fix return code for status command when device doesn't exists. + +2011-05-24 Milan Broz + * Version 1.3.1. + +2011-05-17 Milan Broz + * Fix keyfile=- processing in create command (1.3.0). + * Simplify device path status check. + +2011-05-03 Milan Broz + * Do not ignore size argument for create command (1.2.0). + +2011-04-18 Milan Broz + * Fix error paths in blockwise code and lseek_write call. + * Add Nettle crypto backend support. + +2011-04-05 Milan Broz + * Version 1.3.0. + +2011-03-22 Milan Broz + * Also support --skip and --hash option for loopaesOpen. + * Fix return code when passphrase is read from pipe. + * Document cryptsetup exit codes. + +2011-03-18 Milan Broz + * Respect maximum keyfile size parameter. + * Introduce maximum default keyfile size, add configure option. + * Require the whole key read from keyfile in create command (broken in 1.2.0). + * Fix offset option for loopaesOpen. + * Lock memory also in luksDump command. + * Version 1.3.0-rc2. + +2011-03-14 Milan Broz + * Version 1.3.0-rc1. + +2011-03-11 Milan Broz + * Add loop manipulation code and support mapping of images in file. + * Add backing device loop info into status message. + * Add luksChangeKey command. + +2011-03-05 Milan Broz + * Add exception to COPYING for binary distribution linked with OpenSSL library. + * Set secure data flag (wipe all ioctl buffers) if devmapper library supports it. + +2011-01-29 Milan Broz + * Fix mapping removal if device disappeared but node still exists. + * Fix luksAddKey return code if master key is used. + +2011-01-25 Milan Broz + * Add loop-AES handling (loopaesOpen and loopaesClose commands). + (requires kernel 2.6.38 and above) + +2011-01-05 Milan Broz + * Fix static build (--disable-static-cryptsetup now works properly). + +2010-12-30 Milan Broz + * Add compile time crypto backends implementation + (gcrypt, OpenSSL, NSS and userspace Linux kernel crypto api). + * Currently NSS is lacking ripemd160, cannot provide full plain compatibility. + * Use --with-crypto_backend=[gcrypt|openssl|nss|kernel] to configure. + +2010-12-20 Milan Broz + * Version 1.2.0. + +2010-11-25 Milan Broz + * Fix crypt_activate_by_keyfile() to work with PLAIN devices. + * Fix create command to properly handle keyfile size. + +2010-11-16 Milan Broz + * Version 1.2.0-rc1. + +2010-11-13 Milan Broz + * Fix password callback call. + * Fix default plain password entry from terminal in activate_by_passphrase. + * Add --dump-master-key option for luksDump to allow volume key dump. + * Allow to activate by internally cached volume key + (format/activate without keyslots active - used for temporary devices). + * Initialize volume key from active device in crypt_init_by_name() + * Fix cryptsetup binary exitcodes. + * Increase library version (still binary compatible with 1.1.x release). + +2010-11-01 Milan Broz + * No longer support luksDelKey, reload and --non-exclusive. + * Remove some obsolete info from man page. + * Add crypt_get_type(), crypt_resize(), crypt_keyslot_max() + and crypt_get_active_device() to API. + * Rewrite all implementations in cryptsetup to new API. + * Fix luksRemoveKey to behave as documented (do not ask + for remaining keyslot passphrase). + * Add more regression tests for commands. + * Disallow mapping of device which is already in use (mapped or mounted). + * Disallow luksFormat on device in use. + +2010-10-27 Milan Broz + * Rewrite cryptsetup luksFormat, luksOpen, luksAddKey to use new API + to allow adding new features. + * Implement --use-random and --use-urandom for luksFormat to allow + setting of RNG for volume key generator. + * Add crypt_set_rng_type() and crypt_get_rng_type() to API. + * Add crypt_set_uuid() to API. + * Allow UUID setting in luksFormat and luksUUID (--uuid parameter). + * Add --keyfile-size and --new-keyfile-size (in bytes) size and disallow overloading + of --key-size for limiting keyfile reads. + * Fix luksFormat to properly use key file with --master-key-file switch. + * Fix possible double free when handling master key file. + +2010-10-17 Milan Broz + * Add crypt_get_device_name() to API (get underlying device name). + * Change detection for static libraries. + * Fix pkg-config use in automake scripts. + * Remove --disable-shared-library switch and handle static library build + by common libtool logic (using --enable-static). + * Add --enable-static-cryptsetup option to build cryptsetup.static binary + together with shared build. + +2010-08-05 Milan Broz + * Wipe iteration and salt after KillSlot in LUKS header. + * Rewrite file differ test to C (and fix it to really work). + * Switch to 1MiB default alignment of data. + For more info see https://bugzilla.redhat.com/show_bug.cgi?id=621684 + * Do not query non-existent device twice (cryptsetup status /dev/nonexistent). + * Check if requested hash is supported before writing LUKS header. + +2010-07-28 Arno Wagner + * Add FAQ (Frequently Asked Questions) file to distribution. + +2010-07-03 Milan Broz + * Fix udev support for old libdevmapper with not compatible definition. + * Version 1.1.3. + +2010-06-01 Milan Broz + * Fix device alignment ioctl calls parameters. + * Fix activate_by_* API calls to handle NULL device name as documented. + +2010-05-30 Milan Broz + * Version 1.1.2. + +2010-05-27 Milan Broz + * Fix luksFormat/luksOpen reading passphrase from stdin and "-" keyfile. + * Support --key-file/-d option for luksFormat. + * Fix description of --key-file and add --verbose and --debug options to man page. + * Add verbose log level and move unlocking message there. + * Remove device even if underlying device disappeared. + * Fix (deprecated) reload device command to accept new device argument. + +2010-05-23 Milan Broz + * Fix luksClose operation for stacked DM devices. + * Version 1.1.1. + +2010-05-03 Milan Broz + * Fix automatic dm-crypt module loading. + * Escape hyphens in man page. + * Version 1.1.1-rc2. + +2010-04-30 Milan Broz + * Try to use pkgconfig for device mapper library. + * Detect old dm-crypt module and disable LUKS suspend/resume. + * Fix apitest to work on older systems. + * Allow no hash specification in plain device constructor. + * Fix luksOpen reading of passphrase on stdin (if "-" keyfile specified). + * Fix isLuks to initialise crypto backend (blkid instead is suggested anyway). + * Version 1.1.1-rc1. + +2010-04-12 Milan Broz + * Fix package config to use proper package version. + * Avoid class C++ keyword in library header. + * Detect and use devmapper udev support if available (disable by --disable-udev). + +2010-04-06 Milan Broz + * Prefer some device paths in status display. + * Support device topology detectionfor data alignment. + +2010-02-25 Milan Broz + * Do not verify unlocking passphrase in luksAddKey command. + * Properly initialise crypto backend in header backup/restore commands. + +2010-01-17 Milan Broz + * If gcrypt compiled with capabilities, document workaround for cryptsetup (see lib/gcrypt.c). + * Version 1.1.0. + +2010-01-10 Milan Broz + * Fix initialisation of gcrypt during luksFormat. + * Convert hash name to lower case in header (fix sha1 backward compatible header) + * Check for minimum required gcrypt version. + +2009-12-30 Milan Broz + * Fix key slot iteration count calculation (small -i value was the same as default). + * The slot and key digest iteration minimum is now 1000. + * The key digest iteration # is calculated from iteration time (approx 1/8 of that). + * Version 1.1.0-rc4. + +2009-12-11 Milan Broz + * Fix error handling during reading passhrase. + +2009-12-01 Milan Broz + * Allow changes of default compiled-in cipher parameters through configure. + * Switch default key size for LUKS to 256bits. + * Switch default plain mode to aes-cbc-essiv:sha256 (default is backward incompatible!). + +2009-11-14 Milan Broz + * Add CRYPT_ prefix to enum defined in libcryptsetup.h. + * Fix status call to fail when running as non-root user. + * Check in configure if selinux libraries are required in static version. + * Add temporary debug code to find processes locking internal device. + * Simplify build system, use autopoint and clean gettext processing. + * Use proper NLS macros and detection (so the message translation works again). + * Version 1.1.0-rc3. + +2009-09-30 Milan Broz + * Fix exported symbols and versions in libcryptsetup. + * Do not use internal lib functions in cryptsetup. + * Add crypt_log to library. + * Fix crypt_remove_device (remove, luksClose) implementation. + * Move dm backend initialisation to library calls. + * Move duplicate Command failed message to verbose level (error is printed always). + * Add some password and used algorithms notes to man page. + * Version 1.1.0-rc2. + +2009-09-28 Milan Broz + * Add luksHeaderBackup and luksHeaderRestore commands. + * Fail passphrase read if piped input no longer exists. + * Version 1.1.0-rc1. + +2009-09-15 Milan Broz + * Initialize crypto library before LUKS header load. + * Fix manpage to not require --size which expands to device size by default. + +2009-09-10 Milan Broz + * Clean up Makefiles and configure script. + * Version 1.1.0-test0. + +2009-09-08 Milan Broz + * Use dm-uuid for all crypt devices, contains device type and name now. + * Try to read first sector from device to properly check that device is ready. + +2009-09-02 Milan Broz + * Add luksSuspend (freeze device and wipe key) and luksResume (with provided passphrase). + +2009-08-30 Milan Broz + * Require device device-mapper to build and do not use backend wrapper for dm calls. + * Move memory locking and dm initialization to command layer. + * Increase priority of process if memory is locked. + * Add log macros and make logging more consistent. + * Move command successful messages to verbose level. + * Introduce --debug parameter. + * Move device utils code and provide context parameter (for log). + * Keyfile now must be provided by path, only stdin file descriptor is used (api only). + * Do not call isatty() on closed keyfile descriptor. + * Run performance check for PBKDF2 from LUKS code, do not mix hash algorithms results. + * Add ability to provide pre-generated master key and UUID in LUKS header format. + * Add LUKS function to verify master key digest. + * Move key slot manipulation function into LUKS specific code. + * Replace global options struct with separate parameters in helper functions. + * Add new libcryptsetup API (documented in libcryptsetup.h). + * Implement old API calls using new functions. + * Remove old API code helper functions. + * Add --master-key-file option for luksFormat and luksAddKey. + +2009-08-17 Milan Broz + * Fix PBKDF2 speed calculation for large passphrases. + * Allow using passphrase provided in options struct for LuksOpen. + * Allow restrict keys size in LuksOpen. + +2009-07-30 Milan Broz + * Fix errors when compiled with LUKS_DEBUG. + * Print error when getline fails. + * Remove po/cryptsetup-luks.pot, it's autogenerated. + * Return ENOENT for empty keyslots, EINVAL will be used later for other type of error. + * Switch PBKDF2 from internal SHA1 to libgcrypt, make hash algorithm not hardcoded to SHA1 here. + * Add required parameters for changing hash used in LUKS key setup scheme. + * Do not export simple XOR helper now used only inside AF functions. + * Completely remove internal SHA1 implementation code, not needed anymore. + * Enable hash algorithm selection for LUKS through -h luksFormat option. + +2009-07-28 Milan Broz + * Pad luks header to 512 sector size. + * Rework read/write blockwise to not split operation to many pieces. + * Use posix_memalign if available. + +2009-07-22 Milan Broz + * Fix segfault if provided slot in luksKillslot is invalid. + * Remove unneeded timeout when remove of temporary device succeeded. + +2009-07-22 Milan Broz + * version 1.0.7 + +2009-07-16 Milan Broz + * Allow removal of last slot in luksRemoveKey and luksKillSlot. + +2009-07-11 Milan Broz + + * Add --disable-selinux option and fix static build if selinux is required. + * Reject unsupported --offset and --skip options for luksFormat and update man page. + +2009-06-22 Milan Broz + + * Summary of changes in subversion for 1.0.7-rc1: + * Various man page fixes. + * Set UUID in device-mapper for LUKS devices. + * Retain readahead of underlying device. + * Display device name when asking for password. + * Check device size when loading LUKS header. Remove misleading error message later. + * Add error hint if dm-crypt mapping failed. + * Use better error messages if device doesn't exist or is already used by other mapping. + * Fix make distcheck. + * Check if all slots are full during luksAddKey. + * Fix segfault in set_error. + * Code cleanups, remove precompiled pot files, remove unnecessary files from po directory + * Fix uninitialized return value variable in setup.c. + * Code cleanups. (thanks to Ivan Stankovic) + * Fix wrong output for remaining key at key deletion. + * Allow deletion of key slot while other keys have the same key information. + * Add missing AM_PROG_CC_C_O to configure.in + * Remove duplicate sentence in man page. + * Wipe start of device (possible fs signature) before LUKS-formatting. + * Do not process configure.in in hidden directories. + * Return more descriptive error in case of IO or header format error. + * Use remapping to error target instead of calling udevsettle for temporary crypt device. + * Check device mapper communication and warn user if device-mapper support missing in kernel. + * Fix signal handler to properly close device. + * write_lseek_blockwise: declare innerCount outside the if block. + * add -Wall to the default CFLAGS. fix some signedness issues. + * Error handling improvement. + * Add non-exclusive override to interface definition. + * Refactor key slot selection into keyslot_from_option. + +2007-05-01 Clemens Fruhwirth + + * lib/backends.c, man/cryptsetup.8: Apply patch from Ludwig Nussel + , for old SuSE compat hashing. + +2007-04-16 Clemens Fruhwirth + + * Summary of changes in subversion: + Fix segfault for key size > 32 bytes. + Kick ancient header version conversion. + Fix http://bugs.debian.org/403075 + No passwort retrying for I/O errors. + Fix hang on "-i 0". + Fix parenthesization error that prevented --tries from working + correctly. + +2006-11-28 gettextize + + * m4/gettext.m4: Upgrade to gettext-0.15. + * m4/glibc2.m4: New file, from gettext-0.15. + * m4/intmax.m4: New file, from gettext-0.15. + * m4/inttypes-h.m4: New file, from gettext-0.15. + * m4/inttypes-pri.m4: Upgrade to gettext-0.15. + * m4/lib-link.m4: Upgrade to gettext-0.15. + * m4/lib-prefix.m4: Upgrade to gettext-0.15. + * m4/lock.m4: New file, from gettext-0.15. + * m4/longdouble.m4: New file, from gettext-0.15. + * m4/longlong.m4: New file, from gettext-0.15. + * m4/nls.m4: Upgrade to gettext-0.15. + * m4/po.m4: Upgrade to gettext-0.15. + * m4/printf-posix.m4: New file, from gettext-0.15. + * m4/signed.m4: New file, from gettext-0.15. + * m4/size_max.m4: New file, from gettext-0.15. + * m4/visibility.m4: New file, from gettext-0.15. + * m4/wchar_t.m4: New file, from gettext-0.15. + * m4/wint_t.m4: New file, from gettext-0.15. + * m4/xsize.m4: New file, from gettext-0.15. + * m4/Makefile.am: New file. + * configure.in (AC_OUTPUT): Add m4/Makefile. + (AM_GNU_GETTEXT_VERSION): Bump to 0.15. + +2006-10-22 David Härdeman + + * Allow hashing of keys passed through stdin. + +2006-10-13 Clemens Fruhwirth + + * configure.in: 1.0.4 release + +2006-10-13 Clemens Fruhwirth + + * man/cryptsetup.8: Document --tries switch; patch by Jonas + Meurer. + +2006-10-13 Clemens Fruhwirth + + * lib/setup.c: Added terminal timeout rewrite as forwarded by + Jonas Meurer + +2006-10-04 Clemens Fruhwirth + + * Merged patch from Marc Merlin to allow user + selection of key slot. + +2006-09-26 gettextize + + * m4/codeset.m4: Upgrade to gettext-0.14.4. + * m4/gettext.m4: Upgrade to gettext-0.14.4. + * m4/glibc2.m4: New file, from gettext-0.14.4. + * m4/glibc21.m4: Upgrade to gettext-0.14.4. + * m4/iconv.m4: Upgrade to gettext-0.14.4. + * m4/intdiv0.m4: Upgrade to gettext-0.14.4. + * m4/intmax.m4: New file, from gettext-0.14.4. + * m4/inttypes.m4: Upgrade to gettext-0.14.4. + * m4/inttypes_h.m4: Upgrade to gettext-0.14.4. + * m4/inttypes-pri.m4: Upgrade to gettext-0.14.4. + * m4/isc-posix.m4: Upgrade to gettext-0.14.4. + * m4/lcmessage.m4: Upgrade to gettext-0.14.4. + * m4/lib-ld.m4: Upgrade to gettext-0.14.4. + * m4/lib-link.m4: Upgrade to gettext-0.14.4. + * m4/lib-prefix.m4: Upgrade to gettext-0.14.4. + * m4/longdouble.m4: New file, from gettext-0.14.4. + * m4/longlong.m4: New file, from gettext-0.14.4. + * m4/nls.m4: Upgrade to gettext-0.14.4. + * m4/po.m4: Upgrade to gettext-0.14.4. + * m4/printf-posix.m4: New file, from gettext-0.14.4. + * m4/progtest.m4: Upgrade to gettext-0.14.4. + * m4/signed.m4: New file, from gettext-0.14.4. + * m4/size_max.m4: New file, from gettext-0.14.4. + * m4/stdint_h.m4: Upgrade to gettext-0.14.4. + * m4/uintmax_t.m4: Upgrade to gettext-0.14.4. + * m4/ulonglong.m4: Upgrade to gettext-0.14.4. + * m4/wchar_t.m4: New file, from gettext-0.14.4. + * m4/wint_t.m4: New file, from gettext-0.14.4. + * m4/xsize.m4: New file, from gettext-0.14.4. + * Makefile.am (ACLOCAL_AMFLAGS): New variable. + * configure.in (AM_GNU_GETTEXT_VERSION): Bump to 0.14.4. + +2006-08-04 Clemens Fruhwirth + + * configure.in: 1.0.4-rc2 + +2006-08-04 Clemens Fruhwirth + + * luks/Makefile.am: Add a few regression tests + +2006-08-04 Clemens Fruhwirth + + * lib/setup.c (get_key): Applied patch from David Härdeman + for reading binary keys from stdin using + the "-" as key file. + +2006-08-04 Clemens Fruhwirth + + * lib/setup.c (__crypt_luks_add_key): For checking options struct + (optionsCheck) filter out CRYPT_FLAG_VERIFY and + CRYPT_FLAG_VERIFY_IF_POSSIBLE, so that in no case password verification is done + for password retrieval. + +2006-08-04 Clemens Fruhwirth + + * configure.in: Merge Patch from http://bugs.gentoo.org/show_bug.cgi?id=132126 for sepol + +2006-07-23 Clemens Fruhwirth + + * Applied patches from David Härdeman to fix 64 + bit compiler warning issues. + +2006-05-19 Clemens Fruhwirth + + * Applied patches from Jonas Meurer + - fix terminal status after timeout + - add remark for --tries to manpage + - allow more than 32 chars from standard input. + - exit status fix for cryptsetup status. + +2006-05-06 Clemens Fruhwirth + + * src/cryptsetup.c (yesDialog): Fix getline problem for 64-bit archs. + +2006-04-05 Clemens Fruhwirth + + * configure.in: Release 1.0.3. + + * Applied patch by Johannes Weißl for more meaningful exit codes + and password retries + +2006-03-30 Clemens Fruhwirth + + * lib/setup.c (__crypt_create_device): (char *) -> (const char *) + +2006-03-30 Clemens Fruhwirth + + * Apply alignPayload patch from Peter Palfrader + +2006-03-15 Clemens Fruhwirth + + * configure.in: 1.0.3-rc3. Most displease release ever. + * lib/setup.c (__crypt_create_device): More verbose error message. + +2006-02-26 Clemens Fruhwirth + + * lib/setup.c: Revert to 1.0.1 key reading. + +2006-02-25 Clemens Fruhwirth + + * man/cryptsetup.8: merge patch from Jonas Meurer + +2006-02-25 Clemens Fruhwirth + + * configure.in: 1.0.3-rc2 + +2006-02-25 Clemens Fruhwirth + + * lib/libdevmapper.c (dm_create_device): Remove dup check here. + * lib/setup.c (__crypt_luks_open): Adopt same dup check as regular + create command. + +2006-02-22 Clemens Fruhwirth + + * configure.in: Spin 1.0.3-rc1 + +2006-02-22 Clemens Fruhwirth + + * src/cryptsetup.c (action_create): Change defaulting. + (action_luksFormat): Change defaulting. + + * lib/setup.c (parse_into_name_and_mode): Revert that default + change. This is FORBIDDEN here, as it will change cryptsetup + entire default. This is BAD in a non-LUKS world. + +2006-02-21 Clemens Fruhwirth + + * luks/keyencryption.c (setup_mapping): Add proper size restriction to mapping. + (LUKS_endec_template): Add more verbose error message. + +2006-02-21 Clemens Fruhwirth + + * lib/libdevmapper.c (dm_query_device): Incorporate patch from + Bastian Blank + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=344313 + +2006-02-21 Clemens Fruhwirth + + * src/cryptsetup.c: Rename show_error -> show_status. + +2006-02-20 Clemens Fruhwirth + + * lib/libdevmapper.c (dm_create_device): Prevent existing mapping + from being removed when a mapping with the same name is added + + * Add timeout patch from Jonas Meurer + + * src/cryptsetup.c: Remove conditional error printing to enable + printing the no-error msg (Command successful). Verify passphrase + for LUKS volumes. + (main): Add no-verify-passphrase + + * lib/setup.c (parse_into_name_and_mode): Change default mode complition to essiv:sha256. + +2006-01-04 Clemens Fruhwirth + + * src/cryptsetup.c (help): Merge patch from Gentoo: change gettext(..) to _(..). + +2005-12-06 Clemens Fruhwirth + + * man/cryptsetup.8: Correct "seconds" to "microseconds" in the explanation for -i. + +2005-11-09 Clemens Fruhwirth + + * src/cryptsetup.c (main): Add version string. + +2005-11-08 Clemens Fruhwirth + + * lib/backends.c: compile fix. + +2005-09-11 Clemens Fruhwirth + + * lib/setup.c (get_key): Fixed another incompatibility from my + get_key rewrite with original cryptsetup. + +2005-09-11 Clemens Fruhwirth + + * Merged changes from Florian Knauf's fk02 branch. + +2005-09-08 Clemens Fruhwirth + + * lib/setup.c (get_key): Fixed another incompatibility with + original cryptsetup. + +2005-08-20 Clemens Fruhwirth + + * Checked in a patch from Michael Gebetsroither + to silent all confirmation dialogs. + +2005-06-23 Clemens Fruhwirth + + * src/cryptsetup.c (help): print PACKAGE_STRING + +2005-06-20 Clemens Fruhwirth + + * luks/keymanage.c (LUKS_set_key): Security check against header manipulation + + * src/cryptsetup.c (action_luksDelKey): Safety check in luksDelKey + + * luks/keymanage.c: Changed disk layout generation to align key material to 4k boundaries. + (LUKS_is_last_keyslot): Added LUKS_is_last_keyslot function. + + * Applied patch from Bill Nottingham fixing a lot of prototypes. + + * src/cryptsetup.c (action_luksOpen): Add support for -r flag. + + * configure.in: Version bump 1.0.1 + +2005-06-16 Clemens Fruhwirth + + * lib/setup.c (__crypt_luks_open): Remove mem leaking of dmCipherSpec. + (get_key): Fix missing zero termination for read string. + +2005-06-12 Clemens Fruhwirth + + * luks/keyencryption.c (setup_mapping): Added CRYPT_FLAG_READONLY in case of O_RDONLY mode + +2005-06-11 Clemens Fruhwirth + + * configure.in: Version bump 1.0.1-pre + +2005-06-09 Clemens Fruhwirth + + * lib/utils.c: Added write_llseek_blocksize method to support sector wiping on sector_size != 512 + media + +2005-05-23 Clemens Fruhwirth + + * lib/setup.c (crypt_luksDelKey): Added missing return statement + (setup_leave): Added missing return statement + + * luks/keyencryption.c (clear_mapping): Added missing return statement + +2005-05-19 Clemens Fruhwirth + + * lib/utils.c (write_blockwise, read_blockwise): Changed to soft bsize instead of SECTOR_SIZE + + * luks/keymanage.c (wipe): Changed open mode to O_DIRECT | O_SYNC, and changed write + to use the blockwise write helper + +2005-04-21 Clemens Fruhwirth + + * man/cryptsetup.8: Corrected an error, thanks to Dick Middleton. + +2005-04-09 Clemens Fruhwirth + + * luks/sha/hmac.c: Add 64 bit bug fix courtesy to + Oliver Paukstadt . + + * luks/pbkdf.c, luks/keyencryption.c, luks/keymanage.c, luks/af.c: Added a license + disclaimer and remove option for "any future GPL versions". + +2005-03-25 Clemens Fruhwirth + + * configure.in: man page Makefile. Version bump 1.0. + + * man/cryptsetup.8: finalize man page and move to section 8. + + * src/cryptsetup.c (action_luksFormat): Add "are you sure" for interactive sessions. + + * lib/setup.c (crypt_luksDump), src/cryptsetup.c: add LUKS dump command + +2005-03-24 Clemens Fruhwirth + + * src/cryptsetup.c, luks/Makefile.am (test), lib/setup.c (setup_enter): + rename luksInit to luksFormat + +2005-03-12 Clemens Fruhwirth + + * man/cryptsetup.1: Add man page. + + * lib/setup.c: Remove unnecessary LUKS_write_phdr call, so the + phdr is written after passphrase reading, so the user can change + his mind, and not have a partial written LUKS header on it's disk. + +2005-02-09 Clemens Fruhwirth + + * luks/keymanage.c (LUKS_write_phdr): converted argument phdr to + pointer, and make a copy of phdr for conversion + + * configure.in: Version dump. + + * luks/keyencryption.c: Convert to read|write_blockwise. + + * luks/keymanage.c: Convert to read|write_blockwise. + + * lib/utils.c: Add read|write_blockwise functions, to use in + O_DIRECT file accesses. + +2004-03-11 Thursday 15:52 Jana Saout + + * lib/blockdev.h: BLKGETSIZE64 really uses size_t as third + argument, the rest is wrong. + +2004-03-10 Wednesday 17:50 Jana Saout + + * lib/: libcryptsetup.h, libdevmapper.c: Small fixes. + +2004-03-09 Tuesday 21:41 Jana Saout + + * lib/internal.h, lib/libcryptsetup.h, lib/libdevmapper.c, + lib/setup.c, po/de.po, src/cryptsetup.c: Added internal flags to + keep track of malloc'ed return values in struct crypt_options and + add a function to free the memory. Also add a readonly flag to + libcryptsetup. + +2004-03-09 Tuesday 16:03 Jana Saout + + * ChangeLog, configure.in, setup-gettext, lib/Makefile.am, + lib/backends.c, lib/blockdev.h, lib/gcrypt.c, lib/internal.h, + lib/libcryptsetup.h, lib/libdevmapper.c, lib/setup.c, + lib/utils.c, po/de.po, src/Makefile.am, src/cryptsetup.c: More + reorganization work. + +2004-03-08 Monday 01:38 Jana Saout + + * ChangeLog, Makefile.am, acinclude.m4, configure.in, + lib/Makefile.am, lib/backends.c, lib/blockdev.h, lib/gcrypt.c, + lib/libdevmapper.c, lib/setup.c, lib/utils.c, po/de.po, + src/Makefile.am: BLKGETSIZE64 fixes and started modularity + enhancements + +2004-03-04 Thursday 21:06 Jana Saout + + * Makefile.am, po/de.po, src/cryptsetup.c, src/cryptsetup.h: First + backward compatible working version. + +2004-03-04 Thursday 00:42 Jana Saout + + * NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh, + configure.in, setup-gettext, po/ChangeLog, po/LINGUAS, + po/POTFILES.in, po/de.po, src/cryptsetup.c, src/cryptsetup.h, + src/Makefile.am (utags: initial): Initial checkin. + +2004-03-04 Thursday 00:42 Jana Saout + + * NEWS, AUTHORS, ChangeLog, Makefile.am, README, autogen.sh, + configure.in, setup-gettext, po/ChangeLog, po/LINGUAS, + po/POTFILES.in, po/de.po, src/cryptsetup.c, src/cryptsetup.h, + src/Makefile.am: Initial revision diff --git a/docs/Keyring.txt b/docs/Keyring.txt new file mode 100644 index 0000000..bdcc838 --- /dev/null +++ b/docs/Keyring.txt @@ -0,0 +1,56 @@ +Integration with kernel keyring service +--------------------------------------- + +We have two different use cases for kernel keyring service: + +I) Volume keys + +Since upstream kernel 4.10 dm-crypt device mapper target allows loading volume +key (VK) in kernel keyring service. The key offloaded in kernel keyring service +is only referenced (by key description) in dm-crypt target and the VK is therefore +no longer stored directly in dm-crypt target. Starting with cryptsetup 2.0 we +load VK in kernel keyring by default for LUKSv2 devices (when dm-crypt with the +feature is available). + +Currently cryptsetup loads VK in 'logon' type kernel key so that VK is passed in +the kernel and can't be read from userspace afterward. Also cryptsetup loads VK in +thread keyring (before passing the reference to dm-crypt target) so that the key +lifetime is directly bound to the process that performs the dm-crypt setup. When +cryptsetup process exits (for whatever reason) the key gets unlinked in kernel +automatically. In summary, the key description visible in dm-crypt table line is +a reference to VK that usually no longer exists in kernel keyring service if you +used cryptsetup to for device activation. + +Using this feature dm-crypt no longer maintains a direct key copy (but there's +always at least one copy in kernel crypto layer). + +II) Keyslot passphrase +The second use case for kernel keyring is to allow cryptsetup reading the keyslot +passphrase stored in kernel keyring instead. The user may load passphrase in kernel +keyring and notify cryptsetup to read it from there later. Currently, cryptsetup +cli supports kernel keyring for passphrase only via LUKS2 internal token +(luks2-keyring). Library also provides a general method for device activation by +reading passphrase from keyring: crypt_activate_by_keyring(). The key type +for use case II) must always be 'user' since we need to read the actual key +data from userspace unlike with VK in I). Ability to read keyslot passphrase +from kernel keyring also allows easily auto-activate LUKS2 devices. + +Simple example how to use kernel keyring for keyslot passphrase: + +1) create LUKS2 keyring token for keyslot 0 (in LUKS2 device/image) +cryptsetup token add --key-description my:key -S 0 /dev/device + +2) Load keyslot passphrase in user keyring +read -s -p "Keyslot passphrase: "; echo -n $REPLY | keyctl padd user my:key @u + +3) Activate device using passphrase stored in kernel keyring +cryptsetup open /dev/device my_unlocked_device + +4a) unlink the key when no longer needed by +keyctl unlink %user:my:key @u + +4b) or revoke it immediately by +keyctl revoke %user:my:key + +If cryptsetup asks for passphrase in step 3) something went wrong with keyring +activation. See --debug output then. diff --git a/docs/LUKS2-locking.txt b/docs/LUKS2-locking.txt new file mode 100644 index 0000000..e401b61 --- /dev/null +++ b/docs/LUKS2-locking.txt @@ -0,0 +1,61 @@ +LUKS2 device locking overview +============================= + +Why +~~~ + +LUKS2 format keeps two identical copies of metadata stored consecutively +at the head of metadata device (file or bdev). The metadata +area (both copies) must be updated in a single atomic operation to avoid +header corruption during concurrent write. + +While with LUKS1 users may have clear knowledge of when a LUKS header is +being updated (written to) or when it's being read solely the need for +locking with legacy format was not so obvious as it is with the LUKSv2 format. + +With LUKS2 the boundary between read-only and read-write is blurry and what +used to be the exclusively read-only operation (i.e., cryptsetup open command) may +easily become read-update operation silently without user's knowledge. +Major feature of LUKS2 format is resilience against accidental +corruption of metadata (i.e., partial header overwrite by parted or cfdisk +while creating partition on mistaken block device). +Such header corruption is detected early on header read and auto-recovery +procedure takes place (the corrupted header with checksum mismatch is being +replaced by the secondary one if that one is intact). +On current Linux systems header load operation may be triggered without user +direct intervention for example by udev rule or from systemd service. +Such clash of header read and auto-recovery procedure could have severe +consequences with the worst case of having LUKS2 device unaccessible or being +broken beyond repair. + +The whole locking of LUKSv2 device headers split into two categories depending +what backend the header is stored on: + +I) block device +~~~~~~~~~~~~~~~ + +We perform flock() on file descriptors of files stored in a private +directory (by default /run/lock/cryptsetup). The file name is derived +from major:minor couple of affected block device. Note we recommend +that access to private locking directory is supposed to be limited +to superuser only. For this method to work the distribution needs +to install the locking directory with appropriate access rights. + +II) regular files +~~~~~~~~~~~~~~~~~ + +First notable difference between headers stored in a file +vs. headers stored in a block device is that headers in a file may be +manipulated by the regular user unlike headers on block devices. Therefore +we perform flock() protection on file with the luks2 header directly. + +Limitations +~~~~~~~~~~~ + +a) In general, the locking model provides serialization of I/Os targeting +the header only. It means the header is always written or read at once +while locking is enabled. +We do not suppress any other negative effect that two or more concurrent +writers of the same header may cause. + +b) The locking is not cluster aware in any way. diff --git a/docs/doxyfile b/docs/doxyfile new file mode 100644 index 0000000..a8c84db --- /dev/null +++ b/docs/doxyfile @@ -0,0 +1,313 @@ +# Doxyfile 1.8.8 + +#--------------------------------------------------------------------------- +# Project related configuration options +#--------------------------------------------------------------------------- +DOXYFILE_ENCODING = UTF-8 +PROJECT_NAME = "cryptsetup API" +PROJECT_NUMBER = +PROJECT_BRIEF = "Public cryptsetup API" +PROJECT_LOGO = +OUTPUT_DIRECTORY = doxygen_api_docs +CREATE_SUBDIRS = NO +ALLOW_UNICODE_NAMES = NO +OUTPUT_LANGUAGE = English +BRIEF_MEMBER_DESC = YES +REPEAT_BRIEF = YES +ABBREVIATE_BRIEF = +ALWAYS_DETAILED_SEC = NO +INLINE_INHERITED_MEMB = NO +FULL_PATH_NAMES = YES +STRIP_FROM_PATH = +STRIP_FROM_INC_PATH = +SHORT_NAMES = NO +JAVADOC_AUTOBRIEF = NO +QT_AUTOBRIEF = NO +MULTILINE_CPP_IS_BRIEF = NO +INHERIT_DOCS = YES +SEPARATE_MEMBER_PAGES = NO +TAB_SIZE = 8 +ALIASES = +TCL_SUBST = +OPTIMIZE_OUTPUT_FOR_C = YES +OPTIMIZE_OUTPUT_JAVA = NO +OPTIMIZE_FOR_FORTRAN = NO +OPTIMIZE_OUTPUT_VHDL = NO +EXTENSION_MAPPING = +MARKDOWN_SUPPORT = YES +AUTOLINK_SUPPORT = YES +BUILTIN_STL_SUPPORT = NO +CPP_CLI_SUPPORT = NO +SIP_SUPPORT = NO +IDL_PROPERTY_SUPPORT = YES +DISTRIBUTE_GROUP_DOC = NO +SUBGROUPING = YES +INLINE_GROUPED_CLASSES = NO +INLINE_SIMPLE_STRUCTS = NO +TYPEDEF_HIDES_STRUCT = YES +LOOKUP_CACHE_SIZE = 0 +#--------------------------------------------------------------------------- +# Build related configuration options +#--------------------------------------------------------------------------- +EXTRACT_ALL = NO +EXTRACT_PRIVATE = NO +EXTRACT_PACKAGE = NO +EXTRACT_STATIC = NO +EXTRACT_LOCAL_CLASSES = YES +EXTRACT_LOCAL_METHODS = NO +EXTRACT_ANON_NSPACES = NO +HIDE_UNDOC_MEMBERS = NO +HIDE_UNDOC_CLASSES = NO +HIDE_FRIEND_COMPOUNDS = NO +HIDE_IN_BODY_DOCS = NO +INTERNAL_DOCS = NO +CASE_SENSE_NAMES = YES +HIDE_SCOPE_NAMES = NO +SHOW_INCLUDE_FILES = YES +SHOW_GROUPED_MEMB_INC = NO +FORCE_LOCAL_INCLUDES = NO +INLINE_INFO = YES +SORT_MEMBER_DOCS = YES +SORT_BRIEF_DOCS = NO +SORT_MEMBERS_CTORS_1ST = NO +SORT_GROUP_NAMES = NO +SORT_BY_SCOPE_NAME = NO +STRICT_PROTO_MATCHING = NO +GENERATE_TODOLIST = YES +GENERATE_TESTLIST = YES +GENERATE_BUGLIST = YES +GENERATE_DEPRECATEDLIST= YES +ENABLED_SECTIONS = +MAX_INITIALIZER_LINES = 30 +SHOW_USED_FILES = YES +SHOW_FILES = YES +SHOW_NAMESPACES = YES +FILE_VERSION_FILTER = +LAYOUT_FILE = +CITE_BIB_FILES = +#--------------------------------------------------------------------------- +# Configuration options related to warning and progress messages +#--------------------------------------------------------------------------- +QUIET = NO +WARNINGS = YES +WARN_IF_UNDOCUMENTED = YES +WARN_IF_DOC_ERROR = YES +WARN_NO_PARAMDOC = NO +WARN_FORMAT = "$file:$line: $text" +WARN_LOGFILE = +#--------------------------------------------------------------------------- +# Configuration options related to the input files +#--------------------------------------------------------------------------- +INPUT = "doxygen_index.h" \ + "../lib/libcryptsetup.h" +INPUT_ENCODING = UTF-8 +FILE_PATTERNS = +RECURSIVE = NO +EXCLUDE = +EXCLUDE_SYMLINKS = NO +EXCLUDE_PATTERNS = +EXCLUDE_SYMBOLS = +EXAMPLE_PATH = "examples" +EXAMPLE_PATTERNS = +EXAMPLE_RECURSIVE = NO +IMAGE_PATH = +INPUT_FILTER = +FILTER_PATTERNS = +FILTER_SOURCE_FILES = NO +FILTER_SOURCE_PATTERNS = +USE_MDFILE_AS_MAINPAGE = +#--------------------------------------------------------------------------- +# Configuration options related to source browsing +#--------------------------------------------------------------------------- +SOURCE_BROWSER = NO +INLINE_SOURCES = NO +STRIP_CODE_COMMENTS = YES +REFERENCED_BY_RELATION = NO +REFERENCES_RELATION = NO +REFERENCES_LINK_SOURCE = YES +SOURCE_TOOLTIPS = YES +USE_HTAGS = NO +VERBATIM_HEADERS = YES +CLANG_ASSISTED_PARSING = NO +CLANG_OPTIONS = +#--------------------------------------------------------------------------- +# Configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- +ALPHABETICAL_INDEX = YES +COLS_IN_ALPHA_INDEX = 5 +IGNORE_PREFIX = +#--------------------------------------------------------------------------- +# Configuration options related to the HTML output +#--------------------------------------------------------------------------- +GENERATE_HTML = YES +HTML_OUTPUT = html +HTML_FILE_EXTENSION = .html +HTML_HEADER = +HTML_FOOTER = +HTML_STYLESHEET = +HTML_EXTRA_STYLESHEET = +HTML_EXTRA_FILES = +HTML_COLORSTYLE_HUE = 220 +HTML_COLORSTYLE_SAT = 100 +HTML_COLORSTYLE_GAMMA = 80 +HTML_TIMESTAMP = YES +HTML_DYNAMIC_SECTIONS = NO +HTML_INDEX_NUM_ENTRIES = 100 +GENERATE_DOCSET = NO +DOCSET_FEEDNAME = "Doxygen generated docs" +DOCSET_BUNDLE_ID = org.doxygen.Project +DOCSET_PUBLISHER_ID = org.doxygen.Publisher +DOCSET_PUBLISHER_NAME = Publisher +GENERATE_HTMLHELP = NO +CHM_FILE = +HHC_LOCATION = +GENERATE_CHI = NO +CHM_INDEX_ENCODING = +BINARY_TOC = NO +TOC_EXPAND = NO +GENERATE_QHP = NO +QCH_FILE = +QHP_NAMESPACE = org.doxygen.Project +QHP_VIRTUAL_FOLDER = doc +QHP_CUST_FILTER_NAME = +QHP_CUST_FILTER_ATTRS = +QHP_SECT_FILTER_ATTRS = +QHG_LOCATION = +GENERATE_ECLIPSEHELP = NO +ECLIPSE_DOC_ID = org.doxygen.Project +DISABLE_INDEX = NO +GENERATE_TREEVIEW = NO +ENUM_VALUES_PER_LINE = 4 +TREEVIEW_WIDTH = 250 +EXT_LINKS_IN_WINDOW = NO +FORMULA_FONTSIZE = 10 +FORMULA_TRANSPARENT = YES +USE_MATHJAX = NO +MATHJAX_FORMAT = HTML-CSS +MATHJAX_RELPATH = http://www.mathjax.org/mathjax +MATHJAX_EXTENSIONS = +MATHJAX_CODEFILE = +SEARCHENGINE = YES +SERVER_BASED_SEARCH = NO +EXTERNAL_SEARCH = NO +SEARCHENGINE_URL = +SEARCHDATA_FILE = searchdata.xml +EXTERNAL_SEARCH_ID = +EXTRA_SEARCH_MAPPINGS = +#--------------------------------------------------------------------------- +# Configuration options related to the LaTeX output +#--------------------------------------------------------------------------- +GENERATE_LATEX = YES +LATEX_OUTPUT = latex +LATEX_CMD_NAME = latex +MAKEINDEX_CMD_NAME = makeindex +COMPACT_LATEX = NO +PAPER_TYPE = a4 +EXTRA_PACKAGES = +LATEX_HEADER = +LATEX_FOOTER = +LATEX_EXTRA_FILES = +PDF_HYPERLINKS = YES +USE_PDFLATEX = YES +LATEX_BATCHMODE = NO +LATEX_HIDE_INDICES = NO +LATEX_SOURCE_CODE = NO +LATEX_BIB_STYLE = plain +#--------------------------------------------------------------------------- +# Configuration options related to the RTF output +#--------------------------------------------------------------------------- +GENERATE_RTF = NO +RTF_OUTPUT = rtf +COMPACT_RTF = NO +RTF_HYPERLINKS = NO +RTF_STYLESHEET_FILE = +RTF_EXTENSIONS_FILE = +#--------------------------------------------------------------------------- +# Configuration options related to the man page output +#--------------------------------------------------------------------------- +GENERATE_MAN = NO +MAN_OUTPUT = man +MAN_EXTENSION = .3 +MAN_SUBDIR = +MAN_LINKS = NO +#--------------------------------------------------------------------------- +# Configuration options related to the XML output +#--------------------------------------------------------------------------- +GENERATE_XML = NO +XML_OUTPUT = xml +XML_PROGRAMLISTING = YES +#--------------------------------------------------------------------------- +# Configuration options related to the DOCBOOK output +#--------------------------------------------------------------------------- +GENERATE_DOCBOOK = NO +DOCBOOK_OUTPUT = docbook +DOCBOOK_PROGRAMLISTING = NO +#--------------------------------------------------------------------------- +# Configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- +GENERATE_AUTOGEN_DEF = NO +#--------------------------------------------------------------------------- +# Configuration options related to the Perl module output +#--------------------------------------------------------------------------- +GENERATE_PERLMOD = NO +PERLMOD_LATEX = NO +PERLMOD_PRETTY = YES +PERLMOD_MAKEVAR_PREFIX = +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- +ENABLE_PREPROCESSING = YES +MACRO_EXPANSION = NO +EXPAND_ONLY_PREDEF = NO +SEARCH_INCLUDES = YES +INCLUDE_PATH = +INCLUDE_FILE_PATTERNS = +PREDEFINED = +EXPAND_AS_DEFINED = +SKIP_FUNCTION_MACROS = YES +#--------------------------------------------------------------------------- +# Configuration options related to external references +#--------------------------------------------------------------------------- +TAGFILES = +GENERATE_TAGFILE = +ALLEXTERNALS = NO +EXTERNAL_GROUPS = YES +EXTERNAL_PAGES = YES +PERL_PATH = +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- +CLASS_DIAGRAMS = YES +MSCGEN_PATH = +DIA_PATH = +HIDE_UNDOC_RELATIONS = YES +HAVE_DOT = NO +DOT_NUM_THREADS = 0 +DOT_FONTNAME = Helvetica +DOT_FONTSIZE = 10 +DOT_FONTPATH = +CLASS_GRAPH = YES +COLLABORATION_GRAPH = YES +GROUP_GRAPHS = YES +UML_LOOK = NO +UML_LIMIT_NUM_FIELDS = 10 +TEMPLATE_RELATIONS = NO +INCLUDE_GRAPH = YES +INCLUDED_BY_GRAPH = YES +CALL_GRAPH = NO +CALLER_GRAPH = NO +GRAPHICAL_HIERARCHY = YES +DIRECTORY_GRAPH = YES +DOT_IMAGE_FORMAT = png +INTERACTIVE_SVG = NO +DOT_PATH = +DOTFILE_DIRS = +MSCFILE_DIRS = +DIAFILE_DIRS = +PLANTUML_JAR_PATH = +DOT_GRAPH_MAX_NODES = 50 +MAX_DOT_GRAPH_DEPTH = 0 +DOT_TRANSPARENT = NO +DOT_MULTI_TARGETS = NO +GENERATE_LEGEND = YES +DOT_CLEANUP = YES diff --git a/docs/doxygen_index.h b/docs/doxygen_index.h new file mode 100644 index 0000000..8bdf05f --- /dev/null +++ b/docs/doxygen_index.h @@ -0,0 +1,110 @@ +/*! \mainpage Cryptsetup API + * + * The documentation covers public parts of cryptsetup API. In the following sections you'll find + * the examples that describe some features of cryptsetup API. + * For more info about libcryptsetup API versions see + * API Tracker. + * + *
    + *
  1. @ref cexamples "Cryptsetup API examples"
    2. + *
      + *
    1. @ref cluks "crypt_luks_usage" - cryptsetup LUKS device type usage examples
      2. + *
        + *
      • @ref cinit "crypt_init()"
        • + *
      • @ref cformat "crypt_format()" - header and payload on mutual device
        • + *
      • @ref ckeys "Keyslot operations"
        • + *
          + *
        • @ref ckeyslot_vol "crypt_keyslot_add_by_volume_key()"
          • + *
        • @ref ckeyslot_pass "crypt_keyslot_add_by_passphrase()"
          • + *
        + *
      • @ref cload "crypt_load()" + *
      • @ref cactivate "crypt_activate_by_passphrase()"
        • + *
      • @ref cactive_pars "crypt_get_active_device()"
        • + *
      • @ref cinit_by_name "crypt_init_by_name()"
        • + *
      • @ref cdeactivate "crypt_deactivate()"
        • + *
      • @ref cluks_ex "crypt_luks_usage.c"
        • + *
      + *
    2. @ref clog "crypt_log_usage" - cryptsetup logging API examples
      3. + *
    + *
+ * + * @section cexamples Cryptsetup API examples + * @section cluks crypt_luks_usage - cryptsetup LUKS device type usage + * @subsection cinit crypt_init() + * Every time you need to do something with cryptsetup or dmcrypt device + * you need a valid context. The first step to start your work is + * @ref crypt_init call. You can call it either with path + * to the block device or path to the regular file. If you don't supply the path, + * empty context is initialized. + * + * @subsection cformat crypt_format() - header and payload on mutual device + * This section covers basic use cases for formatting LUKS devices. Format operation + * sets device type in context and in case of LUKS header is written at the beginning + * of block device. In the example below we use the scenario where LUKS header and data + * are both stored on the same device. There's also a possibility to store header and + * data separately. + * + * Bear in mind that @ref crypt_format() is destructive operation and it + * overwrites part of the backing block device. + * + * @subsection ckeys Keyslot operations examples + * After successful @ref crypt_format of LUKS device, volume key is not stored + * in a persistent way on the device. Keyslot area is an array beyond LUKS header, where + * volume key is stored in the encrypted form using user input passphrase. For more info about + * LUKS keyslots and how it's actually protected, please look at + * LUKS specification. + * There are two basic methods to create a new keyslot: + * + * @subsection ckeyslot_vol crypt_keyslot_add_by_volume_key() + * Creates a new keyslot directly by encrypting volume_key stored in the device + * context. Passphrase should be supplied or user is prompted if passphrase param is + * NULL. + * + * @subsection ckeyslot_pass crypt_keyslot_add_by_passphrase() + * Creates a new keyslot for the volume key by opening existing active keyslot, + * extracting volume key from it and storing it into a new keyslot + * protected by a new passphrase + * + * @subsection cload crypt_load() + * Function loads header from backing block device into device context. + * + * @subsection cactivate crypt_activate_by_passphrase() + * Activates crypt device by user supplied password for keyslot containing the volume_key. + * If keyslot parameter is set to CRYPT_ANY_SLOT then all active keyslots + * are tried one by one until the volume key is found. + * + * @subsection cactive_pars crypt_get_active_device() + * This call returns structure containing runtime attributes of active device. + * + * @subsection cinit_by_name crypt_init_by_name() + * In case you need to do operations with active device (device which already + * has its corresponding mapping) and you miss valid device context stored in + * *crypt_device reference, you should use this call. Function tries to + * get path to backing device from DM, initializes context for it and loads LUKS + * header. + * + * @subsection cdeactivate crypt_deactivate() + * Deactivates crypt device (removes DM mapping and safely erases volume key from kernel). + * + * @subsection cluks_ex crypt_luks_usage.c - Complex example + * To compile and run use following commands in examples directory: + * + * @code + * make + * ./crypt_luks_usage _path_to_[block_device]_file + * @endcode + * Note that you need to have the cryptsetup library compiled. @include crypt_luks_usage.c + * + * @section clog crypt_log_usage - cryptsetup logging API example + * Example describes basic use case for cryptsetup logging. To compile and run + * use following commands in examples directory: + * + * @code + * make + * ./crypt_log_usage + * @endcode + * Note that you need to have the cryptsetup library compiled. @include crypt_log_usage.c + * + * @example crypt_luks_usage.c + * @example crypt_log_usage.c + */ diff --git a/docs/examples/Makefile b/docs/examples/Makefile new file mode 100644 index 0000000..845b6cb --- /dev/null +++ b/docs/examples/Makefile @@ -0,0 +1,17 @@ +TARGETS=crypt_log_usage crypt_luks_usage +CFLAGS=-O0 -g -Wall -D_GNU_SOURCE +LDLIBS=-lcryptsetup +CC=gcc + +all: $(TARGETS) + +crypt_log_usage: crypt_log_usage.o + $(CC) -o $@ $^ $(LDLIBS) + +crypt_luks_usage: crypt_luks_usage.o + $(CC) -o $@ $^ $(LDLIBS) + +clean: + rm -f *.o *~ core $(TARGETS) + +.PHONY: clean diff --git a/docs/examples/crypt_log_usage.c b/docs/examples/crypt_log_usage.c new file mode 100644 index 0000000..b0cdd56 --- /dev/null +++ b/docs/examples/crypt_log_usage.c @@ -0,0 +1,94 @@ +/* + * libcryptsetup API log example + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +/* + * This is an example of crypt_set_log_callback API callback. + * + */ +static void simple_syslog_wrapper(int level, const char *msg, void *usrptr) +{ + const char *prefix = (const char *)usrptr; + int priority; + + switch(level) { + case CRYPT_LOG_NORMAL: priority = LOG_NOTICE; break; + case CRYPT_LOG_ERROR: priority = LOG_ERR; break; + case CRYPT_LOG_VERBOSE: priority = LOG_INFO; break; + case CRYPT_LOG_DEBUG: priority = LOG_DEBUG; break; + default: + fprintf(stderr, "Unsupported log level requested!\n"); + return; + } + + if (prefix) + syslog(priority, "%s:%s", prefix, msg); + else + syslog(priority, "%s", msg); +} + +int main(void) +{ + struct crypt_device *cd; + char usrprefix[] = "cslog_example"; + int r; + + if (geteuid()) { + printf("Using of libcryptsetup requires super user privileges.\n"); + return 1; + } + + openlog("cryptsetup", LOG_CONS | LOG_PID, LOG_USER); + + /* Initialize empty crypt device context */ + r = crypt_init(&cd, NULL); + if (r < 0) { + printf("crypt_init() failed.\n"); + return 2; + } + + /* crypt_set_log_callback() - register a log callback for crypt context */ + crypt_set_log_callback(cd, &simple_syslog_wrapper, (void *)usrprefix); + + /* send messages ithrough the crypt_log() interface */ + crypt_log(cd, CRYPT_LOG_NORMAL, "This is normal log message"); + crypt_log(cd, CRYPT_LOG_ERROR, "This is error log message"); + crypt_log(cd, CRYPT_LOG_VERBOSE, "This is verbose log message"); + crypt_log(cd, CRYPT_LOG_DEBUG, "This is debug message"); + + /* release crypt context */ + crypt_free(cd); + + /* Initialize default (global) log callback */ + crypt_set_log_callback(NULL, &simple_syslog_wrapper, NULL); + + crypt_log(NULL, CRYPT_LOG_NORMAL, "This is normal log message"); + crypt_log(NULL, CRYPT_LOG_ERROR, "This is error log message"); + crypt_log(NULL, CRYPT_LOG_VERBOSE, "This is verbose log message"); + crypt_log(NULL, CRYPT_LOG_DEBUG, "This is debug message"); + + closelog(); + return 0; +} diff --git a/docs/examples/crypt_luks_usage.c b/docs/examples/crypt_luks_usage.c new file mode 100644 index 0000000..f99bfc7 --- /dev/null +++ b/docs/examples/crypt_luks_usage.c @@ -0,0 +1,250 @@ +/* + * libcryptsetup API - using LUKS device example + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include + +static int format_and_add_keyslots(const char *path) +{ + struct crypt_device *cd; + int r; + + /* + * The crypt_init() call is used to initialize crypt_device context, + * The path parameter specifies a device path. + * + * For path, you can use either link to a file or block device. + * The loopback device will be detached automatically. + */ + + r = crypt_init(&cd, path); + if (r < 0) { + printf("crypt_init() failed for %s.\n", path); + return r; + } + + printf("Context is attached to block device %s.\n", crypt_get_device_name(cd)); + + /* + * So far, no data were written to the device. + */ + printf("Device %s will be formatted as a LUKS device after 5 seconds.\n" + "Press CTRL+C now if you want to cancel this operation.\n", path); + sleep(5); + + /* + * NULLs for uuid and volume_key means that these attributes will be + * generated during crypt_format(). + */ + r = crypt_format(cd, /* crypt context */ + CRYPT_LUKS2, /* LUKS2 is a new LUKS format; use CRYPT_LUKS1 for LUKS1 */ + "aes", /* used cipher */ + "xts-plain64", /* used block mode and IV */ + NULL, /* generate UUID */ + NULL, /* generate volume key from RNG */ + 512 / 8, /* 512bit key - here AES-256 in XTS mode, size is in bytes */ + NULL); /* default parameters */ + + if (r < 0) { + printf("crypt_format() failed on device %s\n", crypt_get_device_name(cd)); + crypt_free(cd); + return r; + } + + /* + * The device now contains a LUKS header, but there is no active keyslot. + * + * crypt_keyslot_add_* call stores the volume_key in the encrypted form into the keyslot. + * + * After format, the volume key is stored internally. + */ + r = crypt_keyslot_add_by_volume_key(cd, /* crypt context */ + CRYPT_ANY_SLOT, /* just use first free slot */ + NULL, /* use internal volume key */ + 0, /* unused (size of volume key) */ + "foo", /* passphrase - NULL means query*/ + 3); /* size of passphrase */ + + if (r < 0) { + printf("Adding keyslot failed.\n"); + crypt_free(cd); + return r; + } + + printf("The first keyslot is initialized.\n"); + + /* + * Add another keyslot, now authenticating with the first keyslot. + * It decrypts the volume key from the first keyslot and creates a new one with the specified passphrase. + */ + r = crypt_keyslot_add_by_passphrase(cd, /* crypt context */ + CRYPT_ANY_SLOT, /* just use first free slot */ + "foo", 3, /* passphrase for the old keyslot */ + "bar", 3); /* passphrase for the new kesylot */ + if (r < 0) { + printf("Adding keyslot failed.\n"); + crypt_free(cd); + return r; + } + + printf("The second keyslot is initialized.\n"); + + crypt_free(cd); + return 0; +} + +static int activate_and_check_status(const char *path, const char *device_name) +{ + struct crypt_device *cd; + struct crypt_active_device cad; + int r; + + /* + * LUKS device activation example. + */ + r = crypt_init(&cd, path); + if (r < 0) { + printf("crypt_init() failed for %s.\n", path); + return r; + } + + /* + * crypt_load() is used to load existing LUKS header from a block device + */ + r = crypt_load(cd, /* crypt context */ + CRYPT_LUKS, /* requested type - here LUKS of any type */ + NULL); /* additional parameters (not used) */ + + if (r < 0) { + printf("crypt_load() failed on device %s.\n", crypt_get_device_name(cd)); + crypt_free(cd); + return r; + } + + /* + * Device activation creates a device-mapper device with the specified name. + */ + r = crypt_activate_by_passphrase(cd, /* crypt context */ + device_name, /* device name to activate */ + CRYPT_ANY_SLOT,/* the keyslot use (try all here) */ + "foo", 3, /* passphrase */ + CRYPT_ACTIVATE_READONLY); /* flags */ + if (r < 0) { + printf("Device %s activation failed.\n", device_name); + crypt_free(cd); + return r; + } + + printf("%s device %s/%s is active.\n", crypt_get_type(cd), crypt_get_dir(), device_name); + printf("\tcipher used: %s\n", crypt_get_cipher(cd)); + printf("\tcipher mode: %s\n", crypt_get_cipher_mode(cd)); + printf("\tdevice UUID: %s\n", crypt_get_uuid(cd)); + + /* + * Get info about the active device. + */ + r = crypt_get_active_device(cd, device_name, &cad); + if (r < 0) { + printf("Get info about active device %s failed.\n", device_name); + crypt_deactivate(cd, device_name); + crypt_free(cd); + return r; + } + + printf("Active device parameters for %s:\n" + "\tDevice offset (in sectors): %" PRIu64 "\n" + "\tIV offset (in sectors) : %" PRIu64 "\n" + "\tdevice size (in sectors) : %" PRIu64 "\n" + "\tread-only flag : %s\n", + device_name, cad.offset, cad.iv_offset, cad.size, + cad.flags & CRYPT_ACTIVATE_READONLY ? "1" : "0"); + + crypt_free(cd); + return 0; +} + +static int handle_active_device(const char *device_name) +{ + struct crypt_device *cd; + int r; + + /* + * crypt_init_by_name() initializes context by an active device-mapper name + */ + r = crypt_init_by_name(&cd, device_name); + if (r < 0) { + printf("crypt_init_by_name() failed for %s.\n", device_name); + return r; + } + + if (crypt_status(cd, device_name) == CRYPT_ACTIVE) + printf("Device %s is still active.\n", device_name); + else { + printf("Something failed perhaps, device %s is not active.\n", device_name); + crypt_free(cd); + return -1; + } + + /* + * crypt_deactivate() is used to deactivate a device + */ + r = crypt_deactivate(cd, device_name); + if (r < 0) { + printf("crypt_deactivate() failed.\n"); + crypt_free(cd); + return r; + } + + printf("Device %s is now deactivated.\n", device_name); + + crypt_free(cd); + return 0; +} + +int main(int argc, char **argv) +{ + if (geteuid()) { + printf("Using of libcryptsetup requires super user privileges.\n"); + return 1; + } + + if (argc != 2) { + printf("usage: ./crypt_luks_usage \n" + " refers to either a regular file or a block device.\n" + " WARNING: the file or device will be wiped.\n"); + return 2; + } + + if (format_and_add_keyslots(argv[1])) + return 3; + + if (activate_and_check_status(argv[1], "example_device")) + return 4; + + if (handle_active_device("example_device")) + return 5; + + return 0; +} diff --git a/docs/on-disk-format-luks2.pdf b/docs/on-disk-format-luks2.pdf new file mode 100644 index 0000000..3f09952 Binary files /dev/null and b/docs/on-disk-format-luks2.pdf differ diff --git a/docs/on-disk-format.pdf b/docs/on-disk-format.pdf new file mode 100644 index 0000000..7f6e5e7 Binary files /dev/null and b/docs/on-disk-format.pdf differ diff --git a/docs/v1.0.7-ReleaseNotes b/docs/v1.0.7-ReleaseNotes new file mode 100644 index 0000000..9288c60 --- /dev/null +++ b/docs/v1.0.7-ReleaseNotes @@ -0,0 +1,92 @@ +cryptsetup 1.0.7 Release Notes (2009-07-22) +=========================================== + +Changes since 1.0.7-rc1 +------------------------ +[committer name] + + * Allow removal of last slot in luksRemoveKey +and luksKillSlot. [Milan Broz] + + * Add --disable-selinux option and fix static build if selinux +is required. [Milan Broz] + + * Reject unsupported --offset and --skip options for luksFormat +and update man page. [Milan Broz] + + +Changes since 1.0.6 +-------------------- +[committer name] + +* Various man page fixes. Also merged some Debian/Ubuntu man page +fixes. (thanks to Martin Pitt) [Milan Broz] + +* Set UUID in device-mapper for LUKS devices. [Milan Broz] + +* Retain readahead of underlying device. [Milan Broz] + +* Display device name when asking for password. (thanks to Till +Maas) [Milan Broz] + +* Check device size when loading LUKS header. Remove misleading +error message later. [Milan Broz] + +* Add error hint if dm-crypt mapping failed. (Key size and kernel +version check for XTS and LRW mode for now.) [Milan Broz] + +* Use better error messages if device doesn't exist or is already +used by other mapping. [Milan Broz] + +* Fix make distcheck. (thanks to Mike Kelly) [Milan Broz] + +* Check if all slots are full during luksAddKey. [Clemens Fruhwirth] + +* Fix segfault in set_error (thanks to Oliver Metz). [Clemens Fruhwirth] + +* Remove precompiled pot files. Fix uninitialized return value +variable in setup.c. [Clemens Fruhwirth] + +* Code cleanups. (thanks to Ivan Stankovic) [Clemens Fruhwirth] + +* Remove unnecessary files from po directory. They will be +regenerated by autogen.sh. [Clemens Fruhwirth] + +* Fix wrong output for remaining key at key deletion. Allow deletion +of key slot while other keys have the same key information. [Clemens +Fruhwirth] + +* Add missing AM_PROG_CC_C_O to configure.in [Milan Broz] + +* Remove duplicate sentence in man page (thanks to Till Maas). +[Milan Broz] + +* Wipe start of device (possible fs signature) before +LUKS-formatting. [Milan Broz] + +* Do not process configure.in in hidden directories. [Milan Broz] + +* Return more descriptive error in case of IO or header format +error. [Milan Broz] + +* Use remapping to error target instead of calling udevsettle +for temporary crypt device. [Milan Broz] + +* Check device mapper communication and warn user in case the +communication fails. (thanks to Milan Broz) [Clemens Fruhwirth] + +* Fix signal handler to proper close device. (thanks to Milan Broz) +[Clemens Fruhwirth] + +* write_lseek_blockwise: declare innerCount outside the if block, +add -Wall to the default CFLAGS, * fix some signedness issues +(thanks to Ivan Stankovic) [Clemens Fruhwirth] + +* Error handling improvement. (thanks to Erik Edin) [Clemens Fruhwirth] + +* Add non-exclusive override to interface definition. [Clemens +Fruhwirth] + +* Refactor key slot selection into keyslot_from_option. Either +autoselect next free keyslot or honor user choice (after checking). +[Clemens Fruhwirth] diff --git a/docs/v1.1.0-ReleaseNotes b/docs/v1.1.0-ReleaseNotes new file mode 100644 index 0000000..7ee6dea --- /dev/null +++ b/docs/v1.1.0-ReleaseNotes @@ -0,0 +1,110 @@ +Cryptsetup 1.1.0 Release Notes +============================== + +Changes since version 1.0.7 +---------------------------- + +Important changes: +~~~~~~~~~~~~~~~~~~ + + * IMPORTANT: the default compiled-in cipher parameters changed + plain mode: aes-cbc-essiv:sha256 (default is backward incompatible!). + LUKS mode: aes-cbc-essiv:sha256 (only key size increased) + In both modes is now default key size 256bits. + + * Default compiled-in parameters are now configurable through configure options: + --with-plain-* / --with-luks1-* (see configure --help) + + * If you need backward compatible defaults for distribution use + configure --with-plain-mode=cbc-plain --with-luks1-keybits=128 + + Default compiled-in modes are printed in "cryptsetup --help" output. + + * Change in iterations count (LUKS): + The slot and key digest iteration minimum count is now 1000. + The key digest iteration count is calculated from iteration time (approx 1/8 of req. time). + For more info about above items see discussion here: http://tinyurl.com/yaug97y + + * New libcryptsetup API (documented in libcryptsetup.h). + + The old API (using crypt_options struct) is still available but will remain + frozen and not used for new functions. + Soname of library changed to libcryptsetup.so.1.0.0. + (But only recompilation should be needed for old programs.) + + The new API provides much more flexible operation over LUKS device for + applications, it is preferred that new applications will use libcryptsetup + and not wrapper around cryptsetup binary. + + * New luksHeaderBackup and luksHeaderRestore commands. + + These commands allows binary backup of LUKS header. + Please read man page about possible security issues with backup files. + + * New luksSuspend (freeze device and wipe key) and luksResume (with provided passphrase). + + luksSuspend wipe encryption key in kernel memory and set device to suspend + (blocking all IO) state. This option can be used for situations when you need + temporary wipe encryption key (like suspend to RAM etc.) + Please read man page for more information. + + * New --master-key-file option for luksFormat and luksAddKey. + + User can now specify pre-generated master key in file, which allows regenerating + LUKS header or add key with only master key knowledge. + + * Uses libgcrypt and enables all gcrypt hash algorithms for LUKS through -h luksFormat option. + + Please note that using different hash for LUKS header make device incompatible with + old cryptsetup releases. + + * Introduces --debug parameter. + + Use when reporting bugs (just run cryptsetup with --debug and attach output + to issue report.) Sensitive data are never printed to this log. + + * Moves command successful messages to verbose level. + + * Requires device-mapper library and libgcrypt to build. + + * Uses dm-uuid for all crypt devices, contains device type and name now. + + * Removes support for dangerous non-exclusive option + (it is ignored now, LUKS device must be always opened exclusive) + +Other changes: +~~~~~~~~~~~~~~ + * Fixed localization to work again. Also cryptsetup is now translated by translationproject.org. + * Fix some libcryptsetup problems, including + * exported symbols and versions in libcryptsetup (properly use versioned symbols) + * Add crypt_log library function. + * Add CRYPT_ prefix to enum defined in libcryptsetup.h. + * Move duplicate Command failed message to verbose level (error is printed always). + * Fix several problems in build system + * use autopoint and clean gettext processing. + * Check in configure if selinux libraries are required in static version. + * Fix build for non-standard location of gcrypt library. + * Add temporary debug code to find processes locking internal device. + * Fix error handling during reading passphrase. + * Fail passphrase read if piped input no longer exists. + * Fix man page to not require --size which expands to device size by default. + * Clean up Makefiles and configure script. + * Try to read first sector from device to properly check that device is ready. + * Move memory locking and dm initialization to command layer. + * Increase priority of process if memory is locked. + * Add log macros and make logging more consistent. + * Keyfile now must be provided by path, only stdin file descriptor is used (api only). + * Do not call isatty() on closed keyfile descriptor. + * Move key slot manipulation function into LUKS specific code. + * Replace global options struct with separate parameters in helper functions. + * Implement old API calls using new functions. + * Allow using passphrase provided in options struct for LuksOpen. + * Allow restrict keys size in LuksOpen. + * Fix errors when compiled with LUKS_DEBUG. + * Print error when getline fails. + * Completely remove internal SHA1 implementation code, not needed anymore. + * Pad luks header to 512 sector size. + * Rework read/write blockwise to not split operation to many pieces. + * Use posix_memalign if available. + * Fix segfault if provided slot in luksKillslot is invalid. + * Remove unneeded timeout when remove of temporary device succeeded. diff --git a/docs/v1.1.1-ReleaseNotes b/docs/v1.1.1-ReleaseNotes new file mode 100644 index 0000000..e85107c --- /dev/null +++ b/docs/v1.1.1-ReleaseNotes @@ -0,0 +1,47 @@ +Cryptsetup 1.1.1 Release Notes +============================== + +Changes since version 1.1.1-rc2 +* Fix luksClose error if underlying device is LVM logical volume. + +Changes since version 1.1.1-rc1 +* Fix automatic dm-crypt module loading. + +Changes since version 1.1.0 + +Important changes: +~~~~~~~~~~~~~~~~~~ + +* Detects and use device-mapper udev support if available. + + This should allow synchronisation with udev rules and avoid races with udev. + + If package maintainer want to use old, direct libdevmapper device node creation, + use configure option --disable-udev. + +* Supports device topology detection for data alignment. + + If kernel provides device topology ioctl calls, the LUKS data area + alignment is automatically set to optimal value. + + This means that stacked devices (like LUKS over MD/LVM) + should use the most optimal data alignment. + + (You can still overwrite this calculation using --align-payload option.) + +* Prefers some device paths in status display. + (So status command will try to find top level device name, like /dev/sdb.) + +* Fix package config file to use proper package version. + +Other changes: +~~~~~~~~~~~~~~ +* Fix luksOpen reading of passphrase on stdin (if "-" keyfile specified). +* Fix isLuks to initialise crypto backend (blkid instead is suggested anyway). +* Properly initialise crypto backend in header backup/restore commands. +* Do not verify unlocking passphrase in luksAddKey command. +* Allow no hash specification in plain device constructor - user can provide volume key directly. +* Try to use pkgconfig for device mapper library in configuration script. +* Add some compatibility checks and disable LUKS suspend/resume if not supported. +* Rearrange tests, "make check" now run all available test for package. +* Avoid class C++ keyword in library header. diff --git a/docs/v1.1.2-ReleaseNotes b/docs/v1.1.2-ReleaseNotes new file mode 100644 index 0000000..9931f05 --- /dev/null +++ b/docs/v1.1.2-ReleaseNotes @@ -0,0 +1,33 @@ +== Cryptsetup 1.1.2 Release Notes == + +This release fixes a regression (introduced in 1.1.1 version) in handling +key files containing new line characters (affects only files read from +standard input). + +Cryptsetup can accept passphrase on stdin (standard input). + +Handling of new line (\n) character is defined by input specification: + + * if keyfile is specified as "-" (using --key-file=- of by "-" positional argument + in luksFormat and luksAddKey, like cat file | cryptsetup --key-file=- ), + input is processed as normal binary file and no new line is interpreted. + + * if there is no key file specification (with default input from stdin pipe + like echo passphrase | cryptsetup ) input is processed as input from terminal, + reading will stop after new line is detected. + +Moreover, luksFormat now understands --key-file (in addition to positional key +file argument). + +N.B. Using of standard input and pipes for passphrases should be avoided if possible, +cryptsetup have no control of used pipe buffers between commands in scripts and cannot +guarantee that all passphrase/key-file buffers are properly wiped after use. + +=== changes since version 1.1.1 === + + * Fix luksFormat/luksOpen reading passphrase from stdin and "-" keyfile. + * Support --key-file/-d option for luksFormat. + * Fix description of --key-file and add --verbose and --debug options to man page. + * Add verbose log level and move unlocking message there. + * Remove device even if underlying device disappeared (remove, luksClose). + * Fix (deprecated) reload device command to accept new device argument. diff --git a/docs/v1.1.3-ReleaseNotes b/docs/v1.1.3-ReleaseNotes new file mode 100644 index 0000000..94ee73e --- /dev/null +++ b/docs/v1.1.3-ReleaseNotes @@ -0,0 +1,13 @@ +== Cryptsetup 1.1.3 Release Notes == + +=== changes since version 1.1.2 === + +* Fix device alignment ioctl calls parameters. + (Device alignment code was not working properly on some architectures like ppc64.) + +* Fix activate_by_* API calls to handle NULL device name as documented. + (To enable check of passphrase/keyfile using libcryptsetup without activating the device.) + +* Fix udev support for old libdevmapper with not compatible definition. + +* Added Polish translation file. diff --git a/docs/v1.2.0-ReleaseNotes b/docs/v1.2.0-ReleaseNotes new file mode 100644 index 0000000..f3061d9 --- /dev/null +++ b/docs/v1.2.0-ReleaseNotes @@ -0,0 +1,126 @@ +Cryptsetup 1.2.0 Release Notes +============================== + +Changes since version 1.2.0-rc1 + + * Fix crypt_activate_by_keyfile() to work with PLAIN devices. + * Fix plain create command to properly handle keyfile size. + * Update translations. + +Changes since version 1.1.3 + +Important changes +~~~~~~~~~~~~~~~~~ + + * Add text version of *FAQ* (Frequently Asked Questions) to distribution. + + * Add selection of random/urandom number generator for luksFormat + (option --use-random and --use-urandom). + + (This affects only long term volume key in *luksFormat*, + not RNG used for salt and AF splitter). + + You can also set the default to /dev/random during compilation with + --enable-dev-random. Compiled-in default is printed in --help output. + + Be very careful before changing default to blocking /dev/random use here. + + * Fix *luksRemoveKey* to not ask for remaining keyslot passphrase, + only for removed one. + + * No longer support *luksDelKey* (replaced with luksKillSlot). + * if you want to remove particular passphrase, use *luksKeyRemove* + * if you want to remove particular keyslot, use *luksKillSlot* + + Note that in batch mode *luksKillSlot* allows removing of any keyslot + without question, in normal mode requires passphrase or keyfile from + other keyslot. + + * *Default alignment* for device (if not overridden by topology info) + is now (multiple of) *1MiB*. + This reflects trends in storage technologies and aligns to the same + defaults for partitions and volume management. + + * Allow explicit UUID setting in *luksFormat* and allow change it later + in *luksUUID* (--uuid parameter). + + * All commands using key file now allows limited read from keyfile using + --keyfile-size and --new-keyfile-size parameters (in bytes). + + This change also disallows overloading of --key-size parameter which + is now exclusively used for key size specification (in bits.) + + * *luksFormat* using pre-generated master key now properly allows + using key file (only passphrase was allowed prior to this update). + + * Add --dump-master-key option for *luksDump* to perform volume (master) + key dump. Note that printed information allows accessing device without + passphrase so it must be stored encrypted. + + This operation is useful for simple Key Escrow function (volume key and + encryption parameters printed on paper on safe place). + + This operation requires passphrase or key file. + + * The reload command is no longer supported. + (Use dmsetup reload instead if needed. There is no real use for this + function except explicit data corruption:-) + + * Cryptsetup now properly checks if underlying device is in use and + disallows *luksFormat*, *luksOpen* and *create* commands on open + (e.g. already mapped or mounted) device. + + * Option --non-exclusive (already deprecated) is removed. + +Libcryptsetup API additions: + + * new functions + * crypt_get_type() - explicit query to crypt device context type + * crypt_resize() - new resize command using context + * crypt_keyslot_max() - helper to get number of supported keyslots + * crypt_get_active_device() - get active device info + * crypt_set/get_rng_type() - random/urandom RNG setting + * crypt_set_uuid() - explicit UUID change of existing device + * crypt_get_device_name() - get underlying device name + + * Fix optional password callback handling. + + * Allow to activate by internally cached volume key immediately after + crypt_format() without active slot (for temporary devices with + on-disk metadata) + + * libcryptsetup is binary compatible with 1.1.x release and still + supports legacy API calls + + * cryptsetup binary now uses only new API calls. + + * Static compilation of both library (--enable-static) and cryptsetup + binary (--enable-static-cryptsetup) is now properly implemented by common + libtool logic. + + Prior to this it produced miscompiled dynamic cryptsetup binary with + statically linked libcryptsetup. + + The static binary is compiled as src/cryptsetup.static in parallel + with dynamic build if requested. + +Other changes +~~~~~~~~~~~~~ + * Fix default plain password entry from terminal in activate_by_passphrase. + * Initialize volume key from active device in crypt_init_by_name() + * Fix cryptsetup binary exit codes. + 0 - success, otherwise fail + 1 - wrong parameters + 2 - no permission + 3 - out of memory + 4 - wrong device specified + 5 - device already exists or device is busy + * Remove some obsolete info from man page. + * Add more regression tests for commands. + * Fix possible double free when handling master key file. + * Fix pkg-config use in automake scripts. + * Wipe iteration and salt after luksKillSlot in LUKS header. + * Rewrite file differ test to C (and fix it to really work). + * Do not query non-existent device twice (cryptsetup status /dev/nonexistent). + * Check if requested hash is supported before writing LUKS header. + * Fix problems reported by clang scan-build. diff --git a/docs/v1.3.0-ReleaseNotes b/docs/v1.3.0-ReleaseNotes new file mode 100644 index 0000000..b7ae977 --- /dev/null +++ b/docs/v1.3.0-ReleaseNotes @@ -0,0 +1,101 @@ +Cryptsetup 1.3.0 Release Notes +============================== + +Changes since version 1.2.0 + +Important changes +~~~~~~~~~~~~~~~~~ + * Several userspace crypto backends support + + cryptsetup now supports generic crypto backend interface which allows + compile package with various crypto libraries, these are already implemented: + + * gcrypt (default, used in previous versions) + * OpenSSL + * NSS (because of missing ripemd160 it cannot provide full backward compatibility) + * kernel userspace API (provided by kernel 2.6.38 and above) + (Note that kernel userspace backend is very slow for this type of operation. + But it can be useful for embedded systems, because you can avoid userspace + crypto library completely.) + + Backend is selected during configure time, using --with-crypto_backend option. + + configure --with-crypto_backend=BACKEND (gcrypt/openssl/nss/kernel) [gcrypt] + + Note that performance checked (iterations) in LUKS header will cause that + real iteration time will differ with different backends. + (There are huge differences in speed between libraries.) + + * Cryptsetup now automatically allocates loopback device (/dev/loop) if device + argument is file and not plain device. + + This require Linux kernel 2.6.25 and above (which implements loop autoclear flag). + + You can see backing file in cryptsetup status output if underlying device is loopback. + + * Introduce maximum default keyfile size, add configure option, visible in --help. + + Cryptsetup now fails if read from keyfile exceeds internal limit. + You can always specify keyfile size (overrides limit) by using --keyfile-size option. + + * Adds luksChangeKey command + + cryptestup luksChangeKey --key-file [--key-slot X] + cryptestup luksChangeKey [--key-slot X] (for passphrase change) + + This command allows passphrase/keyfile change in one step. If no key slot is + specified (and there is still free key slot on device) new slot is allocated before + the old is purged. + + If --key-slot option is specified (or there is no free slot) command will overwrite + existing slot. + WARNING: Be sure you have another slot active or header backup when using explicit + key slot (so you can unlock the device even after possible media failure). + + * Adds compatible support for loop-AES encryption type in loopaesOpen command. + + Linux dm-crypt in 2.6.38 and above supports loop-AES compatible mapping + (including multi-key and special CBC mode, all three modes are supported). + + If you have raw loop-AES keyfile (text file with uuencoded per-line keys), you can + access loop-AES volume using + cryptsetup loopaesOpen [--key-size 128] --key-file + + If you are using GPG encrypted keyfile + gpg --decrypt | cryptsetup loopaesOpen --key-file=- + + Do not forget to specify key size. Version and hash is automatically detected + according to number of lines in key file. For special configuration you can + override IV sector offset using --skip option, device offset with --offset + and hash algorithm using --hash, see man page for details. + + Please note that loopAES dm-crypt mode is provided for compatibility reasons + (so you do not need to patch kernel and util-linux to map existing volumes) + but it is not, and never will be, optimized for speed. + It is experimental feature for now. + + * Require the whole key read from keyfile in create command (regression in 1.2.0). + + * WARNING: This is the last cryptsetup release which supports library with + old API (using struct crypt_options). + These calls are deprecated since 1.1.0 and AFAIK no application + is using it in recent distros. Removing compatible code will allow + new features to be implemented easily. + +Other changes +~~~~~~~~~~~~~ + * Lock memory also in luksDump command. + * Fix return code when passphrase is read from pipe. + * Increase libcryptsetup version (loopAES change), still fully backward compatible. + * Fixes static build (--disable-static-cryptsetup now works properly). + * Supports secure data flag for device-mapper ioctl (will be in 2.6.39, + forcing kernel to wipe all ioctl buffers with possible key data). + To enable this flag you need new device-mapper library, in LVM2 2.02.84. + * Add copyright texts into some files and adds GPL exception allowing + to distribute resulting binaries linked with OpenSSL. + * Update FAQ. + * Fix message when locking memory fails. + * Fix luksAddKey return code if master key is used. + * Update some text files in distributions. + * Add docs directory with Release Notes archive. + * Do not hardcode loopback device name in tests, use internal loopback library. diff --git a/docs/v1.3.1-ReleaseNotes b/docs/v1.3.1-ReleaseNotes new file mode 100644 index 0000000..8b2d1dd --- /dev/null +++ b/docs/v1.3.1-ReleaseNotes @@ -0,0 +1,14 @@ +Cryptsetup 1.3.1 Release Notes +============================== + +Changes since version 1.3.0 + + * Fix keyfile=- processing in create command (regression in 1.3.0). + + * Simplify device path status check (use /sys and do not scan /dev). + + * Do not ignore device size argument for create command (regression in 1.2.0). + + * Fix error paths in blockwise code and lseek_write call. + + * Add optional Nettle crypto backend support. diff --git a/docs/v1.4.0-ReleaseNotes b/docs/v1.4.0-ReleaseNotes new file mode 100644 index 0000000..bef4e74 --- /dev/null +++ b/docs/v1.4.0-ReleaseNotes @@ -0,0 +1,131 @@ +Cryptsetup 1.4.0 Release Notes +============================== + +Changes since version 1.3.1 + +Important changes +~~~~~~~~~~~~~~~~~ + +WARNING: This release removes old deprecated API from libcryptsetup + (all functions using struct crypt_options). + + This require libcrypsetup version change and + rebuild of applications using cryptsetup library. + All new API symbols are backward compatible. + +* If device is not rotational disk, cryptsetup no longer tries + to wipe keyslot with Gutmann algorithm for magnetic media erase + but simply rewrites area once by random data. + +* The on-disk LUKS header can now be detached (e.g. placed on separate + device or in file) using new --header option. + + This option is only relevant for LUKS devices and can be used in + luksFormat, luksOpen, luksSuspend, luksResume and resize commands. + + If used with luksFormat the --align-payload option is taken + as absolute sector alignment on ciphertext device and can be zero. + + Example: + Create LUKS device with ciphertext device on /dev/sdb and header + on device /dev/sdc. Use all space on /dev/sdb (no reserved area for header). + + cryptsetup luksFormat /dev/sdb --header /dev/sdc --align-payload 0 + + Activate such device: + cryptsetup luksOpen /dev/sdb --header /dev/sdc test_disk + + You can use file for LUKS header (loop device will be used while + manipulating with such detached header), just you have to create + large enough file in advance. + + dd if=/dev/zero of=/mnt/luks_header bs=1M count=4 + cryptsetup luksFormat /dev/sdb --header /mnt/luks_header --align-payload 0 + + Activation is the same as above. + + cryptsetup luksOpen /dev/sdb --header /mnt/luks_header test_disk + + All keyslot operations need to be run on _header_ not on ciphertext device, + an example: + + cryptsetup luksAddKey /mnt/luks_header + + If you do not use --align-payload 0, you can later restore LUKS header + on device itself (and use it as normal LUKS device without detached header). + + WARNING: There is no possible check that specified ciphertext device + matches detached on-disk header. Use with care, it can destroy + your data in case of a mistake. + + WARNING: Storing LUKS header in a file means that anti-forensic splitter + cannot properly work (there is filesystem allocation layer between + header and disk). + +* Support --allow-discards option to allow discards/TRIM requests. + + Since kernel 3.1, dm-crypt devices optionally (not by default) support + block discards (TRIM) commands. + If you want to enable this operation, you have to enable it manually + on every activation using --allow-discards + + cryptsetup luksOpen --allow-discards /dev/sdb test_disk + + WARNING: There are several security consequences, please read at least + http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html + before you enable it. + +* Add --shared option for creating non-overlapping crypt segments. + + The --shared options checks that mapped segments are not overlapping + and allows non-exclusive access to underlying device. + Only plain crypt devices can be used in this mode. + + Example - map 64M of device disk and following 32 M area as another disk. + + cryptsetup create outer_disk /dev/sdb --offset 0 --size 65536 + cryptsetup create inner_disk /dev/sdb --offset 65536 --size 32768 --shared + + (It can be used to simulate trivial hidden disk concepts.) + +libcryptsetup API changes: + * Added options to support detached metadata device + crypt_init_by_name_and_header() + crypt_set_data_device() + * Add crypt_last_error() API call. + * Fix plain crypt format parameters to include size option. + * Add crypt_get_iv_offset() function. + + * Remove old API functions (all functions using crypt_options). + +* Support key-slot option for luksOpen (use only explicit keyslot). + + You can now specify key slot in luksOpen and limit checking + only to specified slot. + +* Support retries and timeout parameters for luksSuspend. + (The same way as in luksOpen.) + +* Add doxygen-like documentation (it will be available on project page later). + (To generate it manually run doxygen in docs directory.) + +Other changes +~~~~~~~~~~~~~ +* Fix crypt_load to properly check device size. +* Do not allow context format of already formatted device. +* Do not allow key retrieval while suspended (key could be wiped). +* Do not allow suspend for non-LUKS devices. +* Fix luksKillSLot exit code if slot is inactive or invalid. +* Fix exit code if passphrases do not match in luksAddKey. +* Fix return code for status command when device doesn't exists. +* Fix verbose messages in isLuks command. +* Support Nettle 2.4 crypto backend (supports ripemd160). +* Add LUKS on-disk format description into package. +* Enhance check of device size before writing LUKS header. +* Add more paranoid checks for LUKS header and keyslot attributes. +* Use new /dev/loop-control (kernel 3.1) if possible. +* Remove hash/hmac restart from crypto backend and make it part of hash/hmac final. +* Improve check for invalid offset and size values. +* Revert default initialisation of volume key in crypt_init_by_name(). +* Add more regression tests. +* Add some libcryptsetup example files (see docs/examples). diff --git a/docs/v1.4.1-ReleaseNotes b/docs/v1.4.1-ReleaseNotes new file mode 100644 index 0000000..ea68cb8 --- /dev/null +++ b/docs/v1.4.1-ReleaseNotes @@ -0,0 +1,25 @@ +Cryptsetup 1.4.1 Release Notes +============================== + +Changes since version 1.4.0 + +* Merge experimental Python cryptsetup (pycryptsetup) binding. + + This option is disabled by default, you can enable build of Python binding + with --enable--python configure switch. + + Note that binding currently covers only partial libcryptsetup functions, + mainly LUKS device handling needed for Anaconda installer. + Until now provided separately as python-cryptsetup. + Thanks to Martin Sivak for the code. + + See python subdirectory for more info. + + Python binding code is experimental for now, no stable API guarantee. + +* Fix crypt_get_volume_key_size() for plain device. + (cryptsetup status reported zero key size for plain crypt devices). + +* Fix typo in set_iteration_time API call (old name remains for compatibility reasons). + +* Fix FSF address in license and add LGPL license text. diff --git a/docs/v1.4.2-ReleaseNotes b/docs/v1.4.2-ReleaseNotes new file mode 100644 index 0000000..9dbeb46 --- /dev/null +++ b/docs/v1.4.2-ReleaseNotes @@ -0,0 +1,44 @@ +Cryptsetup 1.4.2 Release Notes +============================== + +Changes since version 1.4.1 + +* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI. + These options can be used to skip start of keyfile or device used as keyfile. + +* Add repair command and crypt_repair() for known LUKS metadata problems repair. + + Some well-known LUKS metadata corruptions are easy to repair, this + command should provide a way to fix these problems. + + Always create binary backup of header device before running repair, + (only 4kB - visible header) for example by using dd: + dd if=/dev/ of=repair_bck.img bs=1k count=4 + + Then you can try to run repair: + cryptsetup repair + + Note, not all problems are possible to repair and if keyslot or some header + parameters are overwritten, device is lost permanently. + +* Fix header check to support old (cryptsetup 1.0.0) header alignment. + (Regression in 1.4.0) + +* Allow to specify --align-payload only for luksFormat. + +* Add --master-key-file option to luksOpen (open using volume key). + +* Support UUID= format for device specification. + You can open device by UUID (only shortcut to /dev/disk/by-uuid/ symlinks). + +* Support password verification with quiet flag if possible. (1.2.0) + Password verification can be still possible if input is terminal. + +* Fix retry if entered passphrases (with verify option) do not match. + (It should retry if requested, not fail.) + +* Fix use of empty keyfile. + +* Fix error message for luksClose and detached LUKS header. + +* Allow --header for status command to get full info with detached header. diff --git a/docs/v1.4.3-ReleaseNotes b/docs/v1.4.3-ReleaseNotes new file mode 100644 index 0000000..f084e06 --- /dev/null +++ b/docs/v1.4.3-ReleaseNotes @@ -0,0 +1,62 @@ +Cryptsetup 1.4.3 Release Notes +============================== + +Changes since version 1.4.2 + +* Fix readonly activation if underlying device is readonly (1.4.0). + +* Fix loop mapping on readonly file. + +* Include stddef.h in libdevmapper.h (size_t definition). + +* Fix keyslot removal for device with 4k hw block (1.4.0). +(Wipe keyslot failed in this case.) + +* Relax --shared flag to allow mapping even for overlapping segments. + + The --shared flag (and API CRYPT_ACTIVATE_SHARED flag) is now able + to map arbitrary overlapping area. From API it is even usable + for LUKS devices. + It is user responsibility to not cause data corruption though. + + This allows e.g. scubed to work again and also allows some + tricky extensions later. + +* Allow empty cipher (cipher_null) for testing. + + You can now use "null" (or directly cipher_null-ecb) in cryptsetup. + This means no encryption, useful for performance tests + (measure dm-crypt layer overhead). + +* Switch on retry on device remove for libdevmapper. + Device-mapper now retry removal if device is busy. + +* Allow "private" activation (skip some udev global rules) flag. + Cryptsetup library API now allows to specify CRYPT_ACTIVATE_PRIVATE, + which means that some udev rules are not processed. + (Used for temporary devices, like internal keyslot mappings where + it is not desirable to run any device scans.) + +* This release also includes some Red Hat/Fedora specific extensions +related to FIPS140-2 compliance. + +In fact, all these patches are more formal changes and are just subset +of building blocks for FIPS certification. See FAQ for more details +about FIPS. + +FIPS extensions are enabled by using --enable-fips configure switch. + +In FIPS mode (kernel booted with fips=1 and gcrypt in FIPS mode) + + - it provides library and binary integrity verification using + libfipscheck (requires pre-generated checksums) + + - it uses FIPS approved RNG for encryption key and salt generation + (note that using /dev/random is not formally FIPS compliant RNG). + + - only gcrypt crypto backend is currently supported in FIPS mode. + +The FIPS RNG requirement for salt comes from NIST SP 800-132 recommendation. +(Recommendation for Password-Based Key Derivation. Part 1: Storage Applications. +http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf) +LUKS should be aligned to this recommendation otherwise. diff --git a/docs/v1.5.0-ReleaseNotes b/docs/v1.5.0-ReleaseNotes new file mode 100644 index 0000000..9f1e1d1 --- /dev/null +++ b/docs/v1.5.0-ReleaseNotes @@ -0,0 +1,241 @@ +Cryptsetup 1.5.0 Release Notes +============================== + +This release covers mainly inclusion of: + + * Veritysetup tool (and related libcryptsetup extensions for dm-verity). + + * Experimental cryptsetup-reencrypt tool (LUKS offline reencryption). + +Changes since version 1.5.0-rc2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + * Add --device-size option for reencryption tool. + + * Switch to use unit suffix for --reduce-device-size option. + + * Remove open device debugging feature (no longer needed). + + * Fix library name for FIPS check. + + * Add example of using reencryption inside dracut (see misc/dracut). + +Changes since version 1.5.0-rc1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool. + +! cryptsetup-reencrypt tool is EXPERIMENTAL +! ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL + +This tool tries to simplify situation when you need to re-encrypt the whole +LUKS device in situ (without need to move data elsewhere). + +This can happen for example when you want to change volume (master) key, +encryption algorithm, or other encryption parameter. + +Cryptsetup-reencrypt can even optionally shift data on device +(reducing data device size - you need some free space at the end of device). + +In general, cryptsetup-reencrypt can be used to + + - re-generate volume key + - change arbitrary encryption parameters + - add encryption to not yet encrypted drive + +Side effect of reencryption is that final device will contain +only ciphertext (for all sectors) so even if device was not properly +wiped by random data, after reencryption you cannot distinguish +which sectors are used. +(Reencryption is done always for the whole device.) + +There are for sure bugs, please TEST IT IN TEST ENVIRONMENT before +use for your data. + +This tool is not resistant to HW and kernel failures - hw crash +will cause serious data corruption. + +You can enable compilation of this tool with --enable-cryptsetup-reencrypt +configure option (it is switched off by default). +(Tool requires libcryptsetup 1.4.3 and later.) + +You have to provide all keyslot passphrases or use --keyslot-option +(then all other keyslots will be disabled). + +EXAMPLES (from man page) + +Reencrypt /dev/sdb1 (change volume key) + # cryptsetup-reencrypt /dev/sdb1 + +Reencrypt and also change cipher and cipher mode + # cryptsetup-reencrypt /dev/sdb1 -c aes-xts-plain64 + + Note: if you are changing key size, there must be enough space + for keyslots in header or you have to use --reduce-device size and + reduce fs in advance. + +Add LUKS encryption to not yet encrypted device + First, be sure you have space added to disk. + Or, alternatively, shrink filesystem in advance. + + Here we need 4096 512-bytes sectors (enough for 2x128 bit key). + + # fdisk -u /dev/sdb # move sdb1 partition end + 4096 sectors + + # cryptsetup-reencrypt /dev/sdb1 --new --reduce-device-size 4096 + +There are some options which can improve performance (depends on system), +namely --use-directio (use direct IO for all operations) can be faster +on some systems. See man page. + +Progress and estimated time is printed during reencryption. + +You can suspend reencryption (using ctrl+c or term signal). +To continue reencryption you have to provide only +the device parameter (offset is stored in temporary log file). + +Please note LUKS device is marked invalid during reencryption and +you have to retain tool temporary files until reencryption finishes. + +Temporary files are LUKS-.[log|org|new] + +Other changes +~~~~~~~~~~~~~ + + * Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID). + + * Add --test-passphrase option for luksOpen (check passphrase only). + + * Fix parsing of hexadecimal string (salt or root hash) in veritysetup. + +Changes since version 1.4.3 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Introduce veritysetup tool for dm-verity target management. + +The dm-verity device-mapper target was added to Linux kernel 3.4 and +provides transparent integrity checking of block devices using a cryptographic +digest provided by the kernel crypto API. This target is read-only. + +It is meant to be setup as part of a verified boot path (it was originally +developed by Chrome OS authors as part of verified boot infrastructure). + +For deeper description please see http://code.google.com/p/cryptsetup/wiki/DMVerity +and kernel dm-verity documentation. + +The libcryptsetup library was extended to support manipulation +with dm-verity kernel module and new veritysetup CLI tool is added. + +There are no additional library requirements (it uses the same crypto +backend as cryptsetup). + +If you want compile cryptsetup without veritysetup tool, +use --disable-veritysetup configure option. +For other configuration option see configure --help and veritysetup --help +(e.g. default parameters). + +Supported libcryptsetup functions new CRYPT_VERITY type: + crypt_init + crypt_init_by_name + crypt_set_data device + crypt_get_type + crypt_format + crypt_load + crypt_get_active_device + crypt_activate_by_volume_key (volume key == root hash here) + crypt_dump +and new introduced function + crypt_get_verity_info + +Please see comments in libcryptsetup.h and veritysetup.c as an code example +how to use CRYPT_VERITY API. + +The veritysetup tool supports these operations: + + veritysetup format + Formats (calculates all hash areas according to ). + This is initial command to prepare device for later verification. + + veritysetup create + Creates (activates) a dm-verity mapping with backed by device + and using for in-kernel verification. + + veritysetup verify + Verifies data in userspace (no kernel device is activated). + + veritysetup remove + Removes activated device from kernel (similar to dmsetup remove). + + veritysetup status + Reports status for the active kernel dm-verity device. + + veritysetup dump + Reports parameters of verity device from on-disk stored superblock. + +For more info see veritysetup --help and veritysetup man page. + +Other changes +~~~~~~~~~~~~~ + + * Both data and header device can now be a file and + loop device is automatically allocated. + + * Require only up to last keyslot area for header device, previously + backup (and activation) required device/file of size up to data start + offset (data payload). + + * Fix header backup and restore to work on files with large data offset. + Backup and restore now works even if backup file is smaller than data offset. + +Appendix: Examples of veritysetup use +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + Format device using default parameters, info and final root hash is printed: + # veritysetup format /dev/sdb /dev/sdc + VERITY header information for /dev/sdc + UUID: fad30431-0c59-4fa6-9b57-732a90501f75 + Hash type: 1 + Data blocks: 52224 + Data block size: 4096 + Hash block size: 4096 + Hash algorithm: sha256 + Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9 + Root hash: 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1 + + Activation of device in-kernel: + # veritysetup create vr /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1 + Note - if device is corrupted, kernel mapping is created but will report failure: + Verity device detected corruption after activation. + + Userspace verification: + # veritysetup verify /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1 + Verification failed at position 8192. + Verification of data area failed. + + Active device status report: + # veritysetup status vr + /dev/mapper/vr is active. + type: VERITY + status: verified + hash type: 1 + data block: 4096 + hash block: 4096 + hash name: sha256 + salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9 + data device: /dev/sdb + size: 417792 sectors + mode: readonly + hash device: /dev/sdc + hash offset: 8 sectors + + Dump of on-disk superblock information: + # veritysetup dump /dev/sdc + VERITY header information for /dev/sdc + UUID: fad30431-0c59-4fa6-9b57-732a90501f75 + Hash type: 1 + Data blocks: 52224 + Data block size: 4096 + Hash block size: 4096 + Hash algorithm: sha256 + Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9 + + Remove mapping: + # veritysetup remove vr diff --git a/docs/v1.5.1-ReleaseNotes b/docs/v1.5.1-ReleaseNotes new file mode 100644 index 0000000..7202a8c --- /dev/null +++ b/docs/v1.5.1-ReleaseNotes @@ -0,0 +1,32 @@ +Cryptsetup 1.5.1 Release Notes +============================== + +Changes since version 1.5.0 + +* The libcryptsetup library now tries to initialize device-mapper backend and + loop devices only if they are really needed (lazy initializations). + This allows some operations to be run by a non-root user. + + (Unfortunately LUKS header keyslot operations still require temporary dm-crypt + device and device-mapper subsystem is available only to superuser.) + + Also clear error messages are provided if running as non-root user and + operation requires privileged user. + +* Veritysetup can be now used by a normal user for creating hash image to file + and also it can create hash image if doesn't exist. + (Previously it required pre-allocated space.) + +* Added crypt_keyslot_area() API call which allows external tools + to get exact keyslot offsets and analyse content. + + An example of a tool that searches the keyslot area of a LUKS container + for positions where entropy is low and hence there is a high probability + of damage is in misc/kesylot_checker. + (Thanks to Arno Wagner for the code.) + +* Optimized seek to keyfile-offset if key offset is large. + +* Fixed luksHeaderBackup for very old v1.0 unaligned LUKS headers. + +* Various fixes for problems found by a several static analysis tools. diff --git a/docs/v1.6.0-ReleaseNotes b/docs/v1.6.0-ReleaseNotes new file mode 100644 index 0000000..fe8770d --- /dev/null +++ b/docs/v1.6.0-ReleaseNotes @@ -0,0 +1,261 @@ +Cryptsetup 1.6.0 Release Notes +============================== + +Changes since version 1.6.0-rc1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + * Change LUKS default cipher to to use XTS encryption mode, + aes-xts-plain64 (i.e. using AES128-XTS). + + XTS mode becomes standard in hard disk encryption. + + You can still use any old mode: + - compile cryptsetup with old default: + configure --with-luks1-cipher=aes --with-luks1-mode=cbc-essiv:sha256 --with-luks1-keybits=256 + - format LUKS device with old default: + cryptsetup luksFormat -c aes-cbc-essiv:sha256 -s 256 + + + * Skip tests and fix error messages if running on old systems (or with old kernel). + + * Rename configure.in to configure.ac and fix issues with new automake and pkgconfig + and --disable-kernel_crypto option to allow compilation with old kernel headers. + + * Allow repair of 512 bits key header. + + * Fix status of device if path argument is used and fix double path prefix + for non-existent device path. + + +Changes since version 1.5.1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Important changes +~~~~~~~~~~~~~~~~~ + + * Cryptsetup and libcryptsetup is now released under GPLv2+ + (GPL version 2 or any later). + Some internal code handling files (loopaes, verity, tcrypt + and crypto backend wrapper) are LGPLv2+. + + Previously code was GPL version 2 only. + + + * Introducing new unified command open and close. + + Example: + cryptsetup open --type plain|luks|loopaes|tcrypt + (type defaults to luks) + + with backward-compatible aliases plainOpen, luksOpen, loopaesOpen, + tcryptOpen. Basically "open --type xyz" has alias "xyzOpen". + + The "create" command (plain device create) is DEPRECATED but will + be still supported. + (This command is confusing because of switched arguments order.) + + The close command is generic command to remove mapping and have + backward compatible aliases (remove, luksClose, ...) which behaves + exactly the same. + + While all old syntax is still supported, I strongly suggest to use + new command syntax which is common for all device types (and possible + new formats added in future). + + + * cryptsetup now support directly TCRYPT (TrueCrypt and compatible tc-play) + on-disk format + (Code is independent implementation not related to original project). + + Only dump (tcryptDump command) and activation (open --type tcrypt or tcryptOpen) + of TCRYPT device are supported. No header changes are supported. + + It is intended to easily access containers shared with other operating systems + without need to install 3rd party software. For native Linux installations LUKS + is the preferred format. + + WARNING: TCRYPT extension requires kernel userspace crypto API to be + available (introduced in Linux kernel 2.6.38). + If you are configuring kernel yourself, enable "User-space interface + for symmetric key cipher algorithms" in "Cryptographic API" section + (CRYPTO_USER_API_SKCIPHER .config option). + + Because TCRYPT header is encrypted, you have to always provide valid + passphrase and keyfiles. Keyfiles are handled exactly the same as in original + format (basically, first 1MB of every keyfile is mixed using CRC32 into pool). + + Cryptsetup should recognize all TCRYPT header variants ever released, except + legacy cipher chains using LRW encryption mode with 64 bits encryption block + (namely Blowfish in LRW mode is not recognized, this is limitation of kernel + crypto API). + + Device activation is supported only for LRW/XTS modes (again, limitation + of kernel dmcrypt which do not implements TCRYPT extensions to CBC mode). + (So old containers cannot be activated, but you can use libcryptsetup + for lost password search, example of such code is included in misc directory.) + + Hidden header are supported using --tcrypt-hidden option, system encryption + using --tcrypt-system option. + + For detailed description see man page. + + EXAMPLE: + * Dump device parameters of container in file: + + # cryptsetup tcryptDump tst + Enter passphrase: + + TCRYPT header information for tst + Version: 5 + Driver req.: 7 + Sector size: 512 + MK offset: 131072 + PBKDF2 hash: sha512 + Cipher chain: serpent-twofish-aes + Cipher mode: xts-plain64 + MK bits: 1536 + + You can also dump master key using --dump-master-key. + Dump does not require superuser privilege. + + * Activation of this container + + # cryptsetup tcryptOpen tst tcrypt_dev + Enter passphrase: + (Chain of dmcrypt devices is activated as /dev/mapper/tcrypt_dev.) + + * See status of active TCRYPT device + + # cryptsetup status tcrypt_dev + + /dev/mapper/tcrypt_dev is active. + type: TCRYPT + cipher: serpent-twofish-aes-xts-plain64 + keysize: 1536 bits + device: /dev/loop0 + loop: /tmp/tst + offset: 256 sectors + size: 65024 sectors + skipped: 256 sectors + mode: read/write + + * And plaintext filesystem now ready to mount + + # blkid /dev/mapper/tcrypt_dev + /dev/mapper/tcrypt_dev: SEC_TYPE="msdos" UUID="9F33-2954" TYPE="vfat" + + + * Add (optional) support for lipwquality for new LUKS passwords. + + If password is entered through terminal (no keyfile specified) + and cryptsetup is compiled with --enable-pwquality, default + system pwquality settings are used to check password quality. + + You can always override this check by using new --force-password option. + + For more info about pwquality project see http://libpwquality.fedorahosted.org/ + + + * Proper handle interrupt signals (ctrl+c and TERM signal) in tools + + Code should now handle interrupt properly, release and explicitly wipe + in-memory key materials on interrupt. + (Direct users of libcryptsetup should always call crypt_free() when + code is interrupted to wipe all resources. There is no signal handling + in library, it is up to the tool using it.) + + + * Add new benchmark command + + The "benchmark" command now tries to benchmark PBKDF2 and some block + cipher variants. You can specify you own parameters (--cipher/--key-size + for block ciphers, --hash for PBKDF2). + + See man page for detailed description. + + WARNING: benchmark command requires kernel userspace crypto API to be + available (introduced in Linux kernel 2.6.38). + If you are configuring kernel yourself, enable "User-space interface + for symmetric key cipher algorithms" in "Cryptographic API" section + (CRYPTO_USER_API_SKCIPHER .config option). + + EXAMPLE: + # cryptsetup benchmark + # Tests are approximate using memory only (no storage IO). + PBKDF2-sha1 111077 iterations per second + PBKDF2-sha256 53718 iterations per second + PBKDF2-sha512 18832 iterations per second + PBKDF2-ripemd160 89775 iterations per second + PBKDF2-whirlpool 23918 iterations per second + # Algorithm | Key | Encryption | Decryption + aes-cbc 128b 212.0 MiB/s 428.0 MiB/s + serpent-cbc 128b 23.1 MiB/s 66.0 MiB/s + twofish-cbc 128b 46.1 MiB/s 50.5 MiB/s + aes-cbc 256b 163.0 MiB/s 350.0 MiB/s + serpent-cbc 256b 23.1 MiB/s 66.0 MiB/s + twofish-cbc 256b 47.0 MiB/s 50.0 MiB/s + aes-xts 256b 190.0 MiB/s 190.0 MiB/s + serpent-xts 256b 58.4 MiB/s 58.0 MiB/s + twofish-xts 256b 49.0 MiB/s 49.5 MiB/s + aes-xts 512b 175.0 MiB/s 175.0 MiB/s + serpent-xts 512b 59.0 MiB/s 58.0 MiB/s + twofish-xts 512b 48.5 MiB/s 49.5 MiB/s + + Or you can specify cipher yourself: + # cryptsetup benchmark --cipher cast5-cbc-essiv:sha256 -s 128 + # Tests are approximate using memory only (no storage IO). + # Algorithm | Key | Encryption | Decryption + cast5-cbc 128b 32.4 MiB/s 35.0 MiB/s + + WARNING: these tests do not use dmcrypt, only crypto API. + You have to benchmark the whole device stack and you can get completely + different results. But is is usable for basic comparison. + (Note for example AES-NI decryption optimization effect in example above.) + +Features +~~~~~~~~ + + * Do not maintain ChangeLog file anymore, see git log for detailed changes, + e.g. here http://code.google.com/p/cryptsetup/source/list + + * Move change key into library, add crypt_keyslot_change_by_passphrase(). + This change is useful mainly in FIPS mode, where we cannot + extract volume key directly from libcryptsetup. + + * Add verbose messages during reencryption. + + * Default LUKS PBKDF2 iteration time is now configurable. + + * Add simple cipher benchmarking API. + + * Add kernel skcipher backend. + + * Add CRC32 implementation (for TCRYPT). + + * Move PBKDF2 into crypto backend wrapper. + This allows use it in other formats, use library implementations and + also possible use of different KDF function in future. + + * New PBKDF2 benchmark using getrusage(). + +Fixes +~~~~~ + + * Avoid O_DIRECT open if underlying storage doesn't support it. + + * Fix some non-translated messages. + + * Fix regression in header backup (1.5.1) with container in file. + + * Fix blockwise read/write for end writes near end of device. + (was not used in previous versions) + + * Ignore setpriority failure. + + * Code changes to fix/ignore problems found by Coverity static analysis, including + - Get page size should never fail. + - Fix time of check/use (TOCTOU test) in tools + - Fix time of check/use in loop/wipe utils. + - Fix time of check/use in device utils. + + * Disallow header restore if context is non-LUKS device. diff --git a/docs/v1.6.1-ReleaseNotes b/docs/v1.6.1-ReleaseNotes new file mode 100644 index 0000000..8fdc7d0 --- /dev/null +++ b/docs/v1.6.1-ReleaseNotes @@ -0,0 +1,32 @@ +Cryptsetup 1.6.1 Release Notes +============================== + +Changes since version 1.6.0 + +* Fix loop-AES keyfile parsing. + Loop-AES keyfile should be text keyfile, reject keyfiles which + are not properly terminated. + +* Fix passphrase pool overflow for too long TCRYPT passphrase. + (Maximal TCRYPT passphrase length is 64 characters.) + +* Return EPERM (translated to exit code 2) for too long TCRYPT passphrase. + +* Fix deactivation of device when failed underlying node disappeared. + +* Fix API deactivate call for TCRYPT format and NULL context parameter. + +* Improve keyslot checker example documentation. + +* Report error message if deactivation fails and device is still busy. + +* Make passphrase prompts more consistent (and remove "LUKS" form prompt). + +* Fix some missing headers (compilation failed with alternative libc). + +* Remove not functional API UUID support for plain & loopaes devices. + (not persistent activation UUID). + +* Properly cleanup devices on interrupt in api-test. + +* Support all tests run if kernel is in FIPS mode. diff --git a/docs/v1.6.2-ReleaseNotes b/docs/v1.6.2-ReleaseNotes new file mode 100644 index 0000000..192f4a6 --- /dev/null +++ b/docs/v1.6.2-ReleaseNotes @@ -0,0 +1,25 @@ +Cryptsetup 1.6.2 Release Notes +============================== + +Changes since version 1.6.1 + +* Print error and fail if more device arguments are present for isLuks command. + +* Fix cipher specification string parsing (found by gcc -fsanitize=address option). + +* Try to map TCRYPT system encryption through partition + (allows to activate mapping when other partition on the same device is mounted). + +* Print a warning if system encryption is used and device is a partition. + (TCRYPT system encryption uses whole device argument.) + +* Disallow explicit small payload offset for LUKS detached header. + LUKS detached header only allows data payload 0 (whole data device is used) + or explicit offset larger than header + keyslots size. + +* Fix boundary condition for verity device that caused failure for certain device sizes. + +* Various fixes to documentation, including update FAQ, default modes + and TCRYPT description. + +* Workaround for some recent changes in automake (serial-tests). diff --git a/docs/v1.6.3-ReleaseNotes b/docs/v1.6.3-ReleaseNotes new file mode 100644 index 0000000..24254b8 --- /dev/null +++ b/docs/v1.6.3-ReleaseNotes @@ -0,0 +1,50 @@ +Cryptsetup 1.6.3 Release Notes +============================== + +Changes since version 1.6.2 + +* Fix cryptsetup reencryption tool to work properly + with devices using 4kB sectors. + +* Always use page size if running through loop device, + this fixes failures for external LUKS header and + filesystem requiring 4kB block size. + +* Fix TCRYPT system encryption mapping for multiple partitions. + Since this commit, one can use partition directly as device parameter. + If you need to activate such partition from image in file, + please first use map partitioned loop device (losetup -P) + on image. + (Cryptsetup require partition offsets visible in kernel sysfs + in this mode.) + +* Support activation of old TrueCrypt containers using CBC mode + and whitening (created in TrueCrypt version < 4.1). + This requires Linux kernel 3.13 or later. + (Containers with cascade CBC ciphers are not supported.) + +* Properly display keys in dump --dump-master-key command + for TrueCrypt CBC containers. + +* Rewrite cipher benchmark loop which was unreliable + on very fast machines. + +* Add warning if LUKS device was activated using non-cryptsetup + library which did not set UUID properly (e.g. cryptmount). + (Some commands, like luksSuspend, are not available then.) + +* Support length limitation also for plain (no hash) length. + This can be used for mapping problematic cryptosystems which + wipes some key (losetup sometimes set last 32 byte to zero, + which can be now configured as --hash plain:31 parameter). + +* Fix hash limit if parameter is not a number. + (The whole key was set to zero instead of command failure.) + +* Unify --key-slot behavior in cryptsetup_reencrypt tool. + +* Update dracut example scripts for system reencryption on first boot. + +* Add command line option --tcrypt-backup to access TCRYPT backup header. + +* Fix static compilation with OpenSSL. diff --git a/docs/v1.6.4-ReleaseNotes b/docs/v1.6.4-ReleaseNotes new file mode 100644 index 0000000..ebc71cb --- /dev/null +++ b/docs/v1.6.4-ReleaseNotes @@ -0,0 +1,57 @@ +Cryptsetup 1.6.4 Release Notes +============================== + +Changes since version 1.6.3 + +* Implement new erase (with alias luksErase) command. + + The erase cryptsetup command can be used to permanently erase + all keyslots and make the LUKS container inaccessible. + (The only way to unlock such device is to use LUKS header backup + created before erase command was used.) + + You do not need to provide any password for this operation. + + This operation is irreversible. + +* Add internal "whirlpool_gcryptbug hash" for accessing flawed + Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above). + + The gcrypt version of Whirlpool hash algorithm was flawed in some + situations. + + This means that if you used Whirlpool in LUKS header and upgraded + to new gcrypt library your LUKS container become inaccessible. + + Please refer to cryptsetup FAQ for detail how to fix this situation. + +* Allow to use --disable-gcrypt-pbkdf2 during configuration + to force use internal PBKDF2 code. + +* Require gcrypt 1.6.1 for imported implementation of PBKDF2 + (PBKDF2 in gcrypt 1.6.0 is too slow). + +* Add --keep-key to cryptsetup-reencrypt. + + This allows change of LUKS header hash (and iteration count) without + the need to reencrypt the whole data area. + (Reencryption of LUKS header only without master key change.) + +* By default verify new passphrase in luksChangeKey and luksAddKey + commands (if input is from terminal). + +* Fix memory leak in Nettle crypto backend. + +* Support --tries option even for TCRYPT devices in cryptsetup. + +* Support --allow-discards option even for TCRYPT devices. + (Note that this could destroy hidden volume and it is not suggested + by original TrueCrypt security model.) + +* Link against -lrt for clock_gettime to fix undefined reference + to clock_gettime error (introduced in 1.6.2). + +* Fix misleading error message when some algorithms are not available. + +* Count system time in PBKDF2 benchmark if kernel returns no self usage info. + (Workaround to broken getrusage() syscall with some hypervisors.) diff --git a/docs/v1.6.5-ReleaseNotes b/docs/v1.6.5-ReleaseNotes new file mode 100644 index 0000000..dc9f525 --- /dev/null +++ b/docs/v1.6.5-ReleaseNotes @@ -0,0 +1,54 @@ +Cryptsetup 1.6.5 Release Notes +============================== + +Changes since version 1.6.4 + +* Allow LUKS header operation handling without requiring root privilege. + It means that you can manipulate with keyslots as a regular user, only + write access to device (or image) is required. + + This requires kernel crypto wrapper (similar to TrueCrypt device handling) + to be available (CRYPTO_USER_API_SKCIPHER kernel option). + If this kernel interface is not available, code fallbacks to old temporary + keyslot device creation (where root privilege is required). + + Note that activation, deactivation, resize and suspend operations still + need root privilege (limitation of kernel device-mapper backend). + +* Fix internal PBKDF2 key derivation function implementation for alternative + crypto backends (kernel, NSS) which do not support PBKDF2 directly and have + issues with longer HMAC keys. + + This fixes the problem for long keyfiles where either calculation is too slow + (because of internal rehashing in every iteration) or there is a limit + (kernel backend seems to not support HMAC key longer than 20480 bytes). + + (Note that for recent version of gcrypt, nettle or openssl the internal + PBKDF2 code is not compiled in and crypto library internal functions are + used instead.) + +* Support for Python3 for simple Python binding. + Python >= 2.6 is now required. You can set Python compiled version by setting + --with-python_version configure option (together with --enable-python). + +* Use internal PBKDF2 in Nettle library for Nettle crypto backend. + Cryptsetup compilation requires Nettle >= 2.6 (if using Nettle crypto backend). + +* Allow simple status of crypt device without providing metadata header. + The command "cryptsetup status" will print basic info, even if you + do not provide detached header argument. + +* Allow to specify ECB mode in cryptsetup benchmark. + +* Add some LUKS images for regression testing. + Note that if image with Whirlpool fails, the most probable cause is that + you have old gcrypt library with flawed whirlpool hash. + Read FAQ section 8.3 for more info. + +Cryptsetup API NOTE: +The direct terminal handling for passphrase entry will be removed from +libcryptsetup in next major version (application should handle it itself). + +It means that you have to always either provide password in buffer or set +your own password callback function trhough crypt_set_password_callback(). +See API documentation (or libcryptsetup.h) for more info. diff --git a/docs/v1.6.6-ReleaseNotes b/docs/v1.6.6-ReleaseNotes new file mode 100644 index 0000000..9d1fbee --- /dev/null +++ b/docs/v1.6.6-ReleaseNotes @@ -0,0 +1,29 @@ +Cryptsetup 1.6.6 Release Notes +============================== + +Changes since version 1.6.5 + +* LUKS: Fix keyslot device access for devices which + do not support direct IO operations. (Regression in 1.6.5.) + +* LUKS: Fallback to old temporary keyslot device mapping method + if hash (for ESSIV) is not supported by userspace crypto + library. (Regression in 1.6.5.) + +* Properly activate device with discard (TRIM for SSDs) + if requested even if dm_crypt module is not yet loaded. + Only if discard is not supported by the old kernel then + the discard option is ignored. + +* Fix some static analysis build warnings (scan-build). + +* Report crypto lib version only once (and always add kernel + version) in debug output. + +Cryptsetup API NOTE: +The direct terminal handling for passphrase entry will be removed from +libcryptsetup in next major version (application should handle it itself). + +It means that you have to always either provide password in buffer or set +your own password callback function through crypt_set_password_callback(). +See API documentation (or libcryptsetup.h) for more info. diff --git a/docs/v1.6.7-ReleaseNotes b/docs/v1.6.7-ReleaseNotes new file mode 100644 index 0000000..edb73e5 --- /dev/null +++ b/docs/v1.6.7-ReleaseNotes @@ -0,0 +1,84 @@ +Cryptsetup 1.6.7 Release Notes +============================== + +Changes since version 1.6.6 + +* Cryptsetup git and wiki are now hosted on GitLab. + https://gitlab.com/cryptsetup/cryptsetup + + Repository of stable releases remains on kernel.org site + https://www.kernel.org/pub/linux/utils/cryptsetup/ + + For more info please see README file. + +* Cryptsetup TCRYPT mode now supports VeraCrypt devices (TrueCrypt extension). + + The VeraCrypt extension only increases iteration count for the key + derivation function (on-disk format is the same as TrueCrypt format). + + Note that unlocking of a VeraCrypt device can take very long time if used + on slow machines. + + To use this extension, add --veracrypt option, for example + cryptsetup open --type tcrypt --veracrypt + + For use through libcryptsetup, just add CRYPT_TCRYPT_VERA_MODES flag. + +* Support keyfile-offset and keyfile-size options even for plain volumes. + +* Support keyfile option for luksAddKey if the master key is specified. + +* For historic reasons, hashing in the plain mode is not used + if keyfile is specified (with exception of --key-file=-). + Print a warning if these parameters are ignored. + +* Support permanent device decryption for cryptsetup-reencrypt. + To remove LUKS encryption from a device, you can now use --decrypt option. + +* Allow to use --header option in all LUKS commands. + The --header always takes precedence over positional device argument. + +* Allow luksSuspend without need to specify a detached header. + +* Detect if O_DIRECT is usable on a device allocation. + There are some strange storage stack configurations which wrongly allows + to open devices with direct-io but fails on all IO operations later. + + Cryptsetup now tries to read the device first sector to ensure it can use + direct-io. + +* Add low-level performance options tuning for dmcrypt (for Linux 4.0 and later). + + Linux kernel 4.0 contains rewritten dmcrypt code which tries to better utilize + encryption on parallel CPU cores. + + While tests show that this change increases performance on most configurations, + dmcrypt now provides some switches to change its new behavior. + + You can use them (per-device) with these cryptsetup switches: + --perf-same_cpu_crypt + --perf-submit_from_crypt_cpus + + Please use these only in the case of serious performance problems. + Refer to the cryptsetup man page and dm-crypt documentation + (for same_cpu_crypt and submit_from_crypt_cpus options). + https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt + +* Get rid of libfipscheck library. + (Note that this option was used only for Red Hat and derived distributions.) + With recent FIPS changes we do not need to link to this FIPS monster anymore. + Also drop some no longer needed FIPS mode checks. + +* Many fixes and clarifications to man pages. + +* Prevent compiler to optimize-out zeroing of buffers for on-stack variables. + +* Fix a crash if non-GNU strerror_r is used. + +Cryptsetup API NOTE: +The direct terminal handling for passphrase entry will be removed from +libcryptsetup in next major version (application should handle it itself). + +It means that you have to always either provide password in buffer or set +your own password callback function through crypt_set_password_callback(). +See API documentation (or libcryptsetup.h) for more info. diff --git a/docs/v1.6.8-ReleaseNotes b/docs/v1.6.8-ReleaseNotes new file mode 100644 index 0000000..43b4f2c --- /dev/null +++ b/docs/v1.6.8-ReleaseNotes @@ -0,0 +1,47 @@ +Cryptsetup 1.6.8 Release Notes +============================== + +Changes since version 1.6.7 + +* If the null cipher (no encryption) is used, allow only empty password for LUKS. + (Previously cryptsetup accepted any password in this case.) + + The null cipher can be used only for testing and it is used temporarily during + offline encrypting not yet encrypted device (cryptsetup-reencrypt tool). + + Accepting only empty password prevents situation when someone adds another + LUKS device using the same UUID (UUID of existing LUKS device) with faked + header containing null cipher. + This could force user to use different LUKS device (with no encryption) + without noticing. + (IOW it prevents situation when attacker intentionally forces + user to boot into different system just by LUKS header manipulation.) + + Properly configured systems should have an additional integrity protection + in place here (LUKS here provides only confidentiality) but it is better + to not allow this situation in the first place. + + (For more info see QubesOS Security Bulletin QSB-019-2015.) + +* Properly support stdin "-" handling for luksAddKey for both new and old + keyfile parameters. + +* If encrypted device is file-backed (it uses underlying loop device), + cryptsetup resize will try to resize underlying loop device as well. + (It can be used to grow up file-backed device in one step.) + +* Cryptsetup now allows to use empty password through stdin pipe. + (Intended only for testing in scripts.) + +Cryptsetup API NOTE: + +Direct terminal handling and password calling callback for passphrase +entry will be removed from libcryptsetup in next major (2.x) version +(application should handle it itself). +It means that application have to always provide password in API calls. + +Functions returning last error will be removed in next major version (2.x). +These functions did not work properly for early initialization errors +and application can implement better function easily using own error callback. + +See comments in libcryptsetup.h for more info about deprecated functions. diff --git a/docs/v1.7.0-ReleaseNotes b/docs/v1.7.0-ReleaseNotes new file mode 100644 index 0000000..cd568c1 --- /dev/null +++ b/docs/v1.7.0-ReleaseNotes @@ -0,0 +1,81 @@ +Cryptsetup 1.7.0 Release Notes +============================== + +The cryptsetup 1.7 release changes defaults for LUKS, +there are no API changes. + +Changes since version 1.6.8 + +* Default hash function is now SHA256 (used in key derivation function + and anti-forensic splitter). + + Note that replacing SHA1 with SHA256 is not for security reasons. + (LUKS does not have problems even if collisions are found for SHA1, + for details see FAQ item 5.20). + + Using SHA256 as default is mainly to prevent compatibility problems + on hardened systems where SHA1 is already be phased out. + + Note that all checks (kernel crypto API availability check) now uses + SHA256 as well. + +* Default iteration time for PBKDF2 is now 2 seconds. + + Increasing iteration time is in combination with PBKDF2 benchmark + fixes a try to keep PBKDF2 iteration count still high enough and + also still acceptable for users. + + N.B. Long term is to replace PBKDF2 algorithm with Password Hashing + Competition winner - Argon2. + + Distributions can still change these defaults in compilation time. + + You can change iteration time and used hash function in existing LUKS + header with cryptsetup-reencrypt utility even without full reencryption + of device (see --keep-key option). + +* Fix PBKDF2 iteration benchmark for longer key sizes. + + The previous PBKDF2 benchmark code did not take into account + output key length properly. + + For SHA1 (with 160-bits output) and 256-bit keys (and longer) + it means that the final iteration value was higher than it should be. + + For other hash algorithms (like SHA256 or SHA512) it caused + that iteration count was lower (in comparison to SHA1) than + expected for the requested time period. + + The PBKDF2 benchmark code is now fixed to use the key size for + the formatted device (or default LUKS key size if running in informational + benchmark mode). + + Thanks to A.Visconti, S.Bossi, A.Calo and H.Ragab + (http://www.club.di.unimi.it/) for point this out. + (Based on "What users should know about Full Disk Encryption + based on LUKS" paper to be presented on CANS2015). + +* Remove experimental warning for reencrypt tool. + The strong request for full backup before using reencryption utility + still applies :) + +* Add optional libpasswdqc support for new LUKS passwords. + + If password is entered through terminal (no keyfile specified) and + cryptsetup is compiled with --enable-passwdqc[=/etc/passwdqc.conf], + configured system passwdqc settings are used to check password quality. + +* Update FAQ document. + +Cryptsetup API NOTE: + +Direct terminal handling and password calling callback for passphrase +entry will be removed from libcryptsetup in next major (2.x) version +(application should handle it itself). +It means that application have to always provide password in API calls. + +Functions returning last error will be removed in next major version (2.x). +These functions did not work properly for early initialization errors +and application can implement better function easily using own error callback. + +See comments in libcryptsetup.h for more info about deprecated functions. diff --git a/docs/v1.7.1-ReleaseNotes b/docs/v1.7.1-ReleaseNotes new file mode 100644 index 0000000..057c135 --- /dev/null +++ b/docs/v1.7.1-ReleaseNotes @@ -0,0 +1,36 @@ +Cryptsetup 1.7.1 Release Notes +============================== + +Changes since version 1.7.0 + +* Code now uses kernel crypto API backend according to new + changes introduced in mainline kernel + + While mainline kernel should contain backward compatible + changes, some stable series kernels do not contain fully + backported compatibility patches. + Without these patches most of cryptsetup operations + (like unlocking device) fail. + + This change in cryptsetup ensures that all operations using + kernel crypto API works even on these kernels. + +* The cryptsetup-reencrypt utility now properly detects removal + of underlying link to block device and does not remove + ongoing re-encryption log. + This allows proper recovery (resume) of reencrypt operation later. + + NOTE: Never use /dev/disk/by-uuid/ path for reencryption utility, + this link disappears once the device metadata is temporarily + removed from device. + +* Cryptsetup now allows special "-" (standard input) keyfile handling + even for TCRYPT (TrueCrypt and VeraCrypt compatible) devices. + +* Cryptsetup now fails if there are more keyfiles specified + for non-TCRYPT device. + +* The luksKillSlot command now does not suppress provided password + in batch mode (if password is wrong slot is not destroyed). + Note that not providing password in batch mode means that keyslot + is destroyed unconditionally. diff --git a/docs/v1.7.2-ReleaseNotes b/docs/v1.7.2-ReleaseNotes new file mode 100644 index 0000000..6323430 --- /dev/null +++ b/docs/v1.7.2-ReleaseNotes @@ -0,0 +1,37 @@ +Cryptsetup 1.7.2 Release Notes +============================== + +Changes since version 1.7.1 + +* Update LUKS documentation format. + Clarify fixed sector size and keyslots alignment. + +* Support activation options for error handling modes in Linux kernel + dm-verity module: + + --ignore-corruption - dm-verity just logs detected corruption + + --restart-on-corruption - dm-verity restarts the kernel if corruption is detected + + If the options above are not specified, default behavior for dm-verity remains. + Default is that I/O operation fails with I/O error if corrupted block is detected. + + --ignore-zero-blocks - Instructs dm-verity to not verify blocks that are expected + to contain zeroes and always return zeroes directly instead. + + NOTE that these options could have security or functional impacts, + do not use them without assessing the risks! + +* Fix help text for cipher benchmark specification (mention --cipher option). + +* Fix off-by-one error in maximum keyfile size. + Allow keyfiles up to compiled-in default and not that value minus one. + +* Support resume of interrupted decryption in cryptsetup-reencrypt utility. + To resume decryption, LUKS device UUID (--uuid option) option must be used. + +* Do not use direct-io for LUKS header with unaligned keyslots. + Such headers were used only by the first cryptsetup-luks-1.0.0 release (2005). + +* Fix device block size detection to properly work on particular file-based + containers over underlying devices with 4k sectors. diff --git a/docs/v1.7.3-ReleaseNotes b/docs/v1.7.3-ReleaseNotes new file mode 100644 index 0000000..4a2757c --- /dev/null +++ b/docs/v1.7.3-ReleaseNotes @@ -0,0 +1,20 @@ +Cryptsetup 1.7.3 Release Notes +============================== + +Changes since version 1.7.2 + +* Fix device access to hash offsets located beyond the 2GB device boundary in veritysetup. + +* Set configured (compile-time) default iteration time for devices created directly through + libcryptsetup (default was hardcoded 1 second, the configured value applied only + for cryptsetup application). + +* Fix PBKDF2 benchmark to not double iteration count for specific corner case. + If the measurement function returns exactly 500 ms, the iteration calculation loop + doubled iteration count but instead of repeating measurement it used this value directly. + +* OpenSSL backend: fix memory leak if hash context was repeatedly reused. + +* OpenSSL backend: add support for OpenSSL 1.1.0. + +* Fix several minor spelling errors. diff --git a/docs/v1.7.4-ReleaseNotes b/docs/v1.7.4-ReleaseNotes new file mode 100644 index 0000000..73dbaa7 --- /dev/null +++ b/docs/v1.7.4-ReleaseNotes @@ -0,0 +1,22 @@ +Cryptsetup 1.7.4 Release Notes +============================== + +Changes since version 1.7.3 + +* Allow to specify LUKS1 hash algorithm in Python luksFormat wrapper. + +* Use LUKS1 compiled-in defaults also in Python wrapper. + +* OpenSSL backend: Fix OpenSSL 1.1.0 support without backward compatible API. + +* OpenSSL backend: Fix LibreSSL compatibility. + +* Check for data device and hash device area overlap in veritysetup. + +* Fix a possible race while allocating a free loop device. + +* Fix possible file descriptor leaks if libcryptsetup is run from a forked process. + +* Fix missing same_cpu_crypt flag in status command. + +* Various updates to FAQ and man pages. diff --git a/docs/v1.7.5-ReleaseNotes b/docs/v1.7.5-ReleaseNotes new file mode 100644 index 0000000..eec4315 --- /dev/null +++ b/docs/v1.7.5-ReleaseNotes @@ -0,0 +1,22 @@ +Cryptsetup 1.7.5 Release Notes +============================== + +Changes since version 1.7.4 + +* Fixes to luksFormat to properly support recent kernel running in FIPS mode. + + Cryptsetup must never use a weak key even if it is just used for testing + of algorithm availability. In FIPS mode, weak keys are always rejected. + + A weak key is for example detected if the XTS encryption mode use + the same key for the tweak and the encryption part. + +* Fixes accesses to unaligned hidden legacy TrueCrypt header. + + On a native 4k-sector device the old hidden TrueCrypt header is not + aligned with the hw sector size (this problem was fixed in later TrueCrypt + on-disk format versions). + + Cryptsetup now properly aligns the read so it does not fail. + +* Fixes to optional dracut ramdisk scripts for offline re-encryption on initial boot. diff --git a/docs/v2.0.0-ReleaseNotes b/docs/v2.0.0-ReleaseNotes new file mode 100644 index 0000000..779dcb0 --- /dev/null +++ b/docs/v2.0.0-ReleaseNotes @@ -0,0 +1,605 @@ +Cryptsetup 2.0.0 Release Notes +============================== +Stable release with experimental features. + +This version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +NOTE: This version changes soname of libcryptsetup library and increases +major version for all public symbols. +Most of the old functions are fully backward compatible, so only +recompilation of programs should be needed. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +To provide all security features of authenticated encryption we need +better nonce-reuse resistant algorithm in kernel (see note below). +For now, please use authenticated encryption as experimental feature. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.0-RC1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* Limit KDF requested (for format) memory by available physical memory. + On some systems too high requested amount of memory causes OOM killer + to kill the process (instead of returning ENOMEM). + We never try to use more than half of available physical memory. + +* Ignore device alignment if it is not multiple of minimal-io. + Some USB enclosures seems to report bogus topology info that + prevents to use LUKS detached header. + +Changes since version 2.0.0-RC0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Enable to use system libargon2 instead of bundled version. + Renames --disable-argon2 to --disable-internal-argon2 option + and adds --enable-libargon2 flag to allow system libargon2. + +* Changes in build system (Automake) + - The build system now uses non-recursive automake (except for tests). + (Tools binaries are now located in buildroot directory.) + - New --disable-cryptsetup option to disable build of cryptsetup tool. + - Enable build of cryptsetup-reencrypt by default. + +* Install tmpfiles.d configuration for LUKS2 locking directory. + You can overwrite this using --with-tmpfilesdir configure option. + If your distro does not support tmpfiles.d directory, you have + to create locking directory (/run/lock/cryptsetup) in cryptsetup + package (or init scripts). + +* Adds limited support for offline reencryption of LUKS2 format. + +* Decrease size of testing images (and the whole release archive). + +* Fixes for several memory leaks found by Valgrind and Coverity tools. + +* Fixes for several typos in man pages and error messages. + +* LUKS header file in luksFormat is now automatically created + if it does not exist. + +* Do not allow resize if device size is not aligned to sector size. + +Cryptsetup 2.0.0 RC0 Release Notes +================================== + +Important features +~~~~~~~~~~~~~~~~~~ + +* New command integritysetup: support for the new dm-integrity kernel target. + + The dm-integrity is a new kernel device-mapper target that introduces + software emulation of per-sector integrity fields on the disk sector level. + It is available since Linux kernel version 4.12. + + The provided per-sector metadata fields can be used for storing a data + integrity checksum (for example CRC32). + The dm-integrity implements data journal that enforces atomic update + of a sector and its integrity metadata. + + Integritysetup is a CLI utility that can setup standalone dm-integrity + devices (that internally check integrity of data). + + Integritysetup is intended to be used for settings that require + non-cryptographic data integrity protection with no data encryption. + Fo setting integrity protected encrypted devices, see disk authenticated + encryption below. + + Note that after formatting the checksums need to be initialized; + otherwise device reads will fail because of integrity errors. + Integritysetup by default tries to wipe the device with zero blocks + to avoid this problem. Device wipe can be time-consuming, you can skip + this step by specifying --no-wipe option. + (But note that not wiping device can cause some operations to fail + if a write is not multiple of page size and kernel page cache tries + to read sectors with not yet initialized checksums.) + + The default setting is tag size 4 bytes per-sector and CRC32C protection. + To format device with these defaults: + $ integritysetup format + $ integritysetup open + + Note that used algorithm (unlike tag size) is NOT stored in device + kernel superblock and if you use different algorithm, you MUST specify + it in every open command, for example: + $ integritysetup format --tag-size 32 --integrity sha256 + $ integritysetup open --integrity sha256 + + For more info, see integrity man page. + +* Veritysetup command can now format and activate dm-verity devices + that contain Forward Error Correction (FEC) (Reed-Solomon code is used). + This feature is used on most of Android devices already (available since + Linux kernel 4.5). + + There are new options --fec-device, --fec-offset to specify data area + with correction code and --fec-roots that set Redd-Solomon generator roots. + This setting can be used for format command (veritysetup will calculate + and store RS codes) or open command (veritysetup configures kernel + dm-verity to use RS codes). + + For more info see veritysetup man page. + +* Support for larger sector sizes for crypt devices. + + LUKS2 and plain crypt devices can be now configured with larger encryption + sector (typically 4096 bytes, sector size must be the power of two, + maximal sector size is 4096 bytes for portability). + Large sector size can decrease encryption overhead and can also help + with some specific crypto hardware accelerators that perform very + badly with 512 bytes sectors. + + Note that if you configure such a larger sector of the device that does use + smaller physical sector, there is a possibility of a data corruption during + power fail (partial sector writes). + + WARNING: If you use different sector size for a plain device after data were + stored, the decryption will produce garbage. + + For LUKS2, the sector size is stored in metadata and cannot be changed later. + +LUKS2 format and features +~~~~~~~~~~~~~~~~~~~~~~~~~ +The LUKS2 is an on-disk storage format designed to provide simple key +management, primarily intended for Full Disk Encryption based on dm-crypt. + +The LUKS2 is inspired by LUKS1 format and in some specific situations (most +of the default configurations) can be converted in-place from LUKS1. + +The LUKS2 format is designed to allow future updates of various +parts without the need to modify binary structures and internally +uses JSON text format for metadata. Compilation now requires the json-c library +that is used for JSON data processing. + +On-disk format provides redundancy of metadata, detection +of metadata corruption and automatic repair from metadata copy. + +NOTE: For security reasons, there is no redundancy in keyslots binary data +(encrypted keys) but the format allows adding such a feature in future. + +NOTE: to operate correctly, LUKS2 requires locking of metadata. +Locking is performed by using flock() system call for images in file +and for block device by using a specific lock file in /run/lock/cryptsetup. + +This directory must be created by distribution (do not rely on internal +fallback). For systemd-based distribution, you can simply install +scripts/cryptsetup.conf into tmpfiles.d directory. + +For more details see LUKS2-format.txt and LUKS2-locking.txt in the docs +directory. (Please note this is just overview, there will be more formal +documentation later.) + +LUKS2 use +~~~~~~~~~ + +LUKS2 allows using all possible configurations as LUKS1. + +To format device as LUKS2, you have to add "--type luks2" during format: + + $ cryptsetup luksFormat --type luks2 + +All commands issued later will recognize the new format automatically. + +The newly added features in LUKS2 include: + +* Authenticated disk (sector) encryption (EXPERIMENTAL) + + Legacy Full disk encryption (FDE), for example, LUKS1, is a length-preserving + encryption (plaintext is the same size as a ciphertext). + Such FDE can provide data confidentiality, but cannot provide sound data + integrity protection. + + Full disk authenticated encryption is a way how to provide both + confidentiality and data integrity protection. Integrity protection here means + not only detection of random data corruption (silent data corruption) but also + prevention of an unauthorized intentional change of disk sector content. + + NOTE: Integrity protection of this type cannot prevent a replay attack. + An attacker can replace the device or its part of the old content, and it + cannot be detected. + If you need such protection, better use integrity protection on a higher layer. + + For data integrity protection on the sector level, we need additional + per-sector metadata space. In LUKS2 this space is provided by a new + device-mapper dm-integrity target (available since kernel 4.12). + Here the integrity target provides only reliable per-sector metadata store, + and the whole authenticated encryption is performed inside dm-crypt stacked + over the dm-integrity device. + + For encryption, Authenticated Encryption with Additional Data (AEAD) is used. + Every sector is processed as a encryption request of this format: + + |----- AAD -------|------ DATA -------|-- AUTH TAG --| + | (authenticated) | (auth+encryption) | | + | sector_LE | IV | sector in/out | tag in/out | + + AEAD encrypts the whole sector and also authenticates sector number + (to detect sector relocation) and also authenticates Initialization Vector. + + AEAD encryption produces encrypted data and authentication tag. + The authenticated tag is then stored in per-sector metadata space provided + by dm-integrity. + + Most of the current AEAD algorithms requires IV as a nonce, value that is + never reused. Because sector number, as an IV, cannot be used in this + environment, we use a new random IV (IV is a random value generated by system + RNG on every write). This random IV is then stored in the per-sector metadata + as well. + + Because the authentication tag (and IV) requires additional space, the device + provided for a user has less capacity. Also, the data journalling means that + writes are performed twice, decreasing throughput. + + This integrity protection works better with SSDs. If you want to ignore + dm-integrity data journal (because journalling is performed on some higher + layer or you just want to trade-off performance to safe recovery), you can + switch journal off with --integrity-no-journal option. + (This flag can be stored persistently as well.) + + Note that (similar to integritysetup) the device read will fail if + authentication tag is not initialized (no previous write). + By default cryptsetup run wipe of a device (writing zeroes) to initialize + authentication tags. This operation can be very time-consuming. + You can skip device wipe using --integrity-no-wipe option. + + To format LUKS2 device with integrity protection, use new --integrity option. + + For now, there are very few AEAD algorithms that can be used, and some + of them are known to be problematic. In this release we support only + a few of AEAD algorithms (options are for now hard coded), later this + extension will be completely algorithm-agnostic. + + For testing of authenticated encryption, these algorithms work for now: + + 1) aes-xts-plain64 with hmac-sha256 or hmac-sha512 as the authentication tag. + (Common FDE mode + independent authentication tag. Authentication key + for HMAC is independently generated. This mode is very slow.) + $ cryptsetup luksFormat --type luks2 --cipher aes-xts-plain64 --integrity hmac-sha256 + + 2) aes-gcm-random (native AEAD mode) + DO NOT USE in production! The GCM mode uses only 96-bit nonce, + and possible collision means fatal security problem. + GCM mode has very good hardware support through AES-NI, so it is useful + for performance testing. + $ cryptsetup luksFormat --type luks2 --cipher aes-gcm-random --integrity aead + + 3) ChaCha20 with Poly1305 authenticator (according to RFC7539) + $ cryptsetup luksFormat --type luks2 --cipher chacha20-random --integrity poly1305 + + To specify AES128/AES256 just specify proper key size (without possible + authentication key). Other symmetric ciphers, like Serpent or Twofish, + should work as well. The mode 1) and 2) should be compatible with IEEE 1619.1 + standard recommendation. + + There will be better suitable authenticated modes available soon + For now we are just preparing framework to enable it (and hopefully improve security of FDE). + + FDE authenticated encryption is not a replacement for filesystem layer + authenticated encryption. The goal is to provide at least something because + data integrity protection is often completely ignored in today systems. + +* New memory-hard PBKDF + + LUKS1 introduced Password-Based Key Derivation Function v2 as a tool to + increase attacker cost for a dictionary and brute force attacks. + The PBKDF2 uses iteration count to increase time of key derivation. + Unfortunately, with modern GPUs, the PBKDF2 calculations can be run + in parallel and PBKDF2 can no longer provide the best available protection. + Increasing iteration count just cannot prevent massive parallel dictionary + password attacks in long-term. + + To solve this problem, a new PBKDF, based on so-called memory-hard functions + can be used. Key derivation with memory-hard function requires a certain + amount of memory to compute its output. The memory requirement is very + costly for GPUs and prevents these systems to operate effectively, + increasing cost for attackers. + + LUKS2 introduces support for Argon2i and Argon2id as a PBKDF. + Argon2 is the winner of Password Hashing Competition and is currently + in final RFC draft specification. + + For now, libcryptsetup contains the embedded copy of reference implementation + of Argon2 (that is easily portable to all architectures). + Later, once this function is available in common crypto libraries, it will + switch to external implementation. (This happened for LUKS1 and PBKDF2 + as well years ago.) + With using reference implementation (that is not optimized for speed), there + is some performance penalty. However, using memory-hard PBKDF should still + significantly complicate GPU-optimized dictionary and brute force attacks. + + The Argon2 uses three costs: memory, time (number of iterations) and parallel + (number of threads). + Note that time and memory cost highly influences each other (accessing a lot + of memory takes more time). + + There is a new benchmark that tries to calculate costs to take similar way as + in LUKS1 (where iteration is measured to take 1-2 seconds on user system). + Because now there are more cost variables, it prefers time cost (iterations) + and tries to find required memory that fits. (IOW required memory cost can be + lower if the benchmarks are not able to find required parameters.) + The benchmark cannot run too long, so it tries to approximate next step + for benchmarking. + + For now, default LUKS2 PBKDF algorithm is Argon2i (data independent variant) + with memory cost set to 128MB, time to 800ms and parallel thread according + to available CPU cores but no more than 4. + + All default parameters can be set during compile time and also set on + the command line by using --pbkdf, --pbkdf-memory, --pbkdf-parallel and + --iter-time options. + (Or without benchmark directly by using --pbkdf-force-iterations, see below.) + + You can still use PBKDF2 even for LUKS2 by specifying --pbkdf pbkdf2 option. + (Then only iteration count is applied.) + +* Use of kernel keyring + + Kernel keyring is a storage for sensitive material (like cryptographic keys) + inside Linux kernel. + + LUKS2 uses keyring for two major functions: + + - To store volume key for dm-crypt where it avoids sending volume key in + every device-mapper ioctl structure. Volume key is also no longer directly + visible in a dm-crypt mapping table. The key is not available for the user + after dm-crypt configuration (obviously except direct memory scan). + Use of kernel keyring can be disabled in runtime by --disable-keyring option. + + - As a tool to automatically unlock LUKS device if a passphrase is put into + kernel keyring and proper keyring token is configured. + + This allows storing a secret (passphrase) to kernel per-user keyring by + some external tool (for example some TPM handler) and LUKS2, if configured, + will automatically search in the keyring and unlock the system. + For more info see Tokens section below. + +* Persistent flags + The activation flags (like allow-discards) can be stored in metadata and used + automatically by all later activations (even without using crypttab). + + To store activation flags permanently, use activation command with required + flags and add --persistent option. + + For example, to mark device to always activate with TRIM enabled, + use (for LUKS2 type): + + $ cryptsetup open --allow-discards --persistent + + You can check persistent flags in dump command output: + + $ cryptsetup luksDump + +* Tokens and auto-activation + + A LUKS2 token is an object that can be described "how to get passphrase or key" + to unlock particular keyslot. + (Also it can be used to store any additional metadata, and with + the libcryptsetup interface it can be used to define user token types.) + + Cryptsetup internally implements keyring token. Cryptsetup tries to use + available tokens before asking for the passphrase. For keyring token, + it means that if the passphrase is available under specified identifier + inside kernel keyring, the device is automatically activated using this + stored passphrase. + + Example of using LUKS2 keyring token: + + # Adding token to metadata with "my_token" identifier (by default it applies to all keyslots). + $ cryptsetup token add --key-description "my_token" + + # Storing passphrase to user keyring (this can be done by an external application) + $ echo -n | keyctl padd user my_token @u + + # Now cryptsetup activates automatically if it finds correct passphrase + $ cryptsetup open + + The main reason to use tokens this way is to separate possible hardware + handlers from cryptsetup code. + +* Keyslot priorities + + LUKS2 keyslot can have a new priority attribute. + The default is "normal". The "prefer" priority tell the keyslot to be tried + before other keyslots. Priority "ignore" means that keyslot will never be + used if not specified explicitly (it can be used for backup administrator + passwords that are used only situations when a user forgets own passphrase). + + The priority of keyslot can be set with new config command, for example + $ cryptsetup config --key-slot 1 --priority prefer + + Setting priority to normal will reset slot to normal state. + +* LUKS2 label and subsystem + + The header now contains additional fields for label and subsystem (additional + label). These fields can be used similar to filesystem label and will be + visible in udev rules to possible filtering. (Note that blkid do not yet + contain the LUKS scanning code). + + By default both labels are empty. Label and subsystem are always set together + (no option means clear the label) with the config command: + + $ cryptsetup config --label my_device --subsystem "" + +* In-place conversion form LUKS1 + + To allow easy testing and transition to the new LUKS2 format, there is a new + convert command that allows in-place conversion from the LUKS1 format and, + if there are no incompatible options, also conversion back from LUKS2 + to LUKS1 format. + + Note this command can be used only on some LUKS1 devices (some device header + sizes are not supported). + This command is dangerous, never run it without header backup! + If something fails in the middle of conversion (IO error), the header + is destroyed. (Note that conversion requires move of keyslot data area to + a different offset.) + + To convert header in-place to LUKS2 format, use + $ cryptsetup convert --type luks2 + + To convert it back to LUKS1 format, use + $ cryptsetup convert --type luks1 + + You can verify LUKS version with luksDump command. + $ cryptsetup luksDump + + Note that some LUKS2 features will make header incompatible with LUKS1 and + conversion will be rejected (for example using new Argon2 PBKDF or integrity + extensions). Some minor attributes can be lost in conversion. + +Other changes +~~~~~~~~~~~~~ + +* Explicit KDF iterations count setting + + With new PBKDF interface, there is also the possibility to setup PBKDF costs + directly, avoiding benchmarks. This can be useful if device is formatted to be + primarily used on a different system. + + The option --pbkdf-force-iterations is available for both LUKS1 and LUKS2 + format. Using this option can cause device to have either very low or very + high PBKDF costs. + In the first case it means bad protection to dictionary attacks, in the second + case, it can mean extremely high unlocking time or memory requirements. + Use only if you are sure what you are doing! + + Not that this setting also affects iteration count for the key digest. + For LUKS1 iteration count for digest will be approximately 1/8 of requested + value, for LUKS2 and "pbkdf2" digest minimal PBKDF2 iteration count (1000) + will be used. You cannot set lower iteration count than the internal minimum + (1000 for PBKDF2). + + To format LUKS1 device with forced iteration count (and no benchmarking), use + $ cryptsetup luksFormat --pbkdf-force-iterations 22222 + + For LUKS2 it is always better to specify full settings (do not rely on default + cost values). + For example, we can set to use Argon2id with iteration cost 5, memory 128000 + and parallel set 1: + $ cryptsetup luksFormat --type luks2 \ + --pbkdf argon2id --pbkdf-force-iterations 5 --pbkdf-memory 128000 --pbkdf-parallel 1 + +* VeraCrypt PIM + + Cryptsetup can now also open VeraCrypt device that uses Personal Iteration + Multiplier (PIM). PIM is an integer value that user must remember additionally + to passphrase and influences PBKDF2 iteration count (without it VeraCrypt uses + a fixed number of iterations). + + To open VeraCrypt device with PIM settings, use --veracrypt-pim (to specify + PIM on the command line) or --veracrypt-query-pim to query PIM interactively. + +* Support for plain64be IV + + The plain64be is big-endian variant of plain64 Initialization Vector. It is + used in some images of hardware-based disk encryption systems. Supporting this + variant allows using dm-crypt to map such images through cryptsetup. + +* Deferral removal + + Cryptsetup now can mark device for deferred removal by using a new option + --deferred. This means that close command will not fail if the device is still + in use, but will instruct the kernel to remove the device automatically after + use count drops to zero (for example, once the filesystem is unmounted). + +* A lot of updates to man pages and many minor changes that would make this + release notes too long ;-) + +Libcryptsetup API changes +~~~~~~~~~~~~~~~~~~~~~~~~~ + +These API functions were removed, libcryptsetup no longer handles password +retries from terminal (application should handle terminal operations itself): + crypt_set_password_callback; + crypt_set_timeout; + crypt_set_password_retry; + crypt_set_password_verify; + +This call is removed (no need to keep typo backward compatibility, +the proper function is crypt_set_iteration_time :-) + crypt_set_iterarion_time; + +These calls were removed because are not safe, use per-context +error callbacks instead: + crypt_last_error; + crypt_get_error; + +The PBKDF benchmark was replaced by a new function that uses new KDF structure + crypt_benchmark_kdf; (removed) + crypt_benchmark_pbkdf; (new API call) + +These new calls are now exported, for details see libcryptsetup.h: + crypt_keyslot_add_by_key; + crypt_keyslot_set_priority; + crypt_keyslot_get_priority; + + crypt_token_json_get; + crypt_token_json_set; + crypt_token_status; + crypt_token_luks2_keyring_get; + crypt_token_luks2_keyring_set; + crypt_token_assign_keyslot; + crypt_token_unassign_keyslot; + crypt_token_register; + + crypt_activate_by_token; + crypt_activate_by_keyring; + crypt_deactivate_by_name; + + crypt_metadata_locking; + crypt_volume_key_keyring; + crypt_get_integrity_info; + crypt_get_sector_size; + crypt_persistent_flags_set; + crypt_persistent_flags_get; + crypt_set_pbkdf_type; + crypt_get_pbkdf_type; + + crypt_convert; + crypt_keyfile_read; + crypt_wipe; + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* There will be better documentation and examples. + +* There will be some more formal definition of the threat model for integrity + protection. (And a link to some papers discussing integrity protection, + once it is, hopefully, accepted and published.) + +* Offline re-encrypt tool LUKS2 support is currently limited. + There will be online LUKS2 re-encryption tool in future. + +* Authenticated encryption will use new algorithms from CAESAR competition + (https://competitions.cr.yp.to/caesar.html) once these algorithms are available + in kernel (more on this later). + NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305) + in kernel have too small 96-bit nonces that are problematic with + randomly generated IVs (the collison probability is not negligible). + For the GCM, nonce collision is a fatal problem. + +* Authenticated encryption do not set encryption for dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* Some utilities (blkid, systemd-cryptsetup) have already support for LUKS + but not yet in released version (support in crypttab etc). + +* There are some examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be deprecated soon in favor + of python bindings to libblockdev library (that can already handle LUKS1 devices). diff --git a/docs/v2.0.1-ReleaseNotes b/docs/v2.0.1-ReleaseNotes new file mode 100644 index 0000000..0cc13b9 --- /dev/null +++ b/docs/v2.0.1-ReleaseNotes @@ -0,0 +1,109 @@ +Cryptsetup 2.0.1 Release Notes +============================== +Stable and bug-fix release with experimental features. + +This version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +To provide all security features of authenticated encryption we need +a better nonce-reuse resistant algorithm in the kernel (see note below). +For now, please use authenticated encryption as an experimental feature. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* To store volume key into kernel keyring, kernel 4.15 with dm-crypt 1.18.1 + is required. If a volume key is stored in keyring (LUKS2 only), + the dm-crypt v1.15.0 through v1.18.0 contains a serious bug that may cause + data corruption for ciphers with ESSIV. + (The key for ESSIV is zeroed because of code misplacement.) + This bug is not present for LUKS1 or any other IVs used in LUKS modes. + This change is not visible to the user (except dmsetup output). + +* Increase maximum allowed PBKDF memory-cost limit to 4 GiB. + The Argon2 PBKDF uses 1GiB by default; this is also limited by the amount + of physical memory available (maximum is half of the physical memory). + +* Use /run/cryptsetup as default for cryptsetup locking dir. + There were problems with sharing /run/lock with lockdev, and in the early + boot, the directory was missing. + The directory can be changed with --with-luks2-lock-path and + --with-luks2-lock-dir-perms configure switches. + +* Introduce new 64-bit byte-offset *keyfile_device_offset functions. + + The keyfile interface was designed, well, for keyfiles. Unfortunately, + there are user cases where a keyfile can be placed on a device, and + size_t offset can overflow on 32-bit systems. + + New set of functions that allow 64-bit offsets even on 32bit systems + are now available: + + - crypt_resume_by_keyfile_device_offset + - crypt_keyslot_add_by_keyfile_device_offset + - crypt_activate_by_keyfile_device_offset + - crypt_keyfile_device_read + + The new functions have added the _device_ in name. + Old functions are just internal wrappers around these. + + Also cryptsetup --keyfile-offset and --new-keyfile-offset now allows + 64-bit offsets as parameters. + +* Add error hint for wrongly formatted cipher strings in LUKS1 and + properly fail in luksFormat if cipher format is missing required IV. + For now, crypto API quietly used cipher without IV if a cipher + algorithm without IV specification was used (e.g., aes-xts). + This caused fail later during activation. + +* Configure check for a recent Argon2 lib to support mandatory Argon2id. + +* Fix for the cryptsetup-reencrypt static build if pwquality is enabled. + +* Update LUKS1 standard doc (https links in the bibliography). + + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* There will be better documentation and examples. + +* There will be some more formal definition of the threat model for integrity + protection. (And a link to some papers discussing integrity protection, + once it is, hopefully, accepted and published.) + +* Offline re-encrypt tool LUKS2 support is currently limited. + There will be online LUKS2 re-encryption tool in future. + +* Authenticated encryption will use new algorithms from CAESAR competition + (https://competitions.cr.yp.to/caesar.html) once these algorithms are + available in the kernel (more on this later). + NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305) + in the kernel have too small 96-bit nonces that are problematic with + randomly generated IVs (the collision probability is not negligible). + For the GCM, nonce collision is a fatal problem. + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be deprecated soon in favor + of python bindings to the libblockdev library (that can already handle LUKS1 + devices). diff --git a/docs/v2.0.2-ReleaseNotes b/docs/v2.0.2-ReleaseNotes new file mode 100644 index 0000000..a85a248 --- /dev/null +++ b/docs/v2.0.2-ReleaseNotes @@ -0,0 +1,93 @@ +Cryptsetup 2.0.2 Release Notes +============================== +Stable and bug-fix release with experimental features. + +Cryptsetup 2.x version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +To provide all security features of authenticated encryption, we need +a better nonce-reuse resistant algorithm in the kernel (see note below). +For now, please use authenticated encryption as an experimental feature. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix a regression in early detection of inactive keyslot for luksKillSlot. + It tried to ask for passphrase even for already erased keyslot. + +* Fix a regression in loopaesOpen processing for keyfile on standard input. + Use of "-" argument was not working properly. + +* Add LUKS2 specific options for cryptsetup-reencrypt. + Tokens and persistent flags are now transferred during reencryption; + change of PBKDF keyslot parameters is now supported and allows + to set precalculated values (no benchmarks). + +* Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags + combination. Persistent flags are now stored only if the device was + successfully activated with the specified flags. + +* Fix integritysetup format after recent Linux kernel changes that + requires to setup key for HMAC in all cases. + Previously integritysetup allowed HMAC with zero key that behaves + like a plain hash. + +* Fix VeraCrypt PIM handling that modified internal iteration counts + even for subsequent activations. The PIM count is no longer printed + in debug log as it is sensitive information. + Also, the code now skips legacy TrueCrypt algorithms if a PIM + is specified (they cannot be used with PIM anyway). + +* PBKDF values cannot be set (even with force parameters) below + hardcoded minimums. For PBKDF2 is it 1000 iterations, for Argon2 + it is 4 iterations and 32 KiB of memory cost. + +* Introduce new crypt_token_is_assigned() API function for reporting + the binding between token and keyslots. + +* Allow crypt_token_json_set() API function to create internal token types. + Do not allow unknown fields in internal token objects. + +* Print message in cryptsetup that about was aborted if a user did not + answer YES in a query. + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* There will be better documentation and examples. + +* There will be some more formal definition of the threat model for integrity + protection. (And a link to some papers discussing integrity protection, + once it is, hopefully, accepted and published.) + +* Authenticated encryption will use new algorithms from CAESAR competition + https://competitions.cr.yp.to/caesar-submissions.html. + We plan to use AEGIS and MORUS, as CAESAR finalists. + + NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305) + in the kernel have too small 96-bit nonces that are problematic with + randomly generated IVs (the collision probability is not negligible). + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be deprecated in version 2.1 + in favor of python bindings to the libblockdev library. diff --git a/docs/v2.0.3-ReleaseNotes b/docs/v2.0.3-ReleaseNotes new file mode 100644 index 0000000..030a1b4 --- /dev/null +++ b/docs/v2.0.3-ReleaseNotes @@ -0,0 +1,121 @@ +Cryptsetup 2.0.3 Release Notes +============================== +Stable bug-fix release with new features. + +Cryptsetup 2.x version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +To provide all security features of authenticated encryption, we need +a better nonce-reuse resistant algorithm in the kernel (see note below). +For now, please use authenticated encryption as an experimental feature. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Expose interface to unbound LUKS2 keyslots. + Unbound LUKS2 keyslot allows storing a key material that is independent + of master volume key (it is not bound to encrypted data segment). + +* New API extensions for unbound keyslots (LUKS2 only) + crypt_keyslot_get_key_size() and crypt_volume_key_get() + These functions allow to get key and key size for unbound keyslots. + +* New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only). + +* Add --unbound keyslot option to the cryptsetup luksAddKey command. + +* Add crypt_get_active_integrity_failures() call to get integrity + failure count for dm-integrity devices. + +* Add crypt_get_pbkdf_default() function to get per-type PBKDF default + setting. + +* Add new flag to crypt_keyslot_add_by_key() to force update device + volume key. This call is mainly intended for a wrapped key change. + +* Allow volume key store in a file with cryptsetup. + The --dump-master-key together with --master-key-file allows cryptsetup + to store the binary volume key to a file instead of standard output. + +* Add support detached header for cryptsetup-reencrypt command. + +* Fix VeraCrypt PIM handling - use proper iterations count formula + for PBKDF2-SHA512 and PBKDF2-Whirlpool used in system volumes. + +* Fix cryptsetup tcryptDump for VeraCrypt PIM (support --veracrypt-pim). + +* Add --with-default-luks-format configure time option. + (Option to override default LUKS format version.) + +* Fix LUKS version conversion for detached (and trimmed) LUKS headers. + +* Add luksConvertKey cryptsetup command that converts specific keyslot + from one PBKDF to another. + +* Do not allow conversion to LUKS2 if LUKSMETA (external tool metadata) + header is detected. + +* More cleanup and hardening of LUKS2 keyslot specific validation options. + Add more checks for cipher validity before writing metadata on-disk. + +* Do not allow LUKS1 version downconversion if the header contains tokens. + +* Add "paes" family ciphers (AES wrapped key scheme for mainframes) + to allowed ciphers. + Specific wrapped ley configuration logic must be done by 3rd party tool, + LUKS2 stores only keyslot material and allow activation of the device. + +* Add support for --check-at-most-once option (kernel 4.17) to veritysetup. + This flag can be dangerous; if you can control underlying device + (you can change its content after it was verified) it will no longer + prevent reading tampered data and also it does not prevent silent + data corruptions that appear after the block was once read. + +* Fix return code (EPERM instead of EINVAL) and retry count for bad + passphrase on non-tty input. + +* Enable support for FEC decoding in veritysetup to check dm-verity devices + with additional Reed-Solomon code in userspace (verify command). + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* There will be better documentation and examples (planned for 2.0.4). + +* There will be some more formal definition of the threat model for integrity + protection. (And a link to some papers discussing integrity protection, + once it is, hopefully, accepted and published.) + +* Authenticated encryption will use new algorithms from CAESAR competition + https://competitions.cr.yp.to/caesar-submissions.html. + We plan to use AEGIS and MORUS, as CAESAR finalists. + + NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305) + in the kernel have too small 96-bit nonces that are problematic with + randomly generated IVs (the collision probability is not negligible). + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be REMOVED in version 2.1 + in favor of python bindings to the libblockdev library. + See https://github.com/storaged-project/libblockdev/releases/tag/2.17-1 that + already supports LUKS2 and VeraCrypt devices handling through libcryptsetup. diff --git a/docs/v2.0.4-ReleaseNotes b/docs/v2.0.4-ReleaseNotes new file mode 100644 index 0000000..9731f59 --- /dev/null +++ b/docs/v2.0.4-ReleaseNotes @@ -0,0 +1,119 @@ +Cryptsetup 2.0.4 Release Notes +============================== +Stable bug-fix release with new features. + +Cryptsetup 2.x version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +To provide all security features of authenticated encryption, we need +a better nonce-reuse resistant algorithm in the kernel (see note below). +For now, please use authenticated encryption as an experimental feature. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.3 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Use the libblkid (blockid) library to detect foreign signatures + on a device before LUKS format and LUKS2 auto-recovery. + + This change fixes an unexpected recovery using the secondary + LUKS2 header after a device was already overwritten with + another format (filesystem or LVM physical volume). + + LUKS2 will not recreate a primary header if it detects a valid + foreign signature. In this situation, a user must always + use cryptsetup repair command for the recovery. + + Note that libcryptsetup and utilities are now linked to libblkid + as a new dependence. + + To compile code without blockid support (strongly discouraged), + use --disable-blkid configure switch. + +* Add prompt for format and repair actions in cryptsetup and + integritysetup if foreign signatures are detected on the device + through the blockid library. + + After the confirmation, all known signatures are then wiped as + part of the format or repair procedure. + +* Print consistent verbose message about keyslot and token numbers. + For keyslot actions: Key slot unlocked/created/removed. + For token actions: Token created/removed. + +* Print error, if a non-existent token is tried to be removed. + +* Add support for LUKS2 token definition export and import. + + The token command now can export/import customized token JSON file + directly from command line. See the man page for more details. + +* Add support for new dm-integrity superblock version 2. + +* Add an error message when nothing was read from a key file. + +* Update cryptsetup man pages, including --type option usage. + +* Add a snapshot of LUKS2 format specification to documentation + and accordingly fix supported secondary header offsets. + +* Add bundled optimized Argon2 SSE (X86_64 platform) code. + + If the bundled Argon2 code is used and the new configure switch + --enable-internal-sse-argon2 option is present, and compiler flags + support required optimization, the code will try to use optimized + and faster variant. + + Always use the shared library (--enable-libargon2) if possible. + + This option was added because an enterprise distribution + rejected to support the shared Argon2 library and native support + in generic cryptographic libraries is not ready yet. + +* Fix compilation with crypto backend for LibreSSL >= 2.7.0. + LibreSSL introduced OpenSSL 1.1.x API functions, so compatibility + wrapper must be commented out. + +* Fix on-disk header size calculation for LUKS2 format if a specific + data alignment is requested. Until now, the code used default size + that could be wrong for converted devices. + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* Authenticated encryption will use new algorithms from CAESAR competition + https://competitions.cr.yp.to/caesar-submissions.html. + We plan to use AEGIS and MORUS (in kernel 4.18), as CAESAR finalists. + + NOTE: Currently available authenticated modes (GCM, Chacha20-poly1305) + in the kernel have too small 96-bit nonces that are problematic with + randomly generated IVs (the collision probability is not negligible). + + For more info about LUKS2 authenticated encryption, please see our paper + https://arxiv.org/abs/1807.00309 + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be REMOVED in version 2.1 + in favor of python bindings to the libblockdev library. + See https://github.com/storaged-project/libblockdev/releases that + already supports LUKS2 and VeraCrypt devices handling through libcryptsetup. + diff --git a/docs/v2.0.5-ReleaseNotes b/docs/v2.0.5-ReleaseNotes new file mode 100644 index 0000000..907d5aa --- /dev/null +++ b/docs/v2.0.5-ReleaseNotes @@ -0,0 +1,102 @@ +Cryptsetup 2.0.5 Release Notes +============================== +Stable bug-fix release with new features. + +Cryptsetup 2.x version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.4 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Wipe full header areas (including unused) during LUKS format. + + Since this version, the whole area up to the data offset is zeroed, + and subsequently, all keyslots areas are wiped with random data. + This ensures that no remaining old data remains in the LUKS header + areas, but it could slow down format operation on some devices. + Previously only first 4k (or 32k for LUKS2) and the used keyslot + was overwritten in the format operation. + +* Several fixes to error messages that were unintentionally replaced + in previous versions with a silent exit code. + More descriptive error messages were added, including error + messages if + - a device is unusable (not a block device, no access, etc.), + - a LUKS device is not detected, + - LUKS header load code detects unsupported version, + - a keyslot decryption fails (also happens in the cipher check), + - converting an inactive keyslot. + +* Device activation fails if data area overlaps with LUKS header. + +* Code now uses explicit_bzero to wipe memory if available + (instead of own implementation). + +* Additional VeraCrypt modes are now supported, including Camellia + and Kuznyechik symmetric ciphers (and cipher chains) and Streebog + hash function. These were introduced in a recent VeraCrypt upstream. + + Note that Kuznyechik requires out-of-tree kernel module and + Streebog hash function is available only with the gcrypt cryptographic + backend for now. + +* Fixes static build for integritysetup if the pwquality library is used. + +* Allows passphrase change for unbound keyslots. + +* Fixes removed keyslot number in verbose message for luksKillSlot, + luksRemoveKey and erase command. + +* Adds blkid scan when attempting to open a plain device and warn the user + about existing device signatures in a ciphertext device. + +* Remove LUKS header signature if luksFormat fails to add the first keyslot. + +* Remove O_SYNC from device open and use fsync() to speed up + wipe operation considerably. + +* Create --master-key-file in luksDump and fail if the file already exists. + +* Fixes a bug when LUKS2 authenticated encryption with a detached header + wiped the header device instead of dm-integrity data device area (causing + unnecessary LUKS2 header auto recovery). + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* Authenticated encryption should use new algorithms from CAESAR competition + https://competitions.cr.yp.to/caesar-submissions.html. + AEGIS and MORUS are already available in kernel 4.18. + + For more info about LUKS2 authenticated encryption, please see our paper + https://arxiv.org/abs/1807.00309 + + Please note that authenticated encryption is still an experimental feature + and can have performance problems for hish-speed devices and device + with larger IO blocks (like RAID). + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be REMOVED in version 2.1 + in favor of python bindings to the libblockdev library. + See https://github.com/storaged-project/libblockdev/releases that + already supports LUKS2 and VeraCrypt devices handling through libcryptsetup. diff --git a/docs/v2.0.6-ReleaseNotes b/docs/v2.0.6-ReleaseNotes new file mode 100644 index 0000000..7fe276a --- /dev/null +++ b/docs/v2.0.6-ReleaseNotes @@ -0,0 +1,97 @@ +Cryptsetup 2.0.6 Release Notes +============================== +Stable bug-fix release. +All users of cryptsetup 2.0.x should upgrade to this version. + +Cryptsetup 2.x version introduces a new on-disk LUKS2 format. + +The legacy LUKS (referenced as LUKS1) will be fully supported +forever as well as a traditional and fully backward compatible format. + +Please note that authenticated disk encryption, non-cryptographic +data integrity protection (dm-integrity), use of Argon2 Password-Based +Key Derivation Function and the LUKS2 on-disk format itself are new +features and can contain some bugs. + +Please do not use LUKS2 without properly configured backup or in +production systems that need to be compatible with older systems. + +Changes since version 2.0.5 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix support of larger metadata areas in LUKS2 header. + + This release properly supports all specified metadata areas, as documented + in LUKS2 format description (see docs/on-disk-format-luks2.pdf in archive). + + Currently, only default metadata area size is used (in format or convert). + Later cryptsetup versions will allow increasing this metadata area size. + +* If AEAD (authenticated encryption) is used, cryptsetup now tries to check + if the requested AEAD algorithm with specified key size is available + in kernel crypto API. + This change avoids formatting a device that cannot be later activated. + + For this function, the kernel must be compiled with the + CONFIG_CRYPTO_USER_API_AEAD option enabled. + Note that kernel user crypto API options (CONFIG_CRYPTO_USER_API and + CONFIG_CRYPTO_USER_API_SKCIPHER) are already mandatory for LUKS2. + +* Fix setting of integrity no-journal flag. + Now you can store this flag to metadata using --persistent option. + +* Fix cryptsetup-reencrypt to not keep temporary reencryption headers + if interrupted during initial password prompt. + +* Adds early check to plain and LUKS2 formats to disallow device format + if device size is not aligned to requested sector size. + Previously it was possible, and the device was rejected to activate by + kernel later. + +* Fix checking of hash algorithms availability for PBKDF early. + Previously LUKS2 format allowed non-existent hash algorithm with + invalid keyslot preventing the device from activation. + +* Allow Adiantum cipher construction (a non-authenticated length-preserving + fast encryption scheme), so it can be used both for data encryption and + keyslot encryption in LUKS1/2 devices. + + For benchmark, use: + # cryptsetup benchmark -c xchacha12,aes-adiantum + # cryptsetup benchmark -c xchacha20,aes-adiantum + + For LUKS format: + # cryptsetup luksFormat -c xchacha20,aes-adiantum-plain64 -s 256 + + The support for Adiantum will be merged in Linux kernel 4.21. + For more info see the paper https://eprint.iacr.org/2018/720. + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* Authenticated encryption should use new algorithms from CAESAR competition + https://competitions.cr.yp.to/caesar-submissions.html. + AEGIS and MORUS are already available in kernel 4.18. + + For more info about LUKS2 authenticated encryption, please see our paper + https://arxiv.org/abs/1807.00309 + + Please note that authenticated encryption is still an experimental feature + and can have performance problems for high-speed devices and device + with larger IO blocks (like RAID). + +* Authenticated encryption do not set encryption for a dm-integrity journal. + + While it does not influence data confidentiality or integrity protection, + an attacker can get some more information from data journal or cause that + system will corrupt sectors after journal replay. (That corruption will be + detected though.) + +* There are examples of user-defined tokens inside misc/luks2_keyslot_example + directory (like a simple external program that uses libssh to unlock LUKS2 + using remote keyfile). + +* The python binding (pycryptsetup) contains only basic functionality for LUKS1 + (it is not updated for new features) and will be REMOVED in version 2.1 + in favor of python bindings to the libblockdev library. + See https://github.com/storaged-project/libblockdev/releases that + already supports LUKS2 and VeraCrypt devices handling through libcryptsetup. diff --git a/docs/v2.1.0-ReleaseNotes b/docs/v2.1.0-ReleaseNotes new file mode 100644 index 0000000..36d2247 --- /dev/null +++ b/docs/v2.1.0-ReleaseNotes @@ -0,0 +1,210 @@ +Cryptsetup 2.1.0 Release Notes +============================== +Stable release with new features and bug fixes. + +Cryptsetup 2.1 version uses a new on-disk LUKS2 format as the default +LUKS format and increases default LUKS2 header size. + +The legacy LUKS (referenced as LUKS1) will be fully supported forever +as well as a traditional and fully backward compatible format. + +When upgrading a stable distribution, please use configure option +--with-default-luks-format=LUKS1 to maintain backward compatibility. + +This release also switches to OpenSSL as a default cryptographic +backend for LUKS header processing. Use --with-crypto_backend=gcrypt +configure option if you need to preserve legacy libgcrypt backend. + +Please do not use LUKS2 without properly configured backup or +in production systems that need to be compatible with older systems. + +Changes since version 2.0.6 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* The default for cryptsetup LUKS format action is now LUKS2. + You can use LUKS1 with cryptsetup option --type luks1. + +* The default size of the LUKS2 header is increased to 16 MB. + It includes metadata and the area used for binary keyslots; + it means that LUKS header backup is now 16MB in size. + + Note, that used keyslot area is much smaller, but this increase + of reserved space allows implementation of later extensions + (like online reencryption). + It is fully compatible with older cryptsetup 2.0.x versions. + If you require to create LUKS2 header with the same size as + in the 2.0.x version, use --offset 8192 option for luksFormat + (units are in 512-bytes sectors; see notes below). + +* Cryptsetup now doubles LUKS default key size if XTS mode is used + (XTS mode uses two internal keys). This does not apply if key size + is explicitly specified on the command line and it does not apply + for the plain mode. + This fixes a confusion with AES and 256bit key in XTS mode where + code used AES128 and not AES256 as often expected. + + Also, the default keyslot encryption algorithm (if cannot be derived + from data encryption algorithm) is now available as configure + options --with-luks2-keyslot-cipher and --with-luks2-keyslot-keybits. + The default is aes-xts-plain64 with 2 * 256-bits key. + +* Default cryptographic backend used for LUKS header processing is now + OpenSSL. For years, OpenSSL provided better performance for PBKDF. + + NOTE: Cryptsetup/libcryptsetup supports several cryptographic + library backends. The fully supported are libgcrypt, OpenSSL and + kernel crypto API. FIPS mode extensions are maintained only for + libgcrypt and OpenSSL. Nettle and NSS are usable only for some + subset of algorithms and cannot provide full backward compatibility. + You can always switch to other backends by using a configure switch, + for libgcrypt (compatibility for older distributions) use: + --with-crypto_backend=gcrypt + +* The Python bindings are no longer supported and the code was removed + from cryptsetup distribution. Please use the libblockdev project + that already covers most of the libcryptsetup functionality + including LUKS2. + +* Cryptsetup now allows using --offset option also for luksFormat. + It means that the specified offset value is used for data offset. + LUKS2 header areas are automatically adjusted according to this value. + (Note units are in 512-byte sectors due to the previous definition + of this option in plain mode.) + This option can replace --align-payload with absolute alignment value. + +* Cryptsetup now supports new refresh action (that is the alias for + "open --refresh"). + It allows changes of parameters for an active device (like root + device mapping), for example, it can enable or disable TRIM support + on-the-fly. + It is supported for LUKS1, LUKS2, plain and loop-AES devices. + +* Integritysetup now supports mode with detached data device through + new --data-device option. + Since kernel 4.18 there is a possibility to specify external data + device for dm-integrity that stores all integrity tags. + +* Integritysetup now supports automatic integrity recalculation + through new --integrity-recalculate option. + Linux kernel since version 4.18 supports automatic background + recalculation of integrity tags for dm-integrity. + +Other changes and fixes +~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix for crypt_wipe call to allocate space if the header is backed + by a file. This means that if you use detached header file, it will + now have always the full size after luksFormat, even if only + a few keyslots are used. + +* Fixes to offline cryptsetup-reencrypt to preserve LUKS2 keyslots + area sizes after reencryption and fixes for some other issues when + creating temporary reencryption headers. + +* Added some FIPS mode workarounds. We cannot (yet) use Argon2 in + FIPS mode, libcryptsetup now fallbacks to use PBKDF2 in FIPS mode. + +* Rejects conversion to LUKS1 if PBKDF2 hash algorithms + in keyslots differ. + +* The hash setting on command line now applies also to LUKS2 PBKDF2 + digest. In previous versions, the LUKS2 key digest used PBKDF2-SHA256 + (except for converted headers). + +* Allow LUKS2 keyslots area to increase if data offset allows it. + Cryptsetup can fine-tune LUKS2 metadata area sizes through + --luks2-metadata-size=BYTES and --luks2-keyslots-size=BYTES. + Please DO NOT use these low-level options until you need it for + some very specific additional feature. + Also, the code now prints these LUKS2 header area sizes in dump + command. + +* For LUKS2, keyslot can use different encryption that data with + new options --keyslot-key-size=BITS and --keyslot-cipher=STRING + in all commands that create new LUKS keyslot. + Please DO NOT use these low-level options until you need it for + some very specific additional feature. + +* Code now avoids data flush when reading device status through + device-mapper. + +* The Nettle crypto backend and the userspace kernel crypto API + backend were enhanced to allow more available hash functions + (like SHA3 variants). + +* Upstream code now does not require libgcrypt-devel + for autoconfigure, because OpenSSL is the default. + The libgcrypt does not use standard pkgconfig detection and + requires specific macro (part of libgcrypt development files) + to be always present during autoconfigure. + With other crypto backends, like OpenSSL, this makes no sense, + so this part of autoconfigure is now optional. + +* Cryptsetup now understands new --debug-json option that allows + an additional dump of some JSON information. These are no longer + present in standard debug output because it could contain some + specific LUKS header parameters. + +* The luksDump contains the hash algorithm used in Anti-Forensic + function. + +* All debug messages are now sent through configured log callback + functions, so an application can easily use own debug messages + handling. In previous versions debug messages were printed directly + to standard output.) + +Libcryptsetup API additions +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +These new calls are now exported, for details see libcryptsetup.h: + + * crypt_init_data_device + * crypt_get_metadata_device_name + functions to init devices with separate metadata and data device + before a format function is called. + + * crypt_set_data_offset + sets the data offset for LUKS to the specified value + in 512-byte sectors. + It should replace alignment calculation in LUKS param structures. + + * crypt_get_metadata_size + * crypt_set_metadata_size + allows to set/get area sizes in LUKS header + (according to specification). + + * crypt_get_default_type + get default compiled-in LUKS type (version). + + * crypt_get_pbkdf_type_params + allows to get compiled-in PBKDF parameters. + + * crypt_keyslot_set_encryption + * crypt_keyslot_get_encryption + allows to set/get per-keyslot encryption algorithm for LUKS2. + + * crypt_keyslot_get_pbkdf + allows to get PBKDF parameters per-keyslot. + + and these new defines: + * CRYPT_LOG_DEBUG_JSON (message type for JSON debug) + * CRYPT_DEBUG_JSON (log level for JSON debug) + * CRYPT_ACTIVATE_RECALCULATE (dm-integrity recalculate flag) + * CRYPT_ACTIVATE_REFRESH (new open with refresh flag) + +All existing API calls should remain backward compatible. + +Unfinished things & TODO for next releases +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +* Optional authenticated encryption is still an experimental feature + and can have performance problems for high-speed devices and device + with larger IO blocks (like RAID). + +* Authenticated encryption does not use encryption for a dm-integrity + journal. While it does not influence data confidentiality or + integrity protection, an attacker can get some more information + from data journal or cause that system will corrupt sectors after + journal replay. (That corruption will be detected though.) + +* The LUKS2 metadata area increase is mainly needed for the new online + reencryption as the major feature for the next release. diff --git a/docs/v2.2.0-ReleaseNotes b/docs/v2.2.0-ReleaseNotes new file mode 100644 index 0000000..b1fd363 --- /dev/null +++ b/docs/v2.2.0-ReleaseNotes @@ -0,0 +1,279 @@ +Cryptsetup 2.2.0 Release Notes +============================== +Stable release with new experimental features and bug fixes. + +Cryptsetup 2.2 version introduces a new LUKS2 online reencryption +extension that allows reencryption of mounted LUKS2 devices +(device in use) in the background. + +Online reencryption is a complex feature. Please be sure you +have a full data backup before using this feature. + +Changes since version 2.1.0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +LUKS2 online reencryption +~~~~~~~~~~~~~~~~~~~~~~~~~ + +The reencryption is intended to provide a reliable way to change +volume key or an algorithm change while the encrypted device is still +in use. + +It is based on userspace-only approach (no kernel changes needed) +that uses the device-mapper subsystem to remap active devices on-the-fly +dynamically. The device is split into several segments (encrypted by old +key, new key and so-called hotzone, where reencryption is actively running). + +The flexible LUKS2 metadata format is used to store intermediate states +(segment mappings) and both version of keyslots (old and new keys). +Also, it provides a binary area (in the unused keyslot area space) +to provide recovery metadata in the case of unexpected failure during +reencryption. LUKS2 header is during the reencryption marked with +"online-reencryption" keyword. After the reencryption is finished, +this keyword is removed, and the device is backward compatible with all +older cryptsetup tools (that support LUKS2). + +The recovery supports three resilience modes: + + - checksum: default mode, where individual checksums of ciphertext hotzone + sectors are stored, so the recovery process can detect which sectors were + already reencrypted. It requires that the device sector write is atomic. + + - journal: the hotzone is journaled in the binary area + (so the data are written twice) + + - none: performance mode; there is no protection + (similar to old offline reencryption) + +These resilience modes are not available if reencryption uses data shift. + +Note: until we have full documentation (both of the process and metadata), +please refer to Ondrej's slides (some slight details are no longer relevant) +https://okozina.fedorapeople.org/online-disk-reencryption-with-luks2-compact.pdf + +The offline reencryption tool (cryptsetup-reencrypt) is still supported +for both LUKS1 and LUKS2 format. + +Cryptsetup examples for reencryption +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The reencryption feature is integrated directly into cryptsetup utility +as the new "reencrypt" action (command). + +There are three basic modes - to perform reencryption (change of already +existing LUKS2 device), to add encryption to plaintext device and to remove +encryption from a device (decryption). + +In all cases, if existing LUKS2 metadata contains information about +the ongoing reencryption process, following reencrypt command continues +with the ongoing reencryption process until it is finished. + +You can activate a device with ongoing reencryption as the standard LUKS2 +device, but the reencryption process will not continue until the cryptsetup +reencrypt command is issued. + + +1) Reencryption +~~~~~~~~~~~~~~~ +This mode is intended to change any attribute of the data encryption +(change of the volume key, algorithm or sector size). +Note that authenticated encryption is not yet supported. + +You can start the reencryption process by specifying a LUKS2 device or with +a detached LUKS2 header. +The code should automatically recognize if the device is in use (and if it +should use online mode of reencryption). + +If you do not specify parameters, only volume key is changed +(a new random key is generated). + +# cryptsetup reencrypt [--header ] + +You can also start reencryption using active mapped device name: + # cryptsetup reencrypt --active-name + +You can also specify the resilience mode (none, checksum, journal) with +--resilience= option, for checksum mode also the hash algorithm with +--resilience-hash= (only hash algorithms supported by cryptographic +backend are available). + +The maximal size of reencryption hotzone can be limited by +--hotzone-size= option and applies to all reencryption modes. +Note that for checksum and journal mode hotzone size is also limited +by available space in binary keyslot area. + +2) Encryption +~~~~~~~~~~~~~ +This mode provides a way to encrypt a plaintext device to LUKS2 format. +This option requires reduction of device size (for LUKS2 header) or new +detached header. + + # cryptsetup reencrypt --encrypt --reduce-device-size + +Or with detached header: + # cryptsetup reencrypt --encrypt --header + +3) Decryption +~~~~~~~~~~~~~ +This mode provides the removal of existing LUKS2 encryption and replacing +a device with plaintext content only. +For now, we support only decryption with a detached header. + + # cryptsetup reencrypt --decrypt --header + +For all three modes, you can split the process to metadata initialization +(prepare keyslots and segments but do not run reencryption yet) and the data +reencryption step by using --init-only option. + +Prepares metadata: + # cryptsetup reencrypt --init-only + +Starts the data processing: + # cryptsetup reencrypt + +Please note, that due to the Linux kernel limitation, the encryption or +decryption process cannot be run entirely online - there must be at least +short offline window where operation adds/removes device-mapper crypt (LUKS2) layer. +This step should also include modification of /etc/crypttab and fstab UUIDs, +but it is out of the scope of cryptsetup tools. + +Limitations +~~~~~~~~~~~ +Most of these limitations will be (hopefully) fixed in next versions. + +* Only one active keyslot is supported (all old keyslots will be removed + after reencryption). + +* Only block devices are now supported as parameters. As a workaround + for images in a file, please explicitly map a loop device over the image + and use the loop device as the parameter. + +* Devices with authenticated encryption are not supported. (Later it will + be limited by the fixed per-sector metadata, per-sector metadata size + cannot be changed without a new device format operation.) + +* The reencryption uses userspace crypto library, with fallback to + the kernel (if available). There can be some specific configurations + where the fallback does not provide optimal performance. + +* There are no translations of error messages until the final release + (some messages can be rephrased as well). + +* The repair command is not finished; the recovery of interrupted + reencryption is made automatically on the first device activation. + +* Reencryption triggers too many udev scans on metadata updates (on closing + write enabled file descriptors). This has a negative performance impact on the whole + reencryption and generates excessive I/O load on the system. + +New libcryptsetup reencryption API +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +The libcryptsetup contains new API calls that are used to setup and +run the reencryption. + +Note that there can be some changes in API implementation of these functions +and/or some new function can be introduced in final cryptsetup 2.2 release. + +New API symbols (see documentation in libcryptsetup.h) +* struct crypt_params_reencrypt - reencryption parameters + +* crypt_reencrypt_init_by_passphrase +* crypt_reencrypt_init_by_keyring + - function to configure LUKS2 metadata for reencryption; + if metadata already exists, it configures the context from this metadata + +* crypt_reencrypt + - run the reencryption process (processing the data) + - the optional callback function can be used to interrupt the reencryption + or report the progress. + +* crypt_reencrypt_status + - function to query LUKS2 metadata about the reencryption state + +Other changes and fixes +~~~~~~~~~~~~~~~~~~~~~~~ +* Add optional global serialization lock for memory hard PBKDF. + (The --serialize-memory-hard-pbkdf option in cryptsetup and + CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF in activation flag.) + + This is an "ugly" optional workaround for a situation when multiple devices + are being activated in parallel (like systemd crypttab activation). + The system instead of returning ENOMEM (no memory available) starts + out-of-memory (OOM) killer to kill processes randomly. + + Until we find a reliable way how to work with memory-hard function + in these situations, cryptsetup provide a way how to serialize memory-hard + unlocking among parallel cryptsetup instances to workaround this problem. + This flag is intended to be used only in very specific situations, + never use it directly :-) + +* Abort conversion to LUKS1 with incompatible sector size that is + not supported in LUKS1. + +* Report error (-ENOENT) if no LUKS keyslots are available. User can now + distinguish between a wrong passphrase and no keyslot available. + +* Fix a possible segfault in detached header handling (double free). + +* Add integritysetup support for bitmap mode introduced in Linux kernel 5.2. + Integritysetup now supports --integrity-bitmap-mode option and + --bitmap-sector-per-bit and --bitmap-flush-time commandline options. + + In the bitmap operation mode, if a bit in the bitmap is 1, the corresponding + region's data and integrity tags are not synchronized - if the machine + crashes, the unsynchronized regions will be recalculated. + The bitmap mode is faster than the journal mode because we don't have + to write the data twice, but it is also less reliable, because if data + corruption happens when the machine crashes, it may not be detected. + This can be used only for standalone devices, not with dm-crypt. + +* The libcryptsetup now keeps all file descriptors to underlying device + open during the whole lifetime of crypt device context to avoid excessive + scanning in udev (udev run scan on every descriptor close). + +* The luksDump command now prints more info for reencryption keyslot + (when a device is in-reencryption). + +* New --device-size parameter is supported for LUKS2 reencryption. + It may be used to encrypt/reencrypt only the initial part of the data + device if the user is aware that the rest of the device is empty. + + Note: This change causes API break since the last rc0 release + (crypt_params_reencrypt structure contains additional field). + +* New --resume-only parameter is supported for LUKS2 reencryption. + This flag resumes reencryption process if it exists (not starting + new reencryption). + +* The repair command now tries LUKS2 reencryption recovery if needed. + +* If reencryption device is a file image, an interactive dialog now + asks if reencryption should be run safely in offline mode + (if autodetection of active devices failed). + +* Fix activation through a token where dm-crypt volume key was not + set through keyring (but using old device-mapper table parameter mode). + +* Online reencryption can now retain all keyslots (if all passphrases + are provided). Note that keyslot numbers will change in this case. + +* Allow volume key file to be used if no LUKS2 keyslots are present. + If all keyslots are removed, LUKS2 has no longer information about + the volume key size (there is only key digest present). + Please use --key-size option to open the device or add a new keyslot + in these cases. + +* Print a warning if online reencrypt is called over LUKS1 (not supported). + +* Fix TCRYPT KDF failure in FIPS mode. + Some crypto backends support plain hash in FIPS mode but not for PBKDF2. + +* Remove FIPS mode restriction for crypt_volume_key_get. + It is an application responsibility to use this API in the proper context. + +* Reduce keyslots area size in luksFormat when the header device is too small. + Unless user explicitly asks for keyslots areas size (either via + --luks2-keyslots-size or --offset) reduce keyslots size so that it fits + in metadata device. + +* Make resize action accept --device-size parameter (supports units suffix). diff --git a/docs/v2.2.1-ReleaseNotes b/docs/v2.2.1-ReleaseNotes new file mode 100644 index 0000000..34bacc1 --- /dev/null +++ b/docs/v2.2.1-ReleaseNotes @@ -0,0 +1,36 @@ +Cryptsetup 2.2.1 Release Notes +============================== +Stable bug-fix release. + +This version contains a fix for a possible data corruption bug +on 32-bit platforms. +All users of cryptsetup 2.1 and 2.2 should upgrade to this version. + +Changes since version 2.2.0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix possible data length and IV offset overflow on 32bit architectures. + Other 64-bit architectures are not affected. + + The flawed helper function prototypes (introduced in version 2.1.0) used + size_t type, that is 32-bit integer on 32-bit systems. + This patch fixes the problem to properly use 64-bit types. + + If the offset parameter addresses devices larger than 2TB, the value + overflows and stores incorrect information in the metadata. + For example, integrity device is smaller than expected size if used + over large disk on 32-bit architecture. + + This issue is not present with the standard LUKS1/LUKS2 devices without + integrity extensions. + +* Fix a regression in TrueCrypt/VeraCrypt system partition activation. + +* Reinstate missing backing file hint for loop device. + + If the encrypted device is backed by a file (loopback), cryptsetup now + shows the path to the backing file in passphrase query (as in 1.x version). + +* LUKS2 reencryption block size is now aligned to reported optimal IO size. + This change eliminates possible non-aligned device warnings in kernel log + during reencryption. diff --git a/docs/v2.2.2-ReleaseNotes b/docs/v2.2.2-ReleaseNotes new file mode 100644 index 0000000..9e68641 --- /dev/null +++ b/docs/v2.2.2-ReleaseNotes @@ -0,0 +1,56 @@ +Cryptsetup 2.2.2 Release Notes +============================== +Stable bug-fix release. + +All users of cryptsetup 2.1 and 2.2 should upgrade to this version. + +Changes since version 2.2.1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Print error message if a keyslot open failed for a different reason + than wrong passwords (for example there is not enough memory). + Only an exit code was present in this case. + +* The progress function switches unit sizes (B/s to GiB/s) according + to the actual speed. Also, it properly calculates speed in the case + of a resumed reencryption operation. + +* The --version now supports short -V short option and better handles + common option priorities. + +* If cryptsetup wipes signatures during format actions through blkid, + it also prints signature device offsets. + +* Compilation now properly uses LTLIBINTL gettext setting in Makefiles. + +* Device-mapper backend now supports new DM_GET_TARGET_VERSION ioctl + (available since Linux kernel 5.4). + This should help to detect some kernel/userspace incompatibilities + earlier later after a failed device activation. + +* Fixes LUKS2 reencryption on systems without kernel keyring. + +* Fixes unlocking prompt for partitions mapped through loop devices + (to properly show the backing device). + +* For LUKS2 decryption, a device is now marked for deferred removal + to be automatically deactivated. + +* Reencryption now limits hotzone size to be maximal 1 GiB or 1/4 + system memory (if lower). + +* Reencryption now retains activation flags during online reencryption. + +* Reencryption now allows LUKS2 device to activate device right after + LUKS2 encryption is initialized through optional active device name + for cryptsetup reencrypt --encrypt command. + This could help with automated encryption during boot. + + NOTE: It means that part of the device is still not encrypted during + activation. Use with care! + +* Fixes failure in resize and plain format activation if activated device + size was not aligned to underlying logical device size. + +* Fixes conversion to LUKS2 format with detached header if a detached + header size was smaller than the expected aligned LUKS1 header size. diff --git a/docs/v2.3.0-ReleaseNotes b/docs/v2.3.0-ReleaseNotes new file mode 100644 index 0000000..2b582c3 --- /dev/null +++ b/docs/v2.3.0-ReleaseNotes @@ -0,0 +1,209 @@ +Cryptsetup 2.3.0 Release Notes +============================== +Stable release with new experimental features and bug fixes. + +Cryptsetup 2.3 version introduces support for BitLocker-compatible +devices (BITLK format). This format is used in Windows systems, +and in combination with a filesystem driver, cryptsetup now provides +native read-write access to BitLocker Full Disk Encryption devices. + +The BITLK implementation is based on publicly available information +and it is an independent and opensource implementation that allows +to access this proprietary disk encryption. + +Changes since version 2.2.2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* BITLK (Windows BitLocker compatible) device access + + BITLK userspace implementation is based on the master thesis and code + provided by Vojtech Trefny. Also, thanks to other opensource projects + like libbde (that provide alternative approach to decode this format) + we were able to verify cryptsetup implementation. + + NOTE: Support for the BITLK device is EXPERIMENTAL and will require + a lot of testing. If you get some error message (mainly unsupported + metadata in the on-disk header), please help us by submitting an issue + to cryptsetup project, so we can fix it. Thank you! + + Cryptsetup supports BITLK activation through passphrase or recovery + passphrase for existing devices (BitLocker and Bitlocker to Go). + + Activation through TPM, SmartCard, or any other key protector + is not supported. And in some situations, mainly for TPM bind to some + PCR registers, it could be even impossible on Linux in the future. + + All metadata (key protectors) are handled read-only, cryptsetup cannot + create or modify them. Except for old devices (created in old Vista + systems), all format variants should be recognized. + + Data devices can be activated read-write (followed by mounting through + the proper filesystem driver). To access filesystem on the decrypted device + you need properly installed driver (vfat, NTFS or exFAT). + + Foe AES-XTS, activation is supported on all recent Linux kernels. + + For older AES-CBC encryption, Linux Kernel version 5.3 is required + (support for special IV variant); for AES-CBC with Elephant diffuser, + Linux Kernel 5.6 is required. + + Please note that CBC variants are legacy, and we provide it only + for backward compatibility (to be able to access old drives). + + Cryptsetup command now supports the new "bitlk" format and implement dump, + open, status, and close actions. + + To activate a BITLK device, use + + # cryptsetup open --type bitlk + or with alias + # cryptsetup bitlkOpen + + Then with properly installed fs driver (usually NTFS, vfat or exFAT), + you can mount the plaintext device /dev/mapper device as a common + filesystem. + + To print metadata information about BITLK device, use + # crypotsetup bitlkDump + + To print information about the active device, use + # cryptsetup status + + Example (activation of disk image): + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + # Recent blkid recognizes BitLocker device,just to verity + # blkid bitlocker_xts_ntfs.img + bitlocker_xts_ntfs.img: TYPE="BitLocker" + + # Print visible metadata information (on-disk, form the image) + # cryptsetup bitlkDump bitlocker_xts_ntfs.img + Info for BITLK device bitlocker_xts_ntfs.img. + Version: 2 + GUID: ... + Created: Wed Oct 23 17:38:15 2019 + Description: DESKTOP-xxxxxxx E: 23.10.2019 + Cipher name: aes + Cipher mode: xts-plain64 + Cipher key: 128 bits + + Keyslots: + 0: VMK + GUID: ... + Protection: VMK protected with passphrase + Salt: ... + Key data size: 44 [bytes] + 1: VMK + GUID: ... + Protection: VMK protected with recovery passphrase + Salt: ... + Key data size: 44 [bytes] + 2: FVEK + Key data size: 44 [bytes] + + # Activation (recovery passphrase works the same as password) + # cryptsetup bitlkOpen bitlocker_xts_ntfs.img test -v + Enter passphrase for bitlocker_xts_ntfs.img: + Command successful. + + # Information about the active device + # cryptsetup status test + /dev/mapper/test is active. + type: BITLK + cipher: aes-xts-plain64 + keysize: 128 bits + ... + + # Plaintext device should now contain decrypted NTFS filesystem + # blkid /dev/mapper/test + /dev/mapper/test: UUID="..." TYPE="ntfs" + + # And can be mounted + # mount /dev/mapper/test /mnt/tst + + # Deactivation + # umount /mnt/tst + # cryptsetup close test + +* Veritysetup now supports activation with additional PKCS7 signature + of root hash through --root-hash-signature option. + The signature uses an in-kernel trusted key to validate the signature + of the root hash during activation. This option requires Linux kernel + 5.4 with DM_VERITY_VERIFY_ROOTHASH_SIG option. + + Verity devices activated with signature now has a special flag + (with signature) active in device status (veritysetup status ). + + Usage: + # veritysetup open name \ + --root-hash-signature= + +* Integritysetup now calculates hash integrity size according to algorithm + instead of requiring an explicit tag size. + + Previously, when integritysetup formats a device with hash or + HMAC integrity checksums, it required explicitly tag size entry from + a user (or used default value). + This led to confusion and unexpected shortened tag sizes. + + Now, libcryptsetup calculates tag size according to real hash output. + Tag size can also be specified, then it warns if these values differ. + +* Integritysetup now supports fixed padding for dm-integrity devices. + + There was an in-kernel bug that wasted a lot of space when using metadata + areas for integrity-protected devices if a larger sector size than + 512 bytes was used. + This problem affects both stand-alone dm-integrity and also LUKS2 with + authenticated encryption and larger sector size. + + The new extension to dm-integrity superblock is needed, so devices + with the new optimal padding cannot be activated on older systems. + + Integritysetup/Cryptsetup will use new padding automatically if it + detects the proper kernel. To create a compatible device with + the old padding, use --integrity-legacy-padding option. + +* A lot of fixes to online LUKS2 reecryption. + +* Add crypt_resume_by_volume_key() function to libcryptsetup. + If a user has a volume key available, the LUKS device can be resumed + directly using the provided volume key. + No keyslot derivation is needed, only the key digest is checked. + +* Implement active device suspend info. + Add CRYPT_ACTIVATE_SUSPENDED bit to crypt_get_active_device() flags + that informs the caller that device is suspended (luksSuspend). + +* Allow --test-passphrase for a detached header. + Before this fix, we required a data device specified on the command + line even though it was not necessary for the passphrase check. + +* Allow --key-file option in legacy offline encryption. + The option was ignored for LUKS1 encryption initialization. + +* Export memory safe functions. + To make developing of some extensions simpler, we now export + functions to handle memory with proper wipe on deallocation. + +* Fail crypt_keyslot_get_pbkdf for inactive LUKS1 keyslot. + +Libcryptsetup API extensions +~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +The libcryptsetup API is backward compatible for existing symbols. + +New symbols + crypt_set_compatibility + crypt_get_compatibility; + crypt_resume_by_volume_key; + crypt_activate_by_signed_key; + crypt_safe_alloc; + crypt_safe_realloc; + crypt_safe_free; + crypt_safe_memzero; + +New defines introduced : + CRYPT_BITLK "BITLK" - BITLK (BitLocker-compatible mode + CRYPT_COMPAT_LEGACY_INTEGRITY_PADDING - dm-integrity legacy padding + CRYPT_VERITY_ROOT_HASH_SIGNATURE - dm-verity root hash signature + CRYPT_ACTIVATE_SUSPENDED - device suspended info flag diff --git a/docs/v2.3.1-ReleaseNotes b/docs/v2.3.1-ReleaseNotes new file mode 100644 index 0000000..1c1d365 --- /dev/null +++ b/docs/v2.3.1-ReleaseNotes @@ -0,0 +1,45 @@ +Cryptsetup 2.3.1 Release Notes +============================== +Stable bug-fix release. + +All users of cryptsetup 2.x should upgrade to this version. + +Changes since version 2.3.0 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Support VeraCrypt 128 bytes passwords. + VeraCrypt now allows passwords of maximal length 128 bytes + (compared to legacy TrueCrypt where it was limited by 64 bytes). + +* Strip extra newline from BitLocker recovery keys + There might be a trailing newline added by the text editor when + the recovery passphrase was passed using the --key-file option. + +* Detect separate libiconv library. + It should fix compilation issues on distributions with iconv + implemented in a separate library. + +* Various fixes and workarounds to build on old Linux distributions. + +* Split lines with hexadecimal digest printing for large key-sizes. + +* Do not wipe the device with no integrity profile. + With --integrity none we performed useless full device wipe. + +* Workaround for dm-integrity kernel table bug. + Some kernels show an invalid dm-integrity mapping table + if superblock contains the "recalculate" bit. This causes + integritysetup to not recognize the dm-integrity device. + Integritysetup now specifies kernel options such a way that + even on unpatched kernels mapping table is correct. + +* Print error message if LUKS1 keyslot cannot be processed. + If the crypto backend is missing support for hash algorithms + used in PBKDF2, the error message was not visible. + +* Properly align LUKS2 keyslots area on conversion. + If the LUKS1 payload offset (data offset) is not aligned + to 4 KiB boundary, new LUKS2 keyslots area in now aligned properly. + +* Validate LUKS2 earlier on conversion to not corrupt the device + if binary keyslots areas metadata are not correct. diff --git a/docs/v2.3.2-ReleaseNotes b/docs/v2.3.2-ReleaseNotes new file mode 100644 index 0000000..eb0d447 --- /dev/null +++ b/docs/v2.3.2-ReleaseNotes @@ -0,0 +1,42 @@ +Cryptsetup 2.3.2 Release Notes +============================== +Stable bug-fix release. + +All users of cryptsetup 2.x should upgrade to this version. + +Changes since version 2.3.1 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Support compilation with json-c library version 0.14. + +* Update FAQ document for some LUKS2 specific information. + +* Add option to dump content of LUKS2 unbound keyslot: + cryptsetup luksDump --unbound -S + or optionally with --master-key-file option. + + The slot number --key-slot (-S) option is mandatory here. + + An unbound keyslot store a key is that is not assigned to data + area on disk (LUKS2 allows to store arbitrary keys). + +* Rephrase some error messages and remove redundant end-of-lines. + +* Add support for discards (TRIM) for standalone dm-integrity devices. + Linux kernel 5.7 adds support for optional discard/TRIM operation + over dm-integrity devices. + + It is now supported through --allow-discards integritysetup option. + Note you need to add this flag in all activation calls. + + Note that this option cannot be used for LUKS2 authenticated encryption + (that uses dm-integrity for storing additional per-sector metadata). + +* Fix cryptsetup-reencrypt to work on devices that do not allow + direct-io device access. + +* Fix a crash in the BitLocker-compatible code error path. + +* Fix Veracrypt compatible support for longer (>64 bytes) passphrases. + It allows some older images to be correctly opened again. + The issue was introduced in version 2.3.1. diff --git a/docs/v2.3.3-ReleaseNotes b/docs/v2.3.3-ReleaseNotes new file mode 100644 index 0000000..75471ac --- /dev/null +++ b/docs/v2.3.3-ReleaseNotes @@ -0,0 +1,42 @@ +Cryptsetup 2.3.3 Release Notes +============================== +Stable bug-fix release. + +All users of cryptsetup 2.x should upgrade to this version. + +Changes since version 2.3.2 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix BitLocker compatible device access that uses native 4kB sectors. + + Devices formatted with storage that natively support 4096-bytes + sectors can also use this sector size for encryption units. + +* Support large IV count (--iv-large-sectors) cryptsetup option + for plain device mapping. + + The large IV count is supported in dm-crypt together with larger + sector encryption. It counts the Initialization Vector (IV) in + a larger sector size instead of 512-bytes sectors. + + This option does not have any performance or security impact, + but it can be used for accessing incompatible existing disk images + from other systems. + + Only open action with plain device type and sector size > 512 bytes + are supported. + +* Fix a memory leak in BitLocker compatible handling. + +* Allow EBOIV (Initialization Vector algorithm) use. + + The EBOIV initialization vector is intended to be used internally + with BitLocker devices (for CBC mode). It can now be used also + outside of the BitLocker compatible code. + +* Require both keyslot cipher and key size options. + + If these LUKS2 keyslot parameters were not specified together, + cryptsetup silently failed. + +* Update to man pages and FAQ. diff --git a/docs/v2.3.4-ReleaseNotes b/docs/v2.3.4-ReleaseNotes new file mode 100644 index 0000000..fb5a411 --- /dev/null +++ b/docs/v2.3.4-ReleaseNotes @@ -0,0 +1,112 @@ +Cryptsetup 2.3.4 Release Notes +============================== +Stable bug-fix release with a security fix (32-bit only). + +All users of cryptsetup 2.2.x and later should upgrade to this version. + +Changes since version 2.3.3 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix a possible out-of-bounds memory write while validating LUKS2 data + segments metadata (CVE-2020-14382). + + This problem can be triggered only on 32-bit builds (64-bit systems + are not affected). + + LUKS2 format validation code contains a bug in segments validation code + where the code does not check for possible overflow on memory allocation. + + Due to the bug, the libcryptsetup can be tricked to expect such allocation + was successful. Later it may read data from image crafted by an attacker and + actually write such data beyond allocated memory. + + The bug was introduced in cryptsetup 2.2.0. All later releases until 2.3.4 + are affected. + + If you only backport the fix for this CVE, these master branch git commits + should be backported: + 52f5cb8cedf22fb3e14c744814ec8af7614146c7 + 46ee71edcd13e1dad50815ad65c28779aa6f7503 + 752c9a52798f11d3b765b673ebaa3058eb25316e + + Thanks to Tobias Stoeckmann for discovering this issue. + +* Ignore reported optimal IO size if not aligned to minimal page size. + + Some USB enclosures report bogus block device topology (see lsblk -t) that + prevents LUKS2 format with 4k sector size (reported values are not correctly + aligned). The code now ignores such values and uses the default alignment. + +* Added support for new no_read/write_wrokqueue dm-crypt options (kernel 5.9). + + These performance options, introduced in kernel 5.9, configure dm-crypt + to bypass read or write workqueues and run encryption synchronously. + + Use --perf-no_read_workqueue or --perf-no_write_workqueue cryptsetup arguments + to use these dm-crypt flags. + + These options are available only for low-level dm-crypt performance tuning, + use only if you need a change to default dm-crypt behavior. + + For LUKS2, these flags can be persistently stored in metadata with + the --persistent option. + +* Added support panic_on_corruption option for dm-verity devices (kernel 5.9). + + Veritysetup now supports --panic-on-corruption argument that configures + the dm-verity device to panics kernel if a corruption is detected. + + This option is intended for specific configurations, do not use it in + standard configurations. + +* Support --master-key-file option for online LUKS2 reencryption + + This can be used for reencryption of devices that uses protected key AES cipher + on some mainframes crypto accelerators. + +* Always return EEXIST error code if a device already exists. + + Some libcryptsetup functions (activate_by*) now return EEXIST error code, + so the caller can distinguish that call fails because some parallel process + already activated the device. + Previously all fails returned EINVAL (invalid value). + +* Fix a problem in integritysetup if a hash algorithm has dash in the name. + + If users want to use blake2b/blake2s, the kernel algorithm name includes + a dash (like "blake2s-256"). + Theses algorithms can now be used for integritysetup devices. + +* Fix crypto backend to properly handle ECB mode. + + Even though it should never be used, it should still work for testing :) + This fixes a bug introduced in cryptsetup version 2.3.2. + +* TrueCrypt/VeraCrypt compatible mode now supports the activation of devices + with a larger sector. + + TrueCrypt/VeraCrypt always uses 512-byte sector for encryption, but for devices + with a larger native sector, it stores this value in the header. + + This patch allows activation of such devices, basically ignoring + the mentioned sector size. + +* LUKS2: Do not create excessively large headers. + + When creating a LUKS2 header with a specified --offset larger than + the LUKS2 header size, do not create a larger file than needed. + +* Fix unspecified sector size for BitLocker compatible mode. + + Some BitLocker devices can contain zeroed sector size in the header. + In this case, the 512-byte sector should be used. + The bug was introduced in version 2.3.3. + +* Fix reading key data size in metadata for BitLocker compatible mode. + + Such devices with an unexpected entry in metadata can now be activated. + + Thanks to all users reporting these problems, BitLocker metadata documentation + is not publicly available, and we depend only on these reports. + +* Fix typos in documentation. diff --git a/docs/v2.3.5-ReleaseNotes b/docs/v2.3.5-ReleaseNotes new file mode 100644 index 0000000..bad4fdf --- /dev/null +++ b/docs/v2.3.5-ReleaseNotes @@ -0,0 +1,181 @@ +Cryptsetup 2.3.5 Release Notes +============================== +Stable bug-fix release with minor extensions. + +All users of cryptsetup 2.x and later should upgrade to this version. + +Changes since version 2.3.4 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix partial reads of passphrase from an interactive terminal. + Some stable kernels (5.3.11) started to return buffer from a terminal + in parts of maximal size 64 bytes. + This breaks the reading of passphrases longer than 64 characters + entered through an interactive terminal. The change is already fixed + in later kernel releases, but tools now support such partial read from + terminal properly. + +* Fix maximal length of password entered through a terminal. + Now the maximal interactive passphrase length is exactly + 512 characters (not 511). + +* integritysetup: support new dm-integrity HMAC recalculation options. + + In older kernels (since version 4.19), an attacker can force + an automatic recalculation of integrity tags by modifying + the dm-integrity superblock. + This is a problem with a keyed algorithms (HMAC), where it expects + nobody can trigger such recalculation without the key. + (Automatic recalculation will start after the next activation.) + + Note that dm-integrity in standalone mode was *not* supposed + to provide cryptographic data integrity protection. + Despite that, we try to keep the system secure if keyed algorithms + are used. + Thank Daniel Glöckner for the original report of this problem. + + Authenticated encryption that provides data integrity protection (in + combination with dm-crypt and LUKS2) is not affected by this problem. + + The fix in the kernel for this problem contains two parts. + + Firstly, the dm-integrity kernel module disables integrity + recalculation if keyed algorithms (HMAC) are used. + This change is included in long-term stable kernels. + + Secondly, since the kernel version 5.11, dm-integrity introduces + modified protection where a journal-integrity algorithm guards + superblock; also, journal sections are protected. An attacker cannot + copy sectors from one journal section to another, and the superblock + also contains salt to prevent header replacement from another device. + + If you want to protect data with HMAC, you should always also use HMAC + for --journal-integrity. Keys can be independent. + If HMAC is used for data but not for the journal, the recalculation + option is disabled. + + If you need to use (insecure) backward compatibility implementation, + two new integritysetup options are introduced: + - Use --integrity-legacy-recalc (instead of --integrity-recalc) + to allow recalculation on legacy devices. + - Use --integrity-legacy-hmac in format action to force old insecure + HMAC format. + + Libcryptsetup API also introduces flags + CRYPT_COMPAT_LEGACY_INTEGRITY_HMAC and + CRYPT_COMPAT_LEGACY_INTEGRITY_RECALC + to set these through crypt_set_compatibility() call. + +* integritysetup: display of recalculating sector in dump command. + +* veritysetup: fix verity FEC if stored in the same image with hashes. + + Optional FEC (Forward Error Correction) data should cover the whole + data area, hashes (Merkle tree), and optionally additional metadata + (located after hash area). + + Unfortunately, if FEC data is stored in the same file as hash, + the calculation wrongly used the whole file size, thus overlaps with + the FEC area itself. This produced unusable and too large FEC data. + There is no problem if the FEC image is a separate image. + + The problem is now fixed, introducing FEC blocks calculation as: + - If the hash device is in a separate image, metadata covers the + whole rest of the image after the hash area. (Unchanged behavior.) + - If hash and FEC device is in the image, metadata ends on the FEC + area offset. + + Note: there is also a fix for FEC in the dm-verity kernel (on the way + to stable kernels) that fixes error correction with larger RS roots. + +* veritysetup: run FEC repair check even if root hash fails. + + Note: The userspace FEC verify command reports are only informational + for now. Code does not check verity hash after FEC recovery in + userspace. The Reed-Solomon decoder can then report the possibility + that it fixed data even if parity is too damaged. + This will be fixed in the next major release. + +* veritysetup: do not process hash image if hash area is empty. + + Sometimes the device is so small that there is only a root hash + needed, and the hash area is not used. + Also, the size of the hash image is not increased for hash block + alignment in this case. + +* veritysetup: store verity hash algorithm in superblock in lowercase. + + Otherwise, the kernel could refuse the activation of the device. + +* bitlk: fix a crash if the device disappears during BitLocker scan. + +* bitlk: show a better error when trying to open an NTFS device. + + Both BitLocker version 1 and NTFS have the same signature. + If a user opens an NTFS device without BitLocker, it now correctly + informs that it is not a BITLK device. + +* bitlk: add support for startup key protected VMKs. + + The startup key can be provided in --key-file option for open command. + +* Fix LUKS1 repair code (regression since version 1.7.x). + + We cannot trust possibly broken keyslots metadata in repair, so the + code recalculates them instead. + This makes the repair code working again when the master boot record + signature overwrites the LUKS header. + +* Fix luksKeyChange for LUKS2 with assigned tokens. + + The token references are now correctly assigned to the new keyslot + number. + +* Fix cryptsetup resize using LUKS2 tokens. + + Code needlessly asked for passphrase even though volume key was + already unlocked via LUKS2 token. + +* Print a visible error if device resize is not supported. + +* Add error message when suspending wrong non-LUKS device. + +* Fix default XTS mode key size in reencryption. + + The same luksFormat logic (double key size because XTS uses two keys) + is applied in the reencryption code. + +* Rephrase missing locking directory warning and move it to debug level. + + The system should later provide a safe transition to tempdir + configuration, so creating locking directory inside libcryptsetup + call is safe. + +* Many fixes for the use of cipher_null (empty debug cipher). + + Support for this empty cipher was intended as a debug feature and for + measuring performance overhead. Unfortunately, many systems started to + use it as an "empty shell" for LUKS (to enable encryption later). + + This use is very dangerous and it creates a false sense of security. + + Anyway, to not break such systems, we try to support these + configurations. + Using cipher_null in any production system is strongly discouraged! + + Fixes include: + - allow LUKS resume for a device with cipher_null. + - do not upload key in keyring when data cipher is null. + - switch to default cipher when reencrypting cipher_null device. + - replace possible bogus cipher_null keyslots before reencryption. + - fix broken detection of null cipher in LUKS2. + cipher_null is no longer possible to be used in keyslot encryption + in LUKS2, it can be used only for data for debugging purposes. + +* Fixes for libpasswdqc 2.0.x (optional passphrase quality check). + +* Fixes for problems discovered by various tools for code analysis. + + Fixes include a rework of libpopt command line option string leaks. + +* Various fixes to man pages. diff --git a/docs/v2.3.6-ReleaseNotes b/docs/v2.3.6-ReleaseNotes new file mode 100644 index 0000000..deb975e --- /dev/null +++ b/docs/v2.3.6-ReleaseNotes @@ -0,0 +1,56 @@ +Cryptsetup 2.3.6 Release Notes +============================== +Stable bug-fix release with minor extensions. + +All users of cryptsetup 2.x and later should upgrade to this version. + +Changes since version 2.3.5 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* integritysetup: Fix possible dm-integrity mapping table truncation. + + While integritysetup in standalone mode (no encryption) was not + designed to provide keyed (and cryptographically strong) data + integrity protection, some options can use such algorithms (HMAC). + + If a key is used, it is directly sent to the kernel dm-integrity as + a mapping table option (no key derivation is performed). + For HMAC, such a key could be quite long (up to 4096 bytes in + integritysetup CLI). + + Unfortunately, due to fixed buffers and not correctly checking string + truncation, some parameter combinations could cause truncation + of the dm-integrity mapping table. + In most cases, the table was rejected by the kernel. + The worst possible case was key truncation for HMAC options + (internal_hash and journal_mac dm-integrity table options). + + This release fixes possible truncation and also adds more sanity + checks to reject truncated options. + Also, integritysetup now mentions maximal allowed key size + in --help output. + + For old standalone dm-integrity devices where the key length was + truncated, you have to modify (shorten) --integrity-key-size + resp. --journal-integrity-key-size option now. + + This bug is _not_ present for dm-crypt/LUKS, LUKS2 (including + integrity protection), or dm-verity devices; it affects only + standalone dm-integrity with HMAC integrity protection. + +* cryptsetup: Backup header can be used to activate TCRYPT device. + Use --header option to specify the header. + +* cryptsetup: Avoid LUKS2 decryption without detached header. + This feature will be added later and is currently not supported. + +* Additional fixes and workarounds for common warnings produced + by some static analysis tools (like gcc-11 analyzer) and additional + code hardening. + +* Fix standalone libintl detection for compiled tests. + +* Add Blake2b and Blake2s hash support for crypto backends. + Kernel and gcrypt crypto backend support all variants. + OpenSSL supports only Blake2b-512 and Blake2s-256. + Crypto backend supports kernel notation e.g. "blake2b-512". diff --git a/docs/v2.3.7-ReleaseNotes b/docs/v2.3.7-ReleaseNotes new file mode 100644 index 0000000..5305d6f --- /dev/null +++ b/docs/v2.3.7-ReleaseNotes @@ -0,0 +1,95 @@ +Cryptsetup 2.3.7 Release Notes +============================== +Stable security bug-fix release that fixes CVE-2021-4122. + +All users of cryptsetup 2.3.x must upgrade to this version. + +Changes since version 2.3.6 +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +* Fix possible attacks against data confidentiality through LUKS2 online + reencryption extension crash recovery (CVE-2021-4122). + + An attacker can modify on-disk metadata to simulate decryption in + progress with crashed (unfinished) reencryption step and persistently + decrypt part of the LUKS device. + + This attack requires repeated physical access to the LUKS device but + no knowledge of user passphrases. + + The decryption step is performed after a valid user activates + the device with a correct passphrase and modified metadata. + There are no visible warnings for the user that such recovery happened + (except using the luksDump command). The attack can also be reversed + afterward (simulating crashed encryption from a plaintext) with + possible modification of revealed plaintext. + + The size of possible decrypted data depends on configured LUKS2 header + size (metadata size is configurable for LUKS2). + With the default parameters (16 MiB LUKS2 header) and only one + allocated keyslot (512 bit key for AES-XTS), simulated decryption with + checksum resilience SHA1 (20 bytes checksum for 4096-byte blocks), + the maximal decrypted size can be over 3GiB. + + The attack is not applicable to LUKS1 format, but the attacker can + update metadata in place to LUKS2 format as an additional step. + For such a converted LUKS2 header, the keyslot area is limited to + decrypted size (with SHA1 checksums) over 300 MiB. + + The issue is present in all cryptsetup releases since 2.2.0. + Versions 1.x, 2.0.x, and 2.1.x are not affected, as these do not + contain LUKS2 reencryption extension. + + The problem was caused by reusing a mechanism designed for actual + reencryption operation without reassessing the security impact for new + encryption and decryption operations. While the reencryption requires + calculating and verifying both key digests, no digest was needed to + initiate decryption recovery if the destination is plaintext (no + encryption key). Also, some metadata (like encryption cipher) is not + protected, and an attacker could change it. Note that LUKS2 protects + visible metadata only when a random change occurs. It does not protect + against intentional modification but such modification must not cause + a violation of data confidentiality. + + The fix introduces additional digest protection of reencryption + metadata. The digest is calculated from known keys and critical + reencryption metadata. Now an attacker cannot create correct metadata + digest without knowledge of a passphrase for used keyslots. + For more details, see LUKS2 On-Disk Format Specification version 1.1.0. + + The former reencryption operation (without the additional digest) is no + longer supported (reencryption with the digest is not backward + compatible). You need to finish in-progress reencryption before + updating to new packages. The alternative approach is to perform + a repair command from the updated package to recalculate reencryption + digest and fix metadata. + The reencryption repair operation always require a user passphrase. + + WARNING: Devices with older reencryption in progress can be no longer + activated without performing the action mentioned above. + + Encryption in progress can be detected by running the luksDump command + (output includes reencrypt keyslot with reencryption parameters). Also, + during the active reencryption, no keyslot operations are available + (change of passphrases, etc.). + + The issue was found by Milan Broz as cryptsetup maintainer. + +Other changes +~~~~~~~~~~~~~ +* Add configure option --disable-luks2-reencryption to completely disable + LUKS2 reencryption code. + + When used, the libcryptsetup library can read metadata with + reencryption code, but all reencryption API calls and cryptsetup + reencrypt commands are disabled. + + Devices with online reencryption in progress cannot be activated. + This option can cause some incompatibilities. Please use with care. + +* Improve internal metadata validation code for reencryption metadata. + +* Add updated documentation for LUKS2 On-Disk Format Specification + version 1.1.0 (with reencryption extension description and updated + metadata description). See docs/on-disk-format-luks2.pdf or online + version in https://gitlab.com/cryptsetup/LUKS2-docs repository. diff --git a/lib/Makemodule.am b/lib/Makemodule.am new file mode 100644 index 0000000..69159fa --- /dev/null +++ b/lib/Makemodule.am @@ -0,0 +1,116 @@ +pkgconfigdir = $(libdir)/pkgconfig +pkgconfig_DATA = lib/libcryptsetup.pc + +lib_LTLIBRARIES = libcryptsetup.la + +noinst_LTLIBRARIES += libutils_io.la + +include_HEADERS = lib/libcryptsetup.h + +EXTRA_DIST += lib/libcryptsetup.pc.in lib/libcryptsetup.sym + +libutils_io_la_CFLAGS = $(AM_CFLAGS) + +libutils_io_la_SOURCES = \ + lib/utils_io.c \ + lib/utils_io.h + +libcryptsetup_la_CPPFLAGS = $(AM_CPPFLAGS) \ + -I $(top_srcdir)/lib/crypto_backend \ + -I $(top_srcdir)/lib/luks1 \ + -I $(top_srcdir)/lib/luks2 \ + -I $(top_srcdir)/lib/loopaes \ + -I $(top_srcdir)/lib/verity \ + -I $(top_srcdir)/lib/tcrypt \ + -I $(top_srcdir)/lib/integrity \ + -I $(top_srcdir)/lib/bitlk + +libcryptsetup_la_DEPENDENCIES = libutils_io.la libcrypto_backend.la lib/libcryptsetup.sym + +libcryptsetup_la_LDFLAGS = $(AM_LDFLAGS) -no-undefined \ + -Wl,--version-script=$(top_srcdir)/lib/libcryptsetup.sym \ + -version-info @LIBCRYPTSETUP_VERSION_INFO@ + +libcryptsetup_la_CFLAGS = $(AM_CFLAGS) @CRYPTO_CFLAGS@ + +libcryptsetup_la_LIBADD = \ + @UUID_LIBS@ \ + @DEVMAPPER_LIBS@ \ + @CRYPTO_LIBS@ \ + @LIBARGON2_LIBS@ \ + @JSON_C_LIBS@ \ + @BLKID_LIBS@ \ + $(LTLIBICONV) \ + libcrypto_backend.la \ + libutils_io.la + +libcryptsetup_la_SOURCES = \ + lib/setup.c \ + lib/internal.h \ + lib/bitops.h \ + lib/nls.h \ + lib/libcryptsetup.h \ + lib/utils.c \ + lib/utils_benchmark.c \ + lib/utils_crypt.c \ + lib/utils_crypt.h \ + lib/utils_loop.c \ + lib/utils_loop.h \ + lib/utils_devpath.c \ + lib/utils_wipe.c \ + lib/utils_fips.c \ + lib/utils_fips.h \ + lib/utils_device.c \ + lib/utils_keyring.c \ + lib/utils_keyring.h \ + lib/utils_device_locking.c \ + lib/utils_device_locking.h \ + lib/utils_pbkdf.c \ + lib/utils_safe_memory.c \ + lib/utils_storage_wrappers.c \ + lib/utils_storage_wrappers.h \ + lib/libdevmapper.c \ + lib/utils_dm.h \ + lib/volumekey.c \ + lib/random.c \ + lib/crypt_plain.c \ + lib/base64.h \ + lib/base64.c \ + lib/integrity/integrity.h \ + lib/integrity/integrity.c \ + lib/loopaes/loopaes.h \ + lib/loopaes/loopaes.c \ + lib/tcrypt/tcrypt.h \ + lib/tcrypt/tcrypt.c \ + lib/luks1/af.h \ + lib/luks1/af.c \ + lib/luks1/keyencryption.c \ + lib/luks1/keymanage.c \ + lib/luks1/luks.h \ + lib/verity/verity_hash.c \ + lib/verity/verity_fec.c \ + lib/verity/verity.c \ + lib/verity/verity.h \ + lib/verity/rs_encode_char.c \ + lib/verity/rs_decode_char.c \ + lib/verity/rs.h \ + lib/luks2/luks2_disk_metadata.c \ + lib/luks2/luks2_json_format.c \ + lib/luks2/luks2_json_metadata.c \ + lib/luks2/luks2_luks1_convert.c \ + lib/luks2/luks2_digest.c \ + lib/luks2/luks2_digest_pbkdf2.c \ + lib/luks2/luks2_keyslot.c \ + lib/luks2/luks2_keyslot_luks2.c \ + lib/luks2/luks2_keyslot_reenc.c \ + lib/luks2/luks2_reencrypt.c \ + lib/luks2/luks2_reencrypt_digest.c \ + lib/luks2/luks2_segment.c \ + lib/luks2/luks2_token_keyring.c \ + lib/luks2/luks2_token.c \ + lib/luks2/luks2_internal.h \ + lib/luks2/luks2.h \ + lib/utils_blkid.c \ + lib/utils_blkid.h \ + lib/bitlk/bitlk.h \ + lib/bitlk/bitlk.c diff --git a/lib/base64.c b/lib/base64.c new file mode 100644 index 0000000..aafb901 --- /dev/null +++ b/lib/base64.c @@ -0,0 +1,605 @@ +/* base64.c -- Encode binary data using printable characters. + Copyright (C) 1999-2001, 2004-2006, 2009-2019 Free Software Foundation, Inc. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, see . */ + +/* Written by Simon Josefsson. Partially adapted from GNU MailUtils + * (mailbox/filter_trans.c, as of 2004-11-28). Improved by review + * from Paul Eggert, Bruno Haible, and Stepan Kasal. + * + * See also RFC 4648 . + * + * Be careful with error checking. Here is how you would typically + * use these functions: + * + * bool ok = base64_decode_alloc (in, inlen, &out, &outlen); + * if (!ok) + * FAIL: input was not valid base64 + * if (out == NULL) + * FAIL: memory allocation error + * OK: data in OUT/OUTLEN + * + * size_t outlen = base64_encode_alloc (in, inlen, &out); + * if (out == NULL && outlen == 0 && inlen != 0) + * FAIL: input too long + * if (out == NULL) + * FAIL: memory allocation error + * OK: data in OUT/OUTLEN. + * + */ + +#include + +/* Get prototype. */ +#include "base64.h" + +/* Get malloc. */ +#include + +/* Get UCHAR_MAX. */ +#include + +#include + +/* C89 compliant way to cast 'char' to 'unsigned char'. */ +static unsigned char +to_uchar (char ch) +{ + return ch; +} + +static const char b64c[64] = + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; + +/* Base64 encode IN array of size INLEN into OUT array. OUT needs + to be of length >= BASE64_LENGTH(INLEN), and INLEN needs to be + a multiple of 3. */ +static void +base64_encode_fast (const char *restrict in, size_t inlen, char *restrict out) +{ + while (inlen) + { + *out++ = b64c[(to_uchar (in[0]) >> 2) & 0x3f]; + *out++ = b64c[((to_uchar (in[0]) << 4) + (to_uchar (in[1]) >> 4)) & 0x3f]; + *out++ = b64c[((to_uchar (in[1]) << 2) + (to_uchar (in[2]) >> 6)) & 0x3f]; + *out++ = b64c[to_uchar (in[2]) & 0x3f]; + + inlen -= 3; + in += 3; + } +} + +/* Base64 encode IN array of size INLEN into OUT array of size OUTLEN. + If OUTLEN is less than BASE64_LENGTH(INLEN), write as many bytes as + possible. If OUTLEN is larger than BASE64_LENGTH(INLEN), also zero + terminate the output buffer. */ +void +base64_encode (const char *restrict in, size_t inlen, + char *restrict out, size_t outlen) +{ + /* Note this outlen constraint can be enforced at compile time. + I.E. that the output buffer is exactly large enough to hold + the encoded inlen bytes. The inlen constraints (of corresponding + to outlen, and being a multiple of 3) can change at runtime + at the end of input. However the common case when reading + large inputs is to have both constraints satisfied, so we depend + on both in base_encode_fast(). */ + if (outlen % 4 == 0 && inlen == outlen / 4 * 3) + { + base64_encode_fast (in, inlen, out); + return; + } + + while (inlen && outlen) + { + *out++ = b64c[(to_uchar (in[0]) >> 2) & 0x3f]; + if (!--outlen) + break; + *out++ = b64c[((to_uchar (in[0]) << 4) + + (--inlen ? to_uchar (in[1]) >> 4 : 0)) + & 0x3f]; + if (!--outlen) + break; + *out++ = + (inlen + ? b64c[((to_uchar (in[1]) << 2) + + (--inlen ? to_uchar (in[2]) >> 6 : 0)) + & 0x3f] + : '='); + if (!--outlen) + break; + *out++ = inlen ? b64c[to_uchar (in[2]) & 0x3f] : '='; + if (!--outlen) + break; + if (inlen) + inlen--; + if (inlen) + in += 3; + } + + if (outlen) + *out = '\0'; +} + +/* Allocate a buffer and store zero terminated base64 encoded data + from array IN of size INLEN, returning BASE64_LENGTH(INLEN), i.e., + the length of the encoded data, excluding the terminating zero. On + return, the OUT variable will hold a pointer to newly allocated + memory that must be deallocated by the caller. If output string + length would overflow, 0 is returned and OUT is set to NULL. If + memory allocation failed, OUT is set to NULL, and the return value + indicates length of the requested memory block, i.e., + BASE64_LENGTH(inlen) + 1. */ +size_t +base64_encode_alloc (const char *in, size_t inlen, char **out) +{ + size_t outlen = 1 + BASE64_LENGTH (inlen); + + /* Check for overflow in outlen computation. + * + * If there is no overflow, outlen >= inlen. + * + * If the operation (inlen + 2) overflows then it yields at most +1, so + * outlen is 0. + * + * If the multiplication overflows, we lose at least half of the + * correct value, so the result is < ((inlen + 2) / 3) * 2, which is + * less than (inlen + 2) * 0.66667, which is less than inlen as soon as + * (inlen > 4). + */ + if (inlen > outlen) + { + *out = NULL; + return 0; + } + + *out = malloc (outlen); + if (!*out) + return outlen; + + base64_encode (in, inlen, *out, outlen); + + return outlen - 1; +} + +/* With this approach this file works independent of the charset used + (think EBCDIC). However, it does assume that the characters in the + Base64 alphabet (A-Za-z0-9+/) are encoded in 0..255. POSIX + 1003.1-2001 require that char and unsigned char are 8-bit + quantities, though, taking care of that problem. But this may be a + potential problem on non-POSIX C99 platforms. + + IBM C V6 for AIX mishandles "#define B64(x) ...'x'...", so use "_" + as the formal parameter rather than "x". */ +#define B64(_) \ + ((_) == 'A' ? 0 \ + : (_) == 'B' ? 1 \ + : (_) == 'C' ? 2 \ + : (_) == 'D' ? 3 \ + : (_) == 'E' ? 4 \ + : (_) == 'F' ? 5 \ + : (_) == 'G' ? 6 \ + : (_) == 'H' ? 7 \ + : (_) == 'I' ? 8 \ + : (_) == 'J' ? 9 \ + : (_) == 'K' ? 10 \ + : (_) == 'L' ? 11 \ + : (_) == 'M' ? 12 \ + : (_) == 'N' ? 13 \ + : (_) == 'O' ? 14 \ + : (_) == 'P' ? 15 \ + : (_) == 'Q' ? 16 \ + : (_) == 'R' ? 17 \ + : (_) == 'S' ? 18 \ + : (_) == 'T' ? 19 \ + : (_) == 'U' ? 20 \ + : (_) == 'V' ? 21 \ + : (_) == 'W' ? 22 \ + : (_) == 'X' ? 23 \ + : (_) == 'Y' ? 24 \ + : (_) == 'Z' ? 25 \ + : (_) == 'a' ? 26 \ + : (_) == 'b' ? 27 \ + : (_) == 'c' ? 28 \ + : (_) == 'd' ? 29 \ + : (_) == 'e' ? 30 \ + : (_) == 'f' ? 31 \ + : (_) == 'g' ? 32 \ + : (_) == 'h' ? 33 \ + : (_) == 'i' ? 34 \ + : (_) == 'j' ? 35 \ + : (_) == 'k' ? 36 \ + : (_) == 'l' ? 37 \ + : (_) == 'm' ? 38 \ + : (_) == 'n' ? 39 \ + : (_) == 'o' ? 40 \ + : (_) == 'p' ? 41 \ + : (_) == 'q' ? 42 \ + : (_) == 'r' ? 43 \ + : (_) == 's' ? 44 \ + : (_) == 't' ? 45 \ + : (_) == 'u' ? 46 \ + : (_) == 'v' ? 47 \ + : (_) == 'w' ? 48 \ + : (_) == 'x' ? 49 \ + : (_) == 'y' ? 50 \ + : (_) == 'z' ? 51 \ + : (_) == '0' ? 52 \ + : (_) == '1' ? 53 \ + : (_) == '2' ? 54 \ + : (_) == '3' ? 55 \ + : (_) == '4' ? 56 \ + : (_) == '5' ? 57 \ + : (_) == '6' ? 58 \ + : (_) == '7' ? 59 \ + : (_) == '8' ? 60 \ + : (_) == '9' ? 61 \ + : (_) == '+' ? 62 \ + : (_) == '/' ? 63 \ + : -1) + +static const signed char b64[0x100] = { + B64 (0), B64 (1), B64 (2), B64 (3), + B64 (4), B64 (5), B64 (6), B64 (7), + B64 (8), B64 (9), B64 (10), B64 (11), + B64 (12), B64 (13), B64 (14), B64 (15), + B64 (16), B64 (17), B64 (18), B64 (19), + B64 (20), B64 (21), B64 (22), B64 (23), + B64 (24), B64 (25), B64 (26), B64 (27), + B64 (28), B64 (29), B64 (30), B64 (31), + B64 (32), B64 (33), B64 (34), B64 (35), + B64 (36), B64 (37), B64 (38), B64 (39), + B64 (40), B64 (41), B64 (42), B64 (43), + B64 (44), B64 (45), B64 (46), B64 (47), + B64 (48), B64 (49), B64 (50), B64 (51), + B64 (52), B64 (53), B64 (54), B64 (55), + B64 (56), B64 (57), B64 (58), B64 (59), + B64 (60), B64 (61), B64 (62), B64 (63), + B64 (64), B64 (65), B64 (66), B64 (67), + B64 (68), B64 (69), B64 (70), B64 (71), + B64 (72), B64 (73), B64 (74), B64 (75), + B64 (76), B64 (77), B64 (78), B64 (79), + B64 (80), B64 (81), B64 (82), B64 (83), + B64 (84), B64 (85), B64 (86), B64 (87), + B64 (88), B64 (89), B64 (90), B64 (91), + B64 (92), B64 (93), B64 (94), B64 (95), + B64 (96), B64 (97), B64 (98), B64 (99), + B64 (100), B64 (101), B64 (102), B64 (103), + B64 (104), B64 (105), B64 (106), B64 (107), + B64 (108), B64 (109), B64 (110), B64 (111), + B64 (112), B64 (113), B64 (114), B64 (115), + B64 (116), B64 (117), B64 (118), B64 (119), + B64 (120), B64 (121), B64 (122), B64 (123), + B64 (124), B64 (125), B64 (126), B64 (127), + B64 (128), B64 (129), B64 (130), B64 (131), + B64 (132), B64 (133), B64 (134), B64 (135), + B64 (136), B64 (137), B64 (138), B64 (139), + B64 (140), B64 (141), B64 (142), B64 (143), + B64 (144), B64 (145), B64 (146), B64 (147), + B64 (148), B64 (149), B64 (150), B64 (151), + B64 (152), B64 (153), B64 (154), B64 (155), + B64 (156), B64 (157), B64 (158), B64 (159), + B64 (160), B64 (161), B64 (162), B64 (163), + B64 (164), B64 (165), B64 (166), B64 (167), + B64 (168), B64 (169), B64 (170), B64 (171), + B64 (172), B64 (173), B64 (174), B64 (175), + B64 (176), B64 (177), B64 (178), B64 (179), + B64 (180), B64 (181), B64 (182), B64 (183), + B64 (184), B64 (185), B64 (186), B64 (187), + B64 (188), B64 (189), B64 (190), B64 (191), + B64 (192), B64 (193), B64 (194), B64 (195), + B64 (196), B64 (197), B64 (198), B64 (199), + B64 (200), B64 (201), B64 (202), B64 (203), + B64 (204), B64 (205), B64 (206), B64 (207), + B64 (208), B64 (209), B64 (210), B64 (211), + B64 (212), B64 (213), B64 (214), B64 (215), + B64 (216), B64 (217), B64 (218), B64 (219), + B64 (220), B64 (221), B64 (222), B64 (223), + B64 (224), B64 (225), B64 (226), B64 (227), + B64 (228), B64 (229), B64 (230), B64 (231), + B64 (232), B64 (233), B64 (234), B64 (235), + B64 (236), B64 (237), B64 (238), B64 (239), + B64 (240), B64 (241), B64 (242), B64 (243), + B64 (244), B64 (245), B64 (246), B64 (247), + B64 (248), B64 (249), B64 (250), B64 (251), + B64 (252), B64 (253), B64 (254), B64 (255) +}; + +#if UCHAR_MAX == 255 +# define uchar_in_range(c) true +#else +# define uchar_in_range(c) ((c) <= 255) +#endif + +/* Return true if CH is a character from the Base64 alphabet, and + false otherwise. Note that '=' is padding and not considered to be + part of the alphabet. */ +bool +isbase64 (char ch) +{ + return uchar_in_range (to_uchar (ch)) && 0 <= b64[to_uchar (ch)]; +} + +/* Initialize decode-context buffer, CTX. */ +void +base64_decode_ctx_init (struct base64_decode_context *ctx) +{ + ctx->i = 0; +} + +/* If CTX->i is 0 or 4, there are four or more bytes in [*IN..IN_END), and + none of those four is a newline, then return *IN. Otherwise, copy up to + 4 - CTX->i non-newline bytes from that range into CTX->buf, starting at + index CTX->i and setting CTX->i to reflect the number of bytes copied, + and return CTX->buf. In either case, advance *IN to point to the byte + after the last one processed, and set *N_NON_NEWLINE to the number of + verified non-newline bytes accessible through the returned pointer. */ +static const char * +get_4 (struct base64_decode_context *ctx, + char const *restrict *in, char const *restrict in_end, + size_t *n_non_newline) +{ + if (ctx->i == 4) + ctx->i = 0; + + if (ctx->i == 0) + { + char const *t = *in; + if (4 <= in_end - *in && memchr (t, '\n', 4) == NULL) + { + /* This is the common case: no newline. */ + *in += 4; + *n_non_newline = 4; + return (const char *) t; + } + } + + { + /* Copy non-newline bytes into BUF. */ + char const *p = *in; + while (p < in_end) + { + char c = *p++; + if (c != '\n') + { + ctx->buf[ctx->i++] = c; + if (ctx->i == 4) + break; + } + } + + *in = p; + *n_non_newline = ctx->i; + return ctx->buf; + } +} + +#define return_false \ + do \ + { \ + *outp = out; \ + return false; \ + } \ + while (false) + +/* Decode up to four bytes of base64-encoded data, IN, of length INLEN + into the output buffer, *OUT, of size *OUTLEN bytes. Return true if + decoding is successful, false otherwise. If *OUTLEN is too small, + as many bytes as possible are written to *OUT. On return, advance + *OUT to point to the byte after the last one written, and decrement + *OUTLEN to reflect the number of bytes remaining in *OUT. */ +static bool +decode_4 (char const *restrict in, size_t inlen, + char *restrict *outp, size_t *outleft) +{ + char *out = *outp; + if (inlen < 2) + return false; + + if (!isbase64 (in[0]) || !isbase64 (in[1])) + return false; + + if (*outleft) + { + *out++ = ((b64[to_uchar (in[0])] << 2) + | (b64[to_uchar (in[1])] >> 4)); + --*outleft; + } + + if (inlen == 2) + return_false; + + if (in[2] == '=') + { + if (inlen != 4) + return_false; + + if (in[3] != '=') + return_false; + } + else + { + if (!isbase64 (in[2])) + return_false; + + if (*outleft) + { + *out++ = (((b64[to_uchar (in[1])] << 4) & 0xf0) + | (b64[to_uchar (in[2])] >> 2)); + --*outleft; + } + + if (inlen == 3) + return_false; + + if (in[3] == '=') + { + if (inlen != 4) + return_false; + } + else + { + if (!isbase64 (in[3])) + return_false; + + if (*outleft) + { + *out++ = (((b64[to_uchar (in[2])] << 6) & 0xc0) + | b64[to_uchar (in[3])]); + --*outleft; + } + } + } + + *outp = out; + return true; +} + +/* Decode base64-encoded input array IN of length INLEN to output array + OUT that can hold *OUTLEN bytes. The input data may be interspersed + with newlines. Return true if decoding was successful, i.e. if the + input was valid base64 data, false otherwise. If *OUTLEN is too + small, as many bytes as possible will be written to OUT. On return, + *OUTLEN holds the length of decoded bytes in OUT. Note that as soon + as any non-alphabet, non-newline character is encountered, decoding + is stopped and false is returned. If INLEN is zero, then process + only whatever data is stored in CTX. + + Initially, CTX must have been initialized via base64_decode_ctx_init. + Subsequent calls to this function must reuse whatever state is recorded + in that buffer. It is necessary for when a quadruple of base64 input + bytes spans two input buffers. + + If CTX is NULL then newlines are treated as garbage and the input + buffer is processed as a unit. */ + +bool +base64_decode_ctx (struct base64_decode_context *ctx, + const char *restrict in, size_t inlen, + char *restrict out, size_t *outlen) +{ + size_t outleft = *outlen; + bool ignore_newlines = ctx != NULL; + bool flush_ctx = false; + unsigned int ctx_i = 0; + + if (ignore_newlines) + { + ctx_i = ctx->i; + flush_ctx = inlen == 0; + } + + + while (true) + { + size_t outleft_save = outleft; + if (ctx_i == 0 && !flush_ctx) + { + while (true) + { + /* Save a copy of outleft, in case we need to re-parse this + block of four bytes. */ + outleft_save = outleft; + if (!decode_4 (in, inlen, &out, &outleft)) + break; + + in += 4; + inlen -= 4; + } + } + + if (inlen == 0 && !flush_ctx) + break; + + /* Handle the common case of 72-byte wrapped lines. + This also handles any other multiple-of-4-byte wrapping. */ + if (inlen && *in == '\n' && ignore_newlines) + { + ++in; + --inlen; + continue; + } + + /* Restore OUT and OUTLEFT. */ + out -= outleft_save - outleft; + outleft = outleft_save; + + { + char const *in_end = in + inlen; + char const *non_nl; + + if (ignore_newlines) + non_nl = get_4 (ctx, &in, in_end, &inlen); + else + non_nl = in; /* Might have nl in this case. */ + + /* If the input is empty or consists solely of newlines (0 non-newlines), + then we're done. Likewise if there are fewer than 4 bytes when not + flushing context and not treating newlines as garbage. */ + if (inlen == 0 || (inlen < 4 && !flush_ctx && ignore_newlines)) + { + inlen = 0; + break; + } + if (!decode_4 (non_nl, inlen, &out, &outleft)) + break; + + inlen = in_end - in; + } + } + + *outlen -= outleft; + + return inlen == 0; +} + +/* Allocate an output buffer in *OUT, and decode the base64 encoded + data stored in IN of size INLEN to the *OUT buffer. On return, the + size of the decoded data is stored in *OUTLEN. OUTLEN may be NULL, + if the caller is not interested in the decoded length. *OUT may be + NULL to indicate an out of memory error, in which case *OUTLEN + contains the size of the memory block needed. The function returns + true on successful decoding and memory allocation errors. (Use the + *OUT and *OUTLEN parameters to differentiate between successful + decoding and memory error.) The function returns false if the + input was invalid, in which case *OUT is NULL and *OUTLEN is + undefined. */ +bool +base64_decode_alloc_ctx (struct base64_decode_context *ctx, + const char *in, size_t inlen, char **out, + size_t *outlen) +{ + /* This may allocate a few bytes too many, depending on input, + but it's not worth the extra CPU time to compute the exact size. + The exact size is 3 * (inlen + (ctx ? ctx->i : 0)) / 4, minus 1 if the + input ends with "=" and minus another 1 if the input ends with "==". + Dividing before multiplying avoids the possibility of overflow. */ + size_t needlen = 3 * (inlen / 4) + 3; + + *out = malloc (needlen); + if (!*out) + return true; + + if (!base64_decode_ctx (ctx, in, inlen, *out, &needlen)) + { + free (*out); + *out = NULL; + return false; + } + + if (outlen) + *outlen = needlen; + + return true; +} diff --git a/lib/base64.h b/lib/base64.h new file mode 100644 index 0000000..a0360dc --- /dev/null +++ b/lib/base64.h @@ -0,0 +1,68 @@ +/* base64.h -- Encode binary data using printable characters. + Copyright (C) 2004-2006, 2009-2019 Free Software Foundation, Inc. + Written by Simon Josefsson. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2, or (at your option) + any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, see . */ + +#ifndef BASE64_H +# define BASE64_H + +/* Get size_t. */ +# include + +/* Get bool. */ +# include + +# ifdef __cplusplus +extern "C" { +# endif + +/* This uses that the expression (n+(k-1))/k means the smallest + integer >= n/k, i.e., the ceiling of n/k. */ +# define BASE64_LENGTH(inlen) ((((inlen) + 2) / 3) * 4) + +struct base64_decode_context +{ + unsigned int i; + char buf[4]; +}; + +extern bool isbase64 (char ch) __attribute__ ((__const__)); + +extern void base64_encode (const char *restrict in, size_t inlen, + char *restrict out, size_t outlen); + +extern size_t base64_encode_alloc (const char *in, size_t inlen, char **out); + +extern void base64_decode_ctx_init (struct base64_decode_context *ctx); + +extern bool base64_decode_ctx (struct base64_decode_context *ctx, + const char *restrict in, size_t inlen, + char *restrict out, size_t *outlen); + +extern bool base64_decode_alloc_ctx (struct base64_decode_context *ctx, + const char *in, size_t inlen, + char **out, size_t *outlen); + +#define base64_decode(in, inlen, out, outlen) \ + base64_decode_ctx (NULL, in, inlen, out, outlen) + +#define base64_decode_alloc(in, inlen, out, outlen) \ + base64_decode_alloc_ctx (NULL, in, inlen, out, outlen) + +# ifdef __cplusplus +} +# endif + +#endif /* BASE64_H */ diff --git a/lib/bitlk/bitlk.c b/lib/bitlk/bitlk.c new file mode 100644 index 0000000..8846660 --- /dev/null +++ b/lib/bitlk/bitlk.c @@ -0,0 +1,1382 @@ +/* + * BITLK (BitLocker-compatible) volume handling + * + * Copyright (C) 2019-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2019-2021 Milan Broz + * Copyright (C) 2019-2021 Vojtech Trefny + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include + +#include "bitlk.h" +#include "internal.h" + +#define BITLK_BOOTCODE_V1 "\xeb\x52\x90" +#define BITLK_BOOTCODE_V2 "\xeb\x58\x90" +#define BITLK_SIGNATURE "-FVE-FS-" +#define BITLK_SIGNATURE_TOGO "MSWIN4.1" +#define BITLK_HEADER_METADATA_OFFSET 160 +#define BITLK_HEADER_METADATA_OFFSET_TOGO 424 + +/* FVE metadata header is split into two parts */ +#define BITLK_FVE_METADATA_BLOCK_HEADER_LEN 64 +#define BITLK_FVE_METADATA_HEADER_LEN 48 +#define BITLK_FVE_METADATA_HEADERS_LEN BITLK_FVE_METADATA_BLOCK_HEADER_LEN + BITLK_FVE_METADATA_HEADER_LEN + +/* total size of the FVE area (64 KiB) */ +#define BITLK_FVE_METADATA_SIZE 64 * 1024 + +#define BITLK_ENTRY_HEADER_LEN 8 +#define BITLK_VMK_HEADER_LEN 28 + +#define BITLK_OPEN_KEY_METADATA_LEN 12 + +#define BITLK_RECOVERY_KEY_LEN 55 +#define BITLK_RECOVERY_PARTS 8 +#define BITLK_RECOVERY_PART_LEN 6 + +#define BITLK_BEK_FILE_HEADER_LEN 48 +#define BITLK_STARTUP_KEY_HEADER_LEN 24 + +#define BITLK_KDF_HASH "sha256" +#define BITLK_KDF_ITERATION_COUNT 0x100000 + +/* maximum number of segments for the DM device */ +#define MAX_BITLK_SEGMENTS 10 + +/* January 1, 1970 as MS file time */ +#define EPOCH_AS_FILETIME 116444736000000000 +#define HUNDREDS_OF_NANOSECONDS 10000000 + +/* not available in older version of libuuid */ +#ifndef UUID_STR_LEN +#define UUID_STR_LEN 37 +#endif + +/* known types of GUIDs from the BITLK superblock */ +const uint8_t BITLK_GUID_NORMAL[16] = { 0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a, + 0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01 }; +const uint8_t BITLK_GUID_EOW[16] = { 0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d, + 0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8 }; + +/* taken from libfdisk gpt.c -- TODO: this is a good candidate for adding to libuuid */ +struct bitlk_guid { + uint32_t time_low; + uint16_t time_mid; + uint16_t time_hi_and_version; + uint8_t clock_seq_hi; + uint8_t clock_seq_low; + uint8_t node[6]; +} __attribute__ ((packed)); + +static void swap_guid(struct bitlk_guid *guid) { + guid->time_low = swab32(guid->time_low); + guid->time_mid = swab16(guid->time_mid); + guid->time_hi_and_version = swab16(guid->time_hi_and_version); +} + +static void guid_to_string(struct bitlk_guid *guid, char *out) { + swap_guid(guid); + uuid_unparse((unsigned char *) guid, out); +} + +typedef enum { + BITLK_SEGTYPE_CRYPT, + BITLK_SEGTYPE_ZERO, +} BitlkSegmentType; + +struct segment { + uint64_t offset; + uint64_t length; + uint64_t iv_offset; + BitlkSegmentType type; +}; + +struct bitlk_signature { + uint8_t boot_code[3]; + uint8_t signature[8]; + uint16_t sector_size; +} __attribute__ ((packed)); + +struct bitlk_superblock { + struct bitlk_guid guid; + uint64_t fve_offset[3]; +} __attribute__ ((packed)); + +struct bitlk_fve_metadata { + /* FVE metadata block header */ + uint8_t signature[8]; + uint16_t fve_size; + uint16_t fve_version; + uint16_t curr_state; + uint16_t next_state; + uint64_t volume_size; + uint32_t unknown2; + uint32_t volume_header_size; + uint64_t fve_offset[3]; + uint64_t volume_header_offset; + /* FVE metadata header */ + uint32_t metadata_size; + uint32_t metadata_version; + uint32_t metadata_header_size; + uint32_t metada_size_copy; + struct bitlk_guid guid; + uint32_t next_nonce; + uint16_t encryption; + uint16_t unknown3; + uint64_t creation_time; +} __attribute__ ((packed)); + +struct bitlk_entry_header_block { + uint64_t offset; + uint64_t size; +} __attribute__ ((packed)); + +struct bitlk_entry_vmk { + struct bitlk_guid guid; + uint8_t modified[8]; + uint16_t _unknown; + uint16_t protection; +} __attribute__ ((packed)); + +struct bitlk_kdf_data { + char last_sha256[32]; + char initial_sha256[32]; + char salt[16]; + uint64_t count; +}; + +struct bitlk_bek_header { + uint32_t metadata_size; + uint32_t metadata_version; + uint32_t metadata_header_size; + uint32_t metada_size_copy; + struct bitlk_guid guid; + uint32_t next_nonce; + uint16_t encryption; + uint16_t unknown; + uint64_t creation_time; +} __attribute__ ((packed)); + +static BITLKVMKProtection get_vmk_protection(uint16_t protection) +{ + switch (protection) { + case 0x0000: + return BITLK_PROTECTION_CLEAR_KEY; + case 0x0100: + return BITLK_PROTECTION_TPM; + case 0x0200: + return BITLK_PROTECTION_STARTUP_KEY; + case 0x0500: + return BITLK_PROTECTION_TPM_PIN; + case 0x0800: + return BITLK_PROTECTION_RECOVERY_PASSPHRASE; + case 0x1000: + return BITLK_PROTECTION_SMART_CARD; + case 0x2000: + return BITLK_PROTECTION_PASSPHRASE; + default: + return BITLK_PROTECTION_UNKNOWN; + } +} + +static const char* get_vmk_protection_string(BITLKVMKProtection protection) +{ + switch (protection) { + case BITLK_PROTECTION_CLEAR_KEY: + return "VMK protected with clear key"; + case BITLK_PROTECTION_TPM: + return "VMK protected with TPM"; + case BITLK_PROTECTION_STARTUP_KEY: + return "VMK protected with startup key"; + case BITLK_PROTECTION_TPM_PIN: + return "VMK protected with TPM and PIN"; + case BITLK_PROTECTION_PASSPHRASE: + return "VMK protected with passphrase"; + case BITLK_PROTECTION_RECOVERY_PASSPHRASE: + return "VMK protected with recovery passphrase"; + case BITLK_PROTECTION_SMART_CARD: + return "VMK protected with smart card"; + default: + return "VMK with unknown protection"; + } +} + +static const char* get_bitlk_type_string(BITLKEncryptionType type) +{ + switch (type) + { + case BITLK_ENCRYPTION_TYPE_NORMAL: + return "normal"; + case BITLK_ENCRYPTION_TYPE_EOW: + return "encrypt-on-write"; + default: + return "unknown"; + } +} + +/* TODO -- move to some utils file */ +static void hexprint(struct crypt_device *cd, const char *d, int n, const char *sep) +{ + int i; + for(i = 0; i < n; i++) + log_std(cd, "%02hhx%s", (const char)d[i], sep); +} + +static uint64_t filetime_to_unixtime(uint64_t time) +{ + return (time - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS; +} + +static int convert_to_utf8(struct crypt_device *cd, uint8_t *input, size_t inlen, char **out) +{ + char *outbuf = NULL; + iconv_t ic; + size_t ic_inlen = inlen; + size_t ic_outlen = inlen; + char *ic_outbuf = NULL; + size_t r = 0; + + outbuf = malloc(inlen); + if (outbuf == NULL) + return -ENOMEM; + + memset(outbuf, 0, inlen); + ic_outbuf = outbuf; + + ic = iconv_open("UTF-8", "UTF-16LE"); + r = iconv(ic, (char **) &input, &ic_inlen, &ic_outbuf, &ic_outlen); + iconv_close(ic); + + if (r == 0) + *out = strdup(outbuf); + else { + *out = NULL; + log_dbg(cd, "Failed to convert volume description: %s", strerror(errno)); + r = 0; + } + + free(outbuf); + return r; +} + +static int passphrase_to_utf16(struct crypt_device *cd, char *input, size_t inlen, char **out) +{ + char *outbuf = NULL; + iconv_t ic; + size_t ic_inlen = inlen; + size_t ic_outlen = inlen * 2; + char *ic_outbuf = NULL; + size_t r = 0; + + if (inlen == 0) + return r; + + outbuf = crypt_safe_alloc(inlen * 2); + if (outbuf == NULL) + return -ENOMEM; + + memset(outbuf, 0, inlen * 2); + ic_outbuf = outbuf; + + ic = iconv_open("UTF-16LE", "UTF-8"); + r = iconv(ic, &input, &ic_inlen, &ic_outbuf, &ic_outlen); + iconv_close(ic); + + if (r == 0) { + *out = outbuf; + } else { + *out = NULL; + crypt_safe_free(outbuf); + log_dbg(cd, "Failed to convert passphrase: %s", strerror(errno)); + r = -errno; + } + + return r; +} + +static int parse_vmk_entry(struct crypt_device *cd, uint8_t *data, int start, int end, struct bitlk_vmk **vmk) +{ + uint16_t key_entry_size = 0; + uint16_t key_entry_type = 0; + uint16_t key_entry_value = 0; + size_t key_size = 0; + char *string = NULL; + const char *key = NULL; + struct volume_key *vk = NULL; + bool supported = false; + + /* only passphrase or recovery passphrase vmks are supported (can be used to activate) */ + supported = (*vmk)->protection == BITLK_PROTECTION_PASSPHRASE || + (*vmk)->protection == BITLK_PROTECTION_RECOVERY_PASSPHRASE || + (*vmk)->protection == BITLK_PROTECTION_STARTUP_KEY; + + while (end - start > 2) { + /* size of this entry */ + memcpy(&key_entry_size, data + start, sizeof(key_entry_size)); + key_entry_size = le16_to_cpu(key_entry_size); + if (key_entry_size == 0) + break; + + /* type and value of this entry */ + memcpy(&key_entry_type, data + start + sizeof(key_entry_size), sizeof(key_entry_type)); + memcpy(&key_entry_value, + data + start + sizeof(key_entry_size) + sizeof(key_entry_type), + sizeof(key_entry_value)); + key_entry_type = le16_to_cpu(key_entry_type); + key_entry_value = le16_to_cpu(key_entry_value); + + if (key_entry_type != BITLK_ENTRY_TYPE_PROPERTY) { + if (supported) { + log_err(cd, _("Unexpected metadata entry type '%u' found when parsing supported Volume Master Key."), key_entry_type); + return -EINVAL; + } else { + log_dbg(cd, "Unexpected metadata entry type '%u' found when parsing unsupported VMK.", key_entry_type); + } + } + + /* stretch key with salt, skip 4 B (encryption method of the stretch key) */ + if (key_entry_value == BITLK_ENTRY_VALUE_STRETCH_KEY) + memcpy((*vmk)->salt, + data + start + BITLK_ENTRY_HEADER_LEN + 4, + sizeof((*vmk)->salt)); + /* AES-CCM encrypted key */ + else if (key_entry_value == BITLK_ENTRY_VALUE_ENCRYPTED_KEY) { + /* nonce */ + memcpy((*vmk)->nonce, + data + start + BITLK_ENTRY_HEADER_LEN, + sizeof((*vmk)->nonce)); + /* MAC tag */ + memcpy((*vmk)->mac_tag, + data + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE, + sizeof((*vmk)->mac_tag)); + /* AES-CCM encrypted key */ + key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE); + key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE; + vk = crypt_alloc_volume_key(key_size, key); + if (vk == NULL) + return -ENOMEM; + crypt_volume_key_add_next(&((*vmk)->vk), vk); + /* clear key for a partially decrypted volume */ + } else if (key_entry_value == BITLK_ENTRY_VALUE_KEY) { + /* We currently don't want to support opening a partially decrypted + * device so we don't need to store this key. + * + * key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + 4); + * key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + 4; + * vk = crypt_alloc_volume_key(key_size, key); + * if (vk == NULL) + * return -ENOMEM; + * crypt_volume_key_add_next(&((*vmk)->vk), vk); + */ + log_dbg(cd, "Skipping clear key metadata entry."); + /* unknown timestamps in recovery protected VMK */ + } else if (key_entry_value == BITLK_ENTRY_VALUE_RECOVERY_TIME) { + ; + } else if (key_entry_value == BITLK_ENTRY_VALUE_STRING) { + if (convert_to_utf8(cd, data + start + BITLK_ENTRY_HEADER_LEN, key_entry_size - BITLK_ENTRY_HEADER_LEN, &string) < 0) { + log_err(cd, _("Invalid string found when parsing Volume Master Key.")); + free(string); + return -EINVAL; + } else if ((*vmk)->name != NULL) { + if (supported) { + log_err(cd, _("Unexpected string ('%s') found when parsing supported Volume Master Key."), string); + free(string); + return -EINVAL; + } + log_dbg(cd, "Unexpected string ('%s') found when parsing unsupported VMK.", string); + free(string); + string = NULL; + } else { + /* Assume that strings in VMK are the name of the VMK */ + (*vmk)->name = string; + string = NULL; + } + /* no idea what this is, lets hope it's not important */ + } else if (key_entry_value == BITLK_ENTRY_VALUE_USE_KEY && (*vmk)->protection == BITLK_PROTECTION_STARTUP_KEY) { + ; + } else { + if (supported) { + log_err(cd, _("Unexpected metadata entry value '%u' found when parsing supported Volume Master Key."), key_entry_value); + return -EINVAL; + } else { + log_dbg(cd, "Unexpected metadata entry value '%u' found when parsing unsupported VMK.", key_entry_value); + } + } + + start += key_entry_size; + } + + return 0; +} + +void BITLK_bitlk_fvek_free(struct bitlk_fvek *fvek) +{ + if (!fvek) + return; + + crypt_free_volume_key(fvek->vk); + free(fvek); +} + +void BITLK_bitlk_vmk_free(struct bitlk_vmk *vmk) +{ + struct bitlk_vmk *vmk_next = NULL; + + while (vmk) { + if (vmk->guid) + free(vmk->guid); + if (vmk->name) + free(vmk->name); + crypt_free_volume_key(vmk->vk); + vmk_next = vmk->next; + free(vmk); + vmk = vmk_next; + } +} + +void BITLK_bitlk_metadata_free(struct bitlk_metadata *metadata) +{ + if (!metadata) + return; + + free(metadata->guid); + if (metadata->description) + free(metadata->description); + BITLK_bitlk_vmk_free(metadata->vmks); + BITLK_bitlk_fvek_free(metadata->fvek); +} + +int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params) +{ + int devfd; + struct device *device = crypt_metadata_device(cd); + struct bitlk_signature sig = {}; + struct bitlk_superblock sb = {}; + struct bitlk_fve_metadata fve = {}; + struct bitlk_entry_vmk entry_vmk = {}; + uint8_t *fve_entries = NULL; + uint32_t fve_metadata_size = 0; + int fve_offset = 0; + char guid_buf[UUID_STR_LEN] = {0}; + uint16_t entry_size = 0; + uint16_t entry_type = 0; + int i = 0; + int r = 0; + int start = 0; + int end = 0; + size_t key_size = 0; + const char *key = NULL; + + struct bitlk_vmk *vmk = NULL; + struct bitlk_vmk *vmk_p = params->vmks; + + devfd = device_open(cd, crypt_data_device(cd), O_RDONLY); + if (devfd < 0) { + r = -EINVAL; + goto out; + } + + /* read and check the signature */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &sig, sizeof(sig), 0) != sizeof(sig)) { + log_err(cd, _("Failed to read BITLK signature from %s."), device_path(device)); + r = -EINVAL; + goto out; + } + + if (memcmp(sig.signature, BITLK_SIGNATURE, sizeof(sig.signature)) == 0) { + params->togo = false; + fve_offset = BITLK_HEADER_METADATA_OFFSET; + } else if (memcmp(sig.signature, BITLK_SIGNATURE_TOGO, sizeof(sig.signature)) == 0) { + params->togo = true; + fve_offset = BITLK_HEADER_METADATA_OFFSET_TOGO; + } else { + log_err(cd, _("Invalid or unknown signature for BITLK device.")); + r = -EINVAL; + goto out; + } + + if (memcmp(sig.boot_code, BITLK_BOOTCODE_V1, sizeof(sig.boot_code)) == 0) { + log_err(cd, _("BITLK version 1 is currently not supported.")); + r = -ENOTSUP; + goto out; + } else if (memcmp(sig.boot_code, BITLK_BOOTCODE_V2, sizeof(sig.boot_code)) == 0) + ; + else { + log_err(cd, _("Invalid or unknown boot signature for BITLK device.")); + r = -EINVAL; + goto out; + } + + params->sector_size = le16_to_cpu(sig.sector_size); + if (params->sector_size == 0) { + log_dbg(cd, "Got sector size 0, assuming 512."); + params->sector_size = SECTOR_SIZE; + } + + if (!(params->sector_size == 512 || params->sector_size == 4096)) { + log_err(cd, _("Unsupported sector size %" PRIu16 "."), params->sector_size); + r = -EINVAL; + goto out; + } + + /* read GUID and FVE metadata offsets */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &sb, sizeof(sb), fve_offset) != sizeof(sb)) { + log_err(cd, _("Failed to read BITLK header from %s."), device_path(device)); + r = -EINVAL; + goto out; + } + + /* get encryption "type" based on the GUID from BITLK superblock */ + if (memcmp(&sb.guid, BITLK_GUID_NORMAL, 16) == 0) + params->type = BITLK_ENCRYPTION_TYPE_NORMAL; + else if (memcmp(&sb.guid, BITLK_GUID_EOW, 16) == 0) + params->type = BITLK_ENCRYPTION_TYPE_EOW; + else + params->type = BITLK_ENCRYPTION_TYPE_UNKNOWN; + log_dbg(cd, "BITLK type from GUID: %s.", get_bitlk_type_string(params->type)); + + for (i = 0; i < 3; i++) + params->metadata_offset[i] = le64_to_cpu(sb.fve_offset[i]); + + log_dbg(cd, "Reading BITLK FVE metadata of size %zu on device %s, offset %" PRIu64 ".", + sizeof(fve), device_path(device), params->metadata_offset[0]); + + /* read FVE metadata from the first metadata area */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &fve, sizeof(fve), params->metadata_offset[0]) != sizeof(fve) || + memcmp(fve.signature, BITLK_SIGNATURE, sizeof(fve.signature)) || + le16_to_cpu(fve.fve_version) != 2) { + log_err(cd, _("Failed to read BITLK FVE metadata from %s."), device_path(device)); + r = -EINVAL; + goto out; + } + + /* check encryption state for the device */ + params->state = true; + if (le16_to_cpu(fve.curr_state) != BITLK_STATE_NORMAL || le16_to_cpu(fve.next_state) != BITLK_STATE_NORMAL) { + params->state = false; + log_dbg(cd, "Unknown/unsupported state detected. Current state: %"PRIu16", next state: %"PRIu16".", + le16_to_cpu(fve.curr_state), le16_to_cpu(fve.next_state)); + } + + params->metadata_version = le16_to_cpu(fve.fve_version); + fve_metadata_size = le32_to_cpu(fve.metadata_size); + + switch (le16_to_cpu(fve.encryption)) { + /* AES-CBC with Elephant difuser */ + case 0x8000: + params->key_size = 256; + params->cipher = "aes"; + params->cipher_mode = "cbc-elephant"; + break; + case 0x8001: + params->key_size = 512; + params->cipher = "aes"; + params->cipher_mode = "cbc-elephant"; + break; + /* AES-CBC */ + case 0x8002: + params->key_size = 128; + params->cipher = "aes"; + params->cipher_mode = "cbc-eboiv"; + break; + case 0x8003: + params->key_size = 256; + params->cipher = "aes"; + params->cipher_mode = "cbc-eboiv"; + break; + /* AES-XTS */ + case 0x8004: + params->key_size = 256; + params->cipher = "aes"; + params->cipher_mode = "xts-plain64"; + break; + case 0x8005: + params->key_size = 512; + params->cipher = "aes"; + params->cipher_mode = "xts-plain64"; + break; + default: + log_err(cd, _("Unknown or unsupported encryption type.")); + params->key_size = 0; + params->cipher = NULL; + params->cipher_mode = NULL; + r = -ENOTSUP; + goto out; + }; + + /* device GUID */ + guid_to_string(&fve.guid, guid_buf); + params->guid = strdup(guid_buf); + if (!params->guid) { + r = -ENOMEM; + goto out; + } + + params->creation_time = filetime_to_unixtime(le64_to_cpu(fve.creation_time)); + + /* read and parse all FVE metadata entries */ + fve_entries = malloc(fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN); + if (!fve_entries) { + r = -ENOMEM; + goto out; + } + memset(fve_entries, 0, (fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN)); + + log_dbg(cd, "Reading BITLK FVE metadata entries of size %" PRIu32 " on device %s, offset %" PRIu64 ".", + fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN, device_path(device), + params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN); + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), fve_entries, fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN, + params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN) != (ssize_t)(fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN)) { + log_err(cd, _("Failed to read BITLK metadata entries from %s."), device_path(device)); + r = -EINVAL; + goto out; + } + + end = fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN; + while (end - start > 2) { + /* size of this entry */ + memcpy(&entry_size, fve_entries + start, sizeof(entry_size)); + entry_size = le16_to_cpu(entry_size); + if (entry_size == 0) + break; + + /* type of this entry */ + memcpy(&entry_type, fve_entries + start + sizeof(entry_size), sizeof(entry_type)); + entry_type = le16_to_cpu(entry_type); + + /* VMK */ + if (entry_type == BITLK_ENTRY_TYPE_VMK) { + /* skip first four variables in the entry (entry size, type, value and version) */ + memcpy(&entry_vmk, + fve_entries + start + BITLK_ENTRY_HEADER_LEN, + sizeof(entry_vmk)); + + vmk = malloc(sizeof(struct bitlk_vmk)); + if (!vmk) { + r = -ENOMEM; + goto out; + } + memset(vmk, 0, sizeof(struct bitlk_vmk)); + + guid_to_string(&entry_vmk.guid, guid_buf); + vmk->guid = strdup (guid_buf); + + vmk->name = NULL; + + vmk->protection = get_vmk_protection(le16_to_cpu(entry_vmk.protection)); + + /* more data in another entry list */ + r = parse_vmk_entry(cd, fve_entries, + start + BITLK_ENTRY_HEADER_LEN + BITLK_VMK_HEADER_LEN, + start + entry_size, &vmk); + if (r < 0) { + BITLK_bitlk_vmk_free(vmk); + goto out; + } + + if (params->vmks == NULL) + params->vmks = vmk; + else + vmk_p->next = vmk; + + vmk_p = vmk; + vmk = vmk->next; + /* FVEK */ + } else if (entry_type == BITLK_ENTRY_TYPE_FVEK) { + params->fvek = malloc(sizeof(struct bitlk_fvek)); + if (!params->fvek) { + r = -ENOMEM; + goto out; + } + memcpy(params->fvek->nonce, + fve_entries + start + BITLK_ENTRY_HEADER_LEN, + sizeof(params->fvek->nonce)); + /* MAC tag */ + memcpy(params->fvek->mac_tag, + fve_entries + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE, + sizeof(params->fvek->mac_tag)); + /* AES-CCM encrypted key */ + key_size = entry_size - (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE); + key = (const char *) fve_entries + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE; + params->fvek->vk = crypt_alloc_volume_key(key_size, key); + if (params->fvek->vk == NULL) { + r = -ENOMEM; + goto out; + } + /* volume header info (location and size) */ + } else if (entry_type == BITLK_ENTRY_TYPE_VOLUME_HEADER) { + struct bitlk_entry_header_block entry_header; + memcpy(&entry_header, + fve_entries + start + BITLK_ENTRY_HEADER_LEN, + sizeof(entry_header)); + params->volume_header_offset = le64_to_cpu(entry_header.offset); + params->volume_header_size = le64_to_cpu(entry_header.size); + /* volume description (utf-16 string) */ + } else if (entry_type == BITLK_ENTRY_TYPE_DESCRIPTION) { + r = convert_to_utf8(cd, fve_entries + start + BITLK_ENTRY_HEADER_LEN, + entry_size - BITLK_ENTRY_HEADER_LEN, + &(params->description)); + if (r < 0) { + BITLK_bitlk_vmk_free(vmk); + goto out; + } + } + + start += entry_size; + } + +out: + if (fve_entries) + free(fve_entries); + return r; +} + +int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_metadata *params) +{ + struct volume_key *vk_p; + struct bitlk_vmk *vmk_p; + int next_id = 0; + int i = 0; + + log_std(cd, "Info for BITLK%s device %s.\n", params->togo ? " To Go" : "", device_path(device)); + log_std(cd, "Version: \t%u\n", params->metadata_version); + log_std(cd, "GUID: \t%s\n", params->guid); + log_std(cd, "Sector size: \t%u [bytes]\n", params->sector_size); + log_std(cd, "Created: \t%s", ctime((time_t *)&(params->creation_time))); + log_std(cd, "Description: \t%s\n", params->description); + log_std(cd, "Cipher name: \t%s\n", params->cipher); + log_std(cd, "Cipher mode: \t%s\n", params->cipher_mode); + log_std(cd, "Cipher key: \t%u bits\n", params->key_size); + + log_std(cd, "\n"); + + log_std(cd, "Keyslots:\n"); + vmk_p = params->vmks; + while (vmk_p) { + log_std(cd, " %d: VMK\n", next_id); + if (vmk_p->name != NULL) { + log_std(cd, "\tName: \t%s\n", vmk_p->name); + } + log_std(cd, "\tGUID: \t%s\n", vmk_p->guid); + log_std(cd, "\tProtection: \t%s\n", get_vmk_protection_string (vmk_p->protection)); + log_std(cd, "\tSalt: \t"); + hexprint(cd, (const char *) vmk_p->salt, 16, ""); + log_std(cd, "\n"); + + vk_p = vmk_p->vk; + while (vk_p) { + log_std(cd, "\tKey data size:\t%zu [bytes]\n", vk_p->keylength); + vk_p = vk_p->next; + } + vmk_p = vmk_p->next; + next_id++; + } + + log_std(cd, " %d: FVEK\n", next_id); + log_std(cd, "\tKey data size:\t%zu [bytes]\n", params->fvek->vk->keylength); + + log_std(cd, "\n"); + + log_std(cd, "Metadata segments:\n"); + + for (i = 0; i < 3; i++) { + log_std(cd, " %d: FVE metadata area\n", i); + log_std(cd, "\tOffset: \t%" PRIu64 " [bytes]\n", params->metadata_offset[i]); + log_std(cd, "\tSize: \t%d [bytes]\n", BITLK_FVE_METADATA_SIZE); + } + + log_std(cd, " %d: Volume header\n", i); + log_std(cd, "\tOffset: \t%" PRIu64 " [bytes]\n", params->volume_header_offset); + log_std(cd, "\tSize: \t%" PRIu64 " [bytes]\n", params->volume_header_size); + log_std(cd, "\tCipher: \t%s-%s\n", params->cipher, params->cipher_mode); + + return 0; +} + +/* check if given passphrase can be a recovery key (has right format) and convert it */ +static int get_recovery_key(struct crypt_device *cd, + const char *password, + size_t passwordLen, + struct volume_key **rc_key) +{ + unsigned int i, j = 0; + uint16_t parts[BITLK_RECOVERY_PARTS] = {0}; + char part_str[BITLK_RECOVERY_PART_LEN + 1] = {0}; + long part_num = 0; + + /* check the passphrase it should be: + - 55 characters + - 8 groups of 6 divided by '-' + - each part is a number dividable by 11 + */ + if (passwordLen != BITLK_RECOVERY_KEY_LEN) { + if (passwordLen == BITLK_RECOVERY_KEY_LEN + 1 && password[passwordLen - 1] == '\n') { + /* looks like a recovery key with an extra newline, possibly from a key file */ + passwordLen--; + log_dbg(cd, "Possible extra EOL stripped from the recovery key."); + } else + return 0; + } + + for (i = BITLK_RECOVERY_PART_LEN; i < passwordLen; i += BITLK_RECOVERY_PART_LEN + 1) { + if (password[i] != '-') + return 0; + } + + for (i = 0, j = 0; i < passwordLen; i += BITLK_RECOVERY_PART_LEN + 1, j++) { + strncpy(part_str, password + i, BITLK_RECOVERY_PART_LEN); + + errno = 0; + part_num = strtol(part_str, NULL, 10); + if ((errno == ERANGE && (part_num == LONG_MAX || part_num == LONG_MIN)) || + (errno != 0 && part_num == 0)) + return -errno; + + if (part_num % 11 != 0) + return 0; + parts[j] = cpu_to_le16(part_num / 11); + } + + *rc_key = crypt_alloc_volume_key(16, (const char*) parts); + if (*rc_key == NULL) + return -ENOMEM; + + return 0; +} + +static int parse_external_key_entry(struct crypt_device *cd, const char *data, int start, int end, struct volume_key **vk) +{ + uint16_t key_entry_size = 0; + uint16_t key_entry_type = 0; + uint16_t key_entry_value = 0; + size_t key_size = 0; + const char *key = NULL; + + while (end - start > 2) { + /* size of this entry */ + memcpy(&key_entry_size, data + start, sizeof(key_entry_size)); + key_entry_size = le16_to_cpu(key_entry_size); + if (key_entry_size == 0) + break; + + /* type and value of this entry */ + memcpy(&key_entry_type, data + start + sizeof(key_entry_size), sizeof(key_entry_type)); + memcpy(&key_entry_value, + data + start + sizeof(key_entry_size) + sizeof(key_entry_type), + sizeof(key_entry_value)); + key_entry_type = le16_to_cpu(key_entry_type); + key_entry_value = le16_to_cpu(key_entry_value); + + /* only properties should be in this entry */ + if (key_entry_type != BITLK_ENTRY_TYPE_PROPERTY) { + log_err(cd, _("Unexpected metadata entry type '%u' found when parsing external key."), key_entry_type); + return -EINVAL; + } + + if (key_entry_value == BITLK_ENTRY_VALUE_KEY) { + key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + 4); + key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + 4; + *vk = crypt_alloc_volume_key(key_size, key); + if (*vk == NULL) + return -ENOMEM; + return 0; + /* optional "ExternalKey" string, we can safely ignore it */ + } else if (key_entry_value == BITLK_ENTRY_VALUE_STRING) + ; + else { + log_err(cd, _("Unexpected metadata entry value '%u' found when parsing external key."), key_entry_value); + return -EINVAL; + } + + start += key_entry_size; + } + + /* if we got here we failed to parse the metadata */ + return -EINVAL; +} + +/* check if given passphrase can be a startup key (has right format) and convert it */ +static int get_startup_key(struct crypt_device *cd, + const char *password, + size_t passwordLen, + const struct bitlk_vmk *vmk, + struct volume_key **su_key) +{ + struct bitlk_bek_header bek_header = {0}; + char guid_buf[UUID_STR_LEN] = {0}; + + uint16_t key_entry_size = 0; + uint16_t key_entry_type = 0; + uint16_t key_entry_value = 0; + + if (passwordLen < BITLK_BEK_FILE_HEADER_LEN) + return -EPERM; + + memcpy(&bek_header, password, BITLK_BEK_FILE_HEADER_LEN); + + /* metadata should contain GUID of the VMK this startup key is used for */ + guid_to_string(&bek_header.guid, guid_buf); + if (strcmp(guid_buf, vmk->guid) == 0) + log_dbg(cd, "Found matching startup key for VMK %s", vmk->guid); + else + return -EPERM; + + if (bek_header.metadata_version != 1) { + log_err(cd, "Unsupported BEK metadata version %" PRIu32 "", bek_header.metadata_version); + return -ENOTSUP; + } + + if (bek_header.metadata_size != passwordLen) { + log_err(cd, "Unexpected BEK metadata size %" PRIu32 " does not match BEK file length", bek_header.metadata_size); + return -EINVAL; + } + + /* we are expecting exactly one metadata entry starting immediately after the header */ + memcpy(&key_entry_size, password + BITLK_BEK_FILE_HEADER_LEN, sizeof(key_entry_size)); + key_entry_size = le16_to_cpu(key_entry_size); + if (key_entry_size < BITLK_ENTRY_HEADER_LEN) { + log_dbg(cd, "Unexpected metadata entry size %" PRIu16 " when parsing BEK file", key_entry_size); + return -EINVAL; + } + + /* type and value of this entry */ + memcpy(&key_entry_type, password + BITLK_BEK_FILE_HEADER_LEN + sizeof(key_entry_size), sizeof(key_entry_type)); + memcpy(&key_entry_value, + password + BITLK_BEK_FILE_HEADER_LEN + sizeof(key_entry_size) + sizeof(key_entry_type), + sizeof(key_entry_value)); + key_entry_type = le16_to_cpu(key_entry_type); + key_entry_value = le16_to_cpu(key_entry_value); + + if (key_entry_type == BITLK_ENTRY_TYPE_STARTUP_KEY && key_entry_value == BITLK_ENTRY_VALUE_EXTERNAL_KEY) { + return parse_external_key_entry(cd, password, + BITLK_BEK_FILE_HEADER_LEN + BITLK_ENTRY_HEADER_LEN + BITLK_STARTUP_KEY_HEADER_LEN, + passwordLen, su_key); + } else { + log_err(cd, _("Unexpected metadata entry found when parsing startup key.")); + log_dbg(cd, "Entry type: %u, entry value: %u", key_entry_type, key_entry_value); + return -EINVAL; + } +} + +static int bitlk_kdf(struct crypt_device *cd, + const char *password, + size_t passwordLen, + bool recovery, + const uint8_t *salt, + struct volume_key **vk) +{ + struct bitlk_kdf_data kdf = {}; + struct crypt_hash *hd = NULL; + int len = 0; + char *utf16Password = NULL; + int i = 0; + int r = 0; + + memcpy(kdf.salt, salt, 16); + + r = crypt_hash_init(&hd, BITLK_KDF_HASH); + if (r < 0) + return r; + len = crypt_hash_size(BITLK_KDF_HASH); + if (len < 0) { + crypt_hash_destroy(hd); + return len; + } + + if (!recovery) { + /* passphrase: convert to UTF-16 first, then sha256(sha256(pw)) */ + r = passphrase_to_utf16(cd, CONST_CAST(char*)password, passwordLen, &utf16Password); + if (r < 0) + goto out; + + crypt_hash_write(hd, utf16Password, passwordLen * 2); + r = crypt_hash_final(hd, kdf.initial_sha256, len); + if (r < 0) + goto out; + + crypt_hash_write(hd, kdf.initial_sha256, len); + r = crypt_hash_final(hd, kdf.initial_sha256, len); + if (r < 0) + goto out; + } else { + /* recovery passphrase: already converted in #get_recovery_key, now just sha256(rpw) */ + crypt_hash_write(hd, password, passwordLen); + r = crypt_hash_final(hd, kdf.initial_sha256, len); + if (r < 0) + goto out; + } + + for (i = 0; i < BITLK_KDF_ITERATION_COUNT; i++) { + crypt_hash_write(hd, (const char*) &kdf, sizeof(kdf)); + r = crypt_hash_final(hd, kdf.last_sha256, len); + if (r < 0) + goto out; + kdf.count = cpu_to_le64(le64_to_cpu(kdf.count) + 1); + } + + *vk = crypt_alloc_volume_key(len, kdf.last_sha256); + +out: + crypt_safe_free(utf16Password); + if (hd) + crypt_hash_destroy(hd); + return r; +} + +static int decrypt_key(struct crypt_device *cd, + struct volume_key **vk, + struct volume_key *enc_key, + struct volume_key *key, + const uint8_t *tag, size_t tag_size, + const uint8_t *iv, size_t iv_size, + bool is_fvek) +{ + char *outbuf; + int r; + uint16_t key_size = 0; + + outbuf = crypt_safe_alloc(enc_key->keylength); + if (!outbuf) + return -ENOMEM; + + r = crypt_bitlk_decrypt_key(key->key, key->keylength, enc_key->key, outbuf, enc_key->keylength, + (const char*)iv, iv_size, (const char*)tag, tag_size); + if (r < 0) { + if (r == -ENOTSUP) + log_err(cd, _("This operation is not supported.")); + goto out; + } + + /* key_data has it's size as part of the metadata */ + memcpy(&key_size, outbuf, 2); + key_size = le16_to_cpu(key_size); + if (enc_key->keylength != key_size) { + log_err(cd, _("Unexpected key data size.")); + log_dbg(cd, "Expected key data size: %zu, got %" PRIu16 "", enc_key->keylength, key_size); + + r = -EINVAL; + goto out; + } + + if (is_fvek && strcmp(crypt_get_cipher_mode(cd), "cbc-elephant") == 0 && + crypt_get_volume_key_size(cd) == 32) { + /* 128bit AES-CBC with Elephant -- key size is 256 bit (2 keys) but key data is 512 bits, + data: 16B CBC key, 16B empty, 16B elephant key, 16B empty */ + memcpy(outbuf + 16 + BITLK_OPEN_KEY_METADATA_LEN, + outbuf + 2 * 16 + BITLK_OPEN_KEY_METADATA_LEN, 16); + key_size = 32 + BITLK_OPEN_KEY_METADATA_LEN; + } + + + *vk = crypt_alloc_volume_key(key_size - BITLK_OPEN_KEY_METADATA_LEN, + (const char *)(outbuf + BITLK_OPEN_KEY_METADATA_LEN)); + r = *vk ? 0 : -ENOMEM; +out: + crypt_safe_free(outbuf); + return r; +} + +int BITLK_activate(struct crypt_device *cd, + const char *name, + const char *password, + size_t passwordLen, + const struct bitlk_metadata *params, + uint32_t flags) +{ + int r = 0; + int i = 0; + int j = 0; + int min = 0; + int num_segments = 0; + struct crypt_dm_active_device dmd = { + .flags = flags, + }; + struct dm_target *next_segment = NULL; + struct volume_key *open_vmk_key = NULL; + struct volume_key *open_fvek_key = NULL; + struct volume_key *vmk_dec_key = NULL; + struct volume_key *recovery_key = NULL; + const struct bitlk_vmk *next_vmk = NULL; + struct segment segments[MAX_BITLK_SEGMENTS] = {}; + struct segment temp; + uint64_t next_start = 0; + uint64_t next_end = 0; + uint64_t last_segment = 0; + uint32_t dmt_flags; + + if (!params->state) { + log_err(cd, _("This BITLK device is in an unsupported state and cannot be activated.")); + r = -ENOTSUP; + goto out; + } + + if (params->type != BITLK_ENCRYPTION_TYPE_NORMAL) { + log_err(cd, _("BITLK devices with type '%s' cannot be activated."), get_bitlk_type_string(params->type)); + r = -ENOTSUP; + goto out; + } + + next_vmk = params->vmks; + while (next_vmk) { + if (next_vmk->protection == BITLK_PROTECTION_PASSPHRASE) { + r = bitlk_kdf(cd, password, passwordLen, false, next_vmk->salt, &vmk_dec_key); + if (r) { + /* something wrong happened, but we still want to check other key slots */ + next_vmk = next_vmk->next; + continue; + } + } else if (next_vmk->protection == BITLK_PROTECTION_RECOVERY_PASSPHRASE) { + r = get_recovery_key(cd, password, passwordLen, &recovery_key); + if (r) { + /* something wrong happened, but we still want to check other key slots */ + next_vmk = next_vmk->next; + continue; + } + if (recovery_key == NULL) { + /* r = 0 but no key -> given passphrase is not a recovery passphrase */ + r = -EPERM; + next_vmk = next_vmk->next; + continue; + } + log_dbg(cd, "Trying to use given password as a recovery key."); + r = bitlk_kdf(cd, recovery_key->key, recovery_key->keylength, + true, next_vmk->salt, &vmk_dec_key); + crypt_free_volume_key(recovery_key); + if (r) + return r; + } else if (next_vmk->protection == BITLK_PROTECTION_STARTUP_KEY) { + r = get_startup_key(cd, password, passwordLen, next_vmk, &vmk_dec_key); + if (r) { + next_vmk = next_vmk->next; + continue; + } + log_dbg(cd, "Trying to use external key found in provided password."); + } else { + /* only passphrase, recovery passphrase and startup key VMKs supported right now */ + log_dbg(cd, "Skipping %s", get_vmk_protection_string(next_vmk->protection)); + next_vmk = next_vmk->next; + if (r == 0) + /* we need to set error code in case we have only unsupported VMKs */ + r = -ENOTSUP; + continue; + } + + log_dbg(cd, "Trying to decrypt %s.", get_vmk_protection_string(next_vmk->protection)); + r = decrypt_key(cd, &open_vmk_key, next_vmk->vk, vmk_dec_key, + next_vmk->mac_tag, BITLK_VMK_MAC_TAG_SIZE, + next_vmk->nonce, BITLK_NONCE_SIZE, false); + if (r < 0) { + log_dbg(cd, "Failed to decrypt VMK using provided passphrase."); + crypt_free_volume_key(vmk_dec_key); + if (r == -ENOTSUP) + return r; + next_vmk = next_vmk->next; + continue; + } + crypt_free_volume_key(vmk_dec_key); + + r = decrypt_key(cd, &open_fvek_key, params->fvek->vk, open_vmk_key, + params->fvek->mac_tag, BITLK_VMK_MAC_TAG_SIZE, + params->fvek->nonce, BITLK_NONCE_SIZE, true); + if (r < 0) { + log_dbg(cd, "Failed to decrypt FVEK using VMK."); + crypt_free_volume_key(open_vmk_key); + if (r == -ENOTSUP) + return r; + } else { + crypt_free_volume_key(open_vmk_key); + break; + } + + next_vmk = next_vmk->next; + } + + if (r) { + log_dbg(cd, "No more VMKs to try."); + return r; + } + + /* Password verify only */ + if (!name) { + crypt_free_volume_key(open_fvek_key); + return r; + } + + next_vmk = params->vmks; + while (next_vmk) { + if (next_vmk->protection == BITLK_PROTECTION_CLEAR_KEY) { + crypt_free_volume_key(open_fvek_key); + log_err(cd, _("Activation of partially decrypted BITLK device is not supported.")); + return -ENOTSUP; + } + next_vmk = next_vmk->next; + } + + r = device_block_adjust(cd, crypt_data_device(cd), DEV_EXCL, + 0, &dmd.size, &dmd.flags); + if (r) { + crypt_free_volume_key(open_fvek_key); + return r; + } + + /* there will be always 4 dm-zero segments: 3x metadata, 1x FS header */ + for (i = 0; i < 3; i++) { + segments[num_segments].offset = params->metadata_offset[i] / SECTOR_SIZE; + segments[num_segments].length = BITLK_FVE_METADATA_SIZE / SECTOR_SIZE; + segments[num_segments].iv_offset = 0; + segments[num_segments].type = BITLK_SEGTYPE_ZERO; + num_segments++; + } + segments[num_segments].offset = params->volume_header_offset / SECTOR_SIZE; + segments[num_segments].length = params->volume_header_size / SECTOR_SIZE; + segments[num_segments].iv_offset = 0; + segments[num_segments].type = BITLK_SEGTYPE_ZERO; + num_segments++; + + /* filesystem header (moved from the special location) */ + segments[num_segments].offset = 0; + segments[num_segments].length = params->volume_header_size / SECTOR_SIZE; + segments[num_segments].iv_offset = params->volume_header_offset / SECTOR_SIZE; + segments[num_segments].type = BITLK_SEGTYPE_CRYPT; + num_segments++; + + /* now fill gaps between the dm-zero segments with dm-crypt */ + last_segment = params->volume_header_size / SECTOR_SIZE; + while (true) { + next_start = dmd.size; + next_end = dmd.size; + + /* start of the next segment: end of the first existing segment after the last added */ + for (i = 0; i < num_segments; i++) + if (segments[i].offset + segments[i].length < next_start && segments[i].offset + segments[i].length >= last_segment) + next_start = segments[i].offset + segments[i].length; + + /* end of the next segment: start of the next segment after start we found above */ + for (i = 0; i < num_segments; i++) + if (segments[i].offset < next_end && segments[i].offset >= next_start) + next_end = segments[i].offset; + + /* two zero segments next to each other, just bump the last_segment + so the algorithm moves */ + if (next_end - next_start == 0) { + last_segment = next_end + 1; + continue; + } + + segments[num_segments].offset = next_start; + segments[num_segments].length = next_end - next_start; + segments[num_segments].iv_offset = next_start; + segments[num_segments].type = BITLK_SEGTYPE_CRYPT; + last_segment = next_end; + num_segments++; + + if (next_end == dmd.size) + break; + + if (num_segments == 10) { + log_dbg(cd, "Failed to calculate number of dm-crypt segments for open."); + r = -EINVAL; + goto out; + } + } + + /* device mapper needs the segment sorted */ + for (i = 0; i < num_segments - 1; i++) { + min = i; + for (j = i + 1; j < num_segments; j++) + if (segments[j].offset < segments[min].offset) + min = j; + + if (min != i) { + temp.offset = segments[min].offset; + temp.length = segments[min].length; + temp.iv_offset = segments[min].iv_offset; + temp.type = segments[min].type; + + segments[min].offset = segments[i].offset; + segments[min].length = segments[i].length; + segments[min].iv_offset = segments[i].iv_offset; + segments[min].type = segments[i].type; + + segments[i].offset = temp.offset; + segments[i].length = temp.length; + segments[i].iv_offset = temp.iv_offset; + segments[i].type = temp.type; + } + } + + if (params->sector_size != SECTOR_SIZE) + dmd.flags |= CRYPT_ACTIVATE_IV_LARGE_SECTORS; + + r = dm_targets_allocate(&dmd.segment, num_segments); + if (r) + goto out; + next_segment = &dmd.segment; + + for (i = 0; i < num_segments; i++) { + if (segments[i].type == BITLK_SEGTYPE_ZERO) + r = dm_zero_target_set(next_segment, + segments[i].offset, + segments[i].length); + else if (segments[i].type == BITLK_SEGTYPE_CRYPT) + r = dm_crypt_target_set(next_segment, + segments[i].offset, + segments[i].length, + crypt_data_device(cd), + open_fvek_key, + crypt_get_cipher_spec(cd), + segments[i].iv_offset, + segments[i].iv_offset, + NULL, 0, + params->sector_size); + if (r) + goto out; + + next_segment = next_segment->next; + } + + log_dbg(cd, "Trying to activate BITLK on device %s%s%s.", + device_path(crypt_data_device(cd)), name ? " with name " :"", name ?: ""); + + r = dm_create_device(cd, name, CRYPT_BITLK, &dmd); + if (r < 0) { + dm_flags(cd, DM_CRYPT, &dmt_flags); + if (!strcmp(params->cipher_mode, "cbc-eboiv") && !(dmt_flags & DM_BITLK_EBOIV_SUPPORTED)) { + log_err(cd, _("Cannot activate device, kernel dm-crypt is missing support for BITLK IV.")); + r = -ENOTSUP; + } + if (!strcmp(params->cipher_mode, "cbc-elephant") && !(dmt_flags & DM_BITLK_ELEPHANT_SUPPORTED)) { + log_err(cd, _("Cannot activate device, kernel dm-crypt is missing support for BITLK Elephant diffuser.")); + r = -ENOTSUP; + } + } +out: + dm_targets_free(cd, &dmd); + crypt_free_volume_key(open_fvek_key); + return r; +} diff --git a/lib/bitlk/bitlk.h b/lib/bitlk/bitlk.h new file mode 100644 index 0000000..1081519 --- /dev/null +++ b/lib/bitlk/bitlk.h @@ -0,0 +1,131 @@ +/* + * BITLK (BitLocker-compatible) header definition + * + * Copyright (C) 2019-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2019-2021 Milan Broz + * Copyright (C) 2019-2021 Vojtech Trefny + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_BITLK_H +#define _CRYPTSETUP_BITLK_H + +#include +#include +#include + +struct crypt_device; +struct device; + +#define BITLK_NONCE_SIZE 12 +#define BITLK_SALT_SIZE 16 +#define BITLK_VMK_MAC_TAG_SIZE 16 + +#define BITLK_STATE_NORMAL 0x0004 + +typedef enum { + BITLK_ENCRYPTION_TYPE_NORMAL = 0, + BITLK_ENCRYPTION_TYPE_EOW, + BITLK_ENCRYPTION_TYPE_UNKNOWN, +} BITLKEncryptionType; + +typedef enum { + BITLK_PROTECTION_CLEAR_KEY = 0, + BITLK_PROTECTION_TPM, + BITLK_PROTECTION_STARTUP_KEY, + BITLK_PROTECTION_TPM_PIN, + BITLK_PROTECTION_RECOVERY_PASSPHRASE, + BITLK_PROTECTION_PASSPHRASE, + BITLK_PROTECTION_SMART_CARD, + BITLK_PROTECTION_UNKNOWN, +} BITLKVMKProtection; + +typedef enum { + BITLK_ENTRY_TYPE_PROPERTY = 0x0000, + BITLK_ENTRY_TYPE_VMK = 0x0002, + BITLK_ENTRY_TYPE_FVEK = 0x0003, + BITLK_ENTRY_TYPE_STARTUP_KEY = 0x0006, + BITLK_ENTRY_TYPE_DESCRIPTION = 0x0007, + BITLK_ENTRY_TYPE_VOLUME_HEADER = 0x000f, +} BITLKFVEEntryType; + +typedef enum { + BITLK_ENTRY_VALUE_ERASED = 0x0000, + BITLK_ENTRY_VALUE_KEY = 0x0001, + BITLK_ENTRY_VALUE_STRING = 0x0002, + BITLK_ENTRY_VALUE_STRETCH_KEY = 0x0003, + BITLK_ENTRY_VALUE_USE_KEY = 0x0004, + BITLK_ENTRY_VALUE_ENCRYPTED_KEY = 0x0005, + BITLK_ENTRY_VALUE_TPM_KEY = 0x0006, + BITLK_ENTRY_VALUE_VALIDATION = 0x0007, + BITLK_ENTRY_VALUE_VMK = 0x0008, + BITLK_ENTRY_VALUE_EXTERNAL_KEY = 0x0009, + BITLK_ENTRY_VALUE_OFFSET_SIZE = 0x000f, + BITLK_ENTRY_VALUE_RECOVERY_TIME = 0x015, +} BITLKFVEEntryValue; + +struct bitlk_vmk { + char *guid; + char *name; + BITLKVMKProtection protection; + uint8_t salt[BITLK_SALT_SIZE]; + uint8_t mac_tag[BITLK_VMK_MAC_TAG_SIZE]; + uint8_t nonce[BITLK_NONCE_SIZE]; + struct volume_key *vk; + struct bitlk_vmk *next; +}; + +struct bitlk_fvek { + uint8_t mac_tag[BITLK_VMK_MAC_TAG_SIZE]; + uint8_t nonce[BITLK_NONCE_SIZE]; + struct volume_key *vk; +}; + +struct bitlk_metadata { + uint16_t sector_size; + bool togo; + bool state; + BITLKEncryptionType type; + const char *cipher; + const char *cipher_mode; + uint16_t key_size; + char *guid; + uint64_t creation_time; + char *description; + uint64_t metadata_offset[3]; + uint32_t metadata_version; + uint64_t volume_header_offset; + uint64_t volume_header_size; + struct bitlk_vmk *vmks; + struct bitlk_fvek *fvek; +}; + +int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params); + +int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_metadata *params); + +int BITLK_activate(struct crypt_device *cd, + const char *name, + const char *password, + size_t passwordLen, + const struct bitlk_metadata *params, + uint32_t flags); + +void BITLK_bitlk_fvek_free(struct bitlk_fvek *fvek); +void BITLK_bitlk_vmk_free(struct bitlk_vmk *vmk); +void BITLK_bitlk_metadata_free(struct bitlk_metadata *params); + +#endif diff --git a/lib/bitops.h b/lib/bitops.h new file mode 100644 index 0000000..a991687 --- /dev/null +++ b/lib/bitops.h @@ -0,0 +1,123 @@ +/* + * No copyright is claimed. This code is in the public domain; do with + * it what you wish. + * + * Written by Karel Zak + */ +#ifndef BITOPS_H +#define BITOPS_H + +#include +#include + +#if defined(HAVE_BYTESWAP_H) +# include +#endif + +#if defined(HAVE_ENDIAN_H) +# include +#elif defined(HAVE_SYS_ENDIAN_H) /* BSDs have them here */ +# include +#endif + +#if defined(__OpenBSD__) +# include +# define be16toh(x) betoh16(x) +# define be32toh(x) betoh32(x) +# define be64toh(x) betoh64(x) +#endif + +/* + * Fallbacks + */ +#ifndef bswap_16 +# define bswap_16(x) ((((x) & 0x00FF) << 8) | \ + (((x) & 0xFF00) >> 8)) +#endif + +#ifndef bswap_32 +# define bswap_32(x) ((((x) & 0x000000FF) << 24) | \ + (((x) & 0x0000FF00) << 8) | \ + (((x) & 0x00FF0000) >> 8) | \ + (((x) & 0xFF000000) >> 24)) +#endif + +#ifndef bswap_64 +# define bswap_64(x) ((((x) & 0x00000000000000FFULL) << 56) | \ + (((x) & 0x000000000000FF00ULL) << 40) | \ + (((x) & 0x0000000000FF0000ULL) << 24) | \ + (((x) & 0x00000000FF000000ULL) << 8) | \ + (((x) & 0x000000FF00000000ULL) >> 8) | \ + (((x) & 0x0000FF0000000000ULL) >> 24) | \ + (((x) & 0x00FF000000000000ULL) >> 40) | \ + (((x) & 0xFF00000000000000ULL) >> 56)) +#endif + +#ifndef htobe16 +# if !defined(WORDS_BIGENDIAN) +# define htobe16(x) bswap_16 (x) +# define htole16(x) (x) +# define be16toh(x) bswap_16 (x) +# define le16toh(x) (x) +# define htobe32(x) bswap_32 (x) +# define htole32(x) (x) +# define be32toh(x) bswap_32 (x) +# define le32toh(x) (x) +# define htobe64(x) bswap_64 (x) +# define htole64(x) (x) +# define be64toh(x) bswap_64 (x) +# define le64toh(x) (x) +# else +# define htobe16(x) (x) +# define htole16(x) bswap_16 (x) +# define be16toh(x) (x) +# define le16toh(x) bswap_16 (x) +# define htobe32(x) (x) +# define htole32(x) bswap_32 (x) +# define be32toh(x) (x) +# define le32toh(x) bswap_32 (x) +# define htobe64(x) (x) +# define htole64(x) bswap_64 (x) +# define be64toh(x) (x) +# define le64toh(x) bswap_64 (x) +# endif +#endif + +/* + * Byte swab macros (based on linux/byteorder/swab.h) + */ +#define swab16(x) bswap_16(x) +#define swab32(x) bswap_32(x) +#define swab64(x) bswap_64(x) + +#define cpu_to_le16(x) ((uint16_t) htole16(x)) +#define cpu_to_le32(x) ((uint32_t) htole32(x)) +#define cpu_to_le64(x) ((uint64_t) htole64(x)) + +#define cpu_to_be16(x) ((uint16_t) htobe16(x)) +#define cpu_to_be32(x) ((uint32_t) htobe32(x)) +#define cpu_to_be64(x) ((uint64_t) htobe64(x)) + +#define le16_to_cpu(x) ((uint16_t) le16toh(x)) +#define le32_to_cpu(x) ((uint32_t) le32toh(x)) +#define le64_to_cpu(x) ((uint64_t) le64toh(x)) + +#define be16_to_cpu(x) ((uint16_t) be16toh(x)) +#define be32_to_cpu(x) ((uint32_t) be32toh(x)) +#define be64_to_cpu(x) ((uint64_t) be64toh(x)) + +/* + * Bit map related macros. Usually provided by libc. + */ +#ifndef NBBY +# define NBBY CHAR_BIT +#endif + +#ifndef setbit +# define setbit(a,i) ((a)[(i)/NBBY] |= 1<<((i)%NBBY)) +# define clrbit(a,i) ((a)[(i)/NBBY] &= ~(1<<((i)%NBBY))) +# define isset(a,i) ((a)[(i)/NBBY] & (1<<((i)%NBBY))) +# define isclr(a,i) (((a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0) +#endif + +#endif /* BITOPS_H */ diff --git a/lib/crypt_plain.c b/lib/crypt_plain.c new file mode 100644 index 0000000..180d08a --- /dev/null +++ b/lib/crypt_plain.c @@ -0,0 +1,117 @@ +/* + * cryptsetup plain device helper functions + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include + +#include "libcryptsetup.h" +#include "internal.h" + +static int hash(const char *hash_name, size_t key_size, char *key, + size_t passphrase_size, const char *passphrase) +{ + struct crypt_hash *md = NULL; + size_t len; + int round, i, r = 0; + + if (crypt_hash_init(&md, hash_name)) + return -ENOENT; + + len = crypt_hash_size(hash_name); + + for(round = 0; key_size && !r; round++) { + /* hack from hashalot to avoid null bytes in key */ + for(i = 0; i < round; i++) + if (crypt_hash_write(md, "A", 1)) + r = 1; + + if (crypt_hash_write(md, passphrase, passphrase_size)) + r = 1; + + if (len > key_size) + len = key_size; + + if (crypt_hash_final(md, key, len)) + r = 1; + + key += len; + key_size -= len; + } + + crypt_hash_destroy(md); + return r; +} + +#define PLAIN_HASH_LEN_MAX 256 + +int crypt_plain_hash(struct crypt_device *cd, + const char *hash_name, + char *key, size_t key_size, + const char *passphrase, size_t passphrase_size) +{ + char hash_name_buf[PLAIN_HASH_LEN_MAX], *s; + size_t hash_size, pad_size; + int r; + + log_dbg(cd, "Plain: hashing passphrase using %s.", hash_name); + + if (strlen(hash_name) >= PLAIN_HASH_LEN_MAX) + return -EINVAL; + strncpy(hash_name_buf, hash_name, PLAIN_HASH_LEN_MAX); + hash_name_buf[PLAIN_HASH_LEN_MAX - 1] = '\0'; + + /* hash[:hash_length] */ + if ((s = strchr(hash_name_buf, ':'))) { + *s = '\0'; + s++; + if (!*s || sscanf(s, "%zd", &hash_size) != 1) { + log_dbg(cd, "Hash length is not a number"); + return -EINVAL; + } + if (hash_size > key_size) { + log_dbg(cd, "Hash length %zd > key length %zd", + hash_size, key_size); + return -EINVAL; + } + pad_size = key_size - hash_size; + } else { + hash_size = key_size; + pad_size = 0; + } + + /* No hash, copy passphrase directly */ + if (!strcmp(hash_name_buf, "plain")) { + if (passphrase_size < hash_size) { + log_dbg(cd, "Too short plain passphrase."); + return -EINVAL; + } + memcpy(key, passphrase, hash_size); + r = 0; + } else + r = hash(hash_name_buf, hash_size, key, passphrase_size, passphrase); + + if (r == 0 && pad_size) + memset(key + hash_size, 0, pad_size); + + return r; +} diff --git a/lib/crypto_backend/Makemodule.am b/lib/crypto_backend/Makemodule.am new file mode 100644 index 0000000..f33cd45 --- /dev/null +++ b/lib/crypto_backend/Makemodule.am @@ -0,0 +1,39 @@ +noinst_LTLIBRARIES += libcrypto_backend.la + +libcrypto_backend_la_CFLAGS = $(AM_CFLAGS) @CRYPTO_CFLAGS@ + +libcrypto_backend_la_SOURCES = \ + lib/crypto_backend/crypto_backend.h \ + lib/crypto_backend/crypto_backend_internal.h \ + lib/crypto_backend/crypto_cipher_kernel.c \ + lib/crypto_backend/crypto_storage.c \ + lib/crypto_backend/pbkdf_check.c \ + lib/crypto_backend/crc32.c \ + lib/crypto_backend/argon2_generic.c \ + lib/crypto_backend/cipher_generic.c \ + lib/crypto_backend/cipher_check.c + +if CRYPTO_BACKEND_GCRYPT +libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_gcrypt.c +endif +if CRYPTO_BACKEND_OPENSSL +libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_openssl.c +endif +if CRYPTO_BACKEND_NSS +libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_nss.c +endif +if CRYPTO_BACKEND_KERNEL +libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_kernel.c +endif +if CRYPTO_BACKEND_NETTLE +libcrypto_backend_la_SOURCES += lib/crypto_backend/crypto_nettle.c +endif + +if CRYPTO_INTERNAL_PBKDF2 +libcrypto_backend_la_SOURCES += lib/crypto_backend/pbkdf2_generic.c +endif + +if CRYPTO_INTERNAL_ARGON2 +libcrypto_backend_la_DEPENDENCIES = libargon2.la +libcrypto_backend_la_LIBADD = libargon2.la +endif diff --git a/lib/crypto_backend/argon2/LICENSE b/lib/crypto_backend/argon2/LICENSE new file mode 100644 index 0000000..de14cd2 --- /dev/null +++ b/lib/crypto_backend/argon2/LICENSE @@ -0,0 +1,30 @@ + CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED HEREUNDER. + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer exclusive Copyright and Related Rights (defined below) upon the creator and subsequent owner(s) (each and all, an "owner") of an original work of authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for the purpose of contributing to a commons of creative, cultural and scientific works ("Commons") that the public can reliably and without fear of later claims of infringement build upon, modify, incorporate in other works, reuse and redistribute as freely as possible in any form whatsoever and for any purposes, including without limitation commercial purposes. These owners may contribute to the Commons to promote the ideal of a free culture and the further production of creative, cultural and scientific works, or to gain reputation or greater distribution for their Work in part through the use and efforts of others. + +For these and/or other purposes and motivations, and without any expectation of additional consideration or compensation, the person associating CC0 with a Work (the "Affirmer"), to the extent that he or she is an owner of Copyright and Related Rights in the Work, voluntarily elects to apply CC0 to the Work and publicly distribute the Work under its terms, with knowledge of his or her Copyright and Related Rights in the Work and the meaning and intended legal effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be protected by copyright and related or neighboring rights ("Copyright and Related Rights"). Copyright and Related Rights include, but are not limited to, the following: + + the right to reproduce, adapt, distribute, perform, display, communicate, and translate a Work; + moral rights retained by the original author(s) and/or performer(s); + publicity and privacy rights pertaining to a person's image or likeness depicted in a Work; + rights protecting against unfair competition in regards to a Work, subject to the limitations in paragraph 4(a), below; + rights protecting the extraction, dissemination, use and reuse of data in a Work; + database rights (such as those arising under Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, and under any national implementation thereof, including any amended or successor version of such directive); and + other similar, equivalent or corresponding rights throughout the world based on applicable law or treaty, and any national implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention of, applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and unconditionally waives, abandons, and surrenders all of Affirmer's Copyright and Related Rights and associated claims and causes of action, whether now known or unknown (including existing as well as future claims and causes of action), in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each member of the public at large and to the detriment of Affirmer's heirs and successors, fully intending that such Waiver shall not be subject to revocation, rescission, cancellation, termination, or any other legal or equitable action to disrupt the quiet enjoyment of the Work by the public as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason be judged legally invalid or ineffective under applicable law, then the Waiver shall be preserved to the maximum extent permitted taking into account Affirmer's express Statement of Purpose. In addition, to the extent the Waiver is so judged Affirmer hereby grants to each affected person a royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional license to exercise Affirmer's Copyright and Related Rights in the Work (i) in all territories worldwide, (ii) for the maximum duration provided by applicable law or treaty (including future time extensions), (iii) in any current or future medium and for any number of copies, and (iv) for any purpose whatsoever, including without limitation commercial, advertising or promotional purposes (the "License"). The License shall be deemed effective as of the date CC0 was applied by Affirmer to the Work. Should any part of the License for any reason be judged legally invalid or ineffective under applicable law, such partial invalidity or ineffectiveness shall not invalidate the remainder of the License, and in such case Affirmer hereby affirms that he or she will not (i) exercise any of his or her remaining Copyright and Related Rights in the Work or (ii) assert any associated claims and causes of action with respect to the Work, in either case contrary to Affirmer's express Statement of Purpose. + +4. Limitations and Disclaimers. + + No trademark or patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document. + Affirmer offers the Work as-is and makes no representations or warranties of any kind concerning the Work, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non infringement, or the absence of latent or other defects, accuracy, or the present or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law. + Affirmer disclaims responsibility for clearing rights of other persons that may apply to the Work or any use thereof, including without limitation any person's Copyright and Related Rights in the Work. Further, Affirmer disclaims responsibility for obtaining any necessary consents, permissions or other rights required for any use of the Work. + Affirmer understands and acknowledges that Creative Commons is not a party to this document and has no duty or obligation with respect to this CC0 or use of the Work. diff --git a/lib/crypto_backend/argon2/Makemodule.am b/lib/crypto_backend/argon2/Makemodule.am new file mode 100644 index 0000000..6fef2f1 --- /dev/null +++ b/lib/crypto_backend/argon2/Makemodule.am @@ -0,0 +1,30 @@ +noinst_LTLIBRARIES += libargon2.la + +libargon2_la_CFLAGS = $(AM_CFLAGS) -std=c89 -pthread -O3 +libargon2_la_CPPFLAGS = $(AM_CPPFLAGS) \ + -I lib/crypto_backend/argon2 \ + -I lib/crypto_backend/argon2/blake2 + +libargon2_la_SOURCES = \ + lib/crypto_backend/argon2/blake2/blake2b.c \ + lib/crypto_backend/argon2/blake2/blake2.h \ + lib/crypto_backend/argon2/blake2/blake2-impl.h \ + lib/crypto_backend/argon2/argon2.c \ + lib/crypto_backend/argon2/argon2.h \ + lib/crypto_backend/argon2/core.c \ + lib/crypto_backend/argon2/core.h \ + lib/crypto_backend/argon2/encoding.c \ + lib/crypto_backend/argon2/encoding.h \ + lib/crypto_backend/argon2/thread.c \ + lib/crypto_backend/argon2/thread.h + +if CRYPTO_INTERNAL_SSE_ARGON2 +libargon2_la_SOURCES += lib/crypto_backend/argon2/blake2/blamka-round-opt.h \ + lib/crypto_backend/argon2/opt.c +else +libargon2_la_SOURCES += lib/crypto_backend/argon2/blake2/blamka-round-ref.h \ + lib/crypto_backend/argon2/ref.c +endif + +EXTRA_DIST += lib/crypto_backend/argon2/LICENSE +EXTRA_DIST += lib/crypto_backend/argon2/README diff --git a/lib/crypto_backend/argon2/README b/lib/crypto_backend/argon2/README new file mode 100644 index 0000000..5376b52 --- /dev/null +++ b/lib/crypto_backend/argon2/README @@ -0,0 +1,5 @@ +This is bundled Argon2 algorithm library, copied from + https://github.com/P-H-C/phc-winner-argon2 + +For more info see Password Hashing Competition site: + https://password-hashing.net/ diff --git a/lib/crypto_backend/argon2/argon2.c b/lib/crypto_backend/argon2/argon2.c new file mode 100644 index 0000000..c784fca --- /dev/null +++ b/lib/crypto_backend/argon2/argon2.c @@ -0,0 +1,458 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "argon2.h" +#include "encoding.h" +#include "core.h" + +/* to silent gcc -Wcast-qual for const cast */ +#define CONST_CAST(x) (x)(uintptr_t) + +const char *argon2_type2string(argon2_type type, int uppercase) { + switch (type) { + case Argon2_d: + return uppercase ? "Argon2d" : "argon2d"; + case Argon2_i: + return uppercase ? "Argon2i" : "argon2i"; + case Argon2_id: + return uppercase ? "Argon2id" : "argon2id"; + } + + return NULL; +} + +int argon2_ctx(argon2_context *context, argon2_type type) { + /* 1. Validate all inputs */ + int result = validate_inputs(context); + uint32_t memory_blocks, segment_length; + argon2_instance_t instance; + + if (ARGON2_OK != result) { + return result; + } + + if (Argon2_d != type && Argon2_i != type && Argon2_id != type) { + return ARGON2_INCORRECT_TYPE; + } + + /* 2. Align memory size */ + /* Minimum memory_blocks = 8L blocks, where L is the number of lanes */ + memory_blocks = context->m_cost; + + if (memory_blocks < 2 * ARGON2_SYNC_POINTS * context->lanes) { + memory_blocks = 2 * ARGON2_SYNC_POINTS * context->lanes; + } + + segment_length = memory_blocks / (context->lanes * ARGON2_SYNC_POINTS); + /* Ensure that all segments have equal length */ + memory_blocks = segment_length * (context->lanes * ARGON2_SYNC_POINTS); + + instance.version = context->version; + instance.memory = NULL; + instance.passes = context->t_cost; + instance.memory_blocks = memory_blocks; + instance.segment_length = segment_length; + instance.lane_length = segment_length * ARGON2_SYNC_POINTS; + instance.lanes = context->lanes; + instance.threads = context->threads; + instance.type = type; + + if (instance.threads > instance.lanes) { + instance.threads = instance.lanes; + } + + /* 3. Initialization: Hashing inputs, allocating memory, filling first + * blocks + */ + result = initialize(&instance, context); + + if (ARGON2_OK != result) { + return result; + } + + /* 4. Filling memory */ + result = fill_memory_blocks(&instance); + + if (ARGON2_OK != result) { + return result; + } + /* 5. Finalization */ + finalize(context, &instance); + + return ARGON2_OK; +} + +int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, const size_t saltlen, + void *hash, const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version){ + + argon2_context context; + int result; + uint8_t *out; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (saltlen > ARGON2_MAX_SALT_LENGTH) { + return ARGON2_SALT_TOO_LONG; + } + + if (hashlen > ARGON2_MAX_OUTLEN) { + return ARGON2_OUTPUT_TOO_LONG; + } + + if (hashlen < ARGON2_MIN_OUTLEN) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + out = malloc(hashlen); + if (!out) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + context.out = (uint8_t *)out; + context.outlen = (uint32_t)hashlen; + context.pwd = CONST_CAST(uint8_t *)pwd; + context.pwdlen = (uint32_t)pwdlen; + context.salt = CONST_CAST(uint8_t *)salt; + context.saltlen = (uint32_t)saltlen; + context.secret = NULL; + context.secretlen = 0; + context.ad = NULL; + context.adlen = 0; + context.t_cost = t_cost; + context.m_cost = m_cost; + context.lanes = parallelism; + context.threads = parallelism; + context.allocate_cbk = NULL; + context.free_cbk = NULL; + context.flags = ARGON2_DEFAULT_FLAGS; + context.version = version; + + result = argon2_ctx(&context, type); + + if (result != ARGON2_OK) { + clear_internal_memory(out, hashlen); + free(out); + return result; + } + + /* if raw hash requested, write it */ + if (hash) { + memcpy(hash, out, hashlen); + } + + /* if encoding requested, write it */ + if (encoded && encodedlen) { + if (encode_string(encoded, encodedlen, &context, type) != ARGON2_OK) { + clear_internal_memory(out, hashlen); /* wipe buffers if error */ + clear_internal_memory(encoded, encodedlen); + free(out); + return ARGON2_ENCODING_FAIL; + } + } + clear_internal_memory(out, hashlen); + free(out); + + return ARGON2_OK; +} + +int argon2i_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_i, + ARGON2_VERSION_NUMBER); +} + +int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_i, ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_d, + ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_d, ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +static int argon2_compare(const uint8_t *b1, const uint8_t *b2, size_t len) { + size_t i; + uint8_t d = 0U; + + for (i = 0U; i < len; i++) { + d |= b1[i] ^ b2[i]; + } + return (int)((1 & ((d - 1) >> 8)) - 1); +} + +int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen, + argon2_type type) { + + argon2_context ctx; + uint8_t *desired_result = NULL; + + int ret = ARGON2_OK; + + size_t encoded_len; + uint32_t max_field_len; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (encoded == NULL) { + return ARGON2_DECODING_FAIL; + } + + encoded_len = strlen(encoded); + if (encoded_len > UINT32_MAX) { + return ARGON2_DECODING_FAIL; + } + + /* No field can be longer than the encoded length */ + /* coverity[strlen_assign] */ + max_field_len = (uint32_t)encoded_len; + + ctx.saltlen = max_field_len; + ctx.outlen = max_field_len; + + ctx.salt = malloc(ctx.saltlen); + ctx.out = malloc(ctx.outlen); + if (!ctx.salt || !ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ctx.pwd = CONST_CAST(uint8_t *)pwd; + ctx.pwdlen = (uint32_t)pwdlen; + + ret = decode_string(&ctx, encoded, type); + if (ret != ARGON2_OK) { + goto fail; + } + + /* Set aside the desired result, and get a new buffer. */ + desired_result = ctx.out; + ctx.out = malloc(ctx.outlen); + if (!ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ret = argon2_verify_ctx(&ctx, (char *)desired_result, type); + if (ret != ARGON2_OK) { + goto fail; + } + +fail: + free(ctx.salt); + free(ctx.out); + free(desired_result); + + return ret; +} + +int argon2i_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_i); +} + +int argon2d_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_d); +} + +int argon2id_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_id); +} + +int argon2d_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_d); +} + +int argon2i_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_i); +} + +int argon2id_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_id); +} + +int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type) { + int ret = argon2_ctx(context, type); + if (ret != ARGON2_OK) { + return ret; + } + + if (argon2_compare(CONST_CAST(uint8_t *)hash, context->out, context->outlen)) { + return ARGON2_VERIFY_MISMATCH; + } + + return ARGON2_OK; +} + +int argon2d_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_d); +} + +int argon2i_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_i); +} + +int argon2id_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_id); +} + +const char *argon2_error_message(int error_code) { + switch (error_code) { + case ARGON2_OK: + return "OK"; + case ARGON2_OUTPUT_PTR_NULL: + return "Output pointer is NULL"; + case ARGON2_OUTPUT_TOO_SHORT: + return "Output is too short"; + case ARGON2_OUTPUT_TOO_LONG: + return "Output is too long"; + case ARGON2_PWD_TOO_SHORT: + return "Password is too short"; + case ARGON2_PWD_TOO_LONG: + return "Password is too long"; + case ARGON2_SALT_TOO_SHORT: + return "Salt is too short"; + case ARGON2_SALT_TOO_LONG: + return "Salt is too long"; + case ARGON2_AD_TOO_SHORT: + return "Associated data is too short"; + case ARGON2_AD_TOO_LONG: + return "Associated data is too long"; + case ARGON2_SECRET_TOO_SHORT: + return "Secret is too short"; + case ARGON2_SECRET_TOO_LONG: + return "Secret is too long"; + case ARGON2_TIME_TOO_SMALL: + return "Time cost is too small"; + case ARGON2_TIME_TOO_LARGE: + return "Time cost is too large"; + case ARGON2_MEMORY_TOO_LITTLE: + return "Memory cost is too small"; + case ARGON2_MEMORY_TOO_MUCH: + return "Memory cost is too large"; + case ARGON2_LANES_TOO_FEW: + return "Too few lanes"; + case ARGON2_LANES_TOO_MANY: + return "Too many lanes"; + case ARGON2_PWD_PTR_MISMATCH: + return "Password pointer is NULL, but password length is not 0"; + case ARGON2_SALT_PTR_MISMATCH: + return "Salt pointer is NULL, but salt length is not 0"; + case ARGON2_SECRET_PTR_MISMATCH: + return "Secret pointer is NULL, but secret length is not 0"; + case ARGON2_AD_PTR_MISMATCH: + return "Associated data pointer is NULL, but ad length is not 0"; + case ARGON2_MEMORY_ALLOCATION_ERROR: + return "Memory allocation error"; + case ARGON2_FREE_MEMORY_CBK_NULL: + return "The free memory callback is NULL"; + case ARGON2_ALLOCATE_MEMORY_CBK_NULL: + return "The allocate memory callback is NULL"; + case ARGON2_INCORRECT_PARAMETER: + return "Argon2_Context context is NULL"; + case ARGON2_INCORRECT_TYPE: + return "There is no such version of Argon2"; + case ARGON2_OUT_PTR_MISMATCH: + return "Output pointer mismatch"; + case ARGON2_THREADS_TOO_FEW: + return "Not enough threads"; + case ARGON2_THREADS_TOO_MANY: + return "Too many threads"; + case ARGON2_MISSING_ARGS: + return "Missing arguments"; + case ARGON2_ENCODING_FAIL: + return "Encoding failed"; + case ARGON2_DECODING_FAIL: + return "Decoding failed"; + case ARGON2_THREAD_FAIL: + return "Threading failure"; + case ARGON2_DECODING_LENGTH_FAIL: + return "Some of encoded parameters are too long or too short"; + case ARGON2_VERIFY_MISMATCH: + return "The password does not match the supplied hash"; + default: + return "Unknown error code"; + } +} + +size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, uint32_t parallelism, + uint32_t saltlen, uint32_t hashlen, argon2_type type) { + if (!argon2_type2string(type, 0)) + return 0; + return strlen("$$v=$m=,t=,p=$$") + strlen(argon2_type2string(type, 0)) + + numlen(t_cost) + numlen(m_cost) + numlen(parallelism) + + b64len(saltlen) + b64len(hashlen) + numlen(ARGON2_VERSION_NUMBER) + 1; +} diff --git a/lib/crypto_backend/argon2/argon2.h b/lib/crypto_backend/argon2/argon2.h new file mode 100644 index 0000000..20df933 --- /dev/null +++ b/lib/crypto_backend/argon2/argon2.h @@ -0,0 +1,437 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_H +#define ARGON2_H + +#include +#include +#include + +#if defined(__cplusplus) +extern "C" { +#endif + +/* Symbols visibility control */ +#ifdef A2_VISCTL +#define ARGON2_PUBLIC __attribute__((visibility("default"))) +#define ARGON2_LOCAL __attribute__ ((visibility ("hidden"))) +#elif _MSC_VER +#define ARGON2_PUBLIC __declspec(dllexport) +#define ARGON2_LOCAL +#else +#define ARGON2_PUBLIC +#define ARGON2_LOCAL +#endif + +/* + * Argon2 input parameter restrictions + */ + +/* Minimum and maximum number of lanes (degree of parallelism) */ +#define ARGON2_MIN_LANES UINT32_C(1) +#define ARGON2_MAX_LANES UINT32_C(0xFFFFFF) + +/* Minimum and maximum number of threads */ +#define ARGON2_MIN_THREADS UINT32_C(1) +#define ARGON2_MAX_THREADS UINT32_C(0xFFFFFF) + +/* Number of synchronization points between lanes per pass */ +#define ARGON2_SYNC_POINTS UINT32_C(4) + +/* Minimum and maximum digest size in bytes */ +#define ARGON2_MIN_OUTLEN UINT32_C(4) +#define ARGON2_MAX_OUTLEN UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum number of memory blocks (each of BLOCK_SIZE bytes) */ +#define ARGON2_MIN_MEMORY (2 * ARGON2_SYNC_POINTS) /* 2 blocks per slice */ + +#define ARGON2_MIN(a, b) ((a) < (b) ? (a) : (b)) +/* Max memory size is addressing-space/2, topping at 2^32 blocks (4 TB) */ +#define ARGON2_MAX_MEMORY_BITS \ + ARGON2_MIN(UINT32_C(32), (sizeof(void *) * CHAR_BIT - 10 - 1)) +#define ARGON2_MAX_MEMORY \ + ARGON2_MIN(UINT32_C(0xFFFFFFFF), UINT64_C(1) << ARGON2_MAX_MEMORY_BITS) + +/* Minimum and maximum number of passes */ +#define ARGON2_MIN_TIME UINT32_C(1) +#define ARGON2_MAX_TIME UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum password length in bytes */ +#define ARGON2_MIN_PWD_LENGTH UINT32_C(0) +#define ARGON2_MAX_PWD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum associated data length in bytes */ +#define ARGON2_MIN_AD_LENGTH UINT32_C(0) +#define ARGON2_MAX_AD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum salt length in bytes */ +#define ARGON2_MIN_SALT_LENGTH UINT32_C(8) +#define ARGON2_MAX_SALT_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum key length in bytes */ +#define ARGON2_MIN_SECRET UINT32_C(0) +#define ARGON2_MAX_SECRET UINT32_C(0xFFFFFFFF) + +/* Flags to determine which fields are securely wiped (default = no wipe). */ +#define ARGON2_DEFAULT_FLAGS UINT32_C(0) +#define ARGON2_FLAG_CLEAR_PASSWORD (UINT32_C(1) << 0) +#define ARGON2_FLAG_CLEAR_SECRET (UINT32_C(1) << 1) + +/* Global flag to determine if we are wiping internal memory buffers. This flag + * is defined in core.c and defaults to 1 (wipe internal memory). */ +extern int FLAG_clear_internal_memory; + +/* Error codes */ +typedef enum Argon2_ErrorCodes { + ARGON2_OK = 0, + + ARGON2_OUTPUT_PTR_NULL = -1, + + ARGON2_OUTPUT_TOO_SHORT = -2, + ARGON2_OUTPUT_TOO_LONG = -3, + + ARGON2_PWD_TOO_SHORT = -4, + ARGON2_PWD_TOO_LONG = -5, + + ARGON2_SALT_TOO_SHORT = -6, + ARGON2_SALT_TOO_LONG = -7, + + ARGON2_AD_TOO_SHORT = -8, + ARGON2_AD_TOO_LONG = -9, + + ARGON2_SECRET_TOO_SHORT = -10, + ARGON2_SECRET_TOO_LONG = -11, + + ARGON2_TIME_TOO_SMALL = -12, + ARGON2_TIME_TOO_LARGE = -13, + + ARGON2_MEMORY_TOO_LITTLE = -14, + ARGON2_MEMORY_TOO_MUCH = -15, + + ARGON2_LANES_TOO_FEW = -16, + ARGON2_LANES_TOO_MANY = -17, + + ARGON2_PWD_PTR_MISMATCH = -18, /* NULL ptr with non-zero length */ + ARGON2_SALT_PTR_MISMATCH = -19, /* NULL ptr with non-zero length */ + ARGON2_SECRET_PTR_MISMATCH = -20, /* NULL ptr with non-zero length */ + ARGON2_AD_PTR_MISMATCH = -21, /* NULL ptr with non-zero length */ + + ARGON2_MEMORY_ALLOCATION_ERROR = -22, + + ARGON2_FREE_MEMORY_CBK_NULL = -23, + ARGON2_ALLOCATE_MEMORY_CBK_NULL = -24, + + ARGON2_INCORRECT_PARAMETER = -25, + ARGON2_INCORRECT_TYPE = -26, + + ARGON2_OUT_PTR_MISMATCH = -27, + + ARGON2_THREADS_TOO_FEW = -28, + ARGON2_THREADS_TOO_MANY = -29, + + ARGON2_MISSING_ARGS = -30, + + ARGON2_ENCODING_FAIL = -31, + + ARGON2_DECODING_FAIL = -32, + + ARGON2_THREAD_FAIL = -33, + + ARGON2_DECODING_LENGTH_FAIL = -34, + + ARGON2_VERIFY_MISMATCH = -35 +} argon2_error_codes; + +/* Memory allocator types --- for external allocation */ +typedef int (*allocate_fptr)(uint8_t **memory, size_t bytes_to_allocate); +typedef void (*deallocate_fptr)(uint8_t *memory, size_t bytes_to_allocate); + +/* Argon2 external data structures */ + +/* + ***** + * Context: structure to hold Argon2 inputs: + * output array and its length, + * password and its length, + * salt and its length, + * secret and its length, + * associated data and its length, + * number of passes, amount of used memory (in KBytes, can be rounded up a bit) + * number of parallel threads that will be run. + * All the parameters above affect the output hash value. + * Additionally, two function pointers can be provided to allocate and + * deallocate the memory (if NULL, memory will be allocated internally). + * Also, three flags indicate whether to erase password, secret as soon as they + * are pre-hashed (and thus not needed anymore), and the entire memory + ***** + * Simplest situation: you have output array out[8], password is stored in + * pwd[32], salt is stored in salt[16], you do not have keys nor associated + * data. You need to spend 1 GB of RAM and you run 5 passes of Argon2d with + * 4 parallel lanes. + * You want to erase the password, but you're OK with last pass not being + * erased. You want to use the default memory allocator. + * Then you initialize: + Argon2_Context(out,8,pwd,32,salt,16,NULL,0,NULL,0,5,1<<20,4,4,NULL,NULL,true,false,false,false) + */ +typedef struct Argon2_Context { + uint8_t *out; /* output array */ + uint32_t outlen; /* digest length */ + + uint8_t *pwd; /* password array */ + uint32_t pwdlen; /* password length */ + + uint8_t *salt; /* salt array */ + uint32_t saltlen; /* salt length */ + + uint8_t *secret; /* key array */ + uint32_t secretlen; /* key length */ + + uint8_t *ad; /* associated data array */ + uint32_t adlen; /* associated data length */ + + uint32_t t_cost; /* number of passes */ + uint32_t m_cost; /* amount of memory requested (KB) */ + uint32_t lanes; /* number of lanes */ + uint32_t threads; /* maximum number of threads */ + + uint32_t version; /* version number */ + + allocate_fptr allocate_cbk; /* pointer to memory allocator */ + deallocate_fptr free_cbk; /* pointer to memory deallocator */ + + uint32_t flags; /* array of bool options */ +} argon2_context; + +/* Argon2 primitive type */ +typedef enum Argon2_type { + Argon2_d = 0, + Argon2_i = 1, + Argon2_id = 2 +} argon2_type; + +/* Version of the algorithm */ +typedef enum Argon2_version { + ARGON2_VERSION_10 = 0x10, + ARGON2_VERSION_13 = 0x13, + ARGON2_VERSION_NUMBER = ARGON2_VERSION_13 +} argon2_version; + +/* + * Function that gives the string representation of an argon2_type. + * @param type The argon2_type that we want the string for + * @param uppercase Whether the string should have the first letter uppercase + * @return NULL if invalid type, otherwise the string representation. + */ +ARGON2_PUBLIC const char *argon2_type2string(argon2_type type, int uppercase); + +/* + * Function that performs memory-hard hashing with certain degree of parallelism + * @param context Pointer to the Argon2 internal structure + * @return Error code if smth is wrong, ARGON2_OK otherwise + */ +ARGON2_PUBLIC int argon2_ctx(argon2_context *context, argon2_type type); + +/** + * Hashes a password with Argon2i, producing an encoded hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hashlen Desired length of the hash in bytes + * @param encoded Buffer where to write the encoded hash + * @param encodedlen Size of the buffer (thus max size of the encoded hash) + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +/** + * Hashes a password with Argon2i, producing a raw hash at @hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hash Buffer where to write the raw hash - updated by the function + * @param hashlen Desired length of the hash in bytes + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2d_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2id_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2id_hash_raw(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version); + +/** + * Verifies a password against an encoded string + * Encoded string is restricted as in validate_inputs() + * @param encoded String encoding parameters, salt, hash + * @param pwd Pointer to password + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2d_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2id_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify(const char *encoded, const void *pwd, + const size_t pwdlen, argon2_type type); + +/** + * Argon2d: Version of Argon2 that picks memory blocks depending + * on the password and salt. Only for side-channel-free + * environment!! + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_ctx(argon2_context *context); + +/** + * Argon2i: Version of Argon2 that picks memory blocks + * independent on the password and salt. Good for side-channels, + * but worse w.r.t. tradeoff attacks if only one pass is used. + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_ctx(argon2_context *context); + +/** + * Argon2id: Version of Argon2 where the first half-pass over memory is + * password-independent, the rest are password-dependent (on the password and + * salt). OK against side channels (they reduce to 1/2-pass Argon2i), and + * better with w.r.t. tradeoff attacks (similar to Argon2d). + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_ctx(argon2_context *context); + +/** + * Verify if a given password is correct for Argon2d hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2i hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2id hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_verify_ctx(argon2_context *context, + const char *hash); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type); + +/** + * Get the associated error message for given error code + * @return The error message associated with the given error code + */ +ARGON2_PUBLIC const char *argon2_error_message(int error_code); + +/** + * Returns the encoded hash length for the given input parameters + * @param t_cost Number of iterations + * @param m_cost Memory usage in kibibytes + * @param parallelism Number of threads; used to compute lanes + * @param saltlen Salt size in bytes + * @param hashlen Hash size in bytes + * @param type The argon2_type that we want the encoded length for + * @return The encoded hash length in bytes + */ +ARGON2_PUBLIC size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, + uint32_t parallelism, uint32_t saltlen, + uint32_t hashlen, argon2_type type); + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/lib/crypto_backend/argon2/blake2/blake2-impl.h b/lib/crypto_backend/argon2/blake2/blake2-impl.h new file mode 100644 index 0000000..dcac827 --- /dev/null +++ b/lib/crypto_backend/argon2/blake2/blake2-impl.h @@ -0,0 +1,154 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_IMPL_H +#define PORTABLE_BLAKE2_IMPL_H + +#include +#include + +#if defined(_MSC_VER) +#define BLAKE2_INLINE __inline +#elif defined(__GNUC__) || defined(__clang__) +#define BLAKE2_INLINE __inline__ +#else +#define BLAKE2_INLINE +#endif + +/* Argon2 Team - Begin Code */ +/* + Not an exhaustive list, but should cover the majority of modern platforms + Additionally, the code will always be correct---this is only a performance + tweak. +*/ +#if (defined(__BYTE_ORDER__) && \ + (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)) || \ + defined(__LITTLE_ENDIAN__) || defined(__ARMEL__) || defined(__MIPSEL__) || \ + defined(__AARCH64EL__) || defined(__amd64__) || defined(__i386__) || \ + defined(_M_IX86) || defined(_M_X64) || defined(_M_AMD64) || \ + defined(_M_ARM) +#define NATIVE_LITTLE_ENDIAN +#endif +/* Argon2 Team - End Code */ + +static BLAKE2_INLINE uint32_t load32(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint32_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint32_t w = *p++; + w |= (uint32_t)(*p++) << 8; + w |= (uint32_t)(*p++) << 16; + w |= (uint32_t)(*p++) << 24; + return w; +#endif +} + +static BLAKE2_INLINE uint64_t load64(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint64_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + w |= (uint64_t)(*p++) << 48; + w |= (uint64_t)(*p++) << 56; + return w; +#endif +} + +static BLAKE2_INLINE void store32(void *dst, uint32_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE void store64(void *dst, uint64_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE uint64_t load48(const void *src) { + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + return w; +} + +static BLAKE2_INLINE void store48(void *dst, uint64_t w) { + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +} + +static BLAKE2_INLINE uint32_t rotr32(const uint32_t w, const unsigned c) { + return (w >> c) | (w << (32 - c)); +} + +static BLAKE2_INLINE uint64_t rotr64(const uint64_t w, const unsigned c) { + return (w >> c) | (w << (64 - c)); +} + +#endif diff --git a/lib/crypto_backend/argon2/blake2/blake2.h b/lib/crypto_backend/argon2/blake2/blake2.h new file mode 100644 index 0000000..0c1b0ee --- /dev/null +++ b/lib/crypto_backend/argon2/blake2/blake2.h @@ -0,0 +1,89 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_H +#define PORTABLE_BLAKE2_H + +#include "../argon2.h" + +#if defined(__cplusplus) +extern "C" { +#endif + +enum blake2b_constant { + BLAKE2B_BLOCKBYTES = 128, + BLAKE2B_OUTBYTES = 64, + BLAKE2B_KEYBYTES = 64, + BLAKE2B_SALTBYTES = 16, + BLAKE2B_PERSONALBYTES = 16 +}; + +#pragma pack(push, 1) +typedef struct __blake2b_param { + uint8_t digest_length; /* 1 */ + uint8_t key_length; /* 2 */ + uint8_t fanout; /* 3 */ + uint8_t depth; /* 4 */ + uint32_t leaf_length; /* 8 */ + uint64_t node_offset; /* 16 */ + uint8_t node_depth; /* 17 */ + uint8_t inner_length; /* 18 */ + uint8_t reserved[14]; /* 32 */ + uint8_t salt[BLAKE2B_SALTBYTES]; /* 48 */ + uint8_t personal[BLAKE2B_PERSONALBYTES]; /* 64 */ +} blake2b_param; +#pragma pack(pop) + +typedef struct __blake2b_state { + uint64_t h[8]; + uint64_t t[2]; + uint64_t f[2]; + uint8_t buf[BLAKE2B_BLOCKBYTES]; + unsigned buflen; + unsigned outlen; + uint8_t last_node; +} blake2b_state; + +/* Ensure param structs have not been wrongly padded */ +/* Poor man's static_assert */ +enum { + blake2_size_check_0 = 1 / !!(CHAR_BIT == 8), + blake2_size_check_2 = + 1 / !!(sizeof(blake2b_param) == sizeof(uint64_t) * CHAR_BIT) +}; + +/* Streaming API */ +ARGON2_LOCAL int blake2b_init(blake2b_state *S, size_t outlen); +ARGON2_LOCAL int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen); +ARGON2_LOCAL int blake2b_init_param(blake2b_state *S, const blake2b_param *P); +ARGON2_LOCAL int blake2b_update(blake2b_state *S, const void *in, size_t inlen); +ARGON2_LOCAL int blake2b_final(blake2b_state *S, void *out, size_t outlen); + +/* Simple API */ +ARGON2_LOCAL int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen); + +/* Argon2 Team - Begin Code */ +ARGON2_LOCAL int blake2b_long(void *out, size_t outlen, const void *in, size_t inlen); +/* Argon2 Team - End Code */ + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/lib/crypto_backend/argon2/blake2/blake2b.c b/lib/crypto_backend/argon2/blake2/blake2b.c new file mode 100644 index 0000000..d8f69e8 --- /dev/null +++ b/lib/crypto_backend/argon2/blake2/blake2b.c @@ -0,0 +1,392 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "blake2.h" +#include "blake2-impl.h" + +void clear_internal_memory(void *v, size_t n); + +static const uint64_t blake2b_IV[8] = { + UINT64_C(0x6a09e667f3bcc908), UINT64_C(0xbb67ae8584caa73b), + UINT64_C(0x3c6ef372fe94f82b), UINT64_C(0xa54ff53a5f1d36f1), + UINT64_C(0x510e527fade682d1), UINT64_C(0x9b05688c2b3e6c1f), + UINT64_C(0x1f83d9abfb41bd6b), UINT64_C(0x5be0cd19137e2179)}; + +static const unsigned int blake2b_sigma[12][16] = { + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, + {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4}, + {7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8}, + {9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13}, + {2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9}, + {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11}, + {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10}, + {6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5}, + {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0}, + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, +}; + +static BLAKE2_INLINE void blake2b_set_lastnode(blake2b_state *S) { + S->f[1] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_set_lastblock(blake2b_state *S) { + if (S->last_node) { + blake2b_set_lastnode(S); + } + S->f[0] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_increment_counter(blake2b_state *S, + uint64_t inc) { + S->t[0] += inc; + S->t[1] += (S->t[0] < inc); +} + +static BLAKE2_INLINE void blake2b_invalidate_state(blake2b_state *S) { + clear_internal_memory(S, sizeof(*S)); /* wipe */ + blake2b_set_lastblock(S); /* invalidate for further use */ +} + +static BLAKE2_INLINE void blake2b_init0(blake2b_state *S) { + memset(S, 0, sizeof(*S)); + memcpy(S->h, blake2b_IV, sizeof(S->h)); +} + +int blake2b_init_param(blake2b_state *S, const blake2b_param *P) { + const unsigned char *p = (const unsigned char *)P; + unsigned int i; + + if (NULL == P || NULL == S) { + return -1; + } + + blake2b_init0(S); + /* IV XOR Parameter Block */ + for (i = 0; i < 8; ++i) { + S->h[i] ^= load64(&p[i * sizeof(S->h[i])]); + } + S->outlen = P->digest_length; + return 0; +} + +/* Sequential blake2b initialization */ +int blake2b_init(blake2b_state *S, size_t outlen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for unkeyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = 0; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + return blake2b_init_param(S, &P); +} + +int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + if ((key == 0) || (keylen == 0) || (keylen > BLAKE2B_KEYBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for keyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = (uint8_t)keylen; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + if (blake2b_init_param(S, &P) < 0) { + blake2b_invalidate_state(S); + return -1; + } + + { + uint8_t block[BLAKE2B_BLOCKBYTES]; + memset(block, 0, BLAKE2B_BLOCKBYTES); + memcpy(block, key, keylen); + blake2b_update(S, block, BLAKE2B_BLOCKBYTES); + /* Burn the key from stack */ + clear_internal_memory(block, BLAKE2B_BLOCKBYTES); + } + return 0; +} + +static void blake2b_compress(blake2b_state *S, const uint8_t *block) { + uint64_t m[16]; + uint64_t v[16]; + unsigned int i, r; + + for (i = 0; i < 16; ++i) { + m[i] = load64(block + i * sizeof(m[i])); + } + + for (i = 0; i < 8; ++i) { + v[i] = S->h[i]; + } + + v[8] = blake2b_IV[0]; + v[9] = blake2b_IV[1]; + v[10] = blake2b_IV[2]; + v[11] = blake2b_IV[3]; + v[12] = blake2b_IV[4] ^ S->t[0]; + v[13] = blake2b_IV[5] ^ S->t[1]; + v[14] = blake2b_IV[6] ^ S->f[0]; + v[15] = blake2b_IV[7] ^ S->f[1]; + +#define G(r, i, a, b, c, d) \ + do { \ + a = a + b + m[blake2b_sigma[r][2 * i + 0]]; \ + d = rotr64(d ^ a, 32); \ + c = c + d; \ + b = rotr64(b ^ c, 24); \ + a = a + b + m[blake2b_sigma[r][2 * i + 1]]; \ + d = rotr64(d ^ a, 16); \ + c = c + d; \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define ROUND(r) \ + do { \ + G(r, 0, v[0], v[4], v[8], v[12]); \ + G(r, 1, v[1], v[5], v[9], v[13]); \ + G(r, 2, v[2], v[6], v[10], v[14]); \ + G(r, 3, v[3], v[7], v[11], v[15]); \ + G(r, 4, v[0], v[5], v[10], v[15]); \ + G(r, 5, v[1], v[6], v[11], v[12]); \ + G(r, 6, v[2], v[7], v[8], v[13]); \ + G(r, 7, v[3], v[4], v[9], v[14]); \ + } while ((void)0, 0) + + for (r = 0; r < 12; ++r) { + ROUND(r); + } + + for (i = 0; i < 8; ++i) { + S->h[i] = S->h[i] ^ v[i] ^ v[i + 8]; + } + +#undef G +#undef ROUND +} + +int blake2b_update(blake2b_state *S, const void *in, size_t inlen) { + const uint8_t *pin = (const uint8_t *)in; + + if (inlen == 0) { + return 0; + } + + /* Sanity check */ + if (S == NULL || in == NULL) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + if (S->buflen + inlen > BLAKE2B_BLOCKBYTES) { + /* Complete current block */ + size_t left = S->buflen; + size_t fill = BLAKE2B_BLOCKBYTES - left; + memcpy(&S->buf[left], pin, fill); + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, S->buf); + S->buflen = 0; + inlen -= fill; + pin += fill; + /* Avoid buffer copies when possible */ + while (inlen > BLAKE2B_BLOCKBYTES) { + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, pin); + inlen -= BLAKE2B_BLOCKBYTES; + pin += BLAKE2B_BLOCKBYTES; + } + } + memcpy(&S->buf[S->buflen], pin, inlen); + S->buflen += (unsigned int)inlen; + return 0; +} + +int blake2b_final(blake2b_state *S, void *out, size_t outlen) { + uint8_t buffer[BLAKE2B_OUTBYTES] = {0}; + unsigned int i; + + /* Sanity checks */ + if (S == NULL || out == NULL || outlen < S->outlen) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + blake2b_increment_counter(S, S->buflen); + blake2b_set_lastblock(S); + memset(&S->buf[S->buflen], 0, BLAKE2B_BLOCKBYTES - S->buflen); /* Padding */ + blake2b_compress(S, S->buf); + + for (i = 0; i < 8; ++i) { /* Output full hash to temp buffer */ + store64(buffer + sizeof(S->h[i]) * i, S->h[i]); + } + + memcpy(out, buffer, S->outlen); + clear_internal_memory(buffer, sizeof(buffer)); + clear_internal_memory(S->buf, sizeof(S->buf)); + clear_internal_memory(S->h, sizeof(S->h)); + return 0; +} + +int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen) { + blake2b_state S; + int ret = -1; + + /* Verify parameters */ + if (NULL == in && inlen > 0) { + goto fail; + } + + if (NULL == out || outlen == 0 || outlen > BLAKE2B_OUTBYTES) { + goto fail; + } + + if ((NULL == key && keylen > 0) || keylen > BLAKE2B_KEYBYTES) { + goto fail; + } + + if (keylen > 0) { + if (blake2b_init_key(&S, outlen, key, keylen) < 0) { + goto fail; + } + } else { + if (blake2b_init(&S, outlen) < 0) { + goto fail; + } + } + + if (blake2b_update(&S, in, inlen) < 0) { + goto fail; + } + ret = blake2b_final(&S, out, outlen); + +fail: + clear_internal_memory(&S, sizeof(S)); + return ret; +} + +/* Argon2 Team - Begin Code */ +int blake2b_long(void *pout, size_t outlen, const void *in, size_t inlen) { + uint8_t *out = (uint8_t *)pout; + blake2b_state blake_state; + uint8_t outlen_bytes[sizeof(uint32_t)] = {0}; + int ret = -1; + + if (outlen > UINT32_MAX) { + goto fail; + } + + /* Ensure little-endian byte order! */ + store32(outlen_bytes, (uint32_t)outlen); + +#define TRY(statement) \ + do { \ + ret = statement; \ + if (ret < 0) { \ + goto fail; \ + } \ + } while ((void)0, 0) + + if (outlen <= BLAKE2B_OUTBYTES) { + TRY(blake2b_init(&blake_state, outlen)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out, outlen)); + } else { + uint32_t toproduce; + uint8_t out_buffer[BLAKE2B_OUTBYTES]; + uint8_t in_buffer[BLAKE2B_OUTBYTES]; + TRY(blake2b_init(&blake_state, BLAKE2B_OUTBYTES)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce = (uint32_t)outlen - BLAKE2B_OUTBYTES / 2; + + while (toproduce > BLAKE2B_OUTBYTES) { + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer, + BLAKE2B_OUTBYTES, NULL, 0)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce -= BLAKE2B_OUTBYTES / 2; + } + + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL, + 0)); + memcpy(out, out_buffer, toproduce); + } +fail: + clear_internal_memory(&blake_state, sizeof(blake_state)); + return ret; +#undef TRY +} +/* Argon2 Team - End Code */ diff --git a/lib/crypto_backend/argon2/blake2/blamka-round-opt.h b/lib/crypto_backend/argon2/blake2/blamka-round-opt.h new file mode 100644 index 0000000..3127f2a --- /dev/null +++ b/lib/crypto_backend/argon2/blake2/blamka-round-opt.h @@ -0,0 +1,471 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef BLAKE_ROUND_MKA_OPT_H +#define BLAKE_ROUND_MKA_OPT_H + +#include "blake2-impl.h" + +#include +#if defined(__SSSE3__) +#include /* for _mm_shuffle_epi8 and _mm_alignr_epi8 */ +#endif + +#if defined(__XOP__) && (defined(__GNUC__) || defined(__clang__)) +#include +#endif + +#if !defined(__AVX512F__) +#if !defined(__AVX2__) +#if !defined(__XOP__) +#if defined(__SSSE3__) +#define r16 \ + (_mm_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)) +#define r24 \ + (_mm_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)) +#define _mm_roti_epi64(x, c) \ + (-(c) == 32) \ + ? _mm_shuffle_epi32((x), _MM_SHUFFLE(2, 3, 0, 1)) \ + : (-(c) == 24) \ + ? _mm_shuffle_epi8((x), r24) \ + : (-(c) == 16) \ + ? _mm_shuffle_epi8((x), r16) \ + : (-(c) == 63) \ + ? _mm_xor_si128(_mm_srli_epi64((x), -(c)), \ + _mm_add_epi64((x), (x))) \ + : _mm_xor_si128(_mm_srli_epi64((x), -(c)), \ + _mm_slli_epi64((x), 64 - (-(c)))) +#else /* defined(__SSE2__) */ +#define _mm_roti_epi64(r, c) \ + _mm_xor_si128(_mm_srli_epi64((r), -(c)), _mm_slli_epi64((r), 64 - (-(c)))) +#endif +#else +#endif + +static BLAKE2_INLINE __m128i fBlaMka(__m128i x, __m128i y) { + const __m128i z = _mm_mul_epu32(x, y); + return _mm_add_epi64(_mm_add_epi64(x, y), _mm_add_epi64(z, z)); +} + +#define G1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka(A0, B0); \ + A1 = fBlaMka(A1, B1); \ + \ + D0 = _mm_xor_si128(D0, A0); \ + D1 = _mm_xor_si128(D1, A1); \ + \ + D0 = _mm_roti_epi64(D0, -32); \ + D1 = _mm_roti_epi64(D1, -32); \ + \ + C0 = fBlaMka(C0, D0); \ + C1 = fBlaMka(C1, D1); \ + \ + B0 = _mm_xor_si128(B0, C0); \ + B1 = _mm_xor_si128(B1, C1); \ + \ + B0 = _mm_roti_epi64(B0, -24); \ + B1 = _mm_roti_epi64(B1, -24); \ + } while ((void)0, 0) + +#define G2(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = fBlaMka(A0, B0); \ + A1 = fBlaMka(A1, B1); \ + \ + D0 = _mm_xor_si128(D0, A0); \ + D1 = _mm_xor_si128(D1, A1); \ + \ + D0 = _mm_roti_epi64(D0, -16); \ + D1 = _mm_roti_epi64(D1, -16); \ + \ + C0 = fBlaMka(C0, D0); \ + C1 = fBlaMka(C1, D1); \ + \ + B0 = _mm_xor_si128(B0, C0); \ + B1 = _mm_xor_si128(B1, C1); \ + \ + B0 = _mm_roti_epi64(B0, -63); \ + B1 = _mm_roti_epi64(B1, -63); \ + } while ((void)0, 0) + +#if defined(__SSSE3__) +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = _mm_alignr_epi8(B1, B0, 8); \ + __m128i t1 = _mm_alignr_epi8(B0, B1, 8); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = _mm_alignr_epi8(D1, D0, 8); \ + t1 = _mm_alignr_epi8(D0, D1, 8); \ + D0 = t1; \ + D1 = t0; \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = _mm_alignr_epi8(B0, B1, 8); \ + __m128i t1 = _mm_alignr_epi8(B1, B0, 8); \ + B0 = t0; \ + B1 = t1; \ + \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + \ + t0 = _mm_alignr_epi8(D0, D1, 8); \ + t1 = _mm_alignr_epi8(D1, D0, 8); \ + D0 = t1; \ + D1 = t0; \ + } while ((void)0, 0) +#else /* SSE2 */ +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0 = D0; \ + __m128i t1 = B0; \ + D0 = C0; \ + C0 = C1; \ + C1 = D0; \ + D0 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t0, t0)); \ + D1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(D1, D1)); \ + B0 = _mm_unpackhi_epi64(B0, _mm_unpacklo_epi64(B1, B1)); \ + B1 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(t1, t1)); \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + __m128i t0, t1; \ + t0 = C0; \ + C0 = C1; \ + C1 = t0; \ + t0 = B0; \ + t1 = D0; \ + B0 = _mm_unpackhi_epi64(B1, _mm_unpacklo_epi64(B0, B0)); \ + B1 = _mm_unpackhi_epi64(t0, _mm_unpacklo_epi64(B1, B1)); \ + D0 = _mm_unpackhi_epi64(D0, _mm_unpacklo_epi64(D1, D1)); \ + D1 = _mm_unpackhi_epi64(D1, _mm_unpacklo_epi64(t1, t1)); \ + } while ((void)0, 0) +#endif + +#define BLAKE2_ROUND(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ + \ + UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void)0, 0) +#else /* __AVX2__ */ + +#include + +#define rotr32(x) _mm256_shuffle_epi32(x, _MM_SHUFFLE(2, 3, 0, 1)) +#define rotr24(x) _mm256_shuffle_epi8(x, _mm256_setr_epi8(3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10, 3, 4, 5, 6, 7, 0, 1, 2, 11, 12, 13, 14, 15, 8, 9, 10)) +#define rotr16(x) _mm256_shuffle_epi8(x, _mm256_setr_epi8(2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9, 2, 3, 4, 5, 6, 7, 0, 1, 10, 11, 12, 13, 14, 15, 8, 9)) +#define rotr63(x) _mm256_xor_si256(_mm256_srli_epi64((x), 63), _mm256_add_epi64((x), (x))) + +#define G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i ml = _mm256_mul_epu32(A0, B0); \ + ml = _mm256_add_epi64(ml, ml); \ + A0 = _mm256_add_epi64(A0, _mm256_add_epi64(B0, ml)); \ + D0 = _mm256_xor_si256(D0, A0); \ + D0 = rotr32(D0); \ + \ + ml = _mm256_mul_epu32(C0, D0); \ + ml = _mm256_add_epi64(ml, ml); \ + C0 = _mm256_add_epi64(C0, _mm256_add_epi64(D0, ml)); \ + \ + B0 = _mm256_xor_si256(B0, C0); \ + B0 = rotr24(B0); \ + \ + ml = _mm256_mul_epu32(A1, B1); \ + ml = _mm256_add_epi64(ml, ml); \ + A1 = _mm256_add_epi64(A1, _mm256_add_epi64(B1, ml)); \ + D1 = _mm256_xor_si256(D1, A1); \ + D1 = rotr32(D1); \ + \ + ml = _mm256_mul_epu32(C1, D1); \ + ml = _mm256_add_epi64(ml, ml); \ + C1 = _mm256_add_epi64(C1, _mm256_add_epi64(D1, ml)); \ + \ + B1 = _mm256_xor_si256(B1, C1); \ + B1 = rotr24(B1); \ + } while((void)0, 0); + +#define G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i ml = _mm256_mul_epu32(A0, B0); \ + ml = _mm256_add_epi64(ml, ml); \ + A0 = _mm256_add_epi64(A0, _mm256_add_epi64(B0, ml)); \ + D0 = _mm256_xor_si256(D0, A0); \ + D0 = rotr16(D0); \ + \ + ml = _mm256_mul_epu32(C0, D0); \ + ml = _mm256_add_epi64(ml, ml); \ + C0 = _mm256_add_epi64(C0, _mm256_add_epi64(D0, ml)); \ + B0 = _mm256_xor_si256(B0, C0); \ + B0 = rotr63(B0); \ + \ + ml = _mm256_mul_epu32(A1, B1); \ + ml = _mm256_add_epi64(ml, ml); \ + A1 = _mm256_add_epi64(A1, _mm256_add_epi64(B1, ml)); \ + D1 = _mm256_xor_si256(D1, A1); \ + D1 = rotr16(D1); \ + \ + ml = _mm256_mul_epu32(C1, D1); \ + ml = _mm256_add_epi64(ml, ml); \ + C1 = _mm256_add_epi64(C1, _mm256_add_epi64(D1, ml)); \ + B1 = _mm256_xor_si256(B1, C1); \ + B1 = rotr63(B1); \ + } while((void)0, 0); + +#define DIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm256_permute4x64_epi64(B0, _MM_SHUFFLE(0, 3, 2, 1)); \ + C0 = _mm256_permute4x64_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + D0 = _mm256_permute4x64_epi64(D0, _MM_SHUFFLE(2, 1, 0, 3)); \ + \ + B1 = _mm256_permute4x64_epi64(B1, _MM_SHUFFLE(0, 3, 2, 1)); \ + C1 = _mm256_permute4x64_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ + D1 = _mm256_permute4x64_epi64(D1, _MM_SHUFFLE(2, 1, 0, 3)); \ + } while((void)0, 0); + +#define DIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i tmp1 = _mm256_blend_epi32(B0, B1, 0xCC); \ + __m256i tmp2 = _mm256_blend_epi32(B0, B1, 0x33); \ + B1 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + B0 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + \ + tmp1 = C0; \ + C0 = C1; \ + C1 = tmp1; \ + \ + tmp1 = _mm256_blend_epi32(D0, D1, 0xCC); \ + tmp2 = _mm256_blend_epi32(D0, D1, 0x33); \ + D0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + D1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + } while(0); + +#define UNDIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm256_permute4x64_epi64(B0, _MM_SHUFFLE(2, 1, 0, 3)); \ + C0 = _mm256_permute4x64_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + D0 = _mm256_permute4x64_epi64(D0, _MM_SHUFFLE(0, 3, 2, 1)); \ + \ + B1 = _mm256_permute4x64_epi64(B1, _MM_SHUFFLE(2, 1, 0, 3)); \ + C1 = _mm256_permute4x64_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ + D1 = _mm256_permute4x64_epi64(D1, _MM_SHUFFLE(0, 3, 2, 1)); \ + } while((void)0, 0); + +#define UNDIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + __m256i tmp1 = _mm256_blend_epi32(B0, B1, 0xCC); \ + __m256i tmp2 = _mm256_blend_epi32(B0, B1, 0x33); \ + B0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + B1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + \ + tmp1 = C0; \ + C0 = C1; \ + C1 = tmp1; \ + \ + tmp1 = _mm256_blend_epi32(D0, D1, 0x33); \ + tmp2 = _mm256_blend_epi32(D0, D1, 0xCC); \ + D0 = _mm256_permute4x64_epi64(tmp1, _MM_SHUFFLE(2,3,0,1)); \ + D1 = _mm256_permute4x64_epi64(tmp2, _MM_SHUFFLE(2,3,0,1)); \ + } while((void)0, 0); + +#define BLAKE2_ROUND_1(A0, A1, B0, B1, C0, C1, D0, D1) \ + do{ \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + DIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + UNDIAGONALIZE_1(A0, B0, C0, D0, A1, B1, C1, D1) \ + } while((void)0, 0); + +#define BLAKE2_ROUND_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do{ \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + DIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + G1_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + G2_AVX2(A0, A1, B0, B1, C0, C1, D0, D1) \ + \ + UNDIAGONALIZE_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + } while((void)0, 0); + +#endif /* __AVX2__ */ + +#else /* __AVX512F__ */ + +#include + +#define ror64(x, n) _mm512_ror_epi64((x), (n)) + +static __m512i muladd(__m512i x, __m512i y) +{ + __m512i z = _mm512_mul_epu32(x, y); + return _mm512_add_epi64(_mm512_add_epi64(x, y), _mm512_add_epi64(z, z)); +} + +#define G1(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = muladd(A0, B0); \ + A1 = muladd(A1, B1); \ +\ + D0 = _mm512_xor_si512(D0, A0); \ + D1 = _mm512_xor_si512(D1, A1); \ +\ + D0 = ror64(D0, 32); \ + D1 = ror64(D1, 32); \ +\ + C0 = muladd(C0, D0); \ + C1 = muladd(C1, D1); \ +\ + B0 = _mm512_xor_si512(B0, C0); \ + B1 = _mm512_xor_si512(B1, C1); \ +\ + B0 = ror64(B0, 24); \ + B1 = ror64(B1, 24); \ + } while ((void)0, 0) + +#define G2(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + A0 = muladd(A0, B0); \ + A1 = muladd(A1, B1); \ +\ + D0 = _mm512_xor_si512(D0, A0); \ + D1 = _mm512_xor_si512(D1, A1); \ +\ + D0 = ror64(D0, 16); \ + D1 = ror64(D1, 16); \ +\ + C0 = muladd(C0, D0); \ + C1 = muladd(C1, D1); \ +\ + B0 = _mm512_xor_si512(B0, C0); \ + B1 = _mm512_xor_si512(B1, C1); \ +\ + B0 = ror64(B0, 63); \ + B1 = ror64(B1, 63); \ + } while ((void)0, 0) + +#define DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm512_permutex_epi64(B0, _MM_SHUFFLE(0, 3, 2, 1)); \ + B1 = _mm512_permutex_epi64(B1, _MM_SHUFFLE(0, 3, 2, 1)); \ +\ + C0 = _mm512_permutex_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + C1 = _mm512_permutex_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ +\ + D0 = _mm512_permutex_epi64(D0, _MM_SHUFFLE(2, 1, 0, 3)); \ + D1 = _mm512_permutex_epi64(D1, _MM_SHUFFLE(2, 1, 0, 3)); \ + } while ((void)0, 0) + +#define UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + B0 = _mm512_permutex_epi64(B0, _MM_SHUFFLE(2, 1, 0, 3)); \ + B1 = _mm512_permutex_epi64(B1, _MM_SHUFFLE(2, 1, 0, 3)); \ +\ + C0 = _mm512_permutex_epi64(C0, _MM_SHUFFLE(1, 0, 3, 2)); \ + C1 = _mm512_permutex_epi64(C1, _MM_SHUFFLE(1, 0, 3, 2)); \ +\ + D0 = _mm512_permutex_epi64(D0, _MM_SHUFFLE(0, 3, 2, 1)); \ + D1 = _mm512_permutex_epi64(D1, _MM_SHUFFLE(0, 3, 2, 1)); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1) \ + do { \ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + DIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + G1(A0, B0, C0, D0, A1, B1, C1, D1); \ + G2(A0, B0, C0, D0, A1, B1, C1, D1); \ +\ + UNDIAGONALIZE(A0, B0, C0, D0, A1, B1, C1, D1); \ + } while ((void)0, 0) + +#define SWAP_HALVES(A0, A1) \ + do { \ + __m512i t0, t1; \ + t0 = _mm512_shuffle_i64x2(A0, A1, _MM_SHUFFLE(1, 0, 1, 0)); \ + t1 = _mm512_shuffle_i64x2(A0, A1, _MM_SHUFFLE(3, 2, 3, 2)); \ + A0 = t0; \ + A1 = t1; \ + } while((void)0, 0) + +#define SWAP_QUARTERS(A0, A1) \ + do { \ + SWAP_HALVES(A0, A1); \ + A0 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A0); \ + A1 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A1); \ + } while((void)0, 0) + +#define UNSWAP_QUARTERS(A0, A1) \ + do { \ + A0 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A0); \ + A1 = _mm512_permutexvar_epi64(_mm512_setr_epi64(0, 1, 4, 5, 2, 3, 6, 7), A1); \ + SWAP_HALVES(A0, A1); \ + } while((void)0, 0) + +#define BLAKE2_ROUND_1(A0, C0, B0, D0, A1, C1, B1, D1) \ + do { \ + SWAP_HALVES(A0, B0); \ + SWAP_HALVES(C0, D0); \ + SWAP_HALVES(A1, B1); \ + SWAP_HALVES(C1, D1); \ + BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1); \ + SWAP_HALVES(A0, B0); \ + SWAP_HALVES(C0, D0); \ + SWAP_HALVES(A1, B1); \ + SWAP_HALVES(C1, D1); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND_2(A0, A1, B0, B1, C0, C1, D0, D1) \ + do { \ + SWAP_QUARTERS(A0, A1); \ + SWAP_QUARTERS(B0, B1); \ + SWAP_QUARTERS(C0, C1); \ + SWAP_QUARTERS(D0, D1); \ + BLAKE2_ROUND(A0, B0, C0, D0, A1, B1, C1, D1); \ + UNSWAP_QUARTERS(A0, A1); \ + UNSWAP_QUARTERS(B0, B1); \ + UNSWAP_QUARTERS(C0, C1); \ + UNSWAP_QUARTERS(D0, D1); \ + } while ((void)0, 0) + +#endif /* __AVX512F__ */ +#endif /* BLAKE_ROUND_MKA_OPT_H */ diff --git a/lib/crypto_backend/argon2/blake2/blamka-round-ref.h b/lib/crypto_backend/argon2/blake2/blamka-round-ref.h new file mode 100644 index 0000000..16cfc1c --- /dev/null +++ b/lib/crypto_backend/argon2/blake2/blamka-round-ref.h @@ -0,0 +1,56 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef BLAKE_ROUND_MKA_H +#define BLAKE_ROUND_MKA_H + +#include "blake2.h" +#include "blake2-impl.h" + +/* designed by the Lyra PHC team */ +static BLAKE2_INLINE uint64_t fBlaMka(uint64_t x, uint64_t y) { + const uint64_t m = UINT64_C(0xFFFFFFFF); + const uint64_t xy = (x & m) * (y & m); + return x + y + 2 * xy; +} + +#define G(a, b, c, d) \ + do { \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 32); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 24); \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 16); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND_NOMSG(v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, \ + v12, v13, v14, v15) \ + do { \ + G(v0, v4, v8, v12); \ + G(v1, v5, v9, v13); \ + G(v2, v6, v10, v14); \ + G(v3, v7, v11, v15); \ + G(v0, v5, v10, v15); \ + G(v1, v6, v11, v12); \ + G(v2, v7, v8, v13); \ + G(v3, v4, v9, v14); \ + } while ((void)0, 0) + +#endif diff --git a/lib/crypto_backend/argon2/core.c b/lib/crypto_backend/argon2/core.c new file mode 100644 index 0000000..b204ba9 --- /dev/null +++ b/lib/crypto_backend/argon2/core.c @@ -0,0 +1,641 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +/*For memory wiping*/ +#ifdef _MSC_VER +#include +#include /* For SecureZeroMemory */ +#endif +#if defined __STDC_LIB_EXT1__ +#define __STDC_WANT_LIB_EXT1__ 1 +#endif +#define VC_GE_2005(version) (version >= 1400) + +#include +#include +#include + +#include "core.h" +#include "thread.h" +#include "blake2/blake2.h" +#include "blake2/blake2-impl.h" + +#ifdef GENKAT +#include "genkat.h" +#endif + +#if defined(__clang__) +#if __has_attribute(optnone) +#define NOT_OPTIMIZED __attribute__((optnone)) +#endif +#elif defined(__GNUC__) +#define GCC_VERSION \ + (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) +#if GCC_VERSION >= 40400 +#define NOT_OPTIMIZED __attribute__((optimize("O0"))) +#endif +#endif +#ifndef NOT_OPTIMIZED +#define NOT_OPTIMIZED +#endif + +/***************Instance and Position constructors**********/ +void init_block_value(block *b, uint8_t in) { memset(b->v, in, sizeof(b->v)); } + +void copy_block(block *dst, const block *src) { + memcpy(dst->v, src->v, sizeof(uint64_t) * ARGON2_QWORDS_IN_BLOCK); +} + +void xor_block(block *dst, const block *src) { + int i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] ^= src->v[i]; + } +} + +static void load_block(block *dst, const void *input) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] = load64((const uint8_t *)input + i * sizeof(dst->v[i])); + } +} + +static void store_block(void *output, const block *src) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + store64((uint8_t *)output + i * sizeof(src->v[i]), src->v[i]); + } +} + +/***************Memory functions*****************/ + +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size) { + size_t memory_size = num*size; + if (memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 1. Check for multiplication overflow */ + if (size != 0 && memory_size / size != num) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 2. Try to allocate with appropriate allocator */ + if (context->allocate_cbk) { + (context->allocate_cbk)(memory, memory_size); + } else { + *memory = malloc(memory_size); + } + + if (*memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + return ARGON2_OK; +} + +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size) { + size_t memory_size = num*size; + clear_internal_memory(memory, memory_size); + if (context->free_cbk) { + (context->free_cbk)(memory, memory_size); + } else { + free(memory); + } +} + +void NOT_OPTIMIZED secure_wipe_memory(void *v, size_t n) { +#if defined(_MSC_VER) && VC_GE_2005(_MSC_VER) + SecureZeroMemory(v, n); +#elif defined memset_s + memset_s(v, n, 0, n); +#elif defined(HAVE_EXPLICIT_BZERO) + explicit_bzero(v, n); +#else + static void *(*const volatile memset_sec)(void *, int, size_t) = &memset; + memset_sec(v, 0, n); +#endif +} + +/* Memory clear flag defaults to true. */ +int FLAG_clear_internal_memory = 1; +void clear_internal_memory(void *v, size_t n) { + if (FLAG_clear_internal_memory && v) { + secure_wipe_memory(v, n); + } +} + +void finalize(const argon2_context *context, argon2_instance_t *instance) { + if (context != NULL && instance != NULL) { + block blockhash; + uint32_t l; + + copy_block(&blockhash, instance->memory + instance->lane_length - 1); + + /* XOR the last blocks */ + for (l = 1; l < instance->lanes; ++l) { + uint32_t last_block_in_lane = + l * instance->lane_length + (instance->lane_length - 1); + xor_block(&blockhash, instance->memory + last_block_in_lane); + } + + /* Hash the result */ + { + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + store_block(blockhash_bytes, &blockhash); + blake2b_long(context->out, context->outlen, blockhash_bytes, + ARGON2_BLOCK_SIZE); + /* clear blockhash and blockhash_bytes */ + clear_internal_memory(blockhash.v, ARGON2_BLOCK_SIZE); + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); + } + +#ifdef GENKAT + print_tag(context->out, context->outlen); +#endif + + free_memory(context, (uint8_t *)instance->memory, + instance->memory_blocks, sizeof(block)); + } +} + +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane) { + /* + * Pass 0: + * This lane : all already finished segments plus already constructed + * blocks in this segment + * Other lanes : all already finished segments + * Pass 1+: + * This lane : (SYNC_POINTS - 1) last segments plus already constructed + * blocks in this segment + * Other lanes : (SYNC_POINTS - 1) last segments + */ + uint32_t reference_area_size; + uint64_t relative_position; + uint32_t start_position, absolute_position; + + if (0 == position->pass) { + /* First pass */ + if (0 == position->slice) { + /* First slice */ + reference_area_size = + position->index - 1; /* all but the previous */ + } else { + if (same_lane) { + /* The same lane => add current segment */ + reference_area_size = + position->slice * instance->segment_length + + position->index - 1; + } else { + reference_area_size = + position->slice * instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + } else { + /* Second pass */ + if (same_lane) { + reference_area_size = instance->lane_length - + instance->segment_length + position->index - + 1; + } else { + reference_area_size = instance->lane_length - + instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + + /* 1.2.4. Mapping pseudo_rand to 0.. and produce + * relative position */ + relative_position = pseudo_rand; + relative_position = relative_position * relative_position >> 32; + relative_position = reference_area_size - 1 - + (reference_area_size * relative_position >> 32); + + /* 1.2.5 Computing starting position */ + start_position = 0; + + if (0 != position->pass) { + start_position = (position->slice == ARGON2_SYNC_POINTS - 1) + ? 0 + : (position->slice + 1) * instance->segment_length; + } + + /* 1.2.6. Computing absolute position */ + absolute_position = (start_position + relative_position) % + instance->lane_length; /* absolute position */ + return absolute_position; +} + +/* Single-threaded version for p=1 case */ +static int fill_memory_blocks_st(argon2_instance_t *instance) { + uint32_t r, s, l; + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position = {r, l, (uint8_t)s, 0}; + fill_segment(instance, position); + } + } +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + return ARGON2_OK; +} + +#if !defined(ARGON2_NO_THREADS) + +#ifdef _WIN32 +static unsigned __stdcall fill_segment_thr(void *thread_data) +#else +static void *fill_segment_thr(void *thread_data) +#endif +{ + argon2_thread_data *my_data = thread_data; + fill_segment(my_data->instance_ptr, my_data->pos); + argon2_thread_exit(); + return 0; +} + +/* Multi-threaded version for p > 1 case */ +static int fill_memory_blocks_mt(argon2_instance_t *instance) { + uint32_t r, s; + argon2_thread_handle_t *thread = NULL; + argon2_thread_data *thr_data = NULL; + int rc = ARGON2_OK; + + /* 1. Allocating space for threads */ + thread = calloc(instance->lanes, sizeof(argon2_thread_handle_t)); + if (thread == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + thr_data = calloc(instance->lanes, sizeof(argon2_thread_data)); + if (thr_data == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + uint32_t l, ll; + + /* 2. Calling threads */ + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position; + + /* 2.1 Join a thread if limit is exceeded */ + if (l >= instance->threads) { + if (argon2_thread_join(thread[l - instance->threads])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + + /* 2.2 Create thread */ + position.pass = r; + position.lane = l; + position.slice = (uint8_t)s; + position.index = 0; + thr_data[l].instance_ptr = + instance; /* preparing the thread input */ + memcpy(&(thr_data[l].pos), &position, + sizeof(argon2_position_t)); + if (argon2_thread_create(&thread[l], &fill_segment_thr, + (void *)&thr_data[l])) { + /* Wait for already running threads */ + for (ll = 0; ll < l; ++ll) + argon2_thread_join(thread[ll]); + rc = ARGON2_THREAD_FAIL; + goto fail; + } + + /* fill_segment(instance, position); */ + /*Non-thread equivalent of the lines above */ + } + + /* 3. Joining remaining threads */ + for (l = instance->lanes - instance->threads; l < instance->lanes; + ++l) { + if (argon2_thread_join(thread[l])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + } + +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + +fail: + if (thread != NULL) { + free(thread); + } + if (thr_data != NULL) { + free(thr_data); + } + return rc; +} + +#endif /* ARGON2_NO_THREADS */ + +int fill_memory_blocks(argon2_instance_t *instance) { + if (instance == NULL || instance->lanes == 0) { + return ARGON2_INCORRECT_PARAMETER; + } +#if defined(ARGON2_NO_THREADS) + return fill_memory_blocks_st(instance); +#else + return instance->threads == 1 ? + fill_memory_blocks_st(instance) : fill_memory_blocks_mt(instance); +#endif +} + +int validate_inputs(const argon2_context *context) { + if (NULL == context) { + return ARGON2_INCORRECT_PARAMETER; + } + + if (NULL == context->out) { + return ARGON2_OUTPUT_PTR_NULL; + } + + /* Validate output length */ + if (ARGON2_MIN_OUTLEN > context->outlen) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + if (ARGON2_MAX_OUTLEN < context->outlen) { + return ARGON2_OUTPUT_TOO_LONG; + } + + /* Validate password (required param) */ + if (NULL == context->pwd) { + if (0 != context->pwdlen) { + return ARGON2_PWD_PTR_MISMATCH; + } + } +#if ARGON2_MIN_PWD_LENGTH > 0 /* cryptsetup: fix gcc warning */ + if (ARGON2_MIN_PWD_LENGTH > context->pwdlen) { + return ARGON2_PWD_TOO_SHORT; + } +#endif + if (ARGON2_MAX_PWD_LENGTH < context->pwdlen) { + return ARGON2_PWD_TOO_LONG; + } + + /* Validate salt (required param) */ + if (NULL == context->salt) { + if (0 != context->saltlen) { + return ARGON2_SALT_PTR_MISMATCH; + } + } + + if (ARGON2_MIN_SALT_LENGTH > context->saltlen) { + return ARGON2_SALT_TOO_SHORT; + } + + if (ARGON2_MAX_SALT_LENGTH < context->saltlen) { + return ARGON2_SALT_TOO_LONG; + } + + /* Validate secret (optional param) */ + if (NULL == context->secret) { + if (0 != context->secretlen) { + return ARGON2_SECRET_PTR_MISMATCH; + } + } else { +#if ARGON2_MIN_SECRET > 0 /* cryptsetup: fix gcc warning */ + if (ARGON2_MIN_SECRET > context->secretlen) { + return ARGON2_SECRET_TOO_SHORT; + } +#endif + if (ARGON2_MAX_SECRET < context->secretlen) { + return ARGON2_SECRET_TOO_LONG; + } + } + + /* Validate associated data (optional param) */ + if (NULL == context->ad) { + if (0 != context->adlen) { + return ARGON2_AD_PTR_MISMATCH; + } + } else { +#if ARGON2_MIN_AD_LENGTH > 0 /* cryptsetup: fix gcc warning */ + if (ARGON2_MIN_AD_LENGTH > context->adlen) { + return ARGON2_AD_TOO_SHORT; + } +#endif + if (ARGON2_MAX_AD_LENGTH < context->adlen) { + return ARGON2_AD_TOO_LONG; + } + } + + /* Validate memory cost */ + if (ARGON2_MIN_MEMORY > context->m_cost) { + return ARGON2_MEMORY_TOO_LITTLE; + } +#if 0 /* UINT32_MAX, cryptsetup: fix gcc warning */ + if (ARGON2_MAX_MEMORY < context->m_cost) { + return ARGON2_MEMORY_TOO_MUCH; + } +#endif + if (context->m_cost < 8 * context->lanes) { + return ARGON2_MEMORY_TOO_LITTLE; + } + + /* Validate time cost */ + if (ARGON2_MIN_TIME > context->t_cost) { + return ARGON2_TIME_TOO_SMALL; + } + + if (ARGON2_MAX_TIME < context->t_cost) { + return ARGON2_TIME_TOO_LARGE; + } + + /* Validate lanes */ + if (ARGON2_MIN_LANES > context->lanes) { + return ARGON2_LANES_TOO_FEW; + } + + if (ARGON2_MAX_LANES < context->lanes) { + return ARGON2_LANES_TOO_MANY; + } + + /* Validate threads */ + if (ARGON2_MIN_THREADS > context->threads) { + return ARGON2_THREADS_TOO_FEW; + } + + if (ARGON2_MAX_THREADS < context->threads) { + return ARGON2_THREADS_TOO_MANY; + } + + if (NULL != context->allocate_cbk && NULL == context->free_cbk) { + return ARGON2_FREE_MEMORY_CBK_NULL; + } + + if (NULL == context->allocate_cbk && NULL != context->free_cbk) { + return ARGON2_ALLOCATE_MEMORY_CBK_NULL; + } + + return ARGON2_OK; +} + +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance) { + uint32_t l; + /* Make the first and second block in each lane as G(H0||0||i) or + G(H0||1||i) */ + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + for (l = 0; l < instance->lanes; ++l) { + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 0); + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH + 4, l); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 0], + blockhash_bytes); + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 1); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 1], + blockhash_bytes); + } + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); +} + +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type) { + blake2b_state BlakeHash; + uint8_t value[sizeof(uint32_t)]; + + if (NULL == context || NULL == blockhash) { + return; + } + + blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH); + + store32(&value, context->lanes); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->outlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->m_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->t_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->version); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, (uint32_t)type); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->pwdlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->pwd != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->pwd, + context->pwdlen); + + if (context->flags & ARGON2_FLAG_CLEAR_PASSWORD) { + secure_wipe_memory(context->pwd, context->pwdlen); + context->pwdlen = 0; + } + } + + store32(&value, context->saltlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->salt != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->salt, + context->saltlen); + } + + store32(&value, context->secretlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->secret != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->secret, + context->secretlen); + + if (context->flags & ARGON2_FLAG_CLEAR_SECRET) { + secure_wipe_memory(context->secret, context->secretlen); + context->secretlen = 0; + } + } + + store32(&value, context->adlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->ad != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->ad, + context->adlen); + } + + blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH); +} + +int initialize(argon2_instance_t *instance, argon2_context *context) { + uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; + int result = ARGON2_OK; + + if (instance == NULL || context == NULL) + return ARGON2_INCORRECT_PARAMETER; + instance->context_ptr = context; + + /* 1. Memory allocation */ + result = allocate_memory(context, (uint8_t **)&(instance->memory), + instance->memory_blocks, sizeof(block)); + if (result != ARGON2_OK) { + return result; + } + + /* 2. Initial hashing */ + /* H_0 + 8 extra bytes to produce the first blocks */ + /* uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; */ + /* Hashing all inputs */ + initial_hash(blockhash, context, instance->type); + /* Zeroing 8 extra bytes */ + clear_internal_memory(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, + ARGON2_PREHASH_SEED_LENGTH - + ARGON2_PREHASH_DIGEST_LENGTH); + +#ifdef GENKAT + initial_kat(blockhash, context, instance->type); +#endif + + /* 3. Creating first blocks, we always have at least two blocks in a slice + */ + fill_first_blocks(blockhash, instance); + /* Clearing the hash */ + clear_internal_memory(blockhash, ARGON2_PREHASH_SEED_LENGTH); + + return ARGON2_OK; +} diff --git a/lib/crypto_backend/argon2/core.h b/lib/crypto_backend/argon2/core.h new file mode 100644 index 0000000..59e2564 --- /dev/null +++ b/lib/crypto_backend/argon2/core.h @@ -0,0 +1,228 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_CORE_H +#define ARGON2_CORE_H + +#include "argon2.h" + +#define CONST_CAST(x) (x)(uintptr_t) + +/**********************Argon2 internal constants*******************************/ + +enum argon2_core_constants { + /* Memory block size in bytes */ + ARGON2_BLOCK_SIZE = 1024, + ARGON2_QWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 8, + ARGON2_OWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 16, + ARGON2_HWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 32, + ARGON2_512BIT_WORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 64, + + /* Number of pseudo-random values generated by one call to Blake in Argon2i + to + generate reference block positions */ + ARGON2_ADDRESSES_IN_BLOCK = 128, + + /* Pre-hashing digest length and its extension*/ + ARGON2_PREHASH_DIGEST_LENGTH = 64, + ARGON2_PREHASH_SEED_LENGTH = 72 +}; + +/*************************Argon2 internal data types***********************/ + +/* + * Structure for the (1KB) memory block implemented as 128 64-bit words. + * Memory blocks can be copied, XORed. Internal words can be accessed by [] (no + * bounds checking). + */ +typedef struct block_ { uint64_t v[ARGON2_QWORDS_IN_BLOCK]; } block; + +/*****************Functions that work with the block******************/ + +/* Initialize each byte of the block with @in */ +void init_block_value(block *b, uint8_t in); + +/* Copy block @src to block @dst */ +void copy_block(block *dst, const block *src); + +/* XOR @src onto @dst bytewise */ +void xor_block(block *dst, const block *src); + +/* + * Argon2 instance: memory pointer, number of passes, amount of memory, type, + * and derived values. + * Used to evaluate the number and location of blocks to construct in each + * thread + */ +typedef struct Argon2_instance_t { + block *memory; /* Memory pointer */ + uint32_t version; + uint32_t passes; /* Number of passes */ + uint32_t memory_blocks; /* Number of blocks in memory */ + uint32_t segment_length; + uint32_t lane_length; + uint32_t lanes; + uint32_t threads; + argon2_type type; + int print_internals; /* whether to print the memory blocks */ + argon2_context *context_ptr; /* points back to original context */ +} argon2_instance_t; + +/* + * Argon2 position: where we construct the block right now. Used to distribute + * work between threads. + */ +typedef struct Argon2_position_t { + uint32_t pass; + uint32_t lane; + uint8_t slice; + uint32_t index; +} argon2_position_t; + +/*Struct that holds the inputs for thread handling FillSegment*/ +typedef struct Argon2_thread_data { + argon2_instance_t *instance_ptr; + argon2_position_t pos; +} argon2_thread_data; + +/*************************Argon2 core functions********************************/ + +/* Allocates memory to the given pointer, uses the appropriate allocator as + * specified in the context. Total allocated memory is num*size. + * @param context argon2_context which specifies the allocator + * @param memory pointer to the pointer to the memory + * @param size the size in bytes for each element to be allocated + * @param num the number of elements to be allocated + * @return ARGON2_OK if @memory is a valid pointer and memory is allocated + */ +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size); + +/* + * Frees memory at the given pointer, uses the appropriate deallocator as + * specified in the context. Also cleans the memory using clear_internal_memory. + * @param context argon2_context which specifies the deallocator + * @param memory pointer to buffer to be freed + * @param size the size in bytes for each element to be deallocated + * @param num the number of elements to be deallocated + */ +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size); + +/* Function that securely cleans the memory. This ignores any flags set + * regarding clearing memory. Usually one just calls clear_internal_memory. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void secure_wipe_memory(void *v, size_t n); + +/* Function that securely clears the memory if FLAG_clear_internal_memory is + * set. If the flag isn't set, this function does nothing. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void clear_internal_memory(void *v, size_t n); + +/* + * Computes absolute position of reference block in the lane following a skewed + * distribution and using a pseudo-random value as input + * @param instance Pointer to the current instance + * @param position Pointer to the current position + * @param pseudo_rand 32-bit pseudo-random value used to determine the position + * @param same_lane Indicates if the block will be taken from the current lane. + * If so we can reference the current segment + * @pre All pointers must be valid + */ +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane); + +/* + * Function that validates all inputs against predefined restrictions and return + * an error code + * @param context Pointer to current Argon2 context + * @return ARGON2_OK if everything is all right, otherwise one of error codes + * (all defined in + */ +int validate_inputs(const argon2_context *context); + +/* + * Hashes all the inputs into @a blockhash[PREHASH_DIGEST_LENGTH], clears + * password and secret if needed + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param blockhash Buffer for pre-hashing digest + * @param type Argon2 type + * @pre @a blockhash must have at least @a PREHASH_DIGEST_LENGTH bytes + * allocated + */ +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type); + +/* + * Function creates first 2 blocks per lane + * @param instance Pointer to the current instance + * @param blockhash Pointer to the pre-hashing digest + * @pre blockhash must point to @a PREHASH_SEED_LENGTH allocated values + */ +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance); + +/* + * Function allocates memory, hashes the inputs with Blake, and creates first + * two blocks. Returns the pointer to the main memory with 2 blocks per lane + * initialized + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param instance Current Argon2 instance + * @return Zero if successful, -1 if memory failed to allocate. @context->state + * will be modified if successful. + */ +int initialize(argon2_instance_t *instance, argon2_context *context); + +/* + * XORing the last block of each lane, hashing it, making the tag. Deallocates + * the memory. + * @param context Pointer to current Argon2 context (use only the out parameters + * from it) + * @param instance Pointer to current instance of Argon2 + * @pre instance->state must point to necessary amount of memory + * @pre context->out must point to outlen bytes of memory + * @pre if context->free_cbk is not NULL, it should point to a function that + * deallocates memory + */ +void finalize(const argon2_context *context, argon2_instance_t *instance); + +/* + * Function that fills the segment using previous segments also from other + * threads + * @param context current context + * @param instance Pointer to the current instance + * @param position Current position + * @pre all block pointers must be valid + */ +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position); + +/* + * Function that fills the entire memory t_cost times based on the first two + * blocks in each lane + * @param instance Pointer to the current instance + * @return ARGON2_OK if successful, @context->state + */ +int fill_memory_blocks(argon2_instance_t *instance); + +#endif diff --git a/lib/crypto_backend/argon2/encoding.c b/lib/crypto_backend/argon2/encoding.c new file mode 100644 index 0000000..a717263 --- /dev/null +++ b/lib/crypto_backend/argon2/encoding.c @@ -0,0 +1,462 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include +#include +#include "encoding.h" +#include "core.h" + +/* + * Example code for a decoder and encoder of "hash strings", with Argon2 + * parameters. + * + * This code comprises three sections: + * + * -- The first section contains generic Base64 encoding and decoding + * functions. It is conceptually applicable to any hash function + * implementation that uses Base64 to encode and decode parameters, + * salts and outputs. It could be made into a library, provided that + * the relevant functions are made public (non-static) and be given + * reasonable names to avoid collisions with other functions. + * + * -- The second section is specific to Argon2. It encodes and decodes + * the parameters, salts and outputs. It does not compute the hash + * itself. + * + * The code was originally written by Thomas Pornin , + * to whom comments and remarks may be sent. It is released under what + * should amount to Public Domain or its closest equivalent; the + * following mantra is supposed to incarnate that fact with all the + * proper legal rituals: + * + * --------------------------------------------------------------------- + * This file is provided under the terms of Creative Commons CC0 1.0 + * Public Domain Dedication. To the extent possible under law, the + * author (Thomas Pornin) has waived all copyright and related or + * neighboring rights to this file. This work is published from: Canada. + * --------------------------------------------------------------------- + * + * Copyright (c) 2015 Thomas Pornin + */ + +/* ==================================================================== */ +/* + * Common code; could be shared between different hash functions. + * + * Note: the Base64 functions below assume that uppercase letters (resp. + * lowercase letters) have consecutive numerical codes, that fit on 8 + * bits. All modern systems use ASCII-compatible charsets, where these + * properties are true. If you are stuck with a dinosaur of a system + * that still defaults to EBCDIC then you already have much bigger + * interoperability issues to deal with. + */ + +/* + * Some macros for constant-time comparisons. These work over values in + * the 0..255 range. Returned value is 0x00 on "false", 0xFF on "true". + */ +#define EQ(x, y) ((((0U - ((unsigned)(x) ^ (unsigned)(y))) >> 8) & 0xFF) ^ 0xFF) +#define GT(x, y) ((((unsigned)(y) - (unsigned)(x)) >> 8) & 0xFF) +#define GE(x, y) (GT(y, x) ^ 0xFF) +#define LT(x, y) GT(y, x) +#define LE(x, y) GE(y, x) + +/* + * Convert value x (0..63) to corresponding Base64 character. + */ +static int b64_byte_to_char(unsigned x) { + return (LT(x, 26) & (x + 'A')) | + (GE(x, 26) & LT(x, 52) & (x + ('a' - 26))) | + (GE(x, 52) & LT(x, 62) & (x + ('0' - 52))) | (EQ(x, 62) & '+') | + (EQ(x, 63) & '/'); +} + +/* + * Convert character c to the corresponding 6-bit value. If character c + * is not a Base64 character, then 0xFF (255) is returned. + */ +static unsigned b64_char_to_byte(int c) { + unsigned x; + + x = (GE(c, 'A') & LE(c, 'Z') & (c - 'A')) | + (GE(c, 'a') & LE(c, 'z') & (c - ('a' - 26))) | + (GE(c, '0') & LE(c, '9') & (c - ('0' - 52))) | (EQ(c, '+') & 62) | + (EQ(c, '/') & 63); + return x | (EQ(x, 0) & (EQ(c, 'A') ^ 0xFF)); +} + +/* + * Convert some bytes to Base64. 'dst_len' is the length (in characters) + * of the output buffer 'dst'; if that buffer is not large enough to + * receive the result (including the terminating 0), then (size_t)-1 + * is returned. Otherwise, the zero-terminated Base64 string is written + * in the buffer, and the output length (counted WITHOUT the terminating + * zero) is returned. + */ +static size_t to_base64(char *dst, size_t dst_len, const void *src, + size_t src_len) { + size_t olen; + const unsigned char *buf; + unsigned acc, acc_len; + + olen = (src_len / 3) << 2; + switch (src_len % 3) { + case 2: + olen++; + /* fall through */ + case 1: + olen += 2; + break; + } + if (dst_len <= olen) { + return (size_t)-1; + } + acc = 0; + acc_len = 0; + buf = (const unsigned char *)src; + while (src_len-- > 0) { + acc = (acc << 8) + (*buf++); + acc_len += 8; + while (acc_len >= 6) { + acc_len -= 6; + *dst++ = (char)b64_byte_to_char((acc >> acc_len) & 0x3F); + } + } + if (acc_len > 0) { + *dst++ = (char)b64_byte_to_char((acc << (6 - acc_len)) & 0x3F); + } + *dst++ = 0; + return olen; +} + +/* + * Decode Base64 chars into bytes. The '*dst_len' value must initially + * contain the length of the output buffer '*dst'; when the decoding + * ends, the actual number of decoded bytes is written back in + * '*dst_len'. + * + * Decoding stops when a non-Base64 character is encountered, or when + * the output buffer capacity is exceeded. If an error occurred (output + * buffer is too small, invalid last characters leading to unprocessed + * buffered bits), then NULL is returned; otherwise, the returned value + * points to the first non-Base64 character in the source stream, which + * may be the terminating zero. + */ +static const char *from_base64(void *dst, size_t *dst_len, const char *src) { + size_t len; + unsigned char *buf; + unsigned acc, acc_len; + + buf = (unsigned char *)dst; + len = 0; + acc = 0; + acc_len = 0; + for (;;) { + unsigned d; + + d = b64_char_to_byte(*src); + if (d == 0xFF) { + break; + } + src++; + acc = (acc << 6) + d; + acc_len += 6; + if (acc_len >= 8) { + acc_len -= 8; + if ((len++) >= *dst_len) { + return NULL; + } + *buf++ = (acc >> acc_len) & 0xFF; + } + } + + /* + * If the input length is equal to 1 modulo 4 (which is + * invalid), then there will remain 6 unprocessed bits; + * otherwise, only 0, 2 or 4 bits are buffered. The buffered + * bits must also all be zero. + */ + if (acc_len > 4 || (acc & (((unsigned)1 << acc_len) - 1)) != 0) { + return NULL; + } + *dst_len = len; + return src; +} + +/* + * Decode decimal integer from 'str'; the value is written in '*v'. + * Returned value is a pointer to the next non-decimal character in the + * string. If there is no digit at all, or the value encoding is not + * minimal (extra leading zeros), or the value does not fit in an + * 'unsigned long', then NULL is returned. + */ +static const char *decode_decimal(const char *str, unsigned long *v) { + const char *orig; + unsigned long acc; + + acc = 0; + for (orig = str;; str++) { + int c; + + c = *str; + if (c < '0' || c > '9') { + break; + } + c -= '0'; + if (acc > (ULONG_MAX / 10)) { + return NULL; + } + acc *= 10; + if ((unsigned long)c > (ULONG_MAX - acc)) { + return NULL; + } + acc += (unsigned long)c; + } + if (str == orig || (*orig == '0' && str != (orig + 1))) { + return NULL; + } + *v = acc; + return str; +} + +/* ==================================================================== */ +/* + * Code specific to Argon2. + * + * The code below applies the following format: + * + * $argon2[$v=]$m=,t=,p=$$ + * + * where is either 'd', 'id', or 'i', is a decimal integer (positive, + * fits in an 'unsigned long'), and is Base64-encoded data (no '=' padding + * characters, no newline or whitespace). + * + * The last two binary chunks (encoded in Base64) are, in that order, + * the salt and the output. Both are required. The binary salt length and the + * output length must be in the allowed ranges defined in argon2.h. + * + * The ctx struct must contain buffers large enough to hold the salt and pwd + * when it is fed into decode_string. + */ + +int decode_string(argon2_context *ctx, const char *str, argon2_type type) { + +/* check for prefix */ +#define CC(prefix) \ + do { \ + size_t cc_len = strlen(prefix); \ + if (strncmp(str, prefix, cc_len) != 0) { \ + return ARGON2_DECODING_FAIL; \ + } \ + str += cc_len; \ + } while ((void)0, 0) + +/* optional prefix checking with supplied code */ +#define CC_opt(prefix, code) \ + do { \ + size_t cc_len = strlen(prefix); \ + if (strncmp(str, prefix, cc_len) == 0) { \ + str += cc_len; \ + { code; } \ + } \ + } while ((void)0, 0) + +/* Decoding prefix into decimal */ +#define DECIMAL(x) \ + do { \ + unsigned long dec_x; \ + str = decode_decimal(str, &dec_x); \ + if (str == NULL) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (x) = dec_x; \ + } while ((void)0, 0) + + +/* Decoding prefix into uint32_t decimal */ +#define DECIMAL_U32(x) \ + do { \ + unsigned long dec_x; \ + str = decode_decimal(str, &dec_x); \ + if (str == NULL || dec_x > UINT32_MAX) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (x) = (uint32_t)dec_x; \ + } while ((void)0, 0) + + +/* Decoding base64 into a binary buffer */ +#define BIN(buf, max_len, len) \ + do { \ + size_t bin_len = (max_len); \ + str = from_base64(buf, &bin_len, str); \ + if (str == NULL || bin_len > UINT32_MAX) { \ + return ARGON2_DECODING_FAIL; \ + } \ + (len) = (uint32_t)bin_len; \ + } while ((void)0, 0) + + size_t maxsaltlen = ctx->saltlen; + size_t maxoutlen = ctx->outlen; + int validation_result; + const char* type_string; + + /* We should start with the argon2_type we are using */ + type_string = argon2_type2string(type, 0); + if (!type_string) { + return ARGON2_INCORRECT_TYPE; + } + + CC("$"); + CC(type_string); + + /* Reading the version number if the default is suppressed */ + ctx->version = ARGON2_VERSION_10; + CC_opt("$v=", DECIMAL_U32(ctx->version)); + + CC("$m="); + DECIMAL_U32(ctx->m_cost); + CC(",t="); + DECIMAL_U32(ctx->t_cost); + CC(",p="); + DECIMAL_U32(ctx->lanes); + ctx->threads = ctx->lanes; + + CC("$"); + BIN(ctx->salt, maxsaltlen, ctx->saltlen); + CC("$"); + BIN(ctx->out, maxoutlen, ctx->outlen); + + /* The rest of the fields get the default values */ + ctx->secret = NULL; + ctx->secretlen = 0; + ctx->ad = NULL; + ctx->adlen = 0; + ctx->allocate_cbk = NULL; + ctx->free_cbk = NULL; + ctx->flags = ARGON2_DEFAULT_FLAGS; + + /* On return, must have valid context */ + validation_result = validate_inputs(ctx); + if (validation_result != ARGON2_OK) { + return validation_result; + } + + /* Can't have any additional characters */ + if (*str == 0) { + return ARGON2_OK; + } else { + return ARGON2_DECODING_FAIL; + } +#undef CC +#undef CC_opt +#undef DECIMAL +#undef BIN +} + +int encode_string(char *dst, size_t dst_len, argon2_context *ctx, + argon2_type type) { +#define SS(str) \ + do { \ + size_t pp_len = strlen(str); \ + if (pp_len >= dst_len) { \ + return ARGON2_ENCODING_FAIL; \ + } \ + memcpy(dst, str, pp_len + 1); \ + dst += pp_len; \ + dst_len -= pp_len; \ + } while ((void)0, 0) + +#define SX(x) \ + do { \ + char tmp[30]; \ + sprintf(tmp, "%lu", (unsigned long)(x)); \ + SS(tmp); \ + } while ((void)0, 0) + +#define SB(buf, len) \ + do { \ + size_t sb_len = to_base64(dst, dst_len, buf, len); \ + if (sb_len == (size_t)-1) { \ + return ARGON2_ENCODING_FAIL; \ + } \ + dst += sb_len; \ + dst_len -= sb_len; \ + } while ((void)0, 0) + + const char* type_string = argon2_type2string(type, 0); + int validation_result = validate_inputs(ctx); + + if (!type_string) { + return ARGON2_ENCODING_FAIL; + } + + if (validation_result != ARGON2_OK) { + return validation_result; + } + + + SS("$"); + SS(type_string); + + SS("$v="); + SX(ctx->version); + + SS("$m="); + SX(ctx->m_cost); + SS(",t="); + SX(ctx->t_cost); + SS(",p="); + SX(ctx->lanes); + + SS("$"); + SB(ctx->salt, ctx->saltlen); + + SS("$"); + SB(ctx->out, ctx->outlen); + return ARGON2_OK; + +#undef SS +#undef SX +#undef SB +} + +size_t b64len(uint32_t len) { + size_t olen = ((size_t)len / 3) << 2; + + switch (len % 3) { + case 2: + olen++; + /* fall through */ + case 1: + olen += 2; + break; + } + + return olen; +} + +size_t numlen(uint32_t num) { + size_t len = 1; + while (num >= 10) { + ++len; + num = num / 10; + } + return len; +} diff --git a/lib/crypto_backend/argon2/encoding.h b/lib/crypto_backend/argon2/encoding.h new file mode 100644 index 0000000..5b8b2dd --- /dev/null +++ b/lib/crypto_backend/argon2/encoding.h @@ -0,0 +1,57 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ENCODING_H +#define ENCODING_H +#include "argon2.h" + +#define ARGON2_MAX_DECODED_LANES UINT32_C(255) +#define ARGON2_MIN_DECODED_SALT_LEN UINT32_C(8) +#define ARGON2_MIN_DECODED_OUT_LEN UINT32_C(12) + +/* +* encode an Argon2 hash string into the provided buffer. 'dst_len' +* contains the size, in characters, of the 'dst' buffer; if 'dst_len' +* is less than the number of required characters (including the +* terminating 0), then this function returns ARGON2_ENCODING_ERROR. +* +* on success, ARGON2_OK is returned. +*/ +int encode_string(char *dst, size_t dst_len, argon2_context *ctx, + argon2_type type); + +/* +* Decodes an Argon2 hash string into the provided structure 'ctx'. +* The only fields that must be set prior to this call are ctx.saltlen and +* ctx.outlen (which must be the maximal salt and out length values that are +* allowed), ctx.salt and ctx.out (which must be buffers of the specified +* length), and ctx.pwd and ctx.pwdlen which must hold a valid password. +* +* Invalid input string causes an error. On success, the ctx is valid and all +* fields have been initialized. +* +* Returned value is ARGON2_OK on success, other ARGON2_ codes on error. +*/ +int decode_string(argon2_context *ctx, const char *str, argon2_type type); + +/* Returns the length of the encoded byte stream with length len */ +size_t b64len(uint32_t len); + +/* Returns the length of the encoded number num */ +size_t numlen(uint32_t num); + +#endif diff --git a/lib/crypto_backend/argon2/opt.c b/lib/crypto_backend/argon2/opt.c new file mode 100644 index 0000000..6c5e403 --- /dev/null +++ b/lib/crypto_backend/argon2/opt.c @@ -0,0 +1,283 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "argon2.h" +#include "core.h" + +#include "blake2/blake2.h" +#include "blake2/blamka-round-opt.h" + +/* + * Function fills a new memory block and optionally XORs the old block over the new one. + * Memory must be initialized. + * @param state Pointer to the just produced block. Content will be updated(!) + * @param ref_block Pointer to the reference block + * @param next_block Pointer to the block to be XORed over. May coincide with @ref_block + * @param with_xor Whether to XOR into the new block (1) or just overwrite (0) + * @pre all block pointers must be valid + */ +#if defined(__AVX512F__) +static void fill_block(__m512i *state, const block *ref_block, + block *next_block, int with_xor) { + __m512i block_XY[ARGON2_512BIT_WORDS_IN_BLOCK]; + unsigned int i; + + if (with_xor) { + for (i = 0; i < ARGON2_512BIT_WORDS_IN_BLOCK; i++) { + state[i] = _mm512_xor_si512( + state[i], _mm512_loadu_si512((const __m512i *)ref_block->v + i)); + block_XY[i] = _mm512_xor_si512( + state[i], _mm512_loadu_si512((const __m512i *)next_block->v + i)); + } + } else { + for (i = 0; i < ARGON2_512BIT_WORDS_IN_BLOCK; i++) { + block_XY[i] = state[i] = _mm512_xor_si512( + state[i], _mm512_loadu_si512((const __m512i *)ref_block->v + i)); + } + } + + for (i = 0; i < 2; ++i) { + BLAKE2_ROUND_1( + state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], state[8 * i + 3], + state[8 * i + 4], state[8 * i + 5], state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 2; ++i) { + BLAKE2_ROUND_2( + state[2 * 0 + i], state[2 * 1 + i], state[2 * 2 + i], state[2 * 3 + i], + state[2 * 4 + i], state[2 * 5 + i], state[2 * 6 + i], state[2 * 7 + i]); + } + + for (i = 0; i < ARGON2_512BIT_WORDS_IN_BLOCK; i++) { + state[i] = _mm512_xor_si512(state[i], block_XY[i]); + _mm512_storeu_si512((__m512i *)next_block->v + i, state[i]); + } +} +#elif defined(__AVX2__) +static void fill_block(__m256i *state, const block *ref_block, + block *next_block, int with_xor) { + __m256i block_XY[ARGON2_HWORDS_IN_BLOCK]; + unsigned int i; + + if (with_xor) { + for (i = 0; i < ARGON2_HWORDS_IN_BLOCK; i++) { + state[i] = _mm256_xor_si256( + state[i], _mm256_loadu_si256((const __m256i *)ref_block->v + i)); + block_XY[i] = _mm256_xor_si256( + state[i], _mm256_loadu_si256((const __m256i *)next_block->v + i)); + } + } else { + for (i = 0; i < ARGON2_HWORDS_IN_BLOCK; i++) { + block_XY[i] = state[i] = _mm256_xor_si256( + state[i], _mm256_loadu_si256((const __m256i *)ref_block->v + i)); + } + } + + for (i = 0; i < 4; ++i) { + BLAKE2_ROUND_1(state[8 * i + 0], state[8 * i + 4], state[8 * i + 1], state[8 * i + 5], + state[8 * i + 2], state[8 * i + 6], state[8 * i + 3], state[8 * i + 7]); + } + + for (i = 0; i < 4; ++i) { + BLAKE2_ROUND_2(state[ 0 + i], state[ 4 + i], state[ 8 + i], state[12 + i], + state[16 + i], state[20 + i], state[24 + i], state[28 + i]); + } + + for (i = 0; i < ARGON2_HWORDS_IN_BLOCK; i++) { + state[i] = _mm256_xor_si256(state[i], block_XY[i]); + _mm256_storeu_si256((__m256i *)next_block->v + i, state[i]); + } +} +#else +static void fill_block(__m128i *state, const block *ref_block, + block *next_block, int with_xor) { + __m128i block_XY[ARGON2_OWORDS_IN_BLOCK]; + unsigned int i; + + if (with_xor) { + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = _mm_xor_si128( + state[i], _mm_loadu_si128((const __m128i *)ref_block->v + i)); + block_XY[i] = _mm_xor_si128( + state[i], _mm_loadu_si128((const __m128i *)next_block->v + i)); + } + } else { + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + block_XY[i] = state[i] = _mm_xor_si128( + state[i], _mm_loadu_si128((const __m128i *)ref_block->v + i)); + } + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND(state[8 * i + 0], state[8 * i + 1], state[8 * i + 2], + state[8 * i + 3], state[8 * i + 4], state[8 * i + 5], + state[8 * i + 6], state[8 * i + 7]); + } + + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND(state[8 * 0 + i], state[8 * 1 + i], state[8 * 2 + i], + state[8 * 3 + i], state[8 * 4 + i], state[8 * 5 + i], + state[8 * 6 + i], state[8 * 7 + i]); + } + + for (i = 0; i < ARGON2_OWORDS_IN_BLOCK; i++) { + state[i] = _mm_xor_si128(state[i], block_XY[i]); + _mm_storeu_si128((__m128i *)next_block->v + i, state[i]); + } +} +#endif + +static void next_addresses(block *address_block, block *input_block) { + /*Temporary zero-initialized blocks*/ +#if defined(__AVX512F__) + __m512i zero_block[ARGON2_512BIT_WORDS_IN_BLOCK]; + __m512i zero2_block[ARGON2_512BIT_WORDS_IN_BLOCK]; +#elif defined(__AVX2__) + __m256i zero_block[ARGON2_HWORDS_IN_BLOCK]; + __m256i zero2_block[ARGON2_HWORDS_IN_BLOCK]; +#else + __m128i zero_block[ARGON2_OWORDS_IN_BLOCK]; + __m128i zero2_block[ARGON2_OWORDS_IN_BLOCK]; +#endif + + memset(zero_block, 0, sizeof(zero_block)); + memset(zero2_block, 0, sizeof(zero2_block)); + + /*Increasing index counter*/ + input_block->v[6]++; + + /*First iteration of G*/ + fill_block(zero_block, input_block, address_block, 0); + + /*Second iteration of G*/ + fill_block(zero2_block, address_block, address_block, 0); +} + +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position) { + block *ref_block = NULL, *curr_block = NULL; + block address_block, input_block; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index, i; +#if defined(__AVX512F__) + __m512i state[ARGON2_512BIT_WORDS_IN_BLOCK]; +#elif defined(__AVX2__) + __m256i state[ARGON2_HWORDS_IN_BLOCK]; +#else + __m128i state[ARGON2_OWORDS_IN_BLOCK]; +#endif + int data_independent_addressing; + + if (instance == NULL) { + return; + } + + data_independent_addressing = + (instance->type == Argon2_i) || + (instance->type == Argon2_id && (position.pass == 0) && + (position.slice < ARGON2_SYNC_POINTS / 2)); + + if (data_independent_addressing) { + init_block_value(&input_block, 0); + + input_block.v[0] = position.pass; + input_block.v[1] = position.lane; + input_block.v[2] = position.slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; /* we have already generated the first two blocks */ + + /* Don't forget to generate the first block of addresses: */ + if (data_independent_addressing) { + next_addresses(&address_block, &input_block); + } + } + + /* Offset of the current block */ + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + /* Last block in this lane */ + prev_offset = curr_offset + instance->lane_length - 1; + } else { + /* Previous block */ + prev_offset = curr_offset - 1; + } + + memcpy(state, ((instance->memory + prev_offset)->v), ARGON2_BLOCK_SIZE); + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + /*1.1 Rotating prev_offset if needed */ + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + /* 1.2 Computing the index of the reference block */ + /* 1.2.1 Taking pseudo-random value from the previous block */ + if (data_independent_addressing) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + next_addresses(&address_block, &input_block); + } + pseudo_rand = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } else { + pseudo_rand = instance->memory[prev_offset].v[0]; + } + + /* 1.2.2 Computing the lane of the reference block */ + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + /* Can not reference other lanes yet */ + ref_lane = position.lane; + } + + /* 1.2.3 Computing the number of possible reference block within the + * lane. + */ + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + /* 2 Creating a new block */ + ref_block = + instance->memory + instance->lane_length * ref_lane + ref_index; + curr_block = instance->memory + curr_offset; + if (ARGON2_VERSION_10 == instance->version) { + /* version 1.2.1 and earlier: overwrite, not XOR */ + fill_block(state, ref_block, curr_block, 0); + } else { + if(0 == position.pass) { + fill_block(state, ref_block, curr_block, 0); + } else { + fill_block(state, ref_block, curr_block, 1); + } + } + } +} diff --git a/lib/crypto_backend/argon2/ref.c b/lib/crypto_backend/argon2/ref.c new file mode 100644 index 0000000..10e45eb --- /dev/null +++ b/lib/crypto_backend/argon2/ref.c @@ -0,0 +1,194 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include +#include +#include + +#include "argon2.h" +#include "core.h" + +#include "blake2/blamka-round-ref.h" +#include "blake2/blake2-impl.h" +#include "blake2/blake2.h" + + +/* + * Function fills a new memory block and optionally XORs the old block over the new one. + * @next_block must be initialized. + * @param prev_block Pointer to the previous block + * @param ref_block Pointer to the reference block + * @param next_block Pointer to the block to be constructed + * @param with_xor Whether to XOR into the new block (1) or just overwrite (0) + * @pre all block pointers must be valid + */ +static void fill_block(const block *prev_block, const block *ref_block, + block *next_block, int with_xor) { + block blockR, block_tmp; + unsigned i; + + copy_block(&blockR, ref_block); + xor_block(&blockR, prev_block); + copy_block(&block_tmp, &blockR); + /* Now blockR = ref_block + prev_block and block_tmp = ref_block + prev_block */ + if (with_xor) { + /* Saving the next block contents for XOR over: */ + xor_block(&block_tmp, next_block); + /* Now blockR = ref_block + prev_block and + block_tmp = ref_block + prev_block + next_block */ + } + + /* Apply Blake2 on columns of 64-bit words: (0,1,...,15) , then + (16,17,..31)... finally (112,113,...127) */ + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NOMSG( + blockR.v[16 * i], blockR.v[16 * i + 1], blockR.v[16 * i + 2], + blockR.v[16 * i + 3], blockR.v[16 * i + 4], blockR.v[16 * i + 5], + blockR.v[16 * i + 6], blockR.v[16 * i + 7], blockR.v[16 * i + 8], + blockR.v[16 * i + 9], blockR.v[16 * i + 10], blockR.v[16 * i + 11], + blockR.v[16 * i + 12], blockR.v[16 * i + 13], blockR.v[16 * i + 14], + blockR.v[16 * i + 15]); + } + + /* Apply Blake2 on rows of 64-bit words: (0,1,16,17,...112,113), then + (2,3,18,19,...,114,115).. finally (14,15,30,31,...,126,127) */ + for (i = 0; i < 8; i++) { + BLAKE2_ROUND_NOMSG( + blockR.v[2 * i], blockR.v[2 * i + 1], blockR.v[2 * i + 16], + blockR.v[2 * i + 17], blockR.v[2 * i + 32], blockR.v[2 * i + 33], + blockR.v[2 * i + 48], blockR.v[2 * i + 49], blockR.v[2 * i + 64], + blockR.v[2 * i + 65], blockR.v[2 * i + 80], blockR.v[2 * i + 81], + blockR.v[2 * i + 96], blockR.v[2 * i + 97], blockR.v[2 * i + 112], + blockR.v[2 * i + 113]); + } + + copy_block(next_block, &block_tmp); + xor_block(next_block, &blockR); +} + +static void next_addresses(block *address_block, block *input_block, + const block *zero_block) { + input_block->v[6]++; + fill_block(zero_block, input_block, address_block, 0); + fill_block(zero_block, address_block, address_block, 0); +} + +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position) { + block *ref_block = NULL, *curr_block = NULL; + block address_block, input_block, zero_block; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index; + uint32_t i; + int data_independent_addressing; + + if (instance == NULL) { + return; + } + + data_independent_addressing = + (instance->type == Argon2_i) || + (instance->type == Argon2_id && (position.pass == 0) && + (position.slice < ARGON2_SYNC_POINTS / 2)); + + if (data_independent_addressing) { + init_block_value(&zero_block, 0); + init_block_value(&input_block, 0); + + input_block.v[0] = position.pass; + input_block.v[1] = position.lane; + input_block.v[2] = position.slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; /* we have already generated the first two blocks */ + + /* Don't forget to generate the first block of addresses: */ + if (data_independent_addressing) { + next_addresses(&address_block, &input_block, &zero_block); + } + } + + /* Offset of the current block */ + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + /* Last block in this lane */ + prev_offset = curr_offset + instance->lane_length - 1; + } else { + /* Previous block */ + prev_offset = curr_offset - 1; + } + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + /*1.1 Rotating prev_offset if needed */ + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + /* 1.2 Computing the index of the reference block */ + /* 1.2.1 Taking pseudo-random value from the previous block */ + if (data_independent_addressing) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + next_addresses(&address_block, &input_block, &zero_block); + } + pseudo_rand = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } else { + pseudo_rand = instance->memory[prev_offset].v[0]; + } + + /* 1.2.2 Computing the lane of the reference block */ + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + /* Can not reference other lanes yet */ + ref_lane = position.lane; + } + + /* 1.2.3 Computing the number of possible reference block within the + * lane. + */ + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + /* 2 Creating a new block */ + ref_block = + instance->memory + instance->lane_length * ref_lane + ref_index; + curr_block = instance->memory + curr_offset; + if (ARGON2_VERSION_10 == instance->version) { + /* version 1.2.1 and earlier: overwrite, not XOR */ + fill_block(instance->memory + prev_offset, ref_block, curr_block, 0); + } else { + if(0 == position.pass) { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 0); + } else { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 1); + } + } + } +} diff --git a/lib/crypto_backend/argon2/thread.c b/lib/crypto_backend/argon2/thread.c new file mode 100644 index 0000000..3ae2fb2 --- /dev/null +++ b/lib/crypto_backend/argon2/thread.c @@ -0,0 +1,57 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#if !defined(ARGON2_NO_THREADS) + +#include "thread.h" +#if defined(_WIN32) +#include +#endif + +int argon2_thread_create(argon2_thread_handle_t *handle, + argon2_thread_func_t func, void *args) { + if (NULL == handle || func == NULL) { + return -1; + } +#if defined(_WIN32) + *handle = _beginthreadex(NULL, 0, func, args, 0, NULL); + return *handle != 0 ? 0 : -1; +#else + return pthread_create(handle, NULL, func, args); +#endif +} + +int argon2_thread_join(argon2_thread_handle_t handle) { +#if defined(_WIN32) + if (WaitForSingleObject((HANDLE)handle, INFINITE) == WAIT_OBJECT_0) { + return CloseHandle((HANDLE)handle) != 0 ? 0 : -1; + } + return -1; +#else + return pthread_join(handle, NULL); +#endif +} + +void argon2_thread_exit(void) { +#if defined(_WIN32) + _endthreadex(0); +#else + pthread_exit(NULL); +#endif +} + +#endif /* ARGON2_NO_THREADS */ diff --git a/lib/crypto_backend/argon2/thread.h b/lib/crypto_backend/argon2/thread.h new file mode 100644 index 0000000..d4ca10c --- /dev/null +++ b/lib/crypto_backend/argon2/thread.h @@ -0,0 +1,67 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_THREAD_H +#define ARGON2_THREAD_H + +#if !defined(ARGON2_NO_THREADS) + +/* + Here we implement an abstraction layer for the simpĺe requirements + of the Argon2 code. We only require 3 primitives---thread creation, + joining, and termination---so full emulation of the pthreads API + is unwarranted. Currently we wrap pthreads and Win32 threads. + + The API defines 2 types: the function pointer type, + argon2_thread_func_t, + and the type of the thread handle---argon2_thread_handle_t. +*/ +#if defined(_WIN32) +#include +typedef unsigned(__stdcall *argon2_thread_func_t)(void *); +typedef uintptr_t argon2_thread_handle_t; +#else +#include +typedef void *(*argon2_thread_func_t)(void *); +typedef pthread_t argon2_thread_handle_t; +#endif + +/* Creates a thread + * @param handle pointer to a thread handle, which is the output of this + * function. Must not be NULL. + * @param func A function pointer for the thread's entry point. Must not be + * NULL. + * @param args Pointer that is passed as an argument to @func. May be NULL. + * @return 0 if @handle and @func are valid pointers and a thread is successfully + * created. + */ +int argon2_thread_create(argon2_thread_handle_t *handle, + argon2_thread_func_t func, void *args); + +/* Waits for a thread to terminate + * @param handle Handle to a thread created with argon2_thread_create. + * @return 0 if @handle is a valid handle, and joining completed successfully. +*/ +int argon2_thread_join(argon2_thread_handle_t handle); + +/* Terminate the current thread. Must be run inside a thread created by + * argon2_thread_create. +*/ +void argon2_thread_exit(void); + +#endif /* ARGON2_NO_THREADS */ +#endif diff --git a/lib/crypto_backend/argon2_generic.c b/lib/crypto_backend/argon2_generic.c new file mode 100644 index 0000000..d8a5b21 --- /dev/null +++ b/lib/crypto_backend/argon2_generic.c @@ -0,0 +1,79 @@ +/* + * Argon2 PBKDF2 library wrapper + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include "crypto_backend_internal.h" +#if HAVE_ARGON2_H +#include +#else +#include "argon2/argon2.h" +#endif + +#define CONST_CAST(x) (x)(uintptr_t) + +int argon2(const char *type, const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) +{ +#if !USE_INTERNAL_ARGON2 && !HAVE_ARGON2_H + return -EINVAL; +#else + argon2_type atype; + argon2_context context = { + .flags = ARGON2_DEFAULT_FLAGS, + .version = ARGON2_VERSION_NUMBER, + .t_cost = (uint32_t)iterations, + .m_cost = (uint32_t)memory, + .lanes = (uint32_t)parallel, + .threads = (uint32_t)parallel, + .out = (uint8_t *)key, + .outlen = (uint32_t)key_length, + .pwd = CONST_CAST(uint8_t *)password, + .pwdlen = (uint32_t)password_length, + .salt = CONST_CAST(uint8_t *)salt, + .saltlen = (uint32_t)salt_length, + }; + int r; + + if (!strcmp(type, "argon2i")) + atype = Argon2_i; + else if(!strcmp(type, "argon2id")) + atype = Argon2_id; + else + return -EINVAL; + + switch (argon2_ctx(&context, atype)) { + case ARGON2_OK: + r = 0; + break; + case ARGON2_MEMORY_ALLOCATION_ERROR: + case ARGON2_FREE_MEMORY_CBK_NULL: + case ARGON2_ALLOCATE_MEMORY_CBK_NULL: + r = -ENOMEM; + break; + default: + r = -EINVAL; + } + + return r; +#endif +} diff --git a/lib/crypto_backend/cipher_check.c b/lib/crypto_backend/cipher_check.c new file mode 100644 index 0000000..70515ee --- /dev/null +++ b/lib/crypto_backend/cipher_check.c @@ -0,0 +1,161 @@ +/* + * Cipher performance check + * + * Copyright (C) 2018-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2018-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include "crypto_backend_internal.h" + +#ifndef CLOCK_MONOTONIC_RAW +#define CLOCK_MONOTONIC_RAW CLOCK_MONOTONIC +#endif + +/* + * This is not simulating storage, so using disk block causes extreme overhead. + * Let's use some fixed block size where results are more reliable... + */ +#define CIPHER_BLOCK_BYTES 65536 + +/* + * If the measured value is lower, encrypted buffer is probably too small + * and calculated values are not reliable. + */ +#define CIPHER_TIME_MIN_MS 0.001 + +/* + * The whole test depends on Linux kernel usermode crypto API for now. + * (The same implementations are used in dm-crypt though.) + */ + +static int time_ms(struct timespec *start, struct timespec *end, double *ms) +{ + double start_ms, end_ms; + + start_ms = start->tv_sec * 1000.0 + start->tv_nsec / (1000.0 * 1000); + end_ms = end->tv_sec * 1000.0 + end->tv_nsec / (1000.0 * 1000); + + *ms = end_ms - start_ms; + return 0; +} + +static int cipher_perf_one(const char *name, const char *mode, char *buffer, size_t buffer_size, + const char *key, size_t key_size, const char *iv, size_t iv_size, int enc) +{ + struct crypt_cipher_kernel cipher; + size_t done = 0, block = CIPHER_BLOCK_BYTES; + int r; + + if (buffer_size < block) + block = buffer_size; + + r = crypt_cipher_init_kernel(&cipher, name, mode, key, key_size); + if (r < 0) + return r; + + while (done < buffer_size) { + if ((done + block) > buffer_size) + block = buffer_size - done; + + if (enc) + r = crypt_cipher_encrypt_kernel(&cipher, &buffer[done], &buffer[done], + block, iv, iv_size); + else + r = crypt_cipher_decrypt_kernel(&cipher, &buffer[done], &buffer[done], + block, iv, iv_size); + if (r < 0) + break; + + done += block; + } + + crypt_cipher_destroy_kernel(&cipher); + + return r; +} +static int cipher_measure(const char *name, const char *mode, char *buffer, size_t buffer_size, + const char *key, size_t key_size, const char *iv, size_t iv_size, + int encrypt, double *ms) +{ + struct timespec start, end; + int r; + + /* + * Using getrusage would be better here but the precision + * is not adequate, so better stick with CLOCK_MONOTONIC + */ + if (clock_gettime(CLOCK_MONOTONIC_RAW, &start) < 0) + return -EINVAL; + + r = cipher_perf_one(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, encrypt); + if (r < 0) + return r; + + if (clock_gettime(CLOCK_MONOTONIC_RAW, &end) < 0) + return -EINVAL; + + r = time_ms(&start, &end, ms); + if (r < 0) + return r; + + if (*ms < CIPHER_TIME_MIN_MS) + return -ERANGE; + + return 0; +} + +static double speed_mbs(unsigned long bytes, double ms) +{ + double speed = bytes, s = ms / 1000.; + + return speed / (1024 * 1024) / s; +} + +int crypt_cipher_perf_kernel(const char *name, const char *mode, char *buffer, size_t buffer_size, + const char *key, size_t key_size, const char *iv, size_t iv_size, + double *encryption_mbs, double *decryption_mbs) +{ + double ms_enc, ms_dec, ms; + int r, repeat_enc, repeat_dec; + + ms_enc = 0.0; + repeat_enc = 1; + while (ms_enc < 1000.0) { + r = cipher_measure(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, 1, &ms); + if (r < 0) + return r; + ms_enc += ms; + repeat_enc++; + } + + ms_dec = 0.0; + repeat_dec = 1; + while (ms_dec < 1000.0) { + r = cipher_measure(name, mode, buffer, buffer_size, key, key_size, iv, iv_size, 0, &ms); + if (r < 0) + return r; + ms_dec += ms; + repeat_dec++; + } + + *encryption_mbs = speed_mbs(buffer_size * repeat_enc, ms_enc); + *decryption_mbs = speed_mbs(buffer_size * repeat_dec, ms_dec); + + return 0; +} diff --git a/lib/crypto_backend/cipher_generic.c b/lib/crypto_backend/cipher_generic.c new file mode 100644 index 0000000..bce36e0 --- /dev/null +++ b/lib/crypto_backend/cipher_generic.c @@ -0,0 +1,90 @@ +/* + * Linux kernel cipher generic utilities + * + * Copyright (C) 2018-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2018-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include "crypto_backend.h" + +struct cipher_alg { + const char *name; + const char *mode; + int blocksize; + bool wrapped_key; +}; + +/* FIXME: Getting block size should be dynamic from cipher backend. */ +static const struct cipher_alg cipher_algs[] = { + { "cipher_null", NULL, 16, false }, + { "aes", NULL, 16, false }, + { "serpent", NULL, 16, false }, + { "twofish", NULL, 16, false }, + { "anubis", NULL, 16, false }, + { "blowfish", NULL, 8, false }, + { "camellia", NULL, 16, false }, + { "cast5", NULL, 8, false }, + { "cast6", NULL, 16, false }, + { "des", NULL, 8, false }, + { "des3_ede", NULL, 8, false }, + { "khazad", NULL, 8, false }, + { "seed", NULL, 16, false }, + { "tea", NULL, 8, false }, + { "xtea", NULL, 8, false }, + { "paes", NULL, 16, true }, /* protected AES, s390 wrapped key scheme */ + { "xchacha12,aes", "adiantum", 32, false }, + { "xchacha20,aes", "adiantum", 32, false }, + { "sm4", NULL, 16, false }, + { NULL, NULL, 0, false } +}; + +static const struct cipher_alg *_get_alg(const char *name, const char *mode) +{ + int i = 0; + + while (name && cipher_algs[i].name) { + if (!strcasecmp(name, cipher_algs[i].name)) + if (!mode || !cipher_algs[i].mode || + !strncasecmp(mode, cipher_algs[i].mode, strlen(cipher_algs[i].mode))) + return &cipher_algs[i]; + i++; + } + return NULL; +} + +int crypt_cipher_ivsize(const char *name, const char *mode) +{ + const struct cipher_alg *ca = _get_alg(name, mode); + + if (!ca) + return -EINVAL; + + if (mode && !strcasecmp(mode, "ecb")) + return 0; + + return ca->blocksize; +} + +int crypt_cipher_wrapped_key(const char *name, const char *mode) +{ + const struct cipher_alg *ca = _get_alg(name, mode); + + return ca ? (int)ca->wrapped_key : 0; +} diff --git a/lib/crypto_backend/crc32.c b/lib/crypto_backend/crc32.c new file mode 100644 index 0000000..9d43623 --- /dev/null +++ b/lib/crypto_backend/crc32.c @@ -0,0 +1,114 @@ +/* + * COPYRIGHT (C) 1986 Gary S. Brown. You may use this program, or + * code or tables extracted from it, as desired without restriction. + * + * First, the polynomial itself and its table of feedback terms. The + * polynomial is + * X^32+X^26+X^23+X^22+X^16+X^12+X^11+X^10+X^8+X^7+X^5+X^4+X^2+X^1+X^0 + * + * Note that we take it "backwards" and put the highest-order term in + * the lowest-order bit. The X^32 term is "implied"; the LSB is the + * X^31 term, etc. The X^0 term (usually shown as "+1") results in + * the MSB being 1. + * + * Note that the usual hardware shift register implementation, which + * is what we're using (we're merely optimizing it by doing eight-bit + * chunks at a time) shifts bits into the lowest-order term. In our + * implementation, that means shifting towards the right. Why do we + * do it this way? Because the calculated CRC must be transmitted in + * order from highest-order term to lowest-order term. UARTs transmit + * characters in order from LSB to MSB. By storing the CRC this way, + * we hand it to the UART in the order low-byte to high-byte; the UART + * sends each low-bit to high-bit; and the result is transmission bit + * by bit from highest- to lowest-order term without requiring any bit + * shuffling on our part. Reception works similarly. + * + * The feedback terms table consists of 256, 32-bit entries. Notes + * + * The table can be generated at runtime if desired; code to do so + * is shown later. It might not be obvious, but the feedback + * terms simply represent the results of eight shift/xor opera- + * tions for all combinations of data and CRC register values. + * + * The values must be right-shifted by eight bits by the "updcrc" + * logic; the shift must be unsigned (bring in zeroes). On some + * hardware you could probably optimize the shift in assembler by + * using byte-swap instructions. + * polynomial $edb88320 + * + */ + +#include + +#include "crypto_backend.h" + +static const uint32_t crc32_tab[] = { + 0x00000000L, 0x77073096L, 0xee0e612cL, 0x990951baL, 0x076dc419L, + 0x706af48fL, 0xe963a535L, 0x9e6495a3L, 0x0edb8832L, 0x79dcb8a4L, + 0xe0d5e91eL, 0x97d2d988L, 0x09b64c2bL, 0x7eb17cbdL, 0xe7b82d07L, + 0x90bf1d91L, 0x1db71064L, 0x6ab020f2L, 0xf3b97148L, 0x84be41deL, + 0x1adad47dL, 0x6ddde4ebL, 0xf4d4b551L, 0x83d385c7L, 0x136c9856L, + 0x646ba8c0L, 0xfd62f97aL, 0x8a65c9ecL, 0x14015c4fL, 0x63066cd9L, + 0xfa0f3d63L, 0x8d080df5L, 0x3b6e20c8L, 0x4c69105eL, 0xd56041e4L, + 0xa2677172L, 0x3c03e4d1L, 0x4b04d447L, 0xd20d85fdL, 0xa50ab56bL, + 0x35b5a8faL, 0x42b2986cL, 0xdbbbc9d6L, 0xacbcf940L, 0x32d86ce3L, + 0x45df5c75L, 0xdcd60dcfL, 0xabd13d59L, 0x26d930acL, 0x51de003aL, + 0xc8d75180L, 0xbfd06116L, 0x21b4f4b5L, 0x56b3c423L, 0xcfba9599L, + 0xb8bda50fL, 0x2802b89eL, 0x5f058808L, 0xc60cd9b2L, 0xb10be924L, + 0x2f6f7c87L, 0x58684c11L, 0xc1611dabL, 0xb6662d3dL, 0x76dc4190L, + 0x01db7106L, 0x98d220bcL, 0xefd5102aL, 0x71b18589L, 0x06b6b51fL, + 0x9fbfe4a5L, 0xe8b8d433L, 0x7807c9a2L, 0x0f00f934L, 0x9609a88eL, + 0xe10e9818L, 0x7f6a0dbbL, 0x086d3d2dL, 0x91646c97L, 0xe6635c01L, + 0x6b6b51f4L, 0x1c6c6162L, 0x856530d8L, 0xf262004eL, 0x6c0695edL, + 0x1b01a57bL, 0x8208f4c1L, 0xf50fc457L, 0x65b0d9c6L, 0x12b7e950L, + 0x8bbeb8eaL, 0xfcb9887cL, 0x62dd1ddfL, 0x15da2d49L, 0x8cd37cf3L, + 0xfbd44c65L, 0x4db26158L, 0x3ab551ceL, 0xa3bc0074L, 0xd4bb30e2L, + 0x4adfa541L, 0x3dd895d7L, 0xa4d1c46dL, 0xd3d6f4fbL, 0x4369e96aL, + 0x346ed9fcL, 0xad678846L, 0xda60b8d0L, 0x44042d73L, 0x33031de5L, + 0xaa0a4c5fL, 0xdd0d7cc9L, 0x5005713cL, 0x270241aaL, 0xbe0b1010L, + 0xc90c2086L, 0x5768b525L, 0x206f85b3L, 0xb966d409L, 0xce61e49fL, + 0x5edef90eL, 0x29d9c998L, 0xb0d09822L, 0xc7d7a8b4L, 0x59b33d17L, + 0x2eb40d81L, 0xb7bd5c3bL, 0xc0ba6cadL, 0xedb88320L, 0x9abfb3b6L, + 0x03b6e20cL, 0x74b1d29aL, 0xead54739L, 0x9dd277afL, 0x04db2615L, + 0x73dc1683L, 0xe3630b12L, 0x94643b84L, 0x0d6d6a3eL, 0x7a6a5aa8L, + 0xe40ecf0bL, 0x9309ff9dL, 0x0a00ae27L, 0x7d079eb1L, 0xf00f9344L, + 0x8708a3d2L, 0x1e01f268L, 0x6906c2feL, 0xf762575dL, 0x806567cbL, + 0x196c3671L, 0x6e6b06e7L, 0xfed41b76L, 0x89d32be0L, 0x10da7a5aL, + 0x67dd4accL, 0xf9b9df6fL, 0x8ebeeff9L, 0x17b7be43L, 0x60b08ed5L, + 0xd6d6a3e8L, 0xa1d1937eL, 0x38d8c2c4L, 0x4fdff252L, 0xd1bb67f1L, + 0xa6bc5767L, 0x3fb506ddL, 0x48b2364bL, 0xd80d2bdaL, 0xaf0a1b4cL, + 0x36034af6L, 0x41047a60L, 0xdf60efc3L, 0xa867df55L, 0x316e8eefL, + 0x4669be79L, 0xcb61b38cL, 0xbc66831aL, 0x256fd2a0L, 0x5268e236L, + 0xcc0c7795L, 0xbb0b4703L, 0x220216b9L, 0x5505262fL, 0xc5ba3bbeL, + 0xb2bd0b28L, 0x2bb45a92L, 0x5cb36a04L, 0xc2d7ffa7L, 0xb5d0cf31L, + 0x2cd99e8bL, 0x5bdeae1dL, 0x9b64c2b0L, 0xec63f226L, 0x756aa39cL, + 0x026d930aL, 0x9c0906a9L, 0xeb0e363fL, 0x72076785L, 0x05005713L, + 0x95bf4a82L, 0xe2b87a14L, 0x7bb12baeL, 0x0cb61b38L, 0x92d28e9bL, + 0xe5d5be0dL, 0x7cdcefb7L, 0x0bdbdf21L, 0x86d3d2d4L, 0xf1d4e242L, + 0x68ddb3f8L, 0x1fda836eL, 0x81be16cdL, 0xf6b9265bL, 0x6fb077e1L, + 0x18b74777L, 0x88085ae6L, 0xff0f6a70L, 0x66063bcaL, 0x11010b5cL, + 0x8f659effL, 0xf862ae69L, 0x616bffd3L, 0x166ccf45L, 0xa00ae278L, + 0xd70dd2eeL, 0x4e048354L, 0x3903b3c2L, 0xa7672661L, 0xd06016f7L, + 0x4969474dL, 0x3e6e77dbL, 0xaed16a4aL, 0xd9d65adcL, 0x40df0b66L, + 0x37d83bf0L, 0xa9bcae53L, 0xdebb9ec5L, 0x47b2cf7fL, 0x30b5ffe9L, + 0xbdbdf21cL, 0xcabac28aL, 0x53b39330L, 0x24b4a3a6L, 0xbad03605L, + 0xcdd70693L, 0x54de5729L, 0x23d967bfL, 0xb3667a2eL, 0xc4614ab8L, + 0x5d681b02L, 0x2a6f2b94L, 0xb40bbe37L, 0xc30c8ea1L, 0x5a05df1bL, + 0x2d02ef8dL +}; + +/* + * This a generic crc32() function, it takes seed as an argument, + * and does __not__ xor at the end. Then individual users can do + * whatever they need. + */ +uint32_t crypt_crc32(uint32_t seed, const unsigned char *buf, size_t len) +{ + uint32_t crc = seed; + const unsigned char *p = buf; + + while(len-- > 0) + crc = crc32_tab[(crc ^ *p++) & 0xff] ^ (crc >> 8); + + return crc; +} diff --git a/lib/crypto_backend/crypto_backend.h b/lib/crypto_backend/crypto_backend.h new file mode 100644 index 0000000..5a49e70 --- /dev/null +++ b/lib/crypto_backend/crypto_backend.h @@ -0,0 +1,138 @@ +/* + * crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#ifndef _CRYPTO_BACKEND_H +#define _CRYPTO_BACKEND_H + +#include +#include +#include +#include + +struct crypt_hash; +struct crypt_hmac; +struct crypt_cipher; +struct crypt_storage; + +int crypt_backend_init(void); +void crypt_backend_destroy(void); + +#define CRYPT_BACKEND_KERNEL (1 << 0) /* Crypto uses kernel part, for benchmark */ + +uint32_t crypt_backend_flags(void); +const char *crypt_backend_version(void); + +/* HASH */ +int crypt_hash_size(const char *name); +int crypt_hash_init(struct crypt_hash **ctx, const char *name); +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length); +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length); +void crypt_hash_destroy(struct crypt_hash *ctx); + +/* HMAC */ +int crypt_hmac_size(const char *name); +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length); +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length); +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length); +void crypt_hmac_destroy(struct crypt_hmac *ctx); + +/* RNG (if fips parameter set, must provide FIPS compliance) */ +enum { CRYPT_RND_NORMAL = 0, CRYPT_RND_KEY = 1, CRYPT_RND_SALT = 2 }; +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips); + + +/* PBKDF*/ +struct crypt_pbkdf_limits { + uint32_t min_iterations, max_iterations; + uint32_t min_memory, max_memory; + uint32_t min_parallel, max_parallel; +}; + +int crypt_pbkdf_get_limits(const char *kdf, struct crypt_pbkdf_limits *l); +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel); +int crypt_pbkdf_perf(const char *kdf, const char *hash, + const char *password, size_t password_size, + const char *salt, size_t salt_size, + size_t volume_key_size, uint32_t time_ms, + uint32_t max_memory_kb, uint32_t parallel_threads, + uint32_t *iterations_out, uint32_t *memory_out, + int (*progress)(uint32_t time_ms, void *usrptr), void *usrptr); + +/* CRC32 */ +uint32_t crypt_crc32(uint32_t seed, const unsigned char *buf, size_t len); + +/* Block ciphers */ +int crypt_cipher_ivsize(const char *name, const char *mode); +int crypt_cipher_wrapped_key(const char *name, const char *mode); +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length); +void crypt_cipher_destroy(struct crypt_cipher *ctx); +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length); +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length); +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx); + +/* Benchmark of kernel cipher performance */ +int crypt_cipher_perf_kernel(const char *name, const char *mode, char *buffer, size_t buffer_size, + const char *key, size_t key_size, const char *iv, size_t iv_size, + double *encryption_mbs, double *decryption_mbs); + +/* Check availability of a cipher (in kernel only) */ +int crypt_cipher_check_kernel(const char *name, const char *mode, + const char *integrity, size_t key_length); + +/* Storage encryption wrappers */ +int crypt_storage_init(struct crypt_storage **ctx, size_t sector_size, + const char *cipher, const char *cipher_mode, + const void *key, size_t key_length, bool large_iv); +void crypt_storage_destroy(struct crypt_storage *ctx); +int crypt_storage_decrypt(struct crypt_storage *ctx, uint64_t iv_offset, + uint64_t length, char *buffer); +int crypt_storage_encrypt(struct crypt_storage *ctx, uint64_t iv_offset, + uint64_t length, char *buffer); + +bool crypt_storage_kernel_only(struct crypt_storage *ctx); + +/* Temporary Bitlk helper */ +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length); + +/* Memzero helper (memset on stack can be optimized out) */ +static inline void crypt_backend_memzero(void *s, size_t n) +{ +#ifdef HAVE_EXPLICIT_BZERO + explicit_bzero(s, n); +#else + volatile uint8_t *p = (volatile uint8_t *)s; + while(n--) *p++ = 0; +#endif +} + +#endif /* _CRYPTO_BACKEND_H */ diff --git a/lib/crypto_backend/crypto_backend_internal.h b/lib/crypto_backend/crypto_backend_internal.h new file mode 100644 index 0000000..9d1bfb2 --- /dev/null +++ b/lib/crypto_backend/crypto_backend_internal.h @@ -0,0 +1,63 @@ +/* + * crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#ifndef _CRYPTO_BACKEND_INTERNAL_H +#define _CRYPTO_BACKEND_INTERNAL_H + +#include "crypto_backend.h" + +#if USE_INTERNAL_PBKDF2 +/* internal PBKDF2 implementation */ +int pkcs5_pbkdf2(const char *hash, + const char *P, size_t Plen, + const char *S, size_t Slen, + unsigned int c, + unsigned int dkLen, char *DK, + unsigned int hash_block_size); +#endif + +/* Argon2 implementation wrapper */ +int argon2(const char *type, const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel); + +/* Block ciphers: fallback to kernel crypto API */ + +struct crypt_cipher_kernel { + int tfmfd; + int opfd; +}; + +int crypt_cipher_init_kernel(struct crypt_cipher_kernel *ctx, const char *name, + const char *mode, const void *key, size_t key_length); +int crypt_cipher_encrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length); +int crypt_cipher_decrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length); +void crypt_cipher_destroy_kernel(struct crypt_cipher_kernel *ctx); +int crypt_bitlk_decrypt_key_kernel(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length); + +#endif /* _CRYPTO_BACKEND_INTERNAL_H */ diff --git a/lib/crypto_backend/crypto_cipher_kernel.c b/lib/crypto_backend/crypto_cipher_kernel.c new file mode 100644 index 0000000..607c3d3 --- /dev/null +++ b/lib/crypto_backend/crypto_cipher_kernel.c @@ -0,0 +1,352 @@ +/* + * Linux kernel userspace API crypto backend implementation (skcipher) + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +#ifdef ENABLE_AF_ALG + +#include + +#ifndef AF_ALG +#define AF_ALG 38 +#endif +#ifndef SOL_ALG +#define SOL_ALG 279 +#endif + +#ifndef ALG_SET_AEAD_AUTHSIZE +#define ALG_SET_AEAD_AUTHSIZE 5 +#endif + +/* + * ciphers + * + * ENOENT - algorithm not available + * ENOTSUP - AF_ALG family not available + * (but cannot check specifically for skcipher API) + */ +static int _crypt_cipher_init(struct crypt_cipher_kernel *ctx, + const void *key, size_t key_length, + size_t tag_length, struct sockaddr_alg *sa) +{ + if (!ctx) + return -EINVAL; + + ctx->opfd = -1; + ctx->tfmfd = socket(AF_ALG, SOCK_SEQPACKET, 0); + if (ctx->tfmfd < 0) { + crypt_cipher_destroy_kernel(ctx); + return -ENOTSUP; + } + + if (bind(ctx->tfmfd, (struct sockaddr *)sa, sizeof(*sa)) < 0) { + crypt_cipher_destroy_kernel(ctx); + return -ENOENT; + } + + if (setsockopt(ctx->tfmfd, SOL_ALG, ALG_SET_KEY, key, key_length) < 0) { + crypt_cipher_destroy_kernel(ctx); + return -EINVAL; + } + + if (tag_length && setsockopt(ctx->tfmfd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, tag_length) < 0) { + crypt_cipher_destroy_kernel(ctx); + return -EINVAL; + } + + ctx->opfd = accept(ctx->tfmfd, NULL, 0); + if (ctx->opfd < 0) { + crypt_cipher_destroy_kernel(ctx); + return -EINVAL; + } + + return 0; +} + +int crypt_cipher_init_kernel(struct crypt_cipher_kernel *ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "skcipher", + }; + int r; + + if (!strcmp(name, "cipher_null")) + key_length = 0; + + r = snprintf((char *)sa.salg_name, sizeof(sa.salg_name), "%s(%s)", mode, name); + if (r < 0 || (size_t)r >= sizeof(sa.salg_name)) + return -EINVAL; + + return _crypt_cipher_init(ctx, key, key_length, 0, &sa); +} + +/* The in/out should be aligned to page boundary */ +static int _crypt_cipher_crypt(struct crypt_cipher_kernel *ctx, + const char *in, size_t in_length, + char *out, size_t out_length, + const char *iv, size_t iv_length, + uint32_t direction) +{ + int r = 0; + ssize_t len; + struct af_alg_iv *alg_iv; + struct cmsghdr *header; + uint32_t *type; + struct iovec iov = { + .iov_base = (void*)(uintptr_t)in, + .iov_len = in_length, + }; + int iv_msg_size = iv ? CMSG_SPACE(sizeof(*alg_iv) + iv_length) : 0; + char buffer[CMSG_SPACE(sizeof(*type)) + iv_msg_size]; + struct msghdr msg = { + .msg_control = buffer, + .msg_controllen = sizeof(buffer), + .msg_iov = &iov, + .msg_iovlen = 1, + }; + + if (!in || !out || !in_length) + return -EINVAL; + + if ((!iv && iv_length) || (iv && !iv_length)) + return -EINVAL; + + memset(buffer, 0, sizeof(buffer)); + + /* Set encrypt/decrypt operation */ + header = CMSG_FIRSTHDR(&msg); + if (!header) + return -EINVAL; + + header->cmsg_level = SOL_ALG; + header->cmsg_type = ALG_SET_OP; + header->cmsg_len = CMSG_LEN(sizeof(*type)); + type = (void*)CMSG_DATA(header); + *type = direction; + + /* Set IV */ + if (iv) { + header = CMSG_NXTHDR(&msg, header); + if (!header) + return -EINVAL; + + header->cmsg_level = SOL_ALG; + header->cmsg_type = ALG_SET_IV; + header->cmsg_len = iv_msg_size; + alg_iv = (void*)CMSG_DATA(header); + alg_iv->ivlen = iv_length; + memcpy(alg_iv->iv, iv, iv_length); + } + + len = sendmsg(ctx->opfd, &msg, 0); + if (len != (ssize_t)(in_length)) { + r = -EIO; + goto bad; + } + + len = read(ctx->opfd, out, out_length); + if (len != (ssize_t)out_length) + r = -EIO; +bad: + crypt_backend_memzero(buffer, sizeof(buffer)); + return r; +} + +int crypt_cipher_encrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return _crypt_cipher_crypt(ctx, in, length, out, length, + iv, iv_length, ALG_OP_ENCRYPT); +} + +int crypt_cipher_decrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return _crypt_cipher_crypt(ctx, in, length, out, length, + iv, iv_length, ALG_OP_DECRYPT); +} + +void crypt_cipher_destroy_kernel(struct crypt_cipher_kernel *ctx) +{ + if (ctx->tfmfd >= 0) + close(ctx->tfmfd); + if (ctx->opfd >= 0) + close(ctx->opfd); + + ctx->tfmfd = -1; + ctx->opfd = -1; +} + +int crypt_cipher_check_kernel(const char *name, const char *mode, + const char *integrity, size_t key_length) +{ + struct crypt_cipher_kernel c; + char mode_name[64], tmp_salg_name[180], *real_mode = NULL, *cipher_iv = NULL, *key; + const char *salg_type; + bool aead; + int r; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + }; + + aead = integrity && strcmp(integrity, "none"); + + /* Remove IV if present */ + if (mode) { + strncpy(mode_name, mode, sizeof(mode_name)); + mode_name[sizeof(mode_name) - 1] = 0; + cipher_iv = strchr(mode_name, '-'); + if (cipher_iv) { + *cipher_iv = '\0'; + real_mode = mode_name; + } + } + + salg_type = aead ? "aead" : "skcipher"; + r = snprintf((char *)sa.salg_type, sizeof(sa.salg_type), "%s", salg_type); + if (r < 0 || (size_t)r >= sizeof(sa.salg_name)) + return -EINVAL; + + memset(tmp_salg_name, 0, sizeof(tmp_salg_name)); + + /* FIXME: this is duplicating a part of devmapper backend */ + if (aead && !strcmp(integrity, "poly1305")) + r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc7539(%s,%s)", name, integrity); + else if (!real_mode) + r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s", name); + else if (aead && !strcmp(real_mode, "ccm")) + r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "rfc4309(%s(%s))", real_mode, name); + else + r = snprintf(tmp_salg_name, sizeof(tmp_salg_name), "%s(%s)", real_mode, name); + + if (r < 0 || (size_t)r >= sizeof(tmp_salg_name)) + return -EINVAL; + + memcpy(sa.salg_name, tmp_salg_name, sizeof(sa.salg_name)); + + key = malloc(key_length); + if (!key) + return -ENOMEM; + + /* We cannot use RNG yet, any key works here, tweak the first part if it is split key (XTS). */ + memset(key, 0xab, key_length); + *key = 0xef; + + r = _crypt_cipher_init(&c, key, key_length, 0, &sa); + crypt_cipher_destroy_kernel(&c); + free(key); + + return r; +} + +int crypt_bitlk_decrypt_key_kernel(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ + struct crypt_cipher_kernel c; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "aead", + .salg_name = "ccm(aes)", + }; + int r; + char buffer[128], ccm_iv[16]; + + if (length + tag_length > sizeof(buffer)) + return -EINVAL; + + if (iv_length > sizeof(ccm_iv) - 2) + return -EINVAL; + + r = _crypt_cipher_init(&c, key, key_length, tag_length, &sa); + if (r < 0) + return r; + + memcpy(buffer, in, length); + memcpy(buffer + length, tag, tag_length); + + /* CCM IV - RFC3610 */ + memset(ccm_iv, 0, sizeof(ccm_iv)); + ccm_iv[0] = 15 - iv_length - 1; + memcpy(ccm_iv + 1, iv, iv_length); + memset(ccm_iv + 1 + iv_length, 0, ccm_iv[0] + 1); + iv_length = sizeof(ccm_iv); + + r = _crypt_cipher_crypt(&c, buffer, length + tag_length, out, length, + ccm_iv, iv_length, ALG_OP_DECRYPT); + + crypt_cipher_destroy_kernel(&c); + crypt_backend_memzero(buffer, sizeof(buffer)); + + return r; +} + +#else /* ENABLE_AF_ALG */ +int crypt_cipher_init_kernel(struct crypt_cipher_kernel *ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + return -ENOTSUP; +} + +void crypt_cipher_destroy_kernel(struct crypt_cipher_kernel *ctx) +{ + return; +} + +int crypt_cipher_encrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return -EINVAL; +} +int crypt_cipher_decrypt_kernel(struct crypt_cipher_kernel *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return -EINVAL; +} +int crypt_cipher_check_kernel(const char *name, const char *mode, + const char *integrity, size_t key_length) +{ + /* Cannot check, expect success. */ + return 0; +} +int crypt_bitlk_decrypt_key_kernel(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ + return -ENOTSUP; +} +#endif diff --git a/lib/crypto_backend/crypto_gcrypt.c b/lib/crypto_backend/crypto_gcrypt.c new file mode 100644 index 0000000..698b52a --- /dev/null +++ b/lib/crypto_backend/crypto_gcrypt.c @@ -0,0 +1,552 @@ +/* + * GCRYPT crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +static int crypto_backend_initialised = 0; +static int crypto_backend_secmem = 1; +static int crypto_backend_whirlpool_bug = -1; +static char version[64]; + +struct crypt_hash { + gcry_md_hd_t hd; + int hash_id; + int hash_len; +}; + +struct crypt_hmac { + gcry_md_hd_t hd; + int hash_id; + int hash_len; +}; + +struct crypt_cipher { + bool use_kernel; + union { + struct crypt_cipher_kernel kernel; + gcry_cipher_hd_t hd; + } u; +}; + +struct hash_alg { + const char *name; + const char *gcrypt_name; +}; + +/* + * Test for wrong Whirlpool variant, + * Ref: https://lists.gnupg.org/pipermail/gcrypt-devel/2014-January/002889.html + */ +static void crypt_hash_test_whirlpool_bug(void) +{ + struct crypt_hash *h; + char buf[2] = "\0\0", hash_out1[64], hash_out2[64]; + int r; + + if (crypto_backend_whirlpool_bug >= 0) + return; + + crypto_backend_whirlpool_bug = 0; + if (crypt_hash_init(&h, "whirlpool")) + return; + + /* One shot */ + if ((r = crypt_hash_write(h, &buf[0], 2)) || + (r = crypt_hash_final(h, hash_out1, 64))) { + crypt_hash_destroy(h); + return; + } + + /* Split buf (crypt_hash_final resets hash state) */ + if ((r = crypt_hash_write(h, &buf[0], 1)) || + (r = crypt_hash_write(h, &buf[1], 1)) || + (r = crypt_hash_final(h, hash_out2, 64))) { + crypt_hash_destroy(h); + return; + } + + crypt_hash_destroy(h); + + if (memcmp(hash_out1, hash_out2, 64)) + crypto_backend_whirlpool_bug = 1; +} + +int crypt_backend_init(void) +{ + int r; + + if (crypto_backend_initialised) + return 0; + + if (!gcry_control (GCRYCTL_INITIALIZATION_FINISHED_P)) { + if (!gcry_check_version (GCRYPT_REQ_VERSION)) { + return -ENOSYS; + } + +/* FIXME: If gcrypt compiled to support POSIX 1003.1e capabilities, + * it drops all privileges during secure memory initialisation. + * For now, the only workaround is to disable secure memory in gcrypt. + * cryptsetup always need at least cap_sys_admin privilege for dm-ioctl + * and it locks its memory space anyway. + */ +#if 0 + gcry_control (GCRYCTL_DISABLE_SECMEM); + crypto_backend_secmem = 0; +#else + + gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN); + gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0); + gcry_control (GCRYCTL_RESUME_SECMEM_WARN); +#endif + gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0); + } + + crypto_backend_initialised = 1; + crypt_hash_test_whirlpool_bug(); + + r = snprintf(version, sizeof(version), "gcrypt %s%s%s", + gcry_check_version(NULL), + crypto_backend_secmem ? "" : ", secmem disabled", + crypto_backend_whirlpool_bug > 0 ? ", flawed whirlpool" : ""); + if (r < 0 || (size_t)r >= sizeof(version)) + return -EINVAL; + + return 0; +} + +void crypt_backend_destroy(void) +{ + if (crypto_backend_initialised) + gcry_control(GCRYCTL_TERM_SECMEM); + + crypto_backend_initialised = 0; +} + +const char *crypt_backend_version(void) +{ + return crypto_backend_initialised ? version : ""; +} + +uint32_t crypt_backend_flags(void) +{ + return 0; +} + +static const char *crypt_hash_compat_name(const char *name, unsigned int *flags) +{ + const char *hash_name = name; + int i; + static struct hash_alg hash_algs[] = { + { "blake2b-160", "blake2b_160" }, + { "blake2b-256", "blake2b_256" }, + { "blake2b-384", "blake2b_384" }, + { "blake2b-512", "blake2b_512" }, + { "blake2s-128", "blake2s_128" }, + { "blake2s-160", "blake2s_160" }, + { "blake2s-224", "blake2s_224" }, + { "blake2s-256", "blake2s_256" }, + { NULL, NULL, }}; + + if (!name) + return NULL; + + /* "whirlpool_gcryptbug" is out shortcut to flawed whirlpool + * in libgcrypt < 1.6.0 */ + if (!strcasecmp(name, "whirlpool_gcryptbug")) { +#if GCRYPT_VERSION_NUMBER >= 0x010601 + if (flags) + *flags |= GCRY_MD_FLAG_BUGEMU1; +#endif + hash_name = "whirlpool"; + } + + i = 0; + while (hash_algs[i].name) { + if (!strcasecmp(name, hash_algs[i].name)) { + hash_name = hash_algs[i].gcrypt_name; + break; + } + i++; + } + + return hash_name; +} + +/* HASH */ +int crypt_hash_size(const char *name) +{ + int hash_id; + + assert(crypto_backend_initialised); + + hash_id = gcry_md_map_name(crypt_hash_compat_name(name, NULL)); + if (!hash_id) + return -EINVAL; + + return gcry_md_get_algo_dlen(hash_id); +} + +int crypt_hash_init(struct crypt_hash **ctx, const char *name) +{ + struct crypt_hash *h; + unsigned int flags = 0; + + assert(crypto_backend_initialised); + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->hash_id = gcry_md_map_name(crypt_hash_compat_name(name, &flags)); + if (!h->hash_id) { + free(h); + return -EINVAL; + } + + if (gcry_md_open(&h->hd, h->hash_id, flags)) { + free(h); + return -EINVAL; + } + + h->hash_len = gcry_md_get_algo_dlen(h->hash_id); + *ctx = h; + return 0; +} + +static void crypt_hash_restart(struct crypt_hash *ctx) +{ + gcry_md_reset(ctx->hd); +} + +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length) +{ + gcry_md_write(ctx->hd, buffer, length); + return 0; +} + +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length) +{ + unsigned char *hash; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + hash = gcry_md_read(ctx->hd, ctx->hash_id); + if (!hash) + return -EINVAL; + + memcpy(buffer, hash, length); + crypt_hash_restart(ctx); + + return 0; +} + +void crypt_hash_destroy(struct crypt_hash *ctx) +{ + gcry_md_close(ctx->hd); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* HMAC */ +int crypt_hmac_size(const char *name) +{ + return crypt_hash_size(name); +} + +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length) +{ + struct crypt_hmac *h; + unsigned int flags = GCRY_MD_FLAG_HMAC; + + assert(crypto_backend_initialised); + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->hash_id = gcry_md_map_name(crypt_hash_compat_name(name, &flags)); + if (!h->hash_id) { + free(h); + return -EINVAL; + } + + if (gcry_md_open(&h->hd, h->hash_id, flags)) { + free(h); + return -EINVAL; + } + + if (gcry_md_setkey(h->hd, key, key_length)) { + gcry_md_close(h->hd); + free(h); + return -EINVAL; + } + + h->hash_len = gcry_md_get_algo_dlen(h->hash_id); + *ctx = h; + return 0; +} + +static void crypt_hmac_restart(struct crypt_hmac *ctx) +{ + gcry_md_reset(ctx->hd); +} + +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length) +{ + gcry_md_write(ctx->hd, buffer, length); + return 0; +} + +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length) +{ + unsigned char *hash; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + hash = gcry_md_read(ctx->hd, ctx->hash_id); + if (!hash) + return -EINVAL; + + memcpy(buffer, hash, length); + crypt_hmac_restart(ctx); + + return 0; +} + +void crypt_hmac_destroy(struct crypt_hmac *ctx) +{ + gcry_md_close(ctx->hd); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* RNG */ +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips) +{ + switch(quality) { + case CRYPT_RND_NORMAL: + gcry_randomize(buffer, length, GCRY_STRONG_RANDOM); + break; + case CRYPT_RND_SALT: + case CRYPT_RND_KEY: + default: + gcry_randomize(buffer, length, GCRY_VERY_STRONG_RANDOM); + break; + } + return 0; +} + +static int pbkdf2(const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations) +{ + const char *hash_name = crypt_hash_compat_name(hash, NULL); + +#if USE_INTERNAL_PBKDF2 + return pkcs5_pbkdf2(hash_name, password, password_length, salt, salt_length, + iterations, key_length, key, 0); +#else /* USE_INTERNAL_PBKDF2 */ + int hash_id = gcry_md_map_name(hash_name); + + if (!hash_id) + return -EINVAL; + + if (gcry_kdf_derive(password, password_length, GCRY_KDF_PBKDF2, hash_id, + salt, salt_length, iterations, key_length, key)) + return -EINVAL; + + return 0; +#endif /* USE_INTERNAL_PBKDF2 */ +} + +/* PBKDF */ +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) +{ + if (!kdf) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) + return pbkdf2(hash, password, password_length, salt, salt_length, + key, key_length, iterations); + else if (!strncmp(kdf, "argon2", 6)) + return argon2(kdf, password, password_length, salt, salt_length, + key, key_length, iterations, memory, parallel); + return -EINVAL; +} + +/* Block ciphers */ +static int _cipher_init(gcry_cipher_hd_t *hd, const char *name, + const char *mode, const void *buffer, size_t length) +{ + int cipher_id, mode_id; + + cipher_id = gcry_cipher_map_name(name); + if (cipher_id == GCRY_CIPHER_MODE_NONE) + return -ENOENT; + + if (!strcmp(mode, "ecb")) + mode_id = GCRY_CIPHER_MODE_ECB; + else if (!strcmp(mode, "cbc")) + mode_id = GCRY_CIPHER_MODE_CBC; +#if HAVE_DECL_GCRY_CIPHER_MODE_XTS + else if (!strcmp(mode, "xts")) + mode_id = GCRY_CIPHER_MODE_XTS; +#endif + else + return -ENOENT; + + if (gcry_cipher_open(hd, cipher_id, mode_id, 0)) + return -EINVAL; + + if (gcry_cipher_setkey(*hd, buffer, length)) { + gcry_cipher_close(*hd); + return -EINVAL; + } + + return 0; +} + +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct crypt_cipher *h; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + if (!_cipher_init(&h->u.hd, name, mode, key, key_length)) { + h->use_kernel = false; + *ctx = h; + return 0; + } + + r = crypt_cipher_init_kernel(&h->u.kernel, name, mode, key, key_length); + if (r < 0) { + free(h); + return r; + } + + h->use_kernel = true; + *ctx = h; + return 0; +} + +void crypt_cipher_destroy(struct crypt_cipher *ctx) +{ + if (ctx->use_kernel) + crypt_cipher_destroy_kernel(&ctx->u.kernel); + else + gcry_cipher_close(ctx->u.hd); + free(ctx); +} + +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + if (ctx->use_kernel) + return crypt_cipher_encrypt_kernel(&ctx->u.kernel, in, out, length, iv, iv_length); + + if (iv && gcry_cipher_setiv(ctx->u.hd, iv, iv_length)) + return -EINVAL; + + if (gcry_cipher_encrypt(ctx->u.hd, out, length, in, length)) + return -EINVAL; + + return 0; +} + +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + if (ctx->use_kernel) + return crypt_cipher_decrypt_kernel(&ctx->u.kernel, in, out, length, iv, iv_length); + + if (iv && gcry_cipher_setiv(ctx->u.hd, iv, iv_length)) + return -EINVAL; + + if (gcry_cipher_decrypt(ctx->u.hd, out, length, in, length)) + return -EINVAL; + + return 0; +} + +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx) +{ + return ctx->use_kernel; +} + +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ +#ifdef GCRY_CCM_BLOCK_LEN + gcry_cipher_hd_t hd; + uint64_t l[3]; + int r = -EINVAL; + + if (gcry_cipher_open(&hd, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CCM, 0)) + return -EINVAL; + + if (gcry_cipher_setkey(hd, key, key_length)) + goto out; + + if (gcry_cipher_setiv(hd, iv, iv_length)) + goto out; + + l[0] = length; + l[1] = 0; + l[2] = tag_length; + if (gcry_cipher_ctl(hd, GCRYCTL_SET_CCM_LENGTHS, l, sizeof(l))) + goto out; + + if (gcry_cipher_decrypt(hd, out, length, in, length)) + goto out; + + if (gcry_cipher_checktag(hd, tag, tag_length)) + goto out; + + r = 0; +out: + gcry_cipher_close(hd); + return r; +#else + return -ENOTSUP; +#endif +} diff --git a/lib/crypto_backend/crypto_kernel.c b/lib/crypto_backend/crypto_kernel.c new file mode 100644 index 0000000..2881ed4 --- /dev/null +++ b/lib/crypto_backend/crypto_kernel.c @@ -0,0 +1,418 @@ +/* + * Linux kernel userspace API crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +/* FIXME: remove later */ +#ifndef AF_ALG +#define AF_ALG 38 +#endif +#ifndef SOL_ALG +#define SOL_ALG 279 +#endif + +static int crypto_backend_initialised = 0; +static char version[256]; + +struct hash_alg { + const char *name; + const char *kernel_name; + int length; + unsigned int block_length; +}; + +static struct hash_alg hash_algs[] = { + { "sha1", "sha1", 20, 64 }, + { "sha224", "sha224", 28, 64 }, + { "sha256", "sha256", 32, 64 }, + { "sha384", "sha384", 48, 128 }, + { "sha512", "sha512", 64, 128 }, + { "ripemd160", "rmd160", 20, 64 }, + { "whirlpool", "wp512", 64, 64 }, + { "sha3-224", "sha3-224", 28, 144 }, + { "sha3-256", "sha3-256", 32, 136 }, + { "sha3-384", "sha3-384", 48, 104 }, + { "sha3-512", "sha3-512", 64, 72 }, + { "stribog256","streebog256", 32, 64 }, + { "stribog512","streebog512", 64, 64 }, + { "sm3", "sm3", 32, 64 }, + { "blake2b-160","blake2b-160",20, 128 }, + { "blake2b-256","blake2b-256",32, 128 }, + { "blake2b-384","blake2b-384",48, 128 }, + { "blake2b-512","blake2b-512",64, 128 }, + { "blake2s-128","blake2s-128",16, 64 }, + { "blake2s-160","blake2s-160",20, 64 }, + { "blake2s-224","blake2s-224",28, 64 }, + { "blake2s-256","blake2s-256",32, 64 }, + { NULL, NULL, 0, 0 } +}; + +struct crypt_hash { + int tfmfd; + int opfd; + int hash_len; +}; + +struct crypt_hmac { + int tfmfd; + int opfd; + int hash_len; +}; + +struct crypt_cipher { + struct crypt_cipher_kernel ck; +}; + +static int crypt_kernel_socket_init(struct sockaddr_alg *sa, int *tfmfd, int *opfd, + const void *key, size_t key_length) +{ + *tfmfd = socket(AF_ALG, SOCK_SEQPACKET, 0); + if (*tfmfd < 0) + return -ENOTSUP; + + if (bind(*tfmfd, (struct sockaddr *)sa, sizeof(*sa)) < 0) { + close(*tfmfd); + *tfmfd = -1; + return -ENOENT; + } + + if (key && setsockopt(*tfmfd, SOL_ALG, ALG_SET_KEY, key, key_length) < 0) { + close(*tfmfd); + *tfmfd = -1; + return -EINVAL; + } + + *opfd = accept(*tfmfd, NULL, 0); + if (*opfd < 0) { + close(*tfmfd); + *tfmfd = -1; + return -EINVAL; + } + + return 0; +} + +int crypt_backend_init(void) +{ + struct utsname uts; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "hash", + .salg_name = "sha256", + }; + int r, tfmfd = -1, opfd = -1; + + if (crypto_backend_initialised) + return 0; + + if (uname(&uts) == -1 || strcmp(uts.sysname, "Linux")) + return -EINVAL; + + r = snprintf(version, sizeof(version), "%s %s kernel cryptoAPI", + uts.sysname, uts.release); + if (r < 0 || (size_t)r >= sizeof(version)) + return -EINVAL; + + if (crypt_kernel_socket_init(&sa, &tfmfd, &opfd, NULL, 0) < 0) + return -EINVAL; + + close(tfmfd); + close(opfd); + + crypto_backend_initialised = 1; + return 0; +} + +void crypt_backend_destroy(void) +{ + crypto_backend_initialised = 0; +} + +uint32_t crypt_backend_flags(void) +{ + return CRYPT_BACKEND_KERNEL; +} + +const char *crypt_backend_version(void) +{ + return crypto_backend_initialised ? version : ""; +} + +static struct hash_alg *_get_alg(const char *name) +{ + int i = 0; + + while (name && hash_algs[i].name) { + if (!strcmp(name, hash_algs[i].name)) + return &hash_algs[i]; + i++; + } + return NULL; +} + +/* HASH */ +int crypt_hash_size(const char *name) +{ + struct hash_alg *ha = _get_alg(name); + + return ha ? ha->length : -EINVAL; +} + +int crypt_hash_init(struct crypt_hash **ctx, const char *name) +{ + struct crypt_hash *h; + struct hash_alg *ha; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "hash", + }; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + ha = _get_alg(name); + if (!ha) { + free(h); + return -EINVAL; + } + h->hash_len = ha->length; + + strncpy((char *)sa.salg_name, ha->kernel_name, sizeof(sa.salg_name)-1); + + if (crypt_kernel_socket_init(&sa, &h->tfmfd, &h->opfd, NULL, 0) < 0) { + free(h); + return -EINVAL; + } + + *ctx = h; + return 0; +} + +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length) +{ + ssize_t r; + + r = send(ctx->opfd, buffer, length, MSG_MORE); + if (r < 0 || (size_t)r < length) + return -EIO; + + return 0; +} + +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length) +{ + ssize_t r; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + r = read(ctx->opfd, buffer, length); + if (r < 0) + return -EIO; + + return 0; +} + +void crypt_hash_destroy(struct crypt_hash *ctx) +{ + if (ctx->tfmfd >= 0) + close(ctx->tfmfd); + if (ctx->opfd >= 0) + close(ctx->opfd); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* HMAC */ +int crypt_hmac_size(const char *name) +{ + return crypt_hash_size(name); +} + +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length) +{ + struct crypt_hmac *h; + struct hash_alg *ha; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "hash", + }; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + ha = _get_alg(name); + if (!ha) { + free(h); + return -EINVAL; + } + h->hash_len = ha->length; + + r = snprintf((char *)sa.salg_name, sizeof(sa.salg_name), + "hmac(%s)", ha->kernel_name); + if (r < 0 || (size_t)r >= sizeof(sa.salg_name)) { + free(h); + return -EINVAL; + } + + if (crypt_kernel_socket_init(&sa, &h->tfmfd, &h->opfd, key, key_length) < 0) { + free(h); + return -EINVAL; + } + + *ctx = h; + return 0; +} + +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length) +{ + ssize_t r; + + r = send(ctx->opfd, buffer, length, MSG_MORE); + if (r < 0 || (size_t)r < length) + return -EIO; + + return 0; +} + +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length) +{ + ssize_t r; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + r = read(ctx->opfd, buffer, length); + if (r < 0) + return -EIO; + + return 0; +} + +void crypt_hmac_destroy(struct crypt_hmac *ctx) +{ + if (ctx->tfmfd >= 0) + close(ctx->tfmfd); + if (ctx->opfd >= 0) + close(ctx->opfd); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* RNG - N/A */ +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips) +{ + return -EINVAL; +} + +/* PBKDF */ +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) +{ + struct hash_alg *ha; + + if (!kdf) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) { + ha = _get_alg(hash); + if (!ha) + return -EINVAL; + + return pkcs5_pbkdf2(hash, password, password_length, salt, salt_length, + iterations, key_length, key, ha->block_length); + } else if (!strncmp(kdf, "argon2", 6)) { + return argon2(kdf, password, password_length, salt, salt_length, + key, key_length, iterations, memory, parallel); + } + + return -EINVAL; +} + +/* Block ciphers */ +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct crypt_cipher *h; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + r = crypt_cipher_init_kernel(&h->ck, name, mode, key, key_length); + if (r < 0) { + free(h); + return r; + } + + *ctx = h; + return 0; +} + +void crypt_cipher_destroy(struct crypt_cipher *ctx) +{ + crypt_cipher_destroy_kernel(&ctx->ck); + free(ctx); +} + +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_encrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_decrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx) +{ + return true; +} + +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ + return crypt_bitlk_decrypt_key_kernel(key, key_length, in, out, length, + iv, iv_length, tag, tag_length); +} diff --git a/lib/crypto_backend/crypto_nettle.c b/lib/crypto_backend/crypto_nettle.c new file mode 100644 index 0000000..3cffba9 --- /dev/null +++ b/lib/crypto_backend/crypto_nettle.c @@ -0,0 +1,444 @@ +/* + * Nettle crypto backend implementation + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2011-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +#if HAVE_NETTLE_VERSION_H +#include +#define VSTR(s) STR(s) +#define STR(s) #s +static const char *version = "Nettle "VSTR(NETTLE_VERSION_MAJOR)"."VSTR(NETTLE_VERSION_MINOR); +#else +static const char *version = "Nettle"; +#endif + +typedef void (*init_func) (void *); +typedef void (*update_func) (void *, size_t, const uint8_t *); +typedef void (*digest_func) (void *, size_t, uint8_t *); +typedef void (*set_key_func) (void *, size_t, const uint8_t *); + +struct hash_alg { + const char *name; + int length; + init_func init; + update_func update; + digest_func digest; + update_func hmac_update; + digest_func hmac_digest; + set_key_func hmac_set_key; +}; + +/* Missing HMAC wrappers in Nettle */ +#define HMAC_FCE(xxx) \ +struct xhmac_##xxx##_ctx HMAC_CTX(struct xxx##_ctx); \ +static void xhmac_##xxx##_set_key(struct xhmac_##xxx##_ctx *ctx, \ +size_t key_length, const uint8_t *key) \ +{HMAC_SET_KEY(ctx, &nettle_##xxx, key_length, key);} \ +static void xhmac_##xxx##_update(struct xhmac_##xxx##_ctx *ctx, \ +size_t length, const uint8_t *data) \ +{xxx##_update(&ctx->state, length, data);} \ +static void xhmac_##xxx##_digest(struct xhmac_##xxx##_ctx *ctx, \ +size_t length, uint8_t *digest) \ +{HMAC_DIGEST(ctx, &nettle_##xxx, length, digest);} + +HMAC_FCE(sha3_224); +HMAC_FCE(sha3_256); +HMAC_FCE(sha3_384); +HMAC_FCE(sha3_512); + +static struct hash_alg hash_algs[] = { + { "sha1", SHA1_DIGEST_SIZE, + (init_func) sha1_init, + (update_func) sha1_update, + (digest_func) sha1_digest, + (update_func) hmac_sha1_update, + (digest_func) hmac_sha1_digest, + (set_key_func) hmac_sha1_set_key, + }, + { "sha224", SHA224_DIGEST_SIZE, + (init_func) sha224_init, + (update_func) sha224_update, + (digest_func) sha224_digest, + (update_func) hmac_sha224_update, + (digest_func) hmac_sha224_digest, + (set_key_func) hmac_sha224_set_key, + }, + { "sha256", SHA256_DIGEST_SIZE, + (init_func) sha256_init, + (update_func) sha256_update, + (digest_func) sha256_digest, + (update_func) hmac_sha256_update, + (digest_func) hmac_sha256_digest, + (set_key_func) hmac_sha256_set_key, + }, + { "sha384", SHA384_DIGEST_SIZE, + (init_func) sha384_init, + (update_func) sha384_update, + (digest_func) sha384_digest, + (update_func) hmac_sha384_update, + (digest_func) hmac_sha384_digest, + (set_key_func) hmac_sha384_set_key, + }, + { "sha512", SHA512_DIGEST_SIZE, + (init_func) sha512_init, + (update_func) sha512_update, + (digest_func) sha512_digest, + (update_func) hmac_sha512_update, + (digest_func) hmac_sha512_digest, + (set_key_func) hmac_sha512_set_key, + }, + { "ripemd160", RIPEMD160_DIGEST_SIZE, + (init_func) ripemd160_init, + (update_func) ripemd160_update, + (digest_func) ripemd160_digest, + (update_func) hmac_ripemd160_update, + (digest_func) hmac_ripemd160_digest, + (set_key_func) hmac_ripemd160_set_key, + }, +/* Nettle prior to version 3.2 has incompatible SHA3 implementation */ +#if NETTLE_SHA3_FIPS202 + { "sha3-224", SHA3_224_DIGEST_SIZE, + (init_func) sha3_224_init, + (update_func) sha3_224_update, + (digest_func) sha3_224_digest, + (update_func) xhmac_sha3_224_update, + (digest_func) xhmac_sha3_224_digest, + (set_key_func) xhmac_sha3_224_set_key, + }, + { "sha3-256", SHA3_256_DIGEST_SIZE, + (init_func) sha3_256_init, + (update_func) sha3_256_update, + (digest_func) sha3_256_digest, + (update_func) xhmac_sha3_256_update, + (digest_func) xhmac_sha3_256_digest, + (set_key_func) xhmac_sha3_256_set_key, + }, + { "sha3-384", SHA3_384_DIGEST_SIZE, + (init_func) sha3_384_init, + (update_func) sha3_384_update, + (digest_func) sha3_384_digest, + (update_func) xhmac_sha3_384_update, + (digest_func) xhmac_sha3_384_digest, + (set_key_func) xhmac_sha3_384_set_key, + }, + { "sha3-512", SHA3_512_DIGEST_SIZE, + (init_func) sha3_512_init, + (update_func) sha3_512_update, + (digest_func) sha3_512_digest, + (update_func) xhmac_sha3_512_update, + (digest_func) xhmac_sha3_512_digest, + (set_key_func) xhmac_sha3_512_set_key, + }, +#endif + { NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL, } +}; + +struct crypt_hash { + const struct hash_alg *hash; + union { + struct sha1_ctx sha1; + struct sha224_ctx sha224; + struct sha256_ctx sha256; + struct sha384_ctx sha384; + struct sha512_ctx sha512; + struct ripemd160_ctx ripemd160; + struct sha3_224_ctx sha3_224; + struct sha3_256_ctx sha3_256; + struct sha3_384_ctx sha3_384; + struct sha3_512_ctx sha3_512; + } nettle_ctx; +}; + +struct crypt_hmac { + const struct hash_alg *hash; + union { + struct hmac_sha1_ctx sha1; + struct hmac_sha224_ctx sha224; + struct hmac_sha256_ctx sha256; + struct hmac_sha384_ctx sha384; + struct hmac_sha512_ctx sha512; + struct hmac_ripemd160_ctx ripemd160; + struct xhmac_sha3_224_ctx sha3_224; + struct xhmac_sha3_256_ctx sha3_256; + struct xhmac_sha3_384_ctx sha3_384; + struct xhmac_sha3_512_ctx sha3_512; + } nettle_ctx; + size_t key_length; + uint8_t *key; +}; + +struct crypt_cipher { + struct crypt_cipher_kernel ck; +}; + +uint32_t crypt_backend_flags(void) +{ + return 0; +} + +static struct hash_alg *_get_alg(const char *name) +{ + int i = 0; + + while (name && hash_algs[i].name) { + if (!strcmp(name, hash_algs[i].name)) + return &hash_algs[i]; + i++; + } + return NULL; +} + +int crypt_backend_init(void) +{ + return 0; +} + +void crypt_backend_destroy(void) +{ + return; +} + +const char *crypt_backend_version(void) +{ + return version; +} + +/* HASH */ +int crypt_hash_size(const char *name) +{ + struct hash_alg *ha = _get_alg(name); + + return ha ? ha->length : -EINVAL; +} + +int crypt_hash_init(struct crypt_hash **ctx, const char *name) +{ + struct crypt_hash *h; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->hash = _get_alg(name); + if (!h->hash) { + free(h); + return -EINVAL; + } + + h->hash->init(&h->nettle_ctx); + + *ctx = h; + return 0; +} + +static void crypt_hash_restart(struct crypt_hash *ctx) +{ + ctx->hash->init(&ctx->nettle_ctx); +} + +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length) +{ + ctx->hash->update(&ctx->nettle_ctx, length, (const uint8_t*)buffer); + return 0; +} + +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length) +{ + if (length > (size_t)ctx->hash->length) + return -EINVAL; + + ctx->hash->digest(&ctx->nettle_ctx, length, (uint8_t *)buffer); + crypt_hash_restart(ctx); + return 0; +} + +void crypt_hash_destroy(struct crypt_hash *ctx) +{ + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* HMAC */ +int crypt_hmac_size(const char *name) +{ + return crypt_hash_size(name); +} + +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length) +{ + struct crypt_hmac *h; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + memset(ctx, 0, sizeof(*ctx)); + + + h->hash = _get_alg(name); + if (!h->hash) + goto bad; + + h->key = malloc(key_length); + if (!h->key) + goto bad; + + memcpy(h->key, key, key_length); + h->key_length = key_length; + + h->hash->init(&h->nettle_ctx); + h->hash->hmac_set_key(&h->nettle_ctx, h->key_length, h->key); + + *ctx = h; + return 0; +bad: + free(h); + return -EINVAL; +} + +static void crypt_hmac_restart(struct crypt_hmac *ctx) +{ + ctx->hash->hmac_set_key(&ctx->nettle_ctx, ctx->key_length, ctx->key); +} + +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length) +{ + ctx->hash->hmac_update(&ctx->nettle_ctx, length, (const uint8_t *)buffer); + return 0; +} + +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length) +{ + if (length > (size_t)ctx->hash->length) + return -EINVAL; + + ctx->hash->hmac_digest(&ctx->nettle_ctx, length, (uint8_t *)buffer); + crypt_hmac_restart(ctx); + return 0; +} + +void crypt_hmac_destroy(struct crypt_hmac *ctx) +{ + memset(ctx->key, 0, ctx->key_length); + free(ctx->key); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* RNG - N/A */ +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips) +{ + return -EINVAL; +} + +/* PBKDF */ +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) +{ + struct crypt_hmac *h; + int r; + + if (!kdf) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) { + r = crypt_hmac_init(&h, hash, password, password_length); + if (r < 0) + return r; + + nettle_pbkdf2(&h->nettle_ctx, h->hash->hmac_update, + h->hash->hmac_digest, h->hash->length, iterations, + salt_length, (const uint8_t *)salt, key_length, + (uint8_t *)key); + crypt_hmac_destroy(h); + return 0; + } else if (!strncmp(kdf, "argon2", 6)) { + return argon2(kdf, password, password_length, salt, salt_length, + key, key_length, iterations, memory, parallel); + } + + return -EINVAL; +} + +/* Block ciphers */ +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct crypt_cipher *h; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + r = crypt_cipher_init_kernel(&h->ck, name, mode, key, key_length); + if (r < 0) { + free(h); + return r; + } + + *ctx = h; + return 0; +} + +void crypt_cipher_destroy(struct crypt_cipher *ctx) +{ + crypt_cipher_destroy_kernel(&ctx->ck); + free(ctx); +} + +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_encrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_decrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx) +{ + return true; +} + +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ + return crypt_bitlk_decrypt_key_kernel(key, key_length, in, out, length, + iv, iv_length, tag, tag_length); +} diff --git a/lib/crypto_backend/crypto_nss.c b/lib/crypto_backend/crypto_nss.c new file mode 100644 index 0000000..7e4db80 --- /dev/null +++ b/lib/crypto_backend/crypto_nss.c @@ -0,0 +1,397 @@ +/* + * NSS crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +#define CONST_CAST(x) (x)(uintptr_t) + +static int crypto_backend_initialised = 0; +static char version[64]; + +struct hash_alg { + const char *name; + SECOidTag oid; + CK_MECHANISM_TYPE ck_type; + int length; + unsigned int block_length; +}; + +static struct hash_alg hash_algs[] = { + { "sha1", SEC_OID_SHA1, CKM_SHA_1_HMAC, 20, 64 }, + { "sha256", SEC_OID_SHA256, CKM_SHA256_HMAC, 32, 64 }, + { "sha384", SEC_OID_SHA384, CKM_SHA384_HMAC, 48, 128 }, + { "sha512", SEC_OID_SHA512, CKM_SHA512_HMAC, 64, 128 }, +// { "ripemd160", SEC_OID_RIPEMD160, CKM_RIPEMD160_HMAC, 20, 64 }, + { NULL, 0, 0, 0 } +}; + +struct crypt_hash { + PK11Context *md; + const struct hash_alg *hash; +}; + +struct crypt_hmac { + PK11Context *md; + PK11SymKey *key; + PK11SlotInfo *slot; + const struct hash_alg *hash; +}; + +struct crypt_cipher { + struct crypt_cipher_kernel ck; +}; + +static struct hash_alg *_get_alg(const char *name) +{ + int i = 0; + + while (name && hash_algs[i].name) { + if (!strcmp(name, hash_algs[i].name)) + return &hash_algs[i]; + i++; + } + return NULL; +} + +int crypt_backend_init(void) +{ + int r; + + if (crypto_backend_initialised) + return 0; + + if (NSS_NoDB_Init(".") != SECSuccess) + return -EINVAL; + +#if HAVE_DECL_NSS_GETVERSION + r = snprintf(version, sizeof(version), "NSS %s", NSS_GetVersion()); +#else + r = snprintf(version, sizeof(version), "NSS"); +#endif + if (r < 0 || (size_t)r >= sizeof(version)) + return -EINVAL; + + crypto_backend_initialised = 1; + return 0; +} + +void crypt_backend_destroy(void) +{ + crypto_backend_initialised = 0; +} + +uint32_t crypt_backend_flags(void) +{ + return 0; +} + +const char *crypt_backend_version(void) +{ + return crypto_backend_initialised ? version : ""; +} + +/* HASH */ +int crypt_hash_size(const char *name) +{ + struct hash_alg *ha = _get_alg(name); + + return ha ? ha->length : -EINVAL; +} + +int crypt_hash_init(struct crypt_hash **ctx, const char *name) +{ + struct crypt_hash *h; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->hash = _get_alg(name); + if (!h->hash) { + free(h); + return -EINVAL; + } + + h->md = PK11_CreateDigestContext(h->hash->oid); + if (!h->md) { + free(h); + return -EINVAL; + } + + if (PK11_DigestBegin(h->md) != SECSuccess) { + PK11_DestroyContext(h->md, PR_TRUE); + free(h); + return -EINVAL; + } + + *ctx = h; + return 0; +} + +static int crypt_hash_restart(struct crypt_hash *ctx) +{ + if (PK11_DigestBegin(ctx->md) != SECSuccess) + return -EINVAL; + + return 0; +} + +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length) +{ + if (PK11_DigestOp(ctx->md, CONST_CAST(unsigned char *)buffer, length) != SECSuccess) + return -EINVAL; + + return 0; +} + +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length) +{ + unsigned char tmp[64]; + unsigned int tmp_len; + + if (length > (size_t)ctx->hash->length) + return -EINVAL; + + if (PK11_DigestFinal(ctx->md, tmp, &tmp_len, length) != SECSuccess) + return -EINVAL; + + memcpy(buffer, tmp, length); + crypt_backend_memzero(tmp, sizeof(tmp)); + + if (tmp_len < length) + return -EINVAL; + + if (crypt_hash_restart(ctx)) + return -EINVAL; + + return 0; +} + +void crypt_hash_destroy(struct crypt_hash *ctx) +{ + PK11_DestroyContext(ctx->md, PR_TRUE); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* HMAC */ +int crypt_hmac_size(const char *name) +{ + return crypt_hash_size(name); +} + +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length) +{ + struct crypt_hmac *h; + SECItem keyItem; + SECItem noParams; + + keyItem.type = siBuffer; + keyItem.data = CONST_CAST(unsigned char *)key; + keyItem.len = (int)key_length; + + noParams.type = siBuffer; + noParams.data = 0; + noParams.len = 0; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + memset(ctx, 0, sizeof(*ctx)); + + + h->hash = _get_alg(name); + if (!h->hash) + goto bad; + + h->slot = PK11_GetInternalKeySlot(); + if (!h->slot) + goto bad; + + h->key = PK11_ImportSymKey(h->slot, h->hash->ck_type, PK11_OriginUnwrap, + CKA_SIGN, &keyItem, NULL); + if (!h->key) + goto bad; + + h->md = PK11_CreateContextBySymKey(h->hash->ck_type, CKA_SIGN, h->key, + &noParams); + if (!h->md) + goto bad; + + if (PK11_DigestBegin(h->md) != SECSuccess) + goto bad; + + *ctx = h; + return 0; +bad: + crypt_hmac_destroy(h); + return -EINVAL; +} + +static int crypt_hmac_restart(struct crypt_hmac *ctx) +{ + if (PK11_DigestBegin(ctx->md) != SECSuccess) + return -EINVAL; + + return 0; +} + +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length) +{ + if (PK11_DigestOp(ctx->md, CONST_CAST(unsigned char *)buffer, length) != SECSuccess) + return -EINVAL; + + return 0; +} + +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length) +{ + unsigned char tmp[64]; + unsigned int tmp_len; + + if (length > (size_t)ctx->hash->length) + return -EINVAL; + + if (PK11_DigestFinal(ctx->md, tmp, &tmp_len, length) != SECSuccess) + return -EINVAL; + + memcpy(buffer, tmp, length); + crypt_backend_memzero(tmp, sizeof(tmp)); + + if (tmp_len < length) + return -EINVAL; + + if (crypt_hmac_restart(ctx)) + return -EINVAL; + + return 0; +} + +void crypt_hmac_destroy(struct crypt_hmac *ctx) +{ + if (ctx->key) + PK11_FreeSymKey(ctx->key); + if (ctx->slot) + PK11_FreeSlot(ctx->slot); + if (ctx->md) + PK11_DestroyContext(ctx->md, PR_TRUE); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* RNG */ +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips) +{ + if (fips) + return -EINVAL; + + if (PK11_GenerateRandom((unsigned char *)buffer, length) != SECSuccess) + return -EINVAL; + + return 0; +} + +/* PBKDF */ +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) +{ + struct hash_alg *ha; + + if (!kdf) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) { + ha = _get_alg(hash); + if (!ha) + return -EINVAL; + + return pkcs5_pbkdf2(hash, password, password_length, salt, salt_length, + iterations, key_length, key, ha->block_length); + } else if (!strncmp(kdf, "argon2", 6)) { + return argon2(kdf, password, password_length, salt, salt_length, + key, key_length, iterations, memory, parallel); + } + + return -EINVAL; +} + +/* Block ciphers */ +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct crypt_cipher *h; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + r = crypt_cipher_init_kernel(&h->ck, name, mode, key, key_length); + if (r < 0) { + free(h); + return r; + } + + *ctx = h; + return 0; +} + +void crypt_cipher_destroy(struct crypt_cipher *ctx) +{ + crypt_cipher_destroy_kernel(&ctx->ck); + free(ctx); +} + +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_encrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + return crypt_cipher_decrypt_kernel(&ctx->ck, in, out, length, iv, iv_length); +} + +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx) +{ + return true; +} + +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ + return crypt_bitlk_decrypt_key_kernel(key, key_length, in, out, length, + iv, iv_length, tag, tag_length); +} diff --git a/lib/crypto_backend/crypto_openssl.c b/lib/crypto_backend/crypto_openssl.c new file mode 100644 index 0000000..8681aab --- /dev/null +++ b/lib/crypto_backend/crypto_openssl.c @@ -0,0 +1,576 @@ +/* + * OPENSSL crypto backend implementation + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2010-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + * In addition, as a special exception, the copyright holders give + * permission to link the code of portions of this program with the + * OpenSSL library under certain conditions as described in each + * individual source file, and distribute linked combinations + * including the two. + * + * You must obey the GNU Lesser General Public License in all respects + * for all of the code used other than OpenSSL. + */ + +#include +#include +#include +#include +#include +#include "crypto_backend_internal.h" + +#define CONST_CAST(x) (x)(uintptr_t) + +static int crypto_backend_initialised = 0; + +struct crypt_hash { + EVP_MD_CTX *md; + const EVP_MD *hash_id; + int hash_len; +}; + +struct crypt_hmac { + HMAC_CTX *md; + const EVP_MD *hash_id; + int hash_len; +}; + +struct crypt_cipher { + bool use_kernel; + union { + struct crypt_cipher_kernel kernel; + struct { + EVP_CIPHER_CTX *hd_enc; + EVP_CIPHER_CTX *hd_dec; + size_t iv_length; + } lib; + } u; +}; + +struct hash_alg { + const char *name; + const char *openssl_name; +}; + +/* + * Compatible wrappers for OpenSSL < 1.1.0 and LibreSSL < 2.7.0 + */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L || \ + (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL) + +static void openssl_backend_init(void) +{ + OpenSSL_add_all_algorithms(); +} + +static const char *openssl_backend_version(void) +{ + return SSLeay_version(SSLEAY_VERSION); +} + +static EVP_MD_CTX *EVP_MD_CTX_new(void) +{ + EVP_MD_CTX *md = malloc(sizeof(*md)); + + if (md) + EVP_MD_CTX_init(md); + + return md; +} + +static void EVP_MD_CTX_free(EVP_MD_CTX *md) +{ + EVP_MD_CTX_cleanup(md); + free(md); +} + +static HMAC_CTX *HMAC_CTX_new(void) +{ + HMAC_CTX *md = malloc(sizeof(*md)); + + if (md) + HMAC_CTX_init(md); + + return md; +} + +static void HMAC_CTX_free(HMAC_CTX *md) +{ + HMAC_CTX_cleanup(md); + free(md); +} +#else +static void openssl_backend_init(void) +{ +} + +static const char *openssl_backend_version(void) +{ + return OpenSSL_version(OPENSSL_VERSION); +} +#endif + +int crypt_backend_init(void) +{ + if (crypto_backend_initialised) + return 0; + + openssl_backend_init(); + + crypto_backend_initialised = 1; + return 0; +} + +void crypt_backend_destroy(void) +{ + crypto_backend_initialised = 0; +} + +uint32_t crypt_backend_flags(void) +{ + return 0; +} + +const char *crypt_backend_version(void) +{ + return openssl_backend_version(); +} + +static const char *crypt_hash_compat_name(const char *name) +{ + const char *hash_name = name; + int i; + static struct hash_alg hash_algs[] = { + { "blake2b-512", "blake2b512" }, + { "blake2s-256", "blake2s256" }, + { NULL, NULL, }}; + + if (!name) + return NULL; + + i = 0; + while (hash_algs[i].name) { + if (!strcasecmp(name, hash_algs[i].name)) { + hash_name = hash_algs[i].openssl_name; + break; + } + i++; + } + + return hash_name; +} + +/* HASH */ +int crypt_hash_size(const char *name) +{ + const EVP_MD *hash_id; + + hash_id = EVP_get_digestbyname(crypt_hash_compat_name(name)); + if (!hash_id) + return -EINVAL; + + return EVP_MD_size(hash_id); +} + +int crypt_hash_init(struct crypt_hash **ctx, const char *name) +{ + struct crypt_hash *h; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->md = EVP_MD_CTX_new(); + if (!h->md) { + free(h); + return -ENOMEM; + } + + h->hash_id = EVP_get_digestbyname(crypt_hash_compat_name(name)); + if (!h->hash_id) { + EVP_MD_CTX_free(h->md); + free(h); + return -EINVAL; + } + + if (EVP_DigestInit_ex(h->md, h->hash_id, NULL) != 1) { + EVP_MD_CTX_free(h->md); + free(h); + return -EINVAL; + } + + h->hash_len = EVP_MD_size(h->hash_id); + *ctx = h; + return 0; +} + +static int crypt_hash_restart(struct crypt_hash *ctx) +{ + if (EVP_DigestInit_ex(ctx->md, ctx->hash_id, NULL) != 1) + return -EINVAL; + + return 0; +} + +int crypt_hash_write(struct crypt_hash *ctx, const char *buffer, size_t length) +{ + if (EVP_DigestUpdate(ctx->md, buffer, length) != 1) + return -EINVAL; + + return 0; +} + +int crypt_hash_final(struct crypt_hash *ctx, char *buffer, size_t length) +{ + unsigned char tmp[EVP_MAX_MD_SIZE]; + unsigned int tmp_len = 0; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + if (EVP_DigestFinal_ex(ctx->md, tmp, &tmp_len) != 1) + return -EINVAL; + + memcpy(buffer, tmp, length); + crypt_backend_memzero(tmp, sizeof(tmp)); + + if (tmp_len < length) + return -EINVAL; + + if (crypt_hash_restart(ctx)) + return -EINVAL; + + return 0; +} + +void crypt_hash_destroy(struct crypt_hash *ctx) +{ + EVP_MD_CTX_free(ctx->md); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* HMAC */ +int crypt_hmac_size(const char *name) +{ + return crypt_hash_size(name); +} + +int crypt_hmac_init(struct crypt_hmac **ctx, const char *name, + const void *key, size_t key_length) +{ + struct crypt_hmac *h; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + h->md = HMAC_CTX_new(); + if (!h->md) { + free(h); + return -ENOMEM; + } + + h->hash_id = EVP_get_digestbyname(crypt_hash_compat_name(name)); + if (!h->hash_id) { + HMAC_CTX_free(h->md); + free(h); + return -EINVAL; + } + + HMAC_Init_ex(h->md, key, key_length, h->hash_id, NULL); + + h->hash_len = EVP_MD_size(h->hash_id); + *ctx = h; + return 0; +} + +static void crypt_hmac_restart(struct crypt_hmac *ctx) +{ + HMAC_Init_ex(ctx->md, NULL, 0, ctx->hash_id, NULL); +} + +int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length) +{ + HMAC_Update(ctx->md, (const unsigned char *)buffer, length); + return 0; +} + +int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length) +{ + unsigned char tmp[EVP_MAX_MD_SIZE]; + unsigned int tmp_len = 0; + + if (length > (size_t)ctx->hash_len) + return -EINVAL; + + HMAC_Final(ctx->md, tmp, &tmp_len); + + memcpy(buffer, tmp, length); + crypt_backend_memzero(tmp, sizeof(tmp)); + + if (tmp_len < length) + return -EINVAL; + + crypt_hmac_restart(ctx); + + return 0; +} + +void crypt_hmac_destroy(struct crypt_hmac *ctx) +{ + HMAC_CTX_free(ctx->md); + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +/* RNG */ +int crypt_backend_rng(char *buffer, size_t length, int quality, int fips) +{ + if (RAND_bytes((unsigned char *)buffer, length) != 1) + return -EINVAL; + + return 0; +} + +/* PBKDF */ +int crypt_pbkdf(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t iterations, uint32_t memory, uint32_t parallel) + +{ + const EVP_MD *hash_id; + + if (!kdf) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) { + hash_id = EVP_get_digestbyname(crypt_hash_compat_name(hash)); + if (!hash_id) + return -EINVAL; + + if (!PKCS5_PBKDF2_HMAC(password, (int)password_length, + (const unsigned char *)salt, (int)salt_length, + (int)iterations, hash_id, (int)key_length, (unsigned char *)key)) + return -EINVAL; + return 0; + } else if (!strncmp(kdf, "argon2", 6)) { + return argon2(kdf, password, password_length, salt, salt_length, + key, key_length, iterations, memory, parallel); + } + + return -EINVAL; +} + +/* Block ciphers */ +static void _cipher_destroy(EVP_CIPHER_CTX **hd_enc, EVP_CIPHER_CTX **hd_dec) +{ + EVP_CIPHER_CTX_free(*hd_enc); + *hd_enc = NULL; + + EVP_CIPHER_CTX_free(*hd_dec); + *hd_dec = NULL; +} + +static int _cipher_init(EVP_CIPHER_CTX **hd_enc, EVP_CIPHER_CTX **hd_dec, const char *name, + const char *mode, const void *key, size_t key_length, size_t *iv_length) +{ + char cipher_name[256]; + const EVP_CIPHER *type; + int r, key_bits; + + key_bits = key_length * 8; + if (!strcmp(mode, "xts")) + key_bits /= 2; + + r = snprintf(cipher_name, sizeof(cipher_name), "%s-%d-%s", name, key_bits, mode); + if (r < 0 || (size_t)r >= sizeof(cipher_name)) + return -EINVAL; + + type = EVP_get_cipherbyname(cipher_name); + if (!type) + return -ENOENT; + + if (EVP_CIPHER_key_length(type) != (int)key_length) + return -EINVAL; + + *hd_enc = EVP_CIPHER_CTX_new(); + *hd_dec = EVP_CIPHER_CTX_new(); + *iv_length = EVP_CIPHER_iv_length(type); + + if (!*hd_enc || !*hd_dec) + return -EINVAL; + + if (EVP_EncryptInit_ex(*hd_enc, type, NULL, key, NULL) != 1 || + EVP_DecryptInit_ex(*hd_dec, type, NULL, key, NULL) != 1) { + _cipher_destroy(hd_enc, hd_dec); + return -EINVAL; + } + + if (EVP_CIPHER_CTX_set_padding(*hd_enc, 0) != 1 || + EVP_CIPHER_CTX_set_padding(*hd_dec, 0) != 1) { + _cipher_destroy(hd_enc, hd_dec); + return -EINVAL; + } + + return 0; +} + +int crypt_cipher_init(struct crypt_cipher **ctx, const char *name, + const char *mode, const void *key, size_t key_length) +{ + struct crypt_cipher *h; + int r; + + h = malloc(sizeof(*h)); + if (!h) + return -ENOMEM; + + if (!_cipher_init(&h->u.lib.hd_enc, &h->u.lib.hd_dec, name, mode, key, + key_length, &h->u.lib.iv_length)) { + h->use_kernel = false; + *ctx = h; + return 0; + } + + r = crypt_cipher_init_kernel(&h->u.kernel, name, mode, key, key_length); + if (r < 0) { + free(h); + return r; + } + + h->use_kernel = true; + *ctx = h; + return 0; +} + +void crypt_cipher_destroy(struct crypt_cipher *ctx) +{ + if (ctx->use_kernel) + crypt_cipher_destroy_kernel(&ctx->u.kernel); + else + _cipher_destroy(&ctx->u.lib.hd_enc, &ctx->u.lib.hd_dec); + free(ctx); +} + +static int _cipher_encrypt(struct crypt_cipher *ctx, const unsigned char *in, unsigned char *out, + int length, const unsigned char *iv, size_t iv_length) +{ + int len; + + if (ctx->u.lib.iv_length != iv_length) + return -EINVAL; + + if (EVP_EncryptInit_ex(ctx->u.lib.hd_enc, NULL, NULL, NULL, iv) != 1) + return -EINVAL; + + if (EVP_EncryptUpdate(ctx->u.lib.hd_enc, out, &len, in, length) != 1) + return -EINVAL; + + if (EVP_EncryptFinal(ctx->u.lib.hd_enc, out + len, &len) != 1) + return -EINVAL; + + return 0; +} + +static int _cipher_decrypt(struct crypt_cipher *ctx, const unsigned char *in, unsigned char *out, + int length, const unsigned char *iv, size_t iv_length) +{ + int len; + + if (ctx->u.lib.iv_length != iv_length) + return -EINVAL; + + if (EVP_DecryptInit_ex(ctx->u.lib.hd_dec, NULL, NULL, NULL, iv) != 1) + return -EINVAL; + + if (EVP_DecryptUpdate(ctx->u.lib.hd_dec, out, &len, in, length) != 1) + return -EINVAL; + + if (EVP_DecryptFinal(ctx->u.lib.hd_dec, out + len, &len) != 1) + return -EINVAL; + + return 0; +} + +int crypt_cipher_encrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + if (ctx->use_kernel) + return crypt_cipher_encrypt_kernel(&ctx->u.kernel, in, out, length, iv, iv_length); + + return _cipher_encrypt(ctx, (const unsigned char*)in, + (unsigned char *)out, length, (const unsigned char*)iv, iv_length); +} + +int crypt_cipher_decrypt(struct crypt_cipher *ctx, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length) +{ + if (ctx->use_kernel) + return crypt_cipher_decrypt_kernel(&ctx->u.kernel, in, out, length, iv, iv_length); + + return _cipher_decrypt(ctx, (const unsigned char*)in, + (unsigned char *)out, length, (const unsigned char*)iv, iv_length); +} + +bool crypt_cipher_kernel_only(struct crypt_cipher *ctx) +{ + return ctx->use_kernel; +} + +int crypt_bitlk_decrypt_key(const void *key, size_t key_length, + const char *in, char *out, size_t length, + const char *iv, size_t iv_length, + const char *tag, size_t tag_length) +{ +#ifdef EVP_CTRL_CCM_SET_IVLEN + EVP_CIPHER_CTX *ctx; + int len = 0, r = -EINVAL; + + ctx = EVP_CIPHER_CTX_new(); + if (!ctx) + return -EINVAL; + + if (EVP_DecryptInit_ex(ctx, EVP_aes_256_ccm(), NULL, NULL, NULL) != 1) + goto out; + + //EVP_CIPHER_CTX_key_length(ctx) + //EVP_CIPHER_CTX_iv_length(ctx) + + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN, iv_length, NULL) != 1) + goto out; + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, tag_length, CONST_CAST(void*)tag) != 1) + goto out; + + if (EVP_DecryptInit_ex(ctx, NULL, NULL, key, (const unsigned char*)iv) != 1) + goto out; + + if (EVP_DecryptUpdate(ctx, (unsigned char*)out, &len, (const unsigned char*)in, length) == 1) + r = 0; +out: + EVP_CIPHER_CTX_free(ctx); + return r; +#else + return -ENOTSUP; +#endif +} diff --git a/lib/crypto_backend/crypto_storage.c b/lib/crypto_backend/crypto_storage.c new file mode 100644 index 0000000..14ab7fe --- /dev/null +++ b/lib/crypto_backend/crypto_storage.c @@ -0,0 +1,339 @@ +/* + * Generic wrapper for storage encryption modes and Initial Vectors + * (reimplementation of some functions from Linux dm-crypt kernel) + * + * Copyright (C) 2014-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include "bitops.h" +#include "crypto_backend.h" + +#define SECTOR_SHIFT 9 + +/* + * Internal IV helper + * IV documentation: https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt + */ +struct crypt_sector_iv { + enum { IV_NONE, IV_NULL, IV_PLAIN, IV_PLAIN64, IV_ESSIV, IV_BENBI, IV_PLAIN64BE, IV_EBOIV } type; + int iv_size; + char *iv; + struct crypt_cipher *cipher; + int shift; +}; + +/* Block encryption storage context */ +struct crypt_storage { + size_t sector_size; + unsigned iv_shift; + struct crypt_cipher *cipher; + struct crypt_sector_iv cipher_iv; +}; + +static int int_log2(unsigned int x) +{ + int r = 0; + for (x >>= 1; x > 0; x >>= 1) + r++; + return r; +} + +static int crypt_sector_iv_init(struct crypt_sector_iv *ctx, + const char *cipher_name, const char *mode_name, + const char *iv_name, const void *key, size_t key_length, + size_t sector_size) +{ + int r; + + memset(ctx, 0, sizeof(*ctx)); + + ctx->iv_size = crypt_cipher_ivsize(cipher_name, mode_name); + if (ctx->iv_size < 0 || (strcmp(mode_name, "ecb") && ctx->iv_size < 8)) + return -ENOENT; + + if (!strcmp(cipher_name, "cipher_null") || + !strcmp(mode_name, "ecb")) { + if (iv_name) + return -EINVAL; + ctx->type = IV_NONE; + ctx->iv_size = 0; + return 0; + } else if (!iv_name) { + return -EINVAL; + } else if (!strcasecmp(iv_name, "null")) { + ctx->type = IV_NULL; + } else if (!strcasecmp(iv_name, "plain64")) { + ctx->type = IV_PLAIN64; + } else if (!strcasecmp(iv_name, "plain64be")) { + ctx->type = IV_PLAIN64BE; + } else if (!strcasecmp(iv_name, "plain")) { + ctx->type = IV_PLAIN; + } else if (!strncasecmp(iv_name, "essiv:", 6)) { + struct crypt_hash *h = NULL; + char *hash_name = strchr(iv_name, ':'); + int hash_size; + char tmp[256]; + + if (!hash_name) + return -EINVAL; + + hash_size = crypt_hash_size(++hash_name); + if (hash_size < 0) + return -ENOENT; + + if ((unsigned)hash_size > sizeof(tmp)) + return -EINVAL; + + if (crypt_hash_init(&h, hash_name)) + return -EINVAL; + + r = crypt_hash_write(h, key, key_length); + if (r) { + crypt_hash_destroy(h); + return r; + } + + r = crypt_hash_final(h, tmp, hash_size); + crypt_hash_destroy(h); + if (r) { + crypt_backend_memzero(tmp, sizeof(tmp)); + return r; + } + + r = crypt_cipher_init(&ctx->cipher, cipher_name, "ecb", + tmp, hash_size); + crypt_backend_memzero(tmp, sizeof(tmp)); + if (r) + return r; + + ctx->type = IV_ESSIV; + } else if (!strncasecmp(iv_name, "benbi", 5)) { + int log = int_log2(ctx->iv_size); + if (log > SECTOR_SHIFT) + return -EINVAL; + + ctx->type = IV_BENBI; + ctx->shift = SECTOR_SHIFT - log; + } else if (!strncasecmp(iv_name, "eboiv", 5)) { + r = crypt_cipher_init(&ctx->cipher, cipher_name, "ecb", + key, key_length); + if (r) + return r; + + ctx->type = IV_EBOIV; + ctx->shift = int_log2(sector_size); + } else + return -ENOENT; + + ctx->iv = malloc(ctx->iv_size); + if (!ctx->iv) + return -ENOMEM; + + return 0; +} + +static int crypt_sector_iv_generate(struct crypt_sector_iv *ctx, uint64_t sector) +{ + uint64_t val; + + switch (ctx->type) { + case IV_NONE: + break; + case IV_NULL: + memset(ctx->iv, 0, ctx->iv_size); + break; + case IV_PLAIN: + memset(ctx->iv, 0, ctx->iv_size); + *(uint32_t *)ctx->iv = cpu_to_le32(sector & 0xffffffff); + break; + case IV_PLAIN64: + memset(ctx->iv, 0, ctx->iv_size); + *(uint64_t *)ctx->iv = cpu_to_le64(sector); + break; + case IV_PLAIN64BE: + memset(ctx->iv, 0, ctx->iv_size); + *(uint64_t *)&ctx->iv[ctx->iv_size - sizeof(uint64_t)] = cpu_to_be64(sector); + break; + case IV_ESSIV: + memset(ctx->iv, 0, ctx->iv_size); + *(uint64_t *)ctx->iv = cpu_to_le64(sector); + return crypt_cipher_encrypt(ctx->cipher, + ctx->iv, ctx->iv, ctx->iv_size, NULL, 0); + break; + case IV_BENBI: + memset(ctx->iv, 0, ctx->iv_size); + val = cpu_to_be64((sector << ctx->shift) + 1); + memcpy(ctx->iv + ctx->iv_size - sizeof(val), &val, sizeof(val)); + break; + case IV_EBOIV: + memset(ctx->iv, 0, ctx->iv_size); + *(uint64_t *)ctx->iv = cpu_to_le64(sector << ctx->shift); + return crypt_cipher_encrypt(ctx->cipher, + ctx->iv, ctx->iv, ctx->iv_size, NULL, 0); + break; + default: + return -EINVAL; + } + + return 0; +} + +static void crypt_sector_iv_destroy(struct crypt_sector_iv *ctx) +{ + if (ctx->type == IV_ESSIV || ctx->type == IV_EBOIV) + crypt_cipher_destroy(ctx->cipher); + + if (ctx->iv) { + memset(ctx->iv, 0, ctx->iv_size); + free(ctx->iv); + } + + memset(ctx, 0, sizeof(*ctx)); +} + +/* Block encryption storage wrappers */ + +int crypt_storage_init(struct crypt_storage **ctx, + size_t sector_size, + const char *cipher, + const char *cipher_mode, + const void *key, size_t key_length, + bool large_iv) +{ + struct crypt_storage *s; + char mode_name[64]; + char *cipher_iv = NULL; + int r = -EIO; + + if (sector_size < (1 << SECTOR_SHIFT) || + sector_size > (1 << (SECTOR_SHIFT + 3)) || + sector_size & (sector_size - 1)) + return -EINVAL; + + s = malloc(sizeof(*s)); + if (!s) + return -ENOMEM; + memset(s, 0, sizeof(*s)); + + /* Remove IV if present */ + strncpy(mode_name, cipher_mode, sizeof(mode_name)); + mode_name[sizeof(mode_name) - 1] = 0; + cipher_iv = strchr(mode_name, '-'); + if (cipher_iv) { + *cipher_iv = '\0'; + cipher_iv++; + } + + r = crypt_cipher_init(&s->cipher, cipher, mode_name, key, key_length); + if (r) { + crypt_storage_destroy(s); + return r; + } + + r = crypt_sector_iv_init(&s->cipher_iv, cipher, mode_name, cipher_iv, key, key_length, sector_size); + if (r) { + crypt_storage_destroy(s); + return r; + } + + s->sector_size = sector_size; + s->iv_shift = large_iv ? int_log2(sector_size) - SECTOR_SHIFT : 0; + + *ctx = s; + return 0; +} + +int crypt_storage_decrypt(struct crypt_storage *ctx, + uint64_t iv_offset, + uint64_t length, char *buffer) +{ + uint64_t i; + int r = 0; + + if (length & (ctx->sector_size - 1)) + return -EINVAL; + + if (iv_offset & ((ctx->sector_size >> SECTOR_SHIFT) - 1)) + return -EINVAL; + + for (i = 0; i < length; i += ctx->sector_size) { + r = crypt_sector_iv_generate(&ctx->cipher_iv, (iv_offset + (i >> SECTOR_SHIFT)) >> ctx->iv_shift); + if (r) + break; + r = crypt_cipher_decrypt(ctx->cipher, + &buffer[i], + &buffer[i], + ctx->sector_size, + ctx->cipher_iv.iv, + ctx->cipher_iv.iv_size); + if (r) + break; + } + + return r; +} + +int crypt_storage_encrypt(struct crypt_storage *ctx, + uint64_t iv_offset, + uint64_t length, char *buffer) +{ + uint64_t i; + int r = 0; + + if (length & (ctx->sector_size - 1)) + return -EINVAL; + + if (iv_offset & ((ctx->sector_size >> SECTOR_SHIFT) - 1)) + return -EINVAL; + + for (i = 0; i < length; i += ctx->sector_size) { + r = crypt_sector_iv_generate(&ctx->cipher_iv, (iv_offset + (i >> SECTOR_SHIFT)) >> ctx->iv_shift); + if (r) + break; + r = crypt_cipher_encrypt(ctx->cipher, + &buffer[i], + &buffer[i], + ctx->sector_size, + ctx->cipher_iv.iv, + ctx->cipher_iv.iv_size); + if (r) + break; + } + + return r; +} + +void crypt_storage_destroy(struct crypt_storage *ctx) +{ + if (!ctx) + return; + + crypt_sector_iv_destroy(&ctx->cipher_iv); + + if (ctx->cipher) + crypt_cipher_destroy(ctx->cipher); + + memset(ctx, 0, sizeof(*ctx)); + free(ctx); +} + +bool crypt_storage_kernel_only(struct crypt_storage *ctx) +{ + return crypt_cipher_kernel_only(ctx->cipher); +} diff --git a/lib/crypto_backend/pbkdf2_generic.c b/lib/crypto_backend/pbkdf2_generic.c new file mode 100644 index 0000000..b18c7a7 --- /dev/null +++ b/lib/crypto_backend/pbkdf2_generic.c @@ -0,0 +1,232 @@ +/* + * Implementation of Password-Based Cryptography as per PKCS#5 + * Copyright (C) 2002,2003 Simon Josefsson + * Copyright (C) 2004 Free Software Foundation + * + * cryptsetup related changes + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include +#include +#include "crypto_backend_internal.h" + +static int hash_buf(const char *src, size_t src_len, + char *dst, size_t dst_len, + const char *hash_name) +{ + struct crypt_hash *hd = NULL; + int r; + + if (crypt_hash_init(&hd, hash_name)) + return -EINVAL; + + r = crypt_hash_write(hd, src, src_len); + + if (!r) + r = crypt_hash_final(hd, dst, dst_len); + + crypt_hash_destroy(hd); + return r; +} + +/* + * 5.2 PBKDF2 + * + * PBKDF2 applies a pseudorandom function (see Appendix B.1 for an + * example) to derive keys. The length of the derived key is essentially + * unbounded. (However, the maximum effective search space for the + * derived key may be limited by the structure of the underlying + * pseudorandom function. See Appendix B.1 for further discussion.) + * PBKDF2 is recommended for new applications. + * + * PBKDF2 (P, S, c, dkLen) + * + * Options: PRF underlying pseudorandom function (hLen + * denotes the length in octets of the + * pseudorandom function output) + * + * Input: P password, an octet string (ASCII or UTF-8) + * S salt, an octet string + * c iteration count, a positive integer + * dkLen intended length in octets of the derived + * key, a positive integer, at most + * (2^32 - 1) * hLen + * + * Output: DK derived key, a dkLen-octet string + */ + +/* + * if hash_block_size is not zero, the HMAC key is pre-hashed + * inside this function. + * This prevents situation when crypto backend doesn't support + * long HMAC keys or it tries hash long key in every iteration + * (because of crypt_final() cannot do simple key reset. + */ + +#define MAX_PRF_BLOCK_LEN 80 + +int pkcs5_pbkdf2(const char *hash, + const char *P, size_t Plen, + const char *S, size_t Slen, + unsigned int c, unsigned int dkLen, + char *DK, unsigned int hash_block_size) +{ + struct crypt_hmac *hmac; + char U[MAX_PRF_BLOCK_LEN]; + char T[MAX_PRF_BLOCK_LEN]; + char P_hash[MAX_PRF_BLOCK_LEN]; + int i, k, rc = -EINVAL; + unsigned int u, hLen, l, r; + size_t tmplen = Slen + 4; + char *tmp; + + tmp = alloca(tmplen); + if (tmp == NULL) + return -ENOMEM; + + hLen = crypt_hmac_size(hash); + if (hLen == 0 || hLen > MAX_PRF_BLOCK_LEN) + return -EINVAL; + + if (c == 0) + return -EINVAL; + + if (dkLen == 0) + return -EINVAL; + + /* + * + * Steps: + * + * 1. If dkLen > (2^32 - 1) * hLen, output "derived key too long" and + * stop. + */ + + if (dkLen > 4294967295U) + return -EINVAL; + + /* + * 2. Let l be the number of hLen-octet blocks in the derived key, + * rounding up, and let r be the number of octets in the last + * block: + * + * l = CEIL (dkLen / hLen) , + * r = dkLen - (l - 1) * hLen . + * + * Here, CEIL (x) is the "ceiling" function, i.e. the smallest + * integer greater than, or equal to, x. + */ + + l = dkLen / hLen; + if (dkLen % hLen) + l++; + r = dkLen - (l - 1) * hLen; + + /* + * 3. For each block of the derived key apply the function F defined + * below to the password P, the salt S, the iteration count c, and + * the block index to compute the block: + * + * T_1 = F (P, S, c, 1) , + * T_2 = F (P, S, c, 2) , + * ... + * T_l = F (P, S, c, l) , + * + * where the function F is defined as the exclusive-or sum of the + * first c iterates of the underlying pseudorandom function PRF + * applied to the password P and the concatenation of the salt S + * and the block index i: + * + * F (P, S, c, i) = U_1 \xor U_2 \xor ... \xor U_c + * + * where + * + * U_1 = PRF (P, S || INT (i)) , + * U_2 = PRF (P, U_1) , + * ... + * U_c = PRF (P, U_{c-1}) . + * + * Here, INT (i) is a four-octet encoding of the integer i, most + * significant octet first. + * + * 4. Concatenate the blocks and extract the first dkLen octets to + * produce a derived key DK: + * + * DK = T_1 || T_2 || ... || T_l<0..r-1> + * + * 5. Output the derived key DK. + * + * Note. The construction of the function F follows a "belt-and- + * suspenders" approach. The iterates U_i are computed recursively to + * remove a degree of parallelism from an opponent; they are exclusive- + * ored together to reduce concerns about the recursion degenerating + * into a small set of values. + * + */ + + /* If hash_block_size is provided, hash password in advance. */ + if (hash_block_size > 0 && Plen > hash_block_size) { + if (hash_buf(P, Plen, P_hash, hLen, hash)) + return -EINVAL; + + if (crypt_hmac_init(&hmac, hash, P_hash, hLen)) + return -EINVAL; + crypt_backend_memzero(P_hash, sizeof(P_hash)); + } else { + if (crypt_hmac_init(&hmac, hash, P, Plen)) + return -EINVAL; + } + + for (i = 1; (unsigned int) i <= l; i++) { + memset(T, 0, hLen); + + for (u = 1; u <= c ; u++) { + if (u == 1) { + memcpy(tmp, S, Slen); + tmp[Slen + 0] = (i & 0xff000000) >> 24; + tmp[Slen + 1] = (i & 0x00ff0000) >> 16; + tmp[Slen + 2] = (i & 0x0000ff00) >> 8; + tmp[Slen + 3] = (i & 0x000000ff) >> 0; + + if (crypt_hmac_write(hmac, tmp, tmplen)) + goto out; + } else { + if (crypt_hmac_write(hmac, U, hLen)) + goto out; + } + + if (crypt_hmac_final(hmac, U, hLen)) + goto out; + + for (k = 0; (unsigned int) k < hLen; k++) + T[k] ^= U[k]; + } + + memcpy(DK + (i - 1) * hLen, T, (unsigned int) i == l ? r : hLen); + } + rc = 0; +out: + crypt_hmac_destroy(hmac); + crypt_backend_memzero(U, sizeof(U)); + crypt_backend_memzero(T, sizeof(T)); + crypt_backend_memzero(tmp, tmplen); + + return rc; +} diff --git a/lib/crypto_backend/pbkdf_check.c b/lib/crypto_backend/pbkdf_check.c new file mode 100644 index 0000000..b4c52a9 --- /dev/null +++ b/lib/crypto_backend/pbkdf_check.c @@ -0,0 +1,437 @@ +/* + * PBKDF performance check + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * Copyright (C) 2016-2020 Ondrej Mosnacek + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include "crypto_backend.h" + +#ifndef CLOCK_MONOTONIC_RAW +#define CLOCK_MONOTONIC_RAW CLOCK_MONOTONIC +#endif + +#define BENCH_MIN_MS 250 +#define BENCH_MIN_MS_FAST 10 +#define BENCH_PERCENT_ATLEAST 95 +#define BENCH_PERCENT_ATMOST 110 +#define BENCH_SAMPLES_FAST 3 +#define BENCH_SAMPLES_SLOW 1 + +/* These PBKDF2 limits must be never violated */ +int crypt_pbkdf_get_limits(const char *kdf, struct crypt_pbkdf_limits *limits) +{ + if (!kdf || !limits) + return -EINVAL; + + if (!strcmp(kdf, "pbkdf2")) { + limits->min_iterations = 1000; /* recommendation in NIST SP 800-132 */ + limits->max_iterations = UINT32_MAX; + limits->min_memory = 0; /* N/A */ + limits->max_memory = 0; /* N/A */ + limits->min_parallel = 0; /* N/A */ + limits->max_parallel = 0; /* N/A */ + return 0; + } else if (!strcmp(kdf, "argon2i") || !strcmp(kdf, "argon2id")) { + limits->min_iterations = 4; + limits->max_iterations = UINT32_MAX; + limits->min_memory = 32; + limits->max_memory = 4*1024*1024; /* 4GiB */ + limits->min_parallel = 1; + limits->max_parallel = 4; + return 0; + } + + return -EINVAL; +} + +static long time_ms(struct rusage *start, struct rusage *end) +{ + int count_kernel_time = 0; + long ms; + + if (crypt_backend_flags() & CRYPT_BACKEND_KERNEL) + count_kernel_time = 1; + + /* + * FIXME: if there is no self usage info, count system time. + * This seem like getrusage() bug in some hypervisors... + */ + if (!end->ru_utime.tv_sec && !start->ru_utime.tv_sec && + !end->ru_utime.tv_usec && !start->ru_utime.tv_usec) + count_kernel_time = 1; + + ms = (end->ru_utime.tv_sec - start->ru_utime.tv_sec) * 1000; + ms += (end->ru_utime.tv_usec - start->ru_utime.tv_usec) / 1000; + + if (count_kernel_time) { + ms += (end->ru_stime.tv_sec - start->ru_stime.tv_sec) * 1000; + ms += (end->ru_stime.tv_usec - start->ru_stime.tv_usec) / 1000; + } + + return ms; +} + +static long timespec_ms(struct timespec *start, struct timespec *end) +{ + return (end->tv_sec - start->tv_sec) * 1000 + + (end->tv_nsec - start->tv_nsec) / (1000 * 1000); +} + +static int measure_argon2(const char *kdf, const char *password, size_t password_length, + const char *salt, size_t salt_length, + char *key, size_t key_length, + uint32_t t_cost, uint32_t m_cost, uint32_t parallel, + size_t samples, long ms_atleast, long *out_ms) +{ + long ms, ms_min = LONG_MAX; + int r; + size_t i; + + for (i = 0; i < samples; i++) { + struct timespec tstart, tend; + + /* + * NOTE: We must use clock_gettime here, because Argon2 can run over + * multiple threads, and thus we care about real time, not CPU time! + */ + if (clock_gettime(CLOCK_MONOTONIC_RAW, &tstart) < 0) + return -EINVAL; + + r = crypt_pbkdf(kdf, NULL, password, password_length, salt, + salt_length, key, key_length, t_cost, m_cost, parallel); + if (r < 0) + return r; + + if (clock_gettime(CLOCK_MONOTONIC_RAW, &tend) < 0) + return -EINVAL; + + ms = timespec_ms(&tstart, &tend); + if (ms < 0) + return -EINVAL; + + if (ms < ms_atleast) { + /* early exit */ + ms_min = ms; + break; + } + if (ms < ms_min) { + ms_min = ms; + } + } + *out_ms = ms_min; + return 0; +} + +#define CONTINUE 0 +#define FINAL 1 +static int next_argon2_params(uint32_t *t_cost, uint32_t *m_cost, + uint32_t min_t_cost, uint32_t min_m_cost, + uint32_t max_m_cost, long ms, uint32_t target_ms) +{ + uint32_t old_t_cost, old_m_cost, new_t_cost, new_m_cost; + uint64_t num, denom; + + old_t_cost = *t_cost; + old_m_cost = *m_cost; + + if ((uint32_t)ms > target_ms) { + /* decreasing, first try to lower t_cost, then m_cost */ + num = (uint64_t)*t_cost * (uint64_t)target_ms; + denom = (uint64_t)ms; + new_t_cost = (uint32_t)(num / denom); + if (new_t_cost < min_t_cost) { + num = (uint64_t)*t_cost * (uint64_t)*m_cost * + (uint64_t)target_ms; + denom = (uint64_t)min_t_cost * (uint64_t)ms; + *t_cost = min_t_cost; + *m_cost = (uint32_t)(num / denom); + if (*m_cost < min_m_cost) { + *m_cost = min_m_cost; + return FINAL; + } + } else { + *t_cost = new_t_cost; + } + } else { + /* increasing, first try to increase m_cost, then t_cost */ + num = (uint64_t)*m_cost * (uint64_t)target_ms; + denom = (uint64_t)ms; + new_m_cost = (uint32_t)(num / denom); + if (new_m_cost > max_m_cost) { + num = (uint64_t)*t_cost * (uint64_t)*m_cost * + (uint64_t)target_ms; + denom = (uint64_t)max_m_cost * (uint64_t)ms; + *t_cost = (uint32_t)(num / denom); + *m_cost = max_m_cost; + if (*t_cost <= min_t_cost) { + *t_cost = min_t_cost; + return FINAL; + } + } else if (new_m_cost < min_m_cost) { + *m_cost = min_m_cost; + return FINAL; + } else { + *m_cost = new_m_cost; + } + } + + /* do not continue if it is the same as in the previous run */ + if (old_t_cost == *t_cost && old_m_cost == *m_cost) + return FINAL; + + return CONTINUE; +} + +static int crypt_argon2_check(const char *kdf, const char *password, + size_t password_length, const char *salt, + size_t salt_length, size_t key_length, + uint32_t min_t_cost, uint32_t min_m_cost, uint32_t max_m_cost, + uint32_t parallel, uint32_t target_ms, + uint32_t *out_t_cost, uint32_t *out_m_cost, + int (*progress)(uint32_t time_ms, void *usrptr), + void *usrptr) +{ + int r = 0; + char *key = NULL; + uint32_t t_cost, m_cost; + long ms; + long ms_atleast = (long)target_ms * BENCH_PERCENT_ATLEAST / 100; + long ms_atmost = (long)target_ms * BENCH_PERCENT_ATMOST / 100; + + if (key_length <= 0 || target_ms <= 0) + return -EINVAL; + + if (min_m_cost < (parallel * 8)) + min_m_cost = parallel * 8; + + if (max_m_cost < min_m_cost) + return -EINVAL; + + key = malloc(key_length); + if (!key) + return -ENOMEM; + + t_cost = min_t_cost; + m_cost = min_m_cost; + + /* 1. Find some small parameters, s. t. ms >= BENCH_MIN_MS: */ + while (1) { + r = measure_argon2(kdf, password, password_length, salt, salt_length, + key, key_length, t_cost, m_cost, parallel, + BENCH_SAMPLES_FAST, BENCH_MIN_MS, &ms); + if (!r) { + /* Update parameters to actual measurement */ + *out_t_cost = t_cost; + *out_m_cost = m_cost; + if (progress && progress((uint32_t)ms, usrptr)) + r = -EINTR; + } + + if (r < 0) + goto out; + + if (ms >= BENCH_MIN_MS) + break; + + if (m_cost == max_m_cost) { + if (ms < BENCH_MIN_MS_FAST) + t_cost *= 16; + else { + uint32_t new = (t_cost * BENCH_MIN_MS) / (uint32_t)ms; + if (new == t_cost) + break; + + t_cost = new; + } + } else { + if (ms < BENCH_MIN_MS_FAST) + m_cost *= 16; + else { + uint32_t new = (m_cost * BENCH_MIN_MS) / (uint32_t)ms; + if (new == m_cost) + break; + + m_cost = new; + } + if (m_cost > max_m_cost) { + m_cost = max_m_cost; + } + } + } + /* + * 2. Use the params obtained in (1.) to estimate the target params. + * 3. Then repeatedly measure the candidate params and if they fall out of + * the acceptance range (+-5 %), try to improve the estimate: + */ + do { + if (next_argon2_params(&t_cost, &m_cost, min_t_cost, min_m_cost, + max_m_cost, ms, target_ms)) { + /* Update parameters to final computation */ + *out_t_cost = t_cost; + *out_m_cost = m_cost; + break; + } + + r = measure_argon2(kdf, password, password_length, salt, salt_length, + key, key_length, t_cost, m_cost, parallel, + BENCH_SAMPLES_SLOW, ms_atleast, &ms); + + if (!r) { + /* Update parameters to actual measurement */ + *out_t_cost = t_cost; + *out_m_cost = m_cost; + if (progress && progress((uint32_t)ms, usrptr)) + r = -EINTR; + } + + if (r < 0) + break; + + } while (ms < ms_atleast || ms > ms_atmost); +out: + if (key) { + crypt_backend_memzero(key, key_length); + free(key); + } + return r; +} + +/* This code benchmarks PBKDF and returns iterations/second using specified hash */ +static int crypt_pbkdf_check(const char *kdf, const char *hash, + const char *password, size_t password_length, + const char *salt, size_t salt_length, + size_t key_length, uint32_t *iter_secs, uint32_t target_ms, + int (*progress)(uint32_t time_ms, void *usrptr), void *usrptr) + +{ + struct rusage rstart, rend; + int r = 0, step = 0; + long ms = 0; + char *key = NULL; + uint32_t iterations; + double PBKDF2_temp; + + if (!kdf || !hash || key_length <= 0) + return -EINVAL; + + key = malloc(key_length); + if (!key) + return -ENOMEM; + + *iter_secs = 0; + iterations = 1 << 15; + while (1) { + if (getrusage(RUSAGE_SELF, &rstart) < 0) { + r = -EINVAL; + goto out; + } + + r = crypt_pbkdf(kdf, hash, password, password_length, salt, + salt_length, key, key_length, iterations, 0, 0); + + if (r < 0) + goto out; + + if (getrusage(RUSAGE_SELF, &rend) < 0) { + r = -EINVAL; + goto out; + } + + ms = time_ms(&rstart, &rend); + if (ms) { + PBKDF2_temp = (double)iterations * target_ms / ms; + if (PBKDF2_temp > UINT32_MAX) { + r = -EINVAL; + goto out; + } + *iter_secs = (uint32_t)PBKDF2_temp; + } + + if (progress && progress((uint32_t)ms, usrptr)) { + r = -EINTR; + goto out; + } + + if (ms > 500) + break; + + if (ms <= 62) + iterations <<= 4; + else if (ms <= 125) + iterations <<= 3; + else if (ms <= 250) + iterations <<= 2; + else + iterations <<= 1; + + if (++step > 10 || !iterations) { + r = -EINVAL; + goto out; + } + } +out: + if (key) { + crypt_backend_memzero(key, key_length); + free(key); + } + return r; +} + +int crypt_pbkdf_perf(const char *kdf, const char *hash, + const char *password, size_t password_size, + const char *salt, size_t salt_size, + size_t volume_key_size, uint32_t time_ms, + uint32_t max_memory_kb, uint32_t parallel_threads, + uint32_t *iterations_out, uint32_t *memory_out, + int (*progress)(uint32_t time_ms, void *usrptr), void *usrptr) +{ + struct crypt_pbkdf_limits pbkdf_limits; + int r = -EINVAL; + + if (!kdf || !iterations_out || !memory_out) + return -EINVAL; + + /* FIXME: whole limits propagation should be more clear here */ + r = crypt_pbkdf_get_limits(kdf, &pbkdf_limits); + if (r < 0) + return r; + + *memory_out = 0; + *iterations_out = 0; + + if (!strcmp(kdf, "pbkdf2")) + r = crypt_pbkdf_check(kdf, hash, password, password_size, + salt, salt_size, volume_key_size, + iterations_out, time_ms, progress, usrptr); + + else if (!strncmp(kdf, "argon2", 6)) + r = crypt_argon2_check(kdf, password, password_size, + salt, salt_size, volume_key_size, + pbkdf_limits.min_iterations, + pbkdf_limits.min_memory, + max_memory_kb, + parallel_threads, time_ms, iterations_out, + memory_out, progress, usrptr); + return r; +} diff --git a/lib/integrity/integrity.c b/lib/integrity/integrity.c new file mode 100644 index 0000000..ccb393e --- /dev/null +++ b/lib/integrity/integrity.c @@ -0,0 +1,378 @@ +/* + * Integrity volume handling + * + * Copyright (C) 2016-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "integrity.h" +#include "internal.h" + +static int INTEGRITY_read_superblock(struct crypt_device *cd, + struct device *device, + uint64_t offset, struct superblock *sb) +{ + int devfd, r; + + devfd = device_open(cd, device, O_RDONLY); + if(devfd < 0) + return -EINVAL; + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), sb, sizeof(*sb), offset) != sizeof(*sb) || + memcmp(sb->magic, SB_MAGIC, sizeof(sb->magic)) || + sb->version < SB_VERSION_1 || sb->version > SB_VERSION_5) { + log_std(cd, "No integrity superblock detected on %s.\n", + device_path(device)); + r = -EINVAL; + } else { + sb->integrity_tag_size = le16toh(sb->integrity_tag_size); + sb->journal_sections = le32toh(sb->journal_sections); + sb->provided_data_sectors = le64toh(sb->provided_data_sectors); + sb->recalc_sector = le64toh(sb->recalc_sector); + sb->flags = le32toh(sb->flags); + r = 0; + } + + return r; +} + +int INTEGRITY_read_sb(struct crypt_device *cd, + struct crypt_params_integrity *params, + uint32_t *flags) +{ + struct superblock sb; + int r; + + r = INTEGRITY_read_superblock(cd, crypt_metadata_device(cd), 0, &sb); + if (r) + return r; + + params->sector_size = SECTOR_SIZE << sb.log2_sectors_per_block; + params->tag_size = sb.integrity_tag_size; + + if (flags) + *flags = sb.flags; + + return 0; +} + +int INTEGRITY_dump(struct crypt_device *cd, struct device *device, uint64_t offset) +{ + struct superblock sb; + int r; + + r = INTEGRITY_read_superblock(cd, device, offset, &sb); + if (r) + return r; + + log_std(cd, "Info for integrity device %s.\n", device_path(device)); + log_std(cd, "superblock_version %d\n", (unsigned)sb.version); + log_std(cd, "log2_interleave_sectors %d\n", sb.log2_interleave_sectors); + log_std(cd, "integrity_tag_size %u\n", sb.integrity_tag_size); + log_std(cd, "journal_sections %u\n", sb.journal_sections); + log_std(cd, "provided_data_sectors %" PRIu64 "\n", sb.provided_data_sectors); + log_std(cd, "sector_size %u\n", SECTOR_SIZE << sb.log2_sectors_per_block); + if (sb.version >= SB_VERSION_2 && (sb.flags & SB_FLAG_RECALCULATING)) + log_std(cd, "recalc_sector %" PRIu64 "\n", sb.recalc_sector); + log_std(cd, "log2_blocks_per_bitmap %u\n", sb.log2_blocks_per_bitmap_bit); + log_std(cd, "flags %s%s%s%s%s\n", + sb.flags & SB_FLAG_HAVE_JOURNAL_MAC ? "have_journal_mac " : "", + sb.flags & SB_FLAG_RECALCULATING ? "recalculating " : "", + sb.flags & SB_FLAG_DIRTY_BITMAP ? "dirty_bitmap " : "", + sb.flags & SB_FLAG_FIXED_PADDING ? "fix_padding " : "", + sb.flags & SB_FLAG_FIXED_HMAC ? "fix_hmac " : ""); + + return 0; +} + +int INTEGRITY_data_sectors(struct crypt_device *cd, + struct device *device, uint64_t offset, + uint64_t *data_sectors) +{ + struct superblock sb; + int r; + + r = INTEGRITY_read_superblock(cd, device, offset, &sb); + if (r) + return r; + + *data_sectors = sb.provided_data_sectors; + return 0; +} + +int INTEGRITY_key_size(struct crypt_device *cd, const char *integrity) +{ + if (!integrity) + return 0; + + //FIXME: use crypto backend hash size + if (!strcmp(integrity, "aead")) + return 0; + else if (!strcmp(integrity, "hmac(sha1)")) + return 20; + else if (!strcmp(integrity, "hmac(sha256)")) + return 32; + else if (!strcmp(integrity, "hmac(sha512)")) + return 64; + else if (!strcmp(integrity, "poly1305")) + return 0; + else if (!strcmp(integrity, "none")) + return 0; + + return -EINVAL; +} + +/* Return hash or hmac(hash) size, if known */ +int INTEGRITY_hash_tag_size(const char *integrity) +{ + char hash[MAX_CIPHER_LEN]; + int r; + + if (!integrity) + return 0; + + if (!strcmp(integrity, "crc32") || !strcmp(integrity, "crc32c")) + return 4; + + r = sscanf(integrity, "hmac(%" MAX_CIPHER_LEN_STR "[^)]s", hash); + if (r == 1) + r = crypt_hash_size(hash); + else + r = crypt_hash_size(integrity); + + return r < 0 ? 0 : r; +} + +int INTEGRITY_tag_size(struct crypt_device *cd, + const char *integrity, + const char *cipher, + const char *cipher_mode) +{ + int iv_tag_size = 0, auth_tag_size = 0; + + if (!cipher_mode) + iv_tag_size = 0; + else if (!strcmp(cipher_mode, "xts-random")) + iv_tag_size = 16; + else if (!strcmp(cipher_mode, "gcm-random")) + iv_tag_size = 12; + else if (!strcmp(cipher_mode, "ccm-random")) + iv_tag_size = 8; + else if (!strcmp(cipher_mode, "ctr-random")) + iv_tag_size = 16; + else if (!strcmp(cipher, "aegis256") && !strcmp(cipher_mode, "random")) + iv_tag_size = 32; + else if (!strcmp(cipher_mode, "random")) + iv_tag_size = 16; + + //FIXME: use crypto backend hash size + if (!integrity || !strcmp(integrity, "none")) + auth_tag_size = 0; + else if (!strcmp(integrity, "aead")) + auth_tag_size = 16; //FIXME gcm- mode only + else if (!strcmp(integrity, "cmac(aes)")) + auth_tag_size = 16; + else if (!strcmp(integrity, "hmac(sha1)")) + auth_tag_size = 20; + else if (!strcmp(integrity, "hmac(sha256)")) + auth_tag_size = 32; + else if (!strcmp(integrity, "hmac(sha512)")) + auth_tag_size = 64; + else if (!strcmp(integrity, "poly1305")) { + if (iv_tag_size) + iv_tag_size = 12; + auth_tag_size = 16; + } + + return iv_tag_size + auth_tag_size; +} + +int INTEGRITY_create_dmd_device(struct crypt_device *cd, + const struct crypt_params_integrity *params, + struct volume_key *vk, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key, + struct crypt_dm_active_device *dmd, + uint32_t flags, uint32_t sb_flags) +{ + int r; + + if (!dmd) + return -EINVAL; + + *dmd = (struct crypt_dm_active_device) { + .flags = flags, + }; + + /* Workaround for kernel dm-integrity table bug */ + if (sb_flags & SB_FLAG_RECALCULATING) + dmd->flags |= CRYPT_ACTIVATE_RECALCULATE; + + r = INTEGRITY_data_sectors(cd, crypt_metadata_device(cd), + crypt_get_data_offset(cd) * SECTOR_SIZE, &dmd->size); + if (r < 0) + return r; + + return dm_integrity_target_set(cd, &dmd->segment, 0, dmd->size, + crypt_metadata_device(cd), crypt_data_device(cd), + crypt_get_integrity_tag_size(cd), crypt_get_data_offset(cd), + crypt_get_sector_size(cd), vk, journal_crypt_key, + journal_mac_key, params); +} + +int INTEGRITY_activate_dmd_device(struct crypt_device *cd, + const char *name, + const char *type, + struct crypt_dm_active_device *dmd, + uint32_t sb_flags) +{ + int r; + uint32_t dmi_flags; + struct dm_target *tgt = &dmd->segment; + + if (!single_segment(dmd) || tgt->type != DM_INTEGRITY) + return -EINVAL; + + log_dbg(cd, "Trying to activate INTEGRITY device on top of %s, using name %s, tag size %d, provided sectors %" PRIu64".", + device_path(tgt->data_device), name, tgt->u.integrity.tag_size, dmd->size); + + r = device_block_adjust(cd, tgt->data_device, DEV_EXCL, + tgt->u.integrity.offset, NULL, &dmd->flags); + if (r) + return r; + + if (tgt->u.integrity.meta_device) { + r = device_block_adjust(cd, tgt->u.integrity.meta_device, DEV_EXCL, 0, NULL, NULL); + if (r) + return r; + } + + r = dm_create_device(cd, name, type, dmd); + if (r < 0 && (dm_flags(cd, DM_INTEGRITY, &dmi_flags) || !(dmi_flags & DM_INTEGRITY_SUPPORTED))) { + log_err(cd, _("Kernel does not support dm-integrity mapping.")); + return -ENOTSUP; + } + + if (r < 0 && (sb_flags & SB_FLAG_FIXED_PADDING) && !dm_flags(cd, DM_INTEGRITY, &dmi_flags) && + !(dmi_flags & DM_INTEGRITY_FIX_PADDING_SUPPORTED)) { + log_err(cd, _("Kernel does not support dm-integrity fixed metadata alignment.")); + return -ENOTSUP; + } + + if (r < 0 && (dmd->flags & CRYPT_ACTIVATE_RECALCULATE) && + !(crypt_get_compatibility(cd) & CRYPT_COMPAT_LEGACY_INTEGRITY_RECALC) && + ((sb_flags & SB_FLAG_FIXED_HMAC) ? + (tgt->u.integrity.vk && !tgt->u.integrity.journal_integrity_key) : + (tgt->u.integrity.vk || tgt->u.integrity.journal_integrity_key))) { + log_err(cd, _("Kernel refuses to activate insecure recalculate option (see legacy activation options to override).")); + return -ENOTSUP; + } + + return r; +} + +int INTEGRITY_activate(struct crypt_device *cd, + const char *name, + const struct crypt_params_integrity *params, + struct volume_key *vk, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key, + uint32_t flags, uint32_t sb_flags) +{ + struct crypt_dm_active_device dmd = {}; + int r = INTEGRITY_create_dmd_device(cd, params, vk, journal_crypt_key, + journal_mac_key, &dmd, flags, sb_flags); + + if (r < 0) + return r; + + r = INTEGRITY_activate_dmd_device(cd, name, CRYPT_INTEGRITY, &dmd, sb_flags); + dm_targets_free(cd, &dmd); + return r; +} + +int INTEGRITY_format(struct crypt_device *cd, + const struct crypt_params_integrity *params, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key) +{ + uint32_t dmi_flags; + char tmp_name[64], tmp_uuid[40]; + struct crypt_dm_active_device dmdi = { + .size = 8, + .flags = CRYPT_ACTIVATE_PRIVATE, /* We always create journal but it can be unused later */ + }; + struct dm_target *tgt = &dmdi.segment; + int r; + uuid_t tmp_uuid_bin; + struct volume_key *vk = NULL; + + uuid_generate(tmp_uuid_bin); + uuid_unparse(tmp_uuid_bin, tmp_uuid); + + r = snprintf(tmp_name, sizeof(tmp_name), "temporary-cryptsetup-%s", tmp_uuid); + if (r < 0 || (size_t)r >= sizeof(tmp_name)) + return -EINVAL; + + /* There is no data area, we can actually use fake zeroed key */ + if (params && params->integrity_key_size) + vk = crypt_alloc_volume_key(params->integrity_key_size, NULL); + + r = dm_integrity_target_set(cd, tgt, 0, dmdi.size, crypt_metadata_device(cd), + crypt_data_device(cd), crypt_get_integrity_tag_size(cd), + crypt_get_data_offset(cd), crypt_get_sector_size(cd), vk, + journal_crypt_key, journal_mac_key, params); + if (r < 0) { + crypt_free_volume_key(vk); + return r; + } + + log_dbg(cd, "Trying to format INTEGRITY device on top of %s, tmp name %s, tag size %d.", + device_path(tgt->data_device), tmp_name, tgt->u.integrity.tag_size); + + r = device_block_adjust(cd, tgt->data_device, DEV_EXCL, tgt->u.integrity.offset, NULL, NULL); + if (r < 0 && (dm_flags(cd, DM_INTEGRITY, &dmi_flags) || !(dmi_flags & DM_INTEGRITY_SUPPORTED))) { + log_err(cd, _("Kernel does not support dm-integrity mapping.")); + r = -ENOTSUP; + } + if (r) { + dm_targets_free(cd, &dmdi); + return r; + } + + if (tgt->u.integrity.meta_device) { + r = device_block_adjust(cd, tgt->u.integrity.meta_device, DEV_EXCL, 0, NULL, NULL); + if (r) { + dm_targets_free(cd, &dmdi); + return r; + } + } + + r = dm_create_device(cd, tmp_name, CRYPT_INTEGRITY, &dmdi); + crypt_free_volume_key(vk); + dm_targets_free(cd, &dmdi); + if (r) + return r; + + return dm_remove_device(cd, tmp_name, CRYPT_DEACTIVATE_FORCE); +} diff --git a/lib/integrity/integrity.h b/lib/integrity/integrity.h new file mode 100644 index 0000000..1f49612 --- /dev/null +++ b/lib/integrity/integrity.h @@ -0,0 +1,103 @@ +/* + * Integrity header definition + * + * Copyright (C) 2016-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_INTEGRITY_H +#define _CRYPTSETUP_INTEGRITY_H + +#include + +struct crypt_device; +struct device; +struct crypt_params_integrity; +struct volume_key; +struct crypt_dm_active_device; + +/* dm-integrity helper */ +#define SB_MAGIC "integrt" +#define SB_VERSION_1 1 +#define SB_VERSION_2 2 +#define SB_VERSION_3 3 +#define SB_VERSION_4 4 +#define SB_VERSION_5 5 + +#define SB_FLAG_HAVE_JOURNAL_MAC (1 << 0) +#define SB_FLAG_RECALCULATING (1 << 1) /* V2 only */ +#define SB_FLAG_DIRTY_BITMAP (1 << 2) /* V3 only */ +#define SB_FLAG_FIXED_PADDING (1 << 3) /* V4 only */ +#define SB_FLAG_FIXED_HMAC (1 << 4) /* V5 only */ + +struct superblock { + uint8_t magic[8]; + uint8_t version; + int8_t log2_interleave_sectors; + uint16_t integrity_tag_size; + uint32_t journal_sections; + uint64_t provided_data_sectors; + uint32_t flags; + uint8_t log2_sectors_per_block; + uint8_t log2_blocks_per_bitmap_bit; /* V3 only */ + uint8_t pad[2]; + uint64_t recalc_sector; /* V2 only */ +} __attribute__ ((packed)); + +int INTEGRITY_read_sb(struct crypt_device *cd, + struct crypt_params_integrity *params, + uint32_t *flags); + +int INTEGRITY_dump(struct crypt_device *cd, struct device *device, uint64_t offset); + +int INTEGRITY_data_sectors(struct crypt_device *cd, + struct device *device, uint64_t offset, + uint64_t *data_sectors); +int INTEGRITY_key_size(struct crypt_device *cd, + const char *integrity); +int INTEGRITY_tag_size(struct crypt_device *cd, + const char *integrity, + const char *cipher, + const char *cipher_mode); +int INTEGRITY_hash_tag_size(const char *integrity); + +int INTEGRITY_format(struct crypt_device *cd, + const struct crypt_params_integrity *params, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key); + +int INTEGRITY_activate(struct crypt_device *cd, + const char *name, + const struct crypt_params_integrity *params, + struct volume_key *vk, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key, + uint32_t flags, uint32_t sb_flags); + +int INTEGRITY_create_dmd_device(struct crypt_device *cd, + const struct crypt_params_integrity *params, + struct volume_key *vk, + struct volume_key *journal_crypt_key, + struct volume_key *journal_mac_key, + struct crypt_dm_active_device *dmd, + uint32_t flags, uint32_t sb_flags); + +int INTEGRITY_activate_dmd_device(struct crypt_device *cd, + const char *name, + const char *type, + struct crypt_dm_active_device *dmd, + uint32_t sb_flags); +#endif diff --git a/lib/internal.h b/lib/internal.h new file mode 100644 index 0000000..42a0c48 --- /dev/null +++ b/lib/internal.h @@ -0,0 +1,277 @@ +/* + * libcryptsetup - cryptsetup library internal + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef INTERNAL_H +#define INTERNAL_H + +#include +#include +#include +#include +#include +#include +#include + +#include "nls.h" +#include "bitops.h" +#include "utils_blkid.h" +#include "utils_crypt.h" +#include "utils_loop.h" +#include "utils_dm.h" +#include "utils_fips.h" +#include "utils_keyring.h" +#include "utils_io.h" +#include "crypto_backend.h" +#include "utils_storage_wrappers.h" + +#include "libcryptsetup.h" + +/* to silent gcc -Wcast-qual for const cast */ +#define CONST_CAST(x) (x)(uintptr_t) + +#define SHIFT_4K 12 +#define SECTOR_SHIFT 9 +#define SECTOR_SIZE (1 << SECTOR_SHIFT) +#define MAX_SECTOR_SIZE 4096 /* min page size among all platforms */ +#define DEFAULT_DISK_ALIGNMENT 1048576 /* 1MiB */ +#define DEFAULT_MEM_ALIGNMENT 4096 +#define LOG_MAX_LEN 4096 +#define MAX_DM_DEPS 32 + +#define CRYPT_SUBDEV "SUBDEV" /* prefix for sublayered devices underneath public crypt types */ + +#define at_least(a, b) ({ __typeof__(a) __at_least = (a); (__at_least >= (b))?__at_least:(b); }) + +#define MISALIGNED(a, b) ((a) & ((b) - 1)) +#define MISALIGNED_4K(a) MISALIGNED((a), 1 << SHIFT_4K) +#define MISALIGNED_512(a) MISALIGNED((a), 1 << SECTOR_SHIFT) +#define NOTPOW2(a) MISALIGNED((a), (a)) + +#ifndef ARRAY_SIZE +# define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0])) +#endif + +#define MOVE_REF(x, y) \ + do { \ + typeof (x) *_px = &(x), *_py = &(y); \ + *_px = *_py; \ + *_py = NULL; \ + } while (0) + +#ifndef O_CLOEXEC +#define O_CLOEXEC 0 +#endif + +struct crypt_device; +struct luks2_reencrypt; + +struct volume_key { + int id; + size_t keylength; + const char *key_description; + struct volume_key *next; + char key[]; +}; + +struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key); +struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, size_t keylength); +void crypt_free_volume_key(struct volume_key *vk); +int crypt_volume_key_set_description(struct volume_key *key, const char *key_description); +void crypt_volume_key_set_id(struct volume_key *vk, int id); +int crypt_volume_key_get_id(const struct volume_key *vk); +void crypt_volume_key_add_next(struct volume_key **vks, struct volume_key *vk); +struct volume_key *crypt_volume_key_next(struct volume_key *vk); +struct volume_key *crypt_volume_key_by_id(struct volume_key *vk, int id); + +struct crypt_pbkdf_type *crypt_get_pbkdf(struct crypt_device *cd); +int init_pbkdf_type(struct crypt_device *cd, + const struct crypt_pbkdf_type *pbkdf, + const char *dev_type); +int verify_pbkdf_params(struct crypt_device *cd, + const struct crypt_pbkdf_type *pbkdf); +int crypt_benchmark_pbkdf_internal(struct crypt_device *cd, + struct crypt_pbkdf_type *pbkdf, + size_t volume_key_size); +const char *crypt_get_cipher_spec(struct crypt_device *cd); + +/* Device backend */ +struct device; +int device_alloc(struct crypt_device *cd, struct device **device, const char *path); +int device_alloc_no_check(struct device **device, const char *path); +void device_close(struct crypt_device *cd, struct device *device); +void device_free(struct crypt_device *cd, struct device *device); +const char *device_path(const struct device *device); +const char *device_dm_name(const struct device *device); +const char *device_block_path(const struct device *device); +void device_topology_alignment(struct crypt_device *cd, + struct device *device, + unsigned long *required_alignment, /* bytes */ + unsigned long *alignment_offset, /* bytes */ + unsigned long default_alignment); +size_t device_block_size(struct crypt_device *cd, struct device *device); +int device_read_ahead(struct device *device, uint32_t *read_ahead); +int device_size(struct device *device, uint64_t *size); +int device_open(struct crypt_device *cd, struct device *device, int flags); +int device_open_excl(struct crypt_device *cd, struct device *device, int flags); +void device_release_excl(struct crypt_device *cd, struct device *device); +void device_disable_direct_io(struct device *device); +int device_is_identical(struct device *device1, struct device *device2); +int device_is_rotational(struct device *device); +size_t device_alignment(struct device *device); +int device_direct_io(const struct device *device); +int device_fallocate(struct device *device, uint64_t size); +void device_sync(struct crypt_device *cd, struct device *device); +int device_check_size(struct crypt_device *cd, + struct device *device, + uint64_t req_offset, int falloc); + +int device_open_locked(struct crypt_device *cd, struct device *device, int flags); +int device_read_lock(struct crypt_device *cd, struct device *device); +int device_write_lock(struct crypt_device *cd, struct device *device); +void device_read_unlock(struct crypt_device *cd, struct device *device); +void device_write_unlock(struct crypt_device *cd, struct device *device); +bool device_is_locked(struct device *device); + +enum devcheck { DEV_OK = 0, DEV_EXCL = 1 }; +int device_check_access(struct crypt_device *cd, + struct device *device, + enum devcheck device_check); +int device_block_adjust(struct crypt_device *cd, + struct device *device, + enum devcheck device_check, + uint64_t device_offset, + uint64_t *size, + uint32_t *flags); +size_t size_round_up(size_t size, size_t block); + +int create_or_reload_device(struct crypt_device *cd, const char *name, + const char *type, struct crypt_dm_active_device *dmd); + +int create_or_reload_device_with_integrity(struct crypt_device *cd, const char *name, + const char *type, struct crypt_dm_active_device *dmd, + struct crypt_dm_active_device *dmdi); + +/* Receive backend devices from context helpers */ +struct device *crypt_metadata_device(struct crypt_device *cd); +struct device *crypt_data_device(struct crypt_device *cd); + +int crypt_confirm(struct crypt_device *cd, const char *msg); + +char *crypt_lookup_dev(const char *dev_id); +int crypt_dev_is_rotational(int major, int minor); +int crypt_dev_is_partition(const char *dev_path); +char *crypt_get_partition_device(const char *dev_path, uint64_t offset, uint64_t size); +char *crypt_get_base_device(const char *dev_path); +uint64_t crypt_dev_partition_offset(const char *dev_path); +int lookup_by_disk_id(const char *dm_uuid); +int lookup_by_sysfs_uuid_field(const char *dm_uuid, size_t max_len); +int crypt_uuid_cmp(const char *dm_uuid, const char *hdr_uuid); + +size_t crypt_getpagesize(void); +unsigned crypt_cpusonline(void); +uint64_t crypt_getphysmemory_kb(void); + +int init_crypto(struct crypt_device *ctx); + +void logger(struct crypt_device *cd, int level, const char *file, int line, const char *format, ...) __attribute__ ((format (printf, 5, 6))); +#define log_dbg(c, x...) logger(c, CRYPT_LOG_DEBUG, __FILE__, __LINE__, x) +#define log_std(c, x...) logger(c, CRYPT_LOG_NORMAL, __FILE__, __LINE__, x) +#define log_verbose(c, x...) logger(c, CRYPT_LOG_VERBOSE, __FILE__, __LINE__, x) +#define log_err(c, x...) logger(c, CRYPT_LOG_ERROR, __FILE__, __LINE__, x) + +int crypt_get_debug_level(void); + +int crypt_memlock_inc(struct crypt_device *ctx); +int crypt_memlock_dec(struct crypt_device *ctx); + +int crypt_metadata_locking_enabled(void); + +int crypt_random_init(struct crypt_device *ctx); +int crypt_random_get(struct crypt_device *ctx, char *buf, size_t len, int quality); +void crypt_random_exit(void); +int crypt_random_default_key_rng(void); + +int crypt_plain_hash(struct crypt_device *cd, + const char *hash_name, + char *key, size_t key_size, + const char *passphrase, size_t passphrase_size); +int PLAIN_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint64_t size, + uint32_t flags); + +void *crypt_get_hdr(struct crypt_device *cd, const char *type); +void crypt_set_luks2_reencrypt(struct crypt_device *cd, struct luks2_reencrypt *rh); +struct luks2_reencrypt *crypt_get_luks2_reencrypt(struct crypt_device *cd); + +int onlyLUKS2(struct crypt_device *cd); +int onlyLUKS2mask(struct crypt_device *cd, uint32_t mask); + +int crypt_wipe_device(struct crypt_device *cd, + struct device *device, + crypt_wipe_pattern pattern, + uint64_t offset, + uint64_t length, + size_t wipe_block_size, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr), + void *usrptr); + +/* Internal integrity helpers */ +const char *crypt_get_integrity(struct crypt_device *cd); +int crypt_get_integrity_key_size(struct crypt_device *cd); +int crypt_get_integrity_tag_size(struct crypt_device *cd); + +int crypt_key_in_keyring(struct crypt_device *cd); +void crypt_set_key_in_keyring(struct crypt_device *cd, unsigned key_in_keyring); +int crypt_volume_key_load_in_keyring(struct crypt_device *cd, struct volume_key *vk); +int crypt_use_keyring_for_vk(struct crypt_device *cd); +void crypt_drop_keyring_key_by_description(struct crypt_device *cd, const char *key_description, key_type_t ktype); +void crypt_drop_keyring_key(struct crypt_device *cd, struct volume_key *vks); + +static inline uint64_t version(uint16_t major, uint16_t minor, uint16_t patch, uint16_t release) +{ + return (uint64_t)release | ((uint64_t)patch << 16) | ((uint64_t)minor << 32) | ((uint64_t)major << 48); +} + +int kernel_version(uint64_t *kversion); + +int crypt_serialize_lock(struct crypt_device *cd); +void crypt_serialize_unlock(struct crypt_device *cd); + +bool crypt_string_in(const char *str, char **list, size_t list_size); +int crypt_strcmp(const char *a, const char *b); +int crypt_compare_dm_devices(struct crypt_device *cd, + const struct crypt_dm_active_device *src, + const struct crypt_dm_active_device *tgt); +static inline void *crypt_zalloc(size_t size) { return calloc(1, size); } + +static inline bool uint64_mult_overflow(uint64_t *u, uint64_t b, size_t size) +{ + *u = (uint64_t)b * size; + if ((uint64_t)(*u / size) != b) + return true; + return false; +} + +#endif /* INTERNAL_H */ diff --git a/lib/libcryptsetup.h b/lib/libcryptsetup.h new file mode 100644 index 0000000..0c35066 --- /dev/null +++ b/lib/libcryptsetup.h @@ -0,0 +1,2380 @@ +/* + * libcryptsetup - cryptsetup library + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +/** + * @file libcryptsetup.h + * @brief Public cryptsetup API + * + * For more verbose examples of LUKS related use cases, + * please read @ref index "examples". + */ + +#ifndef _LIBCRYPTSETUP_H +#define _LIBCRYPTSETUP_H +#ifdef __cplusplus +extern "C" { +#endif + +#include +#include + +/** + * @defgroup crypt-init Cryptsetup device context initialization + * Set of functions for creating and destroying @e crypt_device context + * @addtogroup crypt-init + * @{ + */ + +struct crypt_device; /* crypt device handle */ + +/** + * Initialize crypt device handle and check if the provided device exists. + * + * @param cd Returns pointer to crypt device handle + * @param device Path to the backing device. + * If @e device is not a block device but a path to some file, + * the function will try to create a loopdevice and attach + * the file to the loopdevice with AUTOCLEAR flag set. + * If @e device is @e NULL function it will initialize dm backend only. + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note Note that logging is not initialized here, possible messages use + * default log function. + */ +int crypt_init(struct crypt_device **cd, const char *device); + +/** + * Initialize crypt device handle with optional data device and check + * if devices exist. + * + * @param cd Returns pointer to crypt device handle + * @param device Path to the backing device or detached header. + * @param data_device Path to the data device or @e NULL. + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note Note that logging is not initialized here, possible messages use + * default log function. + */ +int crypt_init_data_device(struct crypt_device **cd, + const char *device, + const char *data_device); + +/** + * Initialize crypt device handle from provided active device name, + * and, optionally, from separate metadata (header) device + * and check if provided device exists. + * + * @return @e 0 on success or negative errno value otherwise. + * + * @param cd returns crypt device handle for active device + * @param name name of active crypt device + * @param header_device optional device containing on-disk header + * (@e NULL if it the same as underlying device on there is no on-disk header) + * + * @post In case @e device points to active LUKS device but header load fails, + * context device type is set to @e NULL and @e 0 is returned as if it were successful. + * Context with @e NULL device type can only be deactivated by crypt_deactivate + * + * @note @link crypt_init_by_name @endlink is equivalent to calling + * crypt_init_by_name_and_header(cd, name, NULL); + */ +int crypt_init_by_name_and_header(struct crypt_device **cd, + const char *name, + const char *header_device); + +/** + * This is equivalent to call + * @ref crypt_init_by_name_and_header "crypt_init_by_name_and_header(cd, name, NULL)" + * + * @sa crypt_init_by_name_and_header + */ +int crypt_init_by_name(struct crypt_device **cd, const char *name); + +/** + * Release crypt device context and used memory. + * + * @param cd crypt device handle + */ +void crypt_free(struct crypt_device *cd); + +/** + * Set confirmation callback (yes/no). + * + * If code need confirmation (like resetting uuid or restoring LUKS header from file) + * this function is called. If not defined, everything is confirmed. + * + * Callback function @e confirm should return @e 0 if operation is declined, + * other values mean accepted. + * + * @param cd crypt device handle + * @param confirm user defined confirm callback reference + * @param usrptr provided identification in callback + * @param msg Message for user to confirm + * + * @note Current version of cryptsetup API requires confirmation for UUID change and + * LUKS header restore only. + */ +void crypt_set_confirm_callback(struct crypt_device *cd, + int (*confirm)(const char *msg, void *usrptr), + void *usrptr); + +/** + * Set data device + * For LUKS it is encrypted data device when LUKS header is separated. + * For VERITY it is data device when hash device is separated. + * + * @param cd crypt device handle + * @param device path to device + * + * @returns 0 on success or negative errno value otherwise. + */ +int crypt_set_data_device(struct crypt_device *cd, const char *device); + +/** + * Set data device offset in 512-byte sectors. + * Used for LUKS. + * This function is replacement for data alignment fields in LUKS param struct. + * If set to 0 (default), old behaviour is preserved. + * This value is reset on @link crypt_load @endlink. + * + * @param cd crypt device handle + * @param data_offset data offset in bytes + * + * @returns 0 on success or negative errno value otherwise. + * + * @note Data offset must be aligned to multiple of 8 (alignment to 4096-byte sectors) + * and must be big enough to accommodate the whole LUKS header with all keyslots. + * @note Data offset is enforced by this function, device topology + * information is no longer used after calling this function. + */ +int crypt_set_data_offset(struct crypt_device *cd, uint64_t data_offset); + +/** @} */ + +/** + * @defgroup crypt-log Cryptsetup logging + * Set of functions and defines used in cryptsetup for + * logging purposes + * @addtogroup crypt-log + * @{ + */ + +/** normal log level */ +#define CRYPT_LOG_NORMAL 0 +/** error log level */ +#define CRYPT_LOG_ERROR 1 +/** verbose log level */ +#define CRYPT_LOG_VERBOSE 2 +/** debug log level - always on stdout */ +#define CRYPT_LOG_DEBUG -1 +/** debug log level - additional JSON output (for LUKS2) */ +#define CRYPT_LOG_DEBUG_JSON -2 + +/** + * Set log function. + * + * @param cd crypt device handle (can be @e NULL to set default log function) + * @param log user defined log function reference + * @param usrptr provided identification in callback + * @param level log level below (debug messages can uses other levels) + * @param msg log message + */ +void crypt_set_log_callback(struct crypt_device *cd, + void (*log)(int level, const char *msg, void *usrptr), + void *usrptr); + +/** + * Defines log function or use the default one otherwise. + * + * @see crypt_set_log_callback + * + * @param cd crypt device handle + * @param level log level + * @param msg log message + */ +void crypt_log(struct crypt_device *cd, int level, const char *msg); +/** @} */ + +/** + * @defgroup crypt-set Cryptsetup settings (RNG, PBKDF, locking) + * @addtogroup crypt-set + * @{ + */ + +/** CRYPT_RNG_URANDOM - use /dev/urandom */ +#define CRYPT_RNG_URANDOM 0 +/** CRYPT_RNG_RANDOM - use /dev/random (waits if no entropy in system) */ +#define CRYPT_RNG_RANDOM 1 + +/** + * Set which RNG (random number generator) is used for generating long term key + * + * @param cd crypt device handle + * @param rng_type kernel random number generator to use + * + */ +void crypt_set_rng_type(struct crypt_device *cd, int rng_type); + +/** + * Get which RNG (random number generator) is used for generating long term key. + * + * @param cd crypt device handle + * @return RNG type on success or negative errno value otherwise. + * + */ +int crypt_get_rng_type(struct crypt_device *cd); + +/** + * PBKDF parameters. + */ +struct crypt_pbkdf_type { + const char *type; /**< PBKDF algorithm */ + const char *hash; /**< Hash algorithm */ + uint32_t time_ms; /**< Requested time cost [milliseconds] */ + uint32_t iterations; /**< Iterations, 0 or benchmarked value. */ + uint32_t max_memory_kb; /**< Requested or benchmarked memory cost [kilobytes] */ + uint32_t parallel_threads;/**< Requested parallel cost [threads] */ + uint32_t flags; /**< CRYPT_PBKDF* flags */ +}; + +/** Iteration time set by crypt_set_iteration_time(), for compatibility only. */ +#define CRYPT_PBKDF_ITER_TIME_SET (1 << 0) +/** Never run benchmarks, use pre-set value or defaults. */ +#define CRYPT_PBKDF_NO_BENCHMARK (1 << 1) + +/** PBKDF2 according to RFC2898, LUKS1 legacy */ +#define CRYPT_KDF_PBKDF2 "pbkdf2" +/** Argon2i according to RFC */ +#define CRYPT_KDF_ARGON2I "argon2i" +/** Argon2id according to RFC */ +#define CRYPT_KDF_ARGON2ID "argon2id" + +/** + * Set default PBKDF (Password-Based Key Derivation Algorithm) for next keyslot + * about to get created with any crypt_keyslot_add_*() call. + * + * @param cd crypt device handle + * @param pbkdf PBKDF parameters + * + * @return 0 on success or negative errno value otherwise. + * + * @note For LUKS1, only PBKDF2 is supported, other settings will be rejected. + * @note For non-LUKS context types the call succeeds, but PBKDF is not used. + */ +int crypt_set_pbkdf_type(struct crypt_device *cd, + const struct crypt_pbkdf_type *pbkdf); + +/** + * Get PBKDF (Password-Based Key Derivation Algorithm) parameters. + * + * @param pbkdf_type type of PBKDF + * + * @return struct on success or NULL value otherwise. + * + */ +const struct crypt_pbkdf_type *crypt_get_pbkdf_type_params(const char *pbkdf_type); + +/** + * Get default PBKDF (Password-Based Key Derivation Algorithm) settings for keyslots. + * Works only with LUKS device handles (both versions). + * + * @param type type of device (see @link crypt-type @endlink) + * + * @return struct on success or NULL value otherwise. + * + */ +const struct crypt_pbkdf_type *crypt_get_pbkdf_default(const char *type); + +/** + * Get current PBKDF (Password-Based Key Derivation Algorithm) settings for keyslots. + * Works only with LUKS device handles (both versions). + * + * @param cd crypt device handle + * + * @return struct on success or NULL value otherwise. + * + */ +const struct crypt_pbkdf_type *crypt_get_pbkdf_type(struct crypt_device *cd); + +/** + * Set how long should cryptsetup iterate in PBKDF2 function. + * Default value heads towards the iterations which takes around 1 second. + * \b Deprecated, only for backward compatibility. + * Use @link crypt_set_pbkdf_type @endlink. + * + * @param cd crypt device handle + * @param iteration_time_ms the time in ms + * + * @note If the time value is not acceptable for active PBKDF, value is quietly ignored. + */ +void crypt_set_iteration_time(struct crypt_device *cd, uint64_t iteration_time_ms); + +/** + * Helper to lock/unlock memory to avoid swap sensitive data to disk. + * + * @param cd crypt device handle, can be @e NULL + * @param lock 0 to unlock otherwise lock memory + * + * @returns Value indicating whether the memory is locked (function can be called multiple times). + * + * @note Only root can do this. + * @note It locks/unlocks all process memory, not only crypt context. + */ +int crypt_memory_lock(struct crypt_device *cd, int lock); + +/** + * Set global lock protection for on-disk metadata (file-based locking). + * + * @param cd crypt device handle, can be @e NULL + * @param enable 0 to disable locking otherwise enable it (default) + * + * @returns @e 0 on success or negative errno value otherwise. + * + * @note Locking applied only for some metadata formats (LUKS2). + * @note The switch is global on the library level. + * In current version locking can be only switched off and cannot be switched on later. + */ +int crypt_metadata_locking(struct crypt_device *cd, int enable); + +/** + * Set metadata header area sizes. This applies only to LUKS2. + * These values limit amount of metadata anf number of supportable keyslots. + * + * @param cd crypt device handle, can be @e NULL + * @param metadata_size size in bytes of JSON area + 4k binary header + * @param keyslots_size size in bytes of binary keyslots area + * + * @returns @e 0 on success or negative errno value otherwise. + * + * @note The metadata area is stored twice and both copies contain 4k binary header. + * Only 16,32,64,128,256,512,1024,2048 and 4096 kB value is allowed (see LUKS2 specification). + * @note Keyslots area size must be multiple of 4k with maximum 128MB. + */ +int crypt_set_metadata_size(struct crypt_device *cd, + uint64_t metadata_size, + uint64_t keyslots_size); + +/** + * Get metadata header area sizes. This applies only to LUKS2. + * These values limit amount of metadata anf number of supportable keyslots. + * + * @param cd crypt device handle + * @param metadata_size size in bytes of JSON area + 4k binary header + * @param keyslots_size size in bytes of binary keyslots area + * + * @returns @e 0 on success or negative errno value otherwise. + */ +int crypt_get_metadata_size(struct crypt_device *cd, + uint64_t *metadata_size, + uint64_t *keyslots_size); + +/** @} */ + +/** + * @defgroup crypt-type Cryptsetup on-disk format types + * Set of functions, \#defines and structs related + * to on-disk format types + * @addtogroup crypt-type + * @{ + */ + +/** plain crypt device, no on-disk header */ +#define CRYPT_PLAIN "PLAIN" +/** LUKS version 1 header on-disk */ +#define CRYPT_LUKS1 "LUKS1" +/** LUKS version 2 header on-disk */ +#define CRYPT_LUKS2 "LUKS2" +/** loop-AES compatibility mode */ +#define CRYPT_LOOPAES "LOOPAES" +/** dm-verity mode */ +#define CRYPT_VERITY "VERITY" +/** TCRYPT (TrueCrypt-compatible and VeraCrypt-compatible) mode */ +#define CRYPT_TCRYPT "TCRYPT" +/** INTEGRITY dm-integrity device */ +#define CRYPT_INTEGRITY "INTEGRITY" +/** BITLK (BitLocker-compatible mode) */ +#define CRYPT_BITLK "BITLK" + +/** LUKS any version */ +#define CRYPT_LUKS NULL + +/** + * Get device type + * + * @param cd crypt device handle + * @return string according to device type or @e NULL if not known. + */ +const char *crypt_get_type(struct crypt_device *cd); + +/** + * Get device default LUKS type + * + * @return string according to device type (CRYPT_LUKS1 or CRYPT_LUKS2). + */ +const char *crypt_get_default_type(void); + +/** + * + * Structure used as parameter for PLAIN device type. + * + * @see crypt_format + */ +struct crypt_params_plain { + const char *hash; /**< password hash function */ + uint64_t offset; /**< offset in sectors */ + uint64_t skip; /**< IV offset / initialization sector */ + uint64_t size; /**< size of mapped device or @e 0 for autodetection */ + uint32_t sector_size; /**< sector size in bytes (@e 0 means 512 for compatibility) */ +}; + +/** + * Structure used as parameter for LUKS device type. + * + * @see crypt_format, crypt_load + * + * @note during crypt_format @e data_device attribute determines + * if the LUKS header is separated from encrypted payload device + * + */ +struct crypt_params_luks1 { + const char *hash; /**< hash used in LUKS header */ + size_t data_alignment; /**< data area alignment in 512B sectors, data offset is multiple of this */ + const char *data_device; /**< detached encrypted data device or @e NULL */ +}; + +/** + * + * Structure used as parameter for loop-AES device type. + * + * @see crypt_format + * + */ +struct crypt_params_loopaes { + const char *hash; /**< key hash function */ + uint64_t offset; /**< offset in sectors */ + uint64_t skip; /**< IV offset / initialization sector */ +}; + +/** + * + * Structure used as parameter for dm-verity device type. + * + * @see crypt_format, crypt_load + * + */ +struct crypt_params_verity { + const char *hash_name; /**< hash function */ + const char *data_device; /**< data_device (CRYPT_VERITY_CREATE_HASH) */ + const char *hash_device; /**< hash_device (output only) */ + const char *fec_device; /**< fec_device (output only) */ + const char *salt; /**< salt */ + uint32_t salt_size; /**< salt size (in bytes) */ + uint32_t hash_type; /**< in-kernel hashing type */ + uint32_t data_block_size; /**< data block size (in bytes) */ + uint32_t hash_block_size; /**< hash block size (in bytes) */ + uint64_t data_size; /**< data area size (in data blocks) */ + uint64_t hash_area_offset; /**< hash/header offset (in bytes) */ + uint64_t fec_area_offset; /**< FEC/header offset (in bytes) */ + uint32_t fec_roots; /**< Reed-Solomon FEC roots */ + uint32_t flags; /**< CRYPT_VERITY* flags */ +}; + +/** No on-disk header (only hashes) */ +#define CRYPT_VERITY_NO_HEADER (1 << 0) +/** Verity hash in userspace before activation */ +#define CRYPT_VERITY_CHECK_HASH (1 << 1) +/** Create hash - format hash device */ +#define CRYPT_VERITY_CREATE_HASH (1 << 2) +/** Root hash signature required for activation */ +#define CRYPT_VERITY_ROOT_HASH_SIGNATURE (1 << 3) + +/** + * + * Structure used as parameter for TCRYPT device type. + * + * @see crypt_load + * + */ +struct crypt_params_tcrypt { + const char *passphrase; /**< passphrase to unlock header (input only) */ + size_t passphrase_size; /**< passphrase size (input only, max length is 64) */ + const char **keyfiles; /**< keyfile paths to unlock header (input only) */ + unsigned int keyfiles_count;/**< keyfiles count (input only) */ + const char *hash_name; /**< hash function for PBKDF */ + const char *cipher; /**< cipher chain c1[-c2[-c3]] */ + const char *mode; /**< cipher block mode */ + size_t key_size; /**< key size in bytes (the whole chain) */ + uint32_t flags; /**< CRYPT_TCRYPT* flags */ + uint32_t veracrypt_pim; /**< VeraCrypt Personal Iteration Multiplier */ +}; + +/** Include legacy modes when scanning for header */ +#define CRYPT_TCRYPT_LEGACY_MODES (1 << 0) +/** Try to load hidden header (describing hidden device) */ +#define CRYPT_TCRYPT_HIDDEN_HEADER (1 << 1) +/** Try to load backup header */ +#define CRYPT_TCRYPT_BACKUP_HEADER (1 << 2) +/** Device contains encrypted system (with boot loader) */ +#define CRYPT_TCRYPT_SYSTEM_HEADER (1 << 3) +/** Include VeraCrypt modes when scanning for header, + * all other TCRYPT flags applies as well. + * VeraCrypt device is reported as TCRYPT type. + */ +#define CRYPT_TCRYPT_VERA_MODES (1 << 4) + +/** + * + * Structure used as parameter for dm-integrity device type. + * + * @see crypt_format, crypt_load + * + * @note In bitmap tracking mode, the journal is implicitly disabled. + * As an ugly workaround for compatibility, journal_watermark is overloaded + * to mean 512-bytes sectors-per-bit and journal_commit_time means bitmap flush time. + * All other journal parameters are not applied in the bitmap mode. + */ +struct crypt_params_integrity { + uint64_t journal_size; /**< size of journal in bytes */ + unsigned int journal_watermark; /**< journal flush watermark in percents; in bitmap mode sectors-per-bit */ + unsigned int journal_commit_time; /**< journal commit time (or bitmap flush time) in ms */ + uint32_t interleave_sectors; /**< number of interleave sectors (power of two) */ + uint32_t tag_size; /**< tag size per-sector in bytes */ + uint32_t sector_size; /**< sector size in bytes */ + uint32_t buffer_sectors; /**< number of sectors in one buffer */ + const char *integrity; /**< integrity algorithm, NULL for LUKS2 */ + uint32_t integrity_key_size; /**< integrity key size in bytes, info only, 0 for LUKS2 */ + + const char *journal_integrity; /**< journal integrity algorithm */ + const char *journal_integrity_key; /**< journal integrity key, only for crypt_load */ + uint32_t journal_integrity_key_size; /**< journal integrity key size in bytes, only for crypt_load */ + + const char *journal_crypt; /**< journal encryption algorithm */ + const char *journal_crypt_key; /**< journal crypt key, only for crypt_load */ + uint32_t journal_crypt_key_size; /**< journal crypt key size in bytes, only for crypt_load */ +}; + +/** + * Structure used as parameter for LUKS2 device type. + * + * @see crypt_format, crypt_load + * + * @note during crypt_format @e data_device attribute determines + * if the LUKS2 header is separated from encrypted payload device + * + */ +struct crypt_params_luks2 { + const struct crypt_pbkdf_type *pbkdf; /**< PBKDF (and hash) parameters or @e NULL*/ + const char *integrity; /**< integrity algorithm or @e NULL */ + const struct crypt_params_integrity *integrity_params; /**< Data integrity parameters or @e NULL*/ + size_t data_alignment; /**< data area alignment in 512B sectors, data offset is multiple of this */ + const char *data_device; /**< detached encrypted data device or @e NULL */ + uint32_t sector_size; /**< encryption sector size */ + const char *label; /**< header label or @e NULL*/ + const char *subsystem; /**< header subsystem label or @e NULL*/ +}; +/** @} */ + +/** + * @defgroup crypt-actions Cryptsetup device context actions + * Set of functions for formatting and manipulating with specific crypt_type + * @addtogroup crypt-actions + * @{ + */ + +/** + * Create (format) new crypt device (and possible header on-disk) but do not activate it. + * + * @pre @e cd contains initialized and not formatted device context (device type must @b not be set) + * + * @param cd crypt device handle + * @param type type of device (optional params struct must be of this type) + * @param cipher (e.g. "aes") + * @param cipher_mode including IV specification (e.g. "xts-plain") + * @param uuid requested UUID or @e NULL if it should be generated + * @param volume_key pre-generated volume key or @e NULL if it should be generated (only for LUKS) + * @param volume_key_size size of volume key in bytes. + * @param params crypt type specific parameters (see @link crypt-type @endlink) + * + * @returns @e 0 on success or negative errno value otherwise. + * + * @note Note that crypt_format does not create LUKS keyslot (any version). To create keyslot + * call any crypt_keyslot_add_* function. + * @note For VERITY @link crypt-type @endlink, only uuid parameter is used, other parameters + * are ignored and verity specific attributes are set through mandatory params option. + */ +int crypt_format(struct crypt_device *cd, + const char *type, + const char *cipher, + const char *cipher_mode, + const char *uuid, + const char *volume_key, + size_t volume_key_size, + void *params); + +/** + * Set format compatibility flags. + * + * @param cd crypt device handle + * @param flags CRYPT_COMPATIBILITY_* flags + */ +void crypt_set_compatibility(struct crypt_device *cd, uint32_t flags); + +/** + * Get compatibility flags. + * + * @param cd crypt device handle + * + * @returns compatibility flags + */ +uint32_t crypt_get_compatibility(struct crypt_device *cd); + +/** dm-integrity device uses less effective (legacy) padding (old kernels) */ +#define CRYPT_COMPAT_LEGACY_INTEGRITY_PADDING (1 << 0) +/** dm-integrity device does not protect superblock with HMAC (old kernels) */ +#define CRYPT_COMPAT_LEGACY_INTEGRITY_HMAC (1 << 1) +/** dm-integrity allow recalculating of volumes with HMAC keys (old kernels) */ +#define CRYPT_COMPAT_LEGACY_INTEGRITY_RECALC (1 << 2) + +/** + * Convert to new type for already existing device. + * + * @param cd crypt device handle + * @param type type of device (optional params struct must be of this type) + * @param params crypt type specific parameters (see @link crypt-type @endlink) + * + * @returns 0 on success or negative errno value otherwise. + * + * @note Currently, only LUKS1->LUKS2 and LUKS2->LUKS1 conversions are supported. + * Not all LUKS2 devices may be converted back to LUKS1. To make such a conversion + * possible all active LUKS2 keyslots must be in LUKS1 compatible mode (i.e. pbkdf + * type must be PBKDF2) and device cannot be formatted with any authenticated + * encryption mode. + * + * @note Device must be offline for conversion. UUID change is not possible for active + * devices. + */ +int crypt_convert(struct crypt_device *cd, + const char *type, + void *params); + +/** + * Set new UUID for already existing device. + * + * @param cd crypt device handle + * @param uuid requested UUID or @e NULL if it should be generated + * + * @returns 0 on success or negative errno value otherwise. + * + * @note Currently, only LUKS device type are supported + */ +int crypt_set_uuid(struct crypt_device *cd, + const char *uuid); + +/** + * Set new labels (label and subsystem) for already existing device. + * + * @param cd crypt device handle + * @param label requested label or @e NULL + * @param subsystem requested subsystem label or @e NULL + * + * @returns 0 on success or negative errno value otherwise. + * + * @note Currently, only LUKS2 device type is supported + */ +int crypt_set_label(struct crypt_device *cd, + const char *label, + const char *subsystem); + +/** + * Enable or disable loading of volume keys via kernel keyring. When set to + * 'enabled' library loads key in kernel keyring first and pass the key + * description to dm-crypt instead of binary key copy. If set to 'disabled' + * library fallbacks to old method of loading volume key directly in + * dm-crypt target. + * + * @param cd crypt device handle, can be @e NULL + * @param enable 0 to disable loading of volume keys via kernel keyring + * (classical method) otherwise enable it (default) + * + * @returns @e 0 on success or negative errno value otherwise. + * + * @note Currently loading of volume keys via kernel keyring is supported + * (and enabled by default) only for LUKS2 devices. + * @note The switch is global on the library level. + */ +int crypt_volume_key_keyring(struct crypt_device *cd, int enable); + +/** + * Load crypt device parameters from on-disk header. + * + * @param cd crypt device handle + * @param requested_type @link crypt-type @endlink or @e NULL for all known + * @param params crypt type specific parameters (see @link crypt-type @endlink) + * + * @returns 0 on success or negative errno value otherwise. + * + * @post In case LUKS header is read successfully but payload device is too small + * error is returned and device type in context is set to @e NULL + * + * @note Note that in current version load works only for LUKS and VERITY device type. + * + */ +int crypt_load(struct crypt_device *cd, + const char *requested_type, + void *params); + +/** + * Try to repair crypt device LUKS on-disk header if invalid. + * + * @param cd crypt device handle + * @param requested_type @link crypt-type @endlink or @e NULL for all known + * @param params crypt type specific parameters (see @link crypt-type @endlink) + * + * @returns 0 on success or negative errno value otherwise. + * + * @note For LUKS2 device crypt_repair bypass blkid checks and + * perform auto-recovery even though there're third party device + * signatures found by blkid probes. Currently the crypt_repair on LUKS2 + * works only if exactly one header checksum does not match or exactly + * one header is missing. + */ +int crypt_repair(struct crypt_device *cd, + const char *requested_type, + void *params); + +/** + * Resize crypt device. + * + * @param cd - crypt device handle + * @param name - name of device to resize + * @param new_size - new device size in sectors or @e 0 to use all of the underlying device size + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note Most notably it returns -EPERM when device was activated with volume key + * in kernel keyring and current device handle (context) doesn't have verified key + * loaded in kernel. To load volume key for already active device use any of + * @link crypt_activate_by_passphrase @endlink, @link crypt_activate_by_keyfile @endlink, + * @link crypt_activate_by_keyfile_offset @endlink, @link crypt_activate_by_volume_key @endlink, + * @link crypt_activate_by_keyring @endlink or @link crypt_activate_by_token @endlink with flag + * @e CRYPT_ACTIVATE_KEYRING_KEY raised and @e name parameter set to @e NULL. + */ +int crypt_resize(struct crypt_device *cd, + const char *name, + uint64_t new_size); + +/** + * Suspend crypt device. + * + * @param cd crypt device handle, can be @e NULL + * @param name name of device to suspend + * + * @return 0 on success or negative errno value otherwise. + * + * @note Only LUKS device type is supported + * + */ +int crypt_suspend(struct crypt_device *cd, + const char *name); + +/** + * Resume crypt device using passphrase. + * + * + * @param cd crypt device handle + * @param name name of device to resume + * @param keyslot requested keyslot or CRYPT_ANY_SLOT + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of @e passphrase (binary data) + * + * @return unlocked key slot number or negative errno otherwise. + * + * @note Only LUKS device type is supported + */ +int crypt_resume_by_passphrase(struct crypt_device *cd, + const char *name, + int keyslot, + const char *passphrase, + size_t passphrase_size); + +/** + * Resume crypt device using key file. + * + * @param cd crypt device handle + * @param name name of device to resume + * @param keyslot requested keyslot or CRYPT_ANY_SLOT + * @param keyfile key file used to unlock volume key + * @param keyfile_size number of bytes to read from keyfile, 0 is unlimited + * @param keyfile_offset number of bytes to skip at start of keyfile + * + * @return unlocked key slot number or negative errno otherwise. + */ +int crypt_resume_by_keyfile_device_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset); + +/** + * Backward compatible crypt_resume_by_keyfile_device_offset() (with size_t offset). + */ +int crypt_resume_by_keyfile_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset); + +/** + * Backward compatible crypt_resume_by_keyfile_device_offset() (without offset). + */ +int crypt_resume_by_keyfile(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size); +/** + * Resume crypt device using provided volume key. + * + * @param cd crypt device handle + * @param name name of device to resume + * @param volume_key provided volume key + * @param volume_key_size size of volume_key + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_resume_by_volume_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size); +/** @} */ + +/** + * @defgroup crypt-keyslot LUKS keyslots + * @addtogroup crypt-keyslot + * @{ + */ + +/** iterate through all keyslots and find first one that fits */ +#define CRYPT_ANY_SLOT -1 + +/** + * Add key slot using provided passphrase. + * + * @pre @e cd contains initialized and formatted LUKS device context + * + * @param cd crypt device handle + * @param keyslot requested keyslot or @e CRYPT_ANY_SLOT + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of passphrase (binary data) + * @param new_passphrase passphrase for new keyslot + * @param new_passphrase_size size of @e new_passphrase (binary data) + * + * @return allocated key slot number or negative errno otherwise. + */ +int crypt_keyslot_add_by_passphrase(struct crypt_device *cd, + int keyslot, + const char *passphrase, + size_t passphrase_size, + const char *new_passphrase, + size_t new_passphrase_size); + +/** + * Change defined key slot using provided passphrase. + * + * @pre @e cd contains initialized and formatted LUKS device context + * + * @param cd crypt device handle + * @param keyslot_old old keyslot or @e CRYPT_ANY_SLOT + * @param keyslot_new new keyslot (can be the same as old) + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of passphrase (binary data) + * @param new_passphrase passphrase for new keyslot + * @param new_passphrase_size size of @e new_passphrase (binary data) + * + * @return allocated key slot number or negative errno otherwise. + */ +int crypt_keyslot_change_by_passphrase(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size, + const char *new_passphrase, + size_t new_passphrase_size); + +/** +* Add key slot using provided key file path. + * + * @pre @e cd contains initialized and formatted LUKS device context + * + * @param cd crypt device handle + * @param keyslot requested keyslot or @e CRYPT_ANY_SLOT + * @param keyfile key file used to unlock volume key + * @param keyfile_size number of bytes to read from keyfile, @e 0 is unlimited + * @param keyfile_offset number of bytes to skip at start of keyfile + * @param new_keyfile keyfile for new keyslot + * @param new_keyfile_size number of bytes to read from @e new_keyfile, @e 0 is unlimited + * @param new_keyfile_offset number of bytes to skip at start of new_keyfile + * + * @return allocated key slot number or negative errno otherwise. + */ +int crypt_keyslot_add_by_keyfile_device_offset(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset, + const char *new_keyfile, + size_t new_keyfile_size, + uint64_t new_keyfile_offset); + +/** + * Backward compatible crypt_keyslot_add_by_keyfile_device_offset() (with size_t offset). + */ +int crypt_keyslot_add_by_keyfile_offset(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset, + const char *new_keyfile, + size_t new_keyfile_size, + size_t new_keyfile_offset); + +/** + * Backward compatible crypt_keyslot_add_by_keyfile_device_offset() (without offset). + */ +int crypt_keyslot_add_by_keyfile(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + const char *new_keyfile, + size_t new_keyfile_size); + +/** + * Add key slot using provided volume key. + * + * @pre @e cd contains initialized and formatted LUKS device context + * + * @param cd crypt device handle + * @param keyslot requested keyslot or CRYPT_ANY_SLOT + * @param volume_key provided volume key or @e NULL if used after crypt_format + * @param volume_key_size size of volume_key + * @param passphrase passphrase for new keyslot + * @param passphrase_size size of passphrase + * + * @return allocated key slot number or negative errno otherwise. + */ +int crypt_keyslot_add_by_volume_key(struct crypt_device *cd, + int keyslot, + const char *volume_key, + size_t volume_key_size, + const char *passphrase, + size_t passphrase_size); + +/** create keyslot with volume key not associated with current dm-crypt segment */ +#define CRYPT_VOLUME_KEY_NO_SEGMENT (1 << 0) + +/** create keyslot with new volume key and assign it to current dm-crypt segment */ +#define CRYPT_VOLUME_KEY_SET (1 << 1) + +/** Assign key to first matching digest before creating new digest */ +#define CRYPT_VOLUME_KEY_DIGEST_REUSE (1 << 2) + +/** + * Add key slot using provided key. + * + * @pre @e cd contains initialized and formatted LUKS2 device context + * + * @param cd crypt device handle + * @param keyslot requested keyslot or CRYPT_ANY_SLOT + * @param volume_key provided volume key or @e NULL (see note below) + * @param volume_key_size size of volume_key + * @param passphrase passphrase for new keyslot + * @param passphrase_size size of passphrase + * @param flags key flags to set + * + * @return allocated key slot number or negative errno otherwise. + * + * @note in case volume_key is @e NULL following first matching rule will apply: + * @li if cd is device handle used in crypt_format() by current process, the volume + * key generated (or passed) in crypt_format() will be stored in keyslot. + * @li if CRYPT_VOLUME_KEY_NO_SEGMENT flag is raised the new volume_key will be + * generated and stored in keyslot. The keyslot will become unbound (unusable to + * dm-crypt device activation). + * @li fails with -EINVAL otherwise + * + * @warning CRYPT_VOLUME_KEY_SET flag force updates volume key. It is @b not @b reencryption! + * By doing so you will most probably destroy your ciphertext data device. It's supposed + * to be used only in wrapped keys scheme for key refresh process where real (inner) volume + * key stays untouched. It may be involed on active @e keyslot which makes the (previously + * unbound) keyslot new regular keyslot. + */ +int crypt_keyslot_add_by_key(struct crypt_device *cd, + int keyslot, + const char *volume_key, + size_t volume_key_size, + const char *passphrase, + size_t passphrase_size, + uint32_t flags); + +/** + * Destroy (and disable) key slot. + * + * @pre @e cd contains initialized and formatted LUKS device context + * + * @param cd crypt device handle + * @param keyslot requested key slot to destroy + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note Note that there is no passphrase verification used. + */ +int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot); +/** @} */ + +/** + * @defgroup crypt-aflags Device runtime attributes + * Activation flags + * @addtogroup crypt-aflags + * @{ + */ + +/** device is read only */ +#define CRYPT_ACTIVATE_READONLY (1 << 0) +/** only reported for device without uuid */ +#define CRYPT_ACTIVATE_NO_UUID (1 << 1) +/** activate even if cannot grant exclusive access (DANGEROUS) */ +#define CRYPT_ACTIVATE_SHARED (1 << 2) +/** enable discards aka TRIM */ +#define CRYPT_ACTIVATE_ALLOW_DISCARDS (1 << 3) +/** skip global udev rules in activation ("private device"), input only */ +#define CRYPT_ACTIVATE_PRIVATE (1 << 4) +/** corruption detected (verity), output only */ +#define CRYPT_ACTIVATE_CORRUPTED (1 << 5) +/** use same_cpu_crypt option for dm-crypt */ +#define CRYPT_ACTIVATE_SAME_CPU_CRYPT (1 << 6) +/** use submit_from_crypt_cpus for dm-crypt */ +#define CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS (1 << 7) +/** dm-verity: ignore_corruption flag - ignore corruption, log it only */ +#define CRYPT_ACTIVATE_IGNORE_CORRUPTION (1 << 8) +/** dm-verity: restart_on_corruption flag - restart kernel on corruption */ +#define CRYPT_ACTIVATE_RESTART_ON_CORRUPTION (1 << 9) +/** dm-verity: ignore_zero_blocks - do not verify zero blocks */ +#define CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS (1 << 10) +/** key loaded in kernel keyring instead directly in dm-crypt */ +#define CRYPT_ACTIVATE_KEYRING_KEY (1 << 11) +/** dm-integrity: direct writes, do not use journal */ +#define CRYPT_ACTIVATE_NO_JOURNAL (1 << 12) +/** dm-integrity: recovery mode - no journal, no integrity checks */ +#define CRYPT_ACTIVATE_RECOVERY (1 << 13) +/** ignore persistently stored flags */ +#define CRYPT_ACTIVATE_IGNORE_PERSISTENT (1 << 14) +/** dm-verity: check_at_most_once - check data blocks only the first time */ +#define CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE (1 << 15) +/** allow activation check including unbound keyslots (keyslots without segments) */ +#define CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY (1 << 16) +/** dm-integrity: activate automatic recalculation */ +#define CRYPT_ACTIVATE_RECALCULATE (1 << 17) +/** reactivate existing and update flags, input only */ +#define CRYPT_ACTIVATE_REFRESH (1 << 18) +/** Use global lock to serialize memory hard KDF on activation (OOM workaround) */ +#define CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF (1 << 19) +/** dm-integrity: direct writes, use bitmap to track dirty sectors */ +#define CRYPT_ACTIVATE_NO_JOURNAL_BITMAP (1 << 20) +/** device is suspended (key should be wiped from memory), output only */ +#define CRYPT_ACTIVATE_SUSPENDED (1 << 21) +/** use IV sector counted in sector_size instead of default 512 bytes sectors */ +#define CRYPT_ACTIVATE_IV_LARGE_SECTORS (1 << 22) +/** dm-verity: panic_on_corruption flag - panic kernel on corruption */ +#define CRYPT_ACTIVATE_PANIC_ON_CORRUPTION (1 << 23) +/** dm-crypt: bypass internal workqueue and process read requests synchronously. */ +#define CRYPT_ACTIVATE_NO_READ_WORKQUEUE (1 << 24) +/** dm-crypt: bypass internal workqueue and process write requests synchronously. */ +#define CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE (1 << 25) + +/** + * Active device runtime attributes + */ +struct crypt_active_device { + uint64_t offset; /**< offset in sectors */ + uint64_t iv_offset; /**< IV initialization sector */ + uint64_t size; /**< active device size */ + uint32_t flags; /**< activation flags */ +}; + +/** + * Receive runtime attributes of active crypt device. + * + * @param cd crypt device handle (can be @e NULL) + * @param name name of active device + * @param cad preallocated active device attributes to fill + * + * @return @e 0 on success or negative errno value otherwise + * + */ +int crypt_get_active_device(struct crypt_device *cd, + const char *name, + struct crypt_active_device *cad); + +/** + * Get detected number of integrity failures. + * + * @param cd crypt device handle (can be @e NULL) + * @param name name of active device + * + * @return number of integrity failures or @e 0 otherwise + * + */ +uint64_t crypt_get_active_integrity_failures(struct crypt_device *cd, + const char *name); +/** @} */ + +/** + * @defgroup crypt-pflags LUKS2 Device persistent flags and requirements + * @addtogroup crypt-pflags + * @{ + */ + +/** + * LUKS2 header requirements + */ +/** Unfinished offline reencryption */ +#define CRYPT_REQUIREMENT_OFFLINE_REENCRYPT (1 << 0) +/** Online reencryption in-progress */ +#define CRYPT_REQUIREMENT_ONLINE_REENCRYPT (1 << 1) +/** unknown requirement in header (output only) */ +#define CRYPT_REQUIREMENT_UNKNOWN (1 << 31) + +/** + * Persistent flags type + */ +typedef enum { + CRYPT_FLAGS_ACTIVATION, /**< activation flags, @see aflags */ + CRYPT_FLAGS_REQUIREMENTS /**< requirements flags */ +} crypt_flags_type; + +/** + * Set persistent flags. + * + * @param cd crypt device handle (can be @e NULL) + * @param type type to set (CRYPT_FLAGS_ACTIVATION or CRYPT_FLAGS_REQUIREMENTS) + * @param flags flags to set + * + * @return @e 0 on success or negative errno value otherwise + * + * @note Valid only for LUKS2. + * + * @note Not all activation flags can be stored. Only ALLOW_DISCARD, + * SAME_CPU_CRYPT, SUBMIT_FROM_CRYPT_CPU and NO_JOURNAL can be + * stored persistently. + * + * @note Only requirements flags recognised by current library may be set. + * CRYPT_REQUIREMENT_UNKNOWN is illegal (output only) in set operation. + */ +int crypt_persistent_flags_set(struct crypt_device *cd, + crypt_flags_type type, + uint32_t flags); + +/** + * Get persistent flags stored in header. + * + * @param cd crypt device handle (can be @e NULL) + * @param type flags type to retrieve (CRYPT_FLAGS_ACTIVATION or CRYPT_FLAGS_REQUIREMENTS) + * @param flags reference to output variable + * + * @return @e 0 on success or negative errno value otherwise + */ +int crypt_persistent_flags_get(struct crypt_device *cd, + crypt_flags_type type, + uint32_t *flags); +/** @} */ + +/** + * @defgroup crypt-activation Device activation + * @addtogroup crypt-activation + * @{ + */ + +/** + * Activate device or check passphrase. + * + * @param cd crypt device handle + * @param name name of device to create, if @e NULL only check passphrase + * @param keyslot requested keyslot to check or @e CRYPT_ANY_SLOT + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of @e passphrase + * @param flags activation flags + * + * @return unlocked key slot number or negative errno otherwise. + */ +int crypt_activate_by_passphrase(struct crypt_device *cd, + const char *name, + int keyslot, + const char *passphrase, + size_t passphrase_size, + uint32_t flags); + +/** + * Activate device or check using key file. + * + * @param cd crypt device handle + * @param name name of device to create, if @e NULL only check keyfile + * @param keyslot requested keyslot to check or CRYPT_ANY_SLOT + * @param keyfile key file used to unlock volume key + * @param keyfile_size number of bytes to read from keyfile, 0 is unlimited + * @param keyfile_offset number of bytes to skip at start of keyfile + * @param flags activation flags + * + * @return unlocked key slot number or negative errno otherwise. + */ +int crypt_activate_by_keyfile_device_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset, + uint32_t flags); + +/** + * Backward compatible crypt_activate_by_keyfile_device_offset() (with size_t offset). + */ +int crypt_activate_by_keyfile_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset, + uint32_t flags); + +/** + * Backward compatible crypt_activate_by_keyfile_device_offset() (without offset). + */ +int crypt_activate_by_keyfile(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint32_t flags); + +/** + * Activate device using provided volume key. + * + * @param cd crypt device handle + * @param name name of device to create, if @e NULL only check volume key + * @param volume_key provided volume key (or @e NULL to use internal) + * @param volume_key_size size of volume_key + * @param flags activation flags + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note If @e NULL is used for volume_key, device has to be initialized + * by previous operation (like @ref crypt_format + * or @ref crypt_init_by_name) + * @note For VERITY the volume key means root hash required for activation. + * Because kernel dm-verity is always read only, you have to provide + * CRYPT_ACTIVATE_READONLY flag always. + * @note For TCRYPT the volume key should be always NULL and because master + * key from decrypted header is used instead. + */ +int crypt_activate_by_volume_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size, + uint32_t flags); + +/** + * Activate VERITY device using provided key and optional signature). + * + * @param cd crypt device handle + * @param name name of device to create + * @param volume_key provided volume key + * @param volume_key_size size of volume_key + * @param signature buffer with signature for the key + * @param signature_size bsize of signature buffer + * @param flags activation flags + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note For VERITY the volume key means root hash required for activation. + * Because kernel dm-verity is always read only, you have to provide + * CRYPT_ACTIVATE_READONLY flag always. + */ +int crypt_activate_by_signed_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size, + const char *signature, + size_t signature_size, + uint32_t flags); + +/** + * Activate device using passphrase stored in kernel keyring. + * + * @param cd crypt device handle + * @param name name of device to create, if @e NULL only check passphrase in keyring + * @param key_description kernel keyring key description library should look + * for passphrase in + * @param keyslot requested keyslot to check or CRYPT_ANY_SLOT + * @param flags activation flags + * + * @return @e unlocked keyslot number on success or negative errno value otherwise. + * + * @note Keyslot passphrase must be stored in 'user' key type + * and the key has to be reachable for process context + * on behalf of which this function is called. + */ +int crypt_activate_by_keyring(struct crypt_device *cd, + const char *name, + const char *key_description, + int keyslot, + uint32_t flags); + +/** lazy deactivation - remove once last user releases it */ +#define CRYPT_DEACTIVATE_DEFERRED (1 << 0) +/** force deactivation - if the device is busy, it is replaced by error device */ +#define CRYPT_DEACTIVATE_FORCE (1 << 1) + +/** + * Deactivate crypt device. This function tries to remove active device-mapper + * mapping from kernel. Also, sensitive data like the volume key are removed from + * memory + * + * @param cd crypt device handle, can be @e NULL + * @param name name of device to deactivate + * @param flags deactivation flags + * + * @return @e 0 on success or negative errno value otherwise. + * + */ +int crypt_deactivate_by_name(struct crypt_device *cd, + const char *name, + uint32_t flags); + +/** + * Deactivate crypt device. See @ref crypt_deactivate_by_name with empty @e flags. + */ +int crypt_deactivate(struct crypt_device *cd, const char *name); +/** @} */ + +/** + * @defgroup crypt-key Volume Key manipulation + * @addtogroup crypt-key + * @{ + */ + +/** + * Get volume key from crypt device. + * + * @param cd crypt device handle + * @param keyslot use this keyslot or @e CRYPT_ANY_SLOT + * @param volume_key buffer for volume key + * @param volume_key_size on input, size of buffer @e volume_key, + * on output size of @e volume_key + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of @e passphrase + * + * @return unlocked key slot number or negative errno otherwise. + * + * @note For TCRYPT cipher chain is the volume key concatenated + * for all ciphers in chain. + * @note For VERITY the volume key means root hash used for activation. + */ +int crypt_volume_key_get(struct crypt_device *cd, + int keyslot, + char *volume_key, + size_t *volume_key_size, + const char *passphrase, + size_t passphrase_size); + +/** + * Verify that provided volume key is valid for crypt device. + * + * @param cd crypt device handle + * @param volume_key provided volume key + * @param volume_key_size size of @e volume_key + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_volume_key_verify(struct crypt_device *cd, + const char *volume_key, + size_t volume_key_size); +/** @} */ + +/** + * @defgroup crypt-devstat Crypt and Verity device status + * @addtogroup crypt-devstat + * @{ + */ + +/** + * Device status + */ +typedef enum { + CRYPT_INVALID, /**< device mapping is invalid in this context */ + CRYPT_INACTIVE, /**< no such mapped device */ + CRYPT_ACTIVE, /**< device is active */ + CRYPT_BUSY /**< device is active and has open count > 0 */ +} crypt_status_info; + +/** + * Get status info about device name. + * + * @param cd crypt device handle, can be @e NULL + * @param name crypt device name + * + * @return value defined by crypt_status_info. + * + */ +crypt_status_info crypt_status(struct crypt_device *cd, const char *name); + +/** + * Dump text-formatted information about crypt or verity device to log output. + * + * @param cd crypt device handle + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_dump(struct crypt_device *cd); + +/** + * Get cipher used in device. + * + * @param cd crypt device handle + * + * @return used cipher, e.g. "aes" or @e NULL otherwise + * + */ +const char *crypt_get_cipher(struct crypt_device *cd); + +/** + * Get cipher mode used in device. + * + * @param cd crypt device handle + * + * @return used cipher mode e.g. "xts-plain" or @e otherwise + * + */ +const char *crypt_get_cipher_mode(struct crypt_device *cd); + +/** + * Get device UUID. + * + * @param cd crypt device handle + * + * @return device UUID or @e NULL if not set + * + */ +const char *crypt_get_uuid(struct crypt_device *cd); + +/** + * Get path to underlying device. + * + * @param cd crypt device handle + * + * @return path to underlying device name + * + */ +const char *crypt_get_device_name(struct crypt_device *cd); + +/** + * Get path to detached metadata device or @e NULL if it is not detached. + * + * @param cd crypt device handle + * + * @return path to underlying device name + * + */ +const char *crypt_get_metadata_device_name(struct crypt_device *cd); + +/** + * Get device offset in 512-bytes sectors where real data starts (on underlying device). + * + * @param cd crypt device handle + * + * @return device offset in sectors + * + */ +uint64_t crypt_get_data_offset(struct crypt_device *cd); + +/** + * Get IV offset in 512-bytes sectors (skip). + * + * @param cd crypt device handle + * + * @return IV offset + * + */ +uint64_t crypt_get_iv_offset(struct crypt_device *cd); + +/** + * Get size (in bytes) of volume key for crypt device. + * + * @param cd crypt device handle + * + * @return volume key size + * + * @note For LUKS2, this function can be used only if there is at least + * one keyslot assigned to data segment. + */ +int crypt_get_volume_key_size(struct crypt_device *cd); + +/** + * Get size (in bytes) of encryption sector for crypt device. + * + * @param cd crypt device handle + * + * @return sector size + * + */ +int crypt_get_sector_size(struct crypt_device *cd); + +/** + * Get device parameters for VERITY device. + * + * @param cd crypt device handle + * @param vp verity device info + * + * @e 0 on success or negative errno value otherwise. + * + */ +int crypt_get_verity_info(struct crypt_device *cd, + struct crypt_params_verity *vp); + +/** + * Get device parameters for INTEGRITY device. + * + * @param cd crypt device handle + * @param ip verity device info + * + * @e 0 on success or negative errno value otherwise. + * + */ +int crypt_get_integrity_info(struct crypt_device *cd, + struct crypt_params_integrity *ip); +/** @} */ + +/** + * @defgroup crypt-benchmark Benchmarking + * Benchmarking of algorithms + * @addtogroup crypt-benchmark + * @{ + */ + +/** + * Informational benchmark for ciphers. + * + * @param cd crypt device handle + * @param cipher (e.g. "aes") + * @param cipher_mode (e.g. "xts"), IV generator is ignored + * @param volume_key_size size of volume key in bytes + * @param iv_size size of IV in bytes + * @param buffer_size size of encryption buffer in bytes used in test + * @param encryption_mbs measured encryption speed in MiB/s + * @param decryption_mbs measured decryption speed in MiB/s + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note If encryption_buffer_size is too small and encryption time + * cannot be properly measured, -ERANGE is returned. + */ +int crypt_benchmark(struct crypt_device *cd, + const char *cipher, + const char *cipher_mode, + size_t volume_key_size, + size_t iv_size, + size_t buffer_size, + double *encryption_mbs, + double *decryption_mbs); + +/** + * Informational benchmark for PBKDF. + * + * @param cd crypt device handle + * @param pbkdf PBKDF parameters + * @param password password for benchmark + * @param password_size size of password + * @param salt salt for benchmark + * @param salt_size size of salt + * @param volume_key_size output volume key size + * @param progress callback function + * @param usrptr provided identification in callback + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_benchmark_pbkdf(struct crypt_device *cd, + struct crypt_pbkdf_type *pbkdf, + const char *password, + size_t password_size, + const char *salt, + size_t salt_size, + size_t volume_key_size, + int (*progress)(uint32_t time_ms, void *usrptr), + void *usrptr); +/** @} */ + +/** + * @addtogroup crypt-keyslot + * @{ + */ + +/** + * Crypt keyslot info + */ +typedef enum { + CRYPT_SLOT_INVALID, /**< invalid keyslot */ + CRYPT_SLOT_INACTIVE, /**< keyslot is inactive (free) */ + CRYPT_SLOT_ACTIVE, /**< keyslot is active (used) */ + CRYPT_SLOT_ACTIVE_LAST,/**< keylost is active (used) + * and last used at the same time */ + CRYPT_SLOT_UNBOUND /**< keyslot is active and not bound + * to any crypt segment (LUKS2 only) */ +} crypt_keyslot_info; + +/** + * Get information about particular key slot. + * + * @param cd crypt device handle + * @param keyslot requested keyslot to check or CRYPT_ANY_SLOT + * + * @return value defined by crypt_keyslot_info + * + */ +crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot); + +/** + * Crypt keyslot priority + */ +typedef enum { + CRYPT_SLOT_PRIORITY_INVALID =-1, /**< no such slot */ + CRYPT_SLOT_PRIORITY_IGNORE = 0, /**< CRYPT_ANY_SLOT will ignore it for open */ + CRYPT_SLOT_PRIORITY_NORMAL = 1, /**< default priority, tried after preferred */ + CRYPT_SLOT_PRIORITY_PREFER = 2, /**< will try to open first */ +} crypt_keyslot_priority; + +/** + * Get keyslot priority (LUKS2) + * + * @param cd crypt device handle + * @param keyslot keyslot number + * + * @return value defined by crypt_keyslot_priority + */ +crypt_keyslot_priority crypt_keyslot_get_priority(struct crypt_device *cd, int keyslot); + +/** + * Set keyslot priority (LUKS2) + * + * @param cd crypt device handle + * @param keyslot keyslot number + * @param priority priority defined in crypt_keyslot_priority + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_keyslot_set_priority(struct crypt_device *cd, int keyslot, crypt_keyslot_priority priority); + +/** + * Get number of keyslots supported for device type. + * + * @param type crypt device type + * + * @return slot count or negative errno otherwise if device + * doesn't not support keyslots. + */ +int crypt_keyslot_max(const char *type); + +/** + * Get keyslot area pointers (relative to metadata device). + * + * @param cd crypt device handle + * @param keyslot keyslot number + * @param offset offset on metadata device (in bytes) + * @param length length of keyslot area (in bytes) + * + * @return @e 0 on success or negative errno value otherwise. + * + */ +int crypt_keyslot_area(struct crypt_device *cd, + int keyslot, + uint64_t *offset, + uint64_t *length); + +/** + * Get size (in bytes) of stored key in particular keyslot. + * Use for LUKS2 unbound keyslots, for other keyslots it is the same as @ref crypt_get_volume_key_size + * + * @param cd crypt device handle + * @param keyslot keyslot number + * + * @return volume key size or negative errno value otherwise. + * + */ +int crypt_keyslot_get_key_size(struct crypt_device *cd, int keyslot); + +/** + * Get cipher and key size for keyslot encryption. + * Use for LUKS2 keyslot to set different encryption type than for data encryption. + * Parameters will be used for next keyslot operations. + * + * @param cd crypt device handle + * @param keyslot keyslot number of CRYPT_ANY_SLOT for default + * @param key_size encryption key size (in bytes) + * + * @return cipher specification on success or @e NULL. + * + * @note This is the encryption of keyslot itself, not the data encryption algorithm! + */ +const char *crypt_keyslot_get_encryption(struct crypt_device *cd, int keyslot, size_t *key_size); + +/** + * Get PBKDF parameters for keyslot. + * + * @param cd crypt device handle + * @param keyslot keyslot number + * @param pbkdf struct with returned PBKDF parameters + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_keyslot_get_pbkdf(struct crypt_device *cd, int keyslot, struct crypt_pbkdf_type *pbkdf); + +/** + * Set encryption for keyslot. + * Use for LUKS2 keyslot to set different encryption type than for data encryption. + * Parameters will be used for next keyslot operations that create or change a keyslot. + * + * @param cd crypt device handle + * @param cipher (e.g. "aes-xts-plain64") + * @param key_size encryption key size (in bytes) + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note To reset to default keyslot encryption (the same as for data) + * set cipher to NULL and key size to 0. + */ +int crypt_keyslot_set_encryption(struct crypt_device *cd, + const char *cipher, + size_t key_size); + +/** + * Get directory where mapped crypt devices are created + * + * @return the directory path + */ +const char *crypt_get_dir(void); + +/** @} */ + +/** + * @defgroup crypt-backup Device metadata backup + * @addtogroup crypt-backup + * @{ + */ +/** + * Backup header and keyslots to file. + * + * @param cd crypt device handle + * @param requested_type @link crypt-type @endlink or @e NULL for all known + * @param backup_file file to backup header to + * + * @return @e 0 on success or negative errno value otherwise. + * + */ +int crypt_header_backup(struct crypt_device *cd, + const char *requested_type, + const char *backup_file); + +/** + * Restore header and keyslots from backup file. + * + * @param cd crypt device handle + * @param requested_type @link crypt-type @endlink or @e NULL for all known + * @param backup_file file to restore header from + * + * @return @e 0 on success or negative errno value otherwise. + * + */ +int crypt_header_restore(struct crypt_device *cd, + const char *requested_type, + const char *backup_file); +/** @} */ + +/** + * @defgroup crypt-dbg Library debug level + * Set library debug level + * @addtogroup crypt-dbg + * @{ + */ + +/** Debug all */ +#define CRYPT_DEBUG_ALL -1 +/** Debug all with additional JSON dump (for LUKS2) */ +#define CRYPT_DEBUG_JSON -2 +/** Debug none */ +#define CRYPT_DEBUG_NONE 0 + +/** + * Set the debug level for library + * + * @param level debug level + * + */ +void crypt_set_debug_level(int level); +/** @} */ + +/** + * @defgroup crypt-keyfile Function to read keyfile + * @addtogroup crypt-keyfile + * @{ + */ + +/** + * Read keyfile + * + * @param cd crypt device handle + * @param keyfile keyfile to read + * @param key buffer for key + * @param key_size_read size of read key + * @param keyfile_offset key offset in keyfile + * @param key_size exact key length to read from file or 0 + * @param flags keyfile read flags + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note If key_size is set to zero we read internal max length + * and actual size read is returned via key_size_read parameter. + */ +int crypt_keyfile_device_read(struct crypt_device *cd, + const char *keyfile, + char **key, size_t *key_size_read, + uint64_t keyfile_offset, + size_t key_size, + uint32_t flags); + +/** + * Backward compatible crypt_keyfile_device_read() (with size_t offset). + */ +int crypt_keyfile_read(struct crypt_device *cd, + const char *keyfile, + char **key, size_t *key_size_read, + size_t keyfile_offset, + size_t key_size, + uint32_t flags); + +/** Read key only to the first end of line (\\n). */ +#define CRYPT_KEYFILE_STOP_EOL (1 << 0) +/** @} */ + +/** + * @defgroup crypt-wipe Function to wipe device + * @addtogroup crypt-wipe + * @{ + */ +/** + * Wipe pattern + */ +typedef enum { + CRYPT_WIPE_ZERO, /**< Fill with zeroes */ + CRYPT_WIPE_RANDOM, /**< Use RNG to fill data */ + CRYPT_WIPE_ENCRYPTED_ZERO, /**< Add encryption and fill with zeroes as plaintext */ + CRYPT_WIPE_SPECIAL, /**< Compatibility only, do not use (Gutmann method) */ +} crypt_wipe_pattern; + +/** + * Wipe/Fill (part of) a device with the selected pattern. + * + * @param cd crypt device handle + * @param dev_path path to device to wipe or @e NULL if data device should be used + * @param pattern selected wipe pattern + * @param offset offset on device (in bytes) + * @param length length of area to be wiped (in bytes) + * @param wipe_block_size used block for wiping (one step) (in bytes) + * @param flags wipe flags + * @param progress callback function called after each @e wipe_block_size or @e NULL + * @param usrptr provided identification in callback + * + * @return @e 0 on success or negative errno value otherwise. + * + * @note A @e progress callback can interrupt wipe process by returning non-zero code. + * + * @note If the error values is -EIO or -EINTR, some part of the device could + * be overwritten. Other error codes (-EINVAL, -ENOMEM) means that no IO was performed. + */ +int crypt_wipe(struct crypt_device *cd, + const char *dev_path, /* if null, use data device */ + crypt_wipe_pattern pattern, + uint64_t offset, + uint64_t length, + size_t wipe_block_size, + uint32_t flags, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr), + void *usrptr +); + +/** Use direct-io */ +#define CRYPT_WIPE_NO_DIRECT_IO (1 << 0) +/** @} */ + +/** + * @defgroup crypt-tokens LUKS2 token wrapper access + * + * Utilities for handling tokens LUKS2 + * Token is a device or a method how to read password for particular keyslot + * automatically. It can be chunk of data stored on hardware token or + * just a metadata how to generate the password. + * + * @addtogroup crypt-tokens + * @{ + */ + +/** Iterate through all tokens */ +#define CRYPT_ANY_TOKEN -1 + +/** + * Get content of a token definition in JSON format. + * + * @param cd crypt device handle + * @param token token id + * @param json buffer with JSON + * + * @return allocated token id or negative errno otherwise. + */ +int crypt_token_json_get(struct crypt_device *cd, + int token, + const char **json); + +/** + * Store content of a token definition in JSON format. + * + * @param cd crypt device handle + * @param token token id or @e CRYPT_ANY_TOKEN to allocate new one + * @param json buffer with JSON or @e NULL to remove token + * + * @return allocated token id or negative errno otherwise. + * + * @note The buffer must be in proper JSON format and must contain at least + * string "type" with slot type and an array of string names "keyslots". + * Keyslots array contains assignments to particular slots and can be empty. + */ +int crypt_token_json_set(struct crypt_device *cd, + int token, + const char *json); + +/** + * Token info + */ +typedef enum { + CRYPT_TOKEN_INVALID, /**< token is invalid */ + CRYPT_TOKEN_INACTIVE, /**< token is empty (free) */ + CRYPT_TOKEN_INTERNAL, /**< active internal token with driver */ + CRYPT_TOKEN_INTERNAL_UNKNOWN, /**< active internal token (reserved name) with missing token driver */ + CRYPT_TOKEN_EXTERNAL, /**< active external (user defined) token with driver */ + CRYPT_TOKEN_EXTERNAL_UNKNOWN, /**< active external (user defined) token with missing token driver */ +} crypt_token_info; + +/** + * Get info for specific token. + * + * @param cd crypt device handle + * @param token existing token id + * @param type pointer for returned type string + * + * @return token status info. For any returned status (besides CRYPT_TOKEN_INVALID + * and CRYPT_TOKEN_INACTIVE) and if type parameter is not NULL it will + * contain address of type string. + * + * @note if required, create a copy of string referenced in *type before calling next + * libcryptsetup API function. The reference may become invalid. + */ +crypt_token_info crypt_token_status(struct crypt_device *cd, int token, const char **type); + +/** + * LUKS2 keyring token parameters. + * + * @see crypt_token_builtin_set + * + */ +struct crypt_token_params_luks2_keyring { + const char *key_description; /**< Reference in keyring */ +}; + +/** + * Create a new luks2 keyring token. + * + * @param cd crypt device handle + * @param token token id or @e CRYPT_ANY_TOKEN to allocate new one + * @param params luks2 keyring token params + * + * @return allocated token id or negative errno otherwise. + * + */ +int crypt_token_luks2_keyring_set(struct crypt_device *cd, + int token, + const struct crypt_token_params_luks2_keyring *params); + +/** + * Get LUKS2 keyring token params + * + * @param cd crypt device handle + * @param token existing luks2 keyring token id + * @param params returned luks2 keyring token params + * + * @return allocated token id or negative errno otherwise. + * + * @note do not call free() on params members. Members are valid only + * until next libcryptsetup function is called. + */ +int crypt_token_luks2_keyring_get(struct crypt_device *cd, + int token, + struct crypt_token_params_luks2_keyring *params); + +/** + * Assign a token to particular keyslot. + * (There can be more keyslots assigned to one token id.) + * + * @param cd crypt device handle + * @param token token id + * @param keyslot keyslot to be assigned to token (CRYPT_ANY SLOT + * assigns all active keyslots to token) + * + * @return allocated token id or negative errno otherwise. + */ +int crypt_token_assign_keyslot(struct crypt_device *cd, + int token, + int keyslot); + +/** + * Unassign a token from particular keyslot. + * (There can be more keyslots assigned to one token id.) + * + * @param cd crypt device handle + * @param token token id + * @param keyslot keyslot to be unassigned from token (CRYPT_ANY SLOT + * unassigns all active keyslots from token) + * + * @return allocated token id or negative errno otherwise. + */ +int crypt_token_unassign_keyslot(struct crypt_device *cd, + int token, + int keyslot); + +/** + * Get info about token assignment to particular keyslot. + * + * @param cd crypt device handle + * @param token token id + * @param keyslot keyslot + * + * @return 0 on success (token exists and is assigned to the keyslot), + * -ENOENT if token is not assigned to a keyslot (token, keyslot + * or both may be inactive) or other negative errno otherwise. + */ +int crypt_token_is_assigned(struct crypt_device *cd, + int token, + int keyslot); + +/** + * Token handler open function prototype. + * This function retrieves password from a token and return allocated buffer + * containing this password. This buffer has to be deallocated by calling + * free() function and content should be wiped before deallocation. + * + * @param cd crypt device handle + * @param token token id + * @param buffer returned allocated buffer with password + * @param buffer_len length of the buffer + * @param usrptr user data in @link crypt_activate_by_token @endlink + */ +typedef int (*crypt_token_open_func) ( + struct crypt_device *cd, + int token, + char **buffer, + size_t *buffer_len, + void *usrptr); + +/** + * Token handler buffer free function prototype. + * This function is used by library to free the buffer with keyslot + * passphrase when it's no longer needed. If not defined the library + * overwrites buffer with zeroes and call free(). + * + * @param buffer the buffer with keyslot passphrase + * @param buffer_len the buffer length + */ +typedef void (*crypt_token_buffer_free_func) (void *buffer, size_t buffer_len); + +/** + * Token handler validate function prototype. + * This function validates JSON representation of user defined token for additional data + * specific for its token type. If defined in the handler, it's called + * during @link crypt_activate_by_token @endlink. It may also be called during + * @link crypt_token_json_set @endlink when appropriate token handler was registered before + * with @link crypt_token_register @endlink. + * + * @param cd crypt device handle + * @param json buffer with JSON + */ +typedef int (*crypt_token_validate_func) (struct crypt_device *cd, const char *json); + +/** + * Token handler dump function prototype. + * This function is supposed to print token implementation specific details. It gets + * called during @link crypt_dump @endlink if token handler was registered before. + * + * @param cd crypt device handle + * @param json buffer with token JSON + * + * @note dump implementations are advised to use @link crypt_log @endlink function + * to dump token details. + */ +typedef void (*crypt_token_dump_func) (struct crypt_device *cd, const char *json); + +/** + * Token handler + */ +typedef struct { + const char *name; /**< token handler name */ + crypt_token_open_func open; /**< token handler open function */ + crypt_token_buffer_free_func buffer_free; /**< token handler buffer_free function (optional) */ + crypt_token_validate_func validate; /**< token handler validate function (optional) */ + crypt_token_dump_func dump; /**< token handler dump function (optional) */ +} crypt_token_handler; + +/** + * Register token handler + * + * @param handler token handler to register + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_token_register(const crypt_token_handler *handler); + +/** + * Activate device or check key using a token. + * + * @param cd crypt device handle + * @param name name of device to create, if @e NULL only check token + * @param token requested token to check or CRYPT_ANY_TOKEN to check all + * @param usrptr provided identification in callback + * @param flags activation flags + * + * @return unlocked key slot number or negative errno otherwise. + */ +int crypt_activate_by_token(struct crypt_device *cd, + const char *name, + int token, + void *usrptr, + uint32_t flags); +/** @} */ + +/** + * @defgroup crypt-reencryption LUKS2 volume reencryption support + * + * Set of functions to handling LUKS2 volume reencryption + * + * @addtogroup crypt-reencryption + * @{ + */ + +/** Initialize reencryption metadata but do not run reencryption yet. (in) */ +#define CRYPT_REENCRYPT_INITIALIZE_ONLY (1 << 0) +/** Move the first segment, used only with data shift. (in/out) */ +#define CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT (1 << 1) +/** Resume already initialized reencryption only. (in) */ +#define CRYPT_REENCRYPT_RESUME_ONLY (1 << 2) +/** Run reencryption recovery only. (in) */ +#define CRYPT_REENCRYPT_RECOVERY (1 << 3) +/** Reencryption requires metadata protection. (in/out) */ +#define CRYPT_REENCRYPT_REPAIR_NEEDED (1 << 4) + +/** + * Reencryption direction + */ +typedef enum { + CRYPT_REENCRYPT_FORWARD = 0, /**< forward direction */ + CRYPT_REENCRYPT_BACKWARD /**< backward direction */ +} crypt_reencrypt_direction_info; + +/** + * Reencryption mode + */ +typedef enum { + CRYPT_REENCRYPT_REENCRYPT = 0, /**< Reencryption mode */ + CRYPT_REENCRYPT_ENCRYPT, /**< Encryption mode */ + CRYPT_REENCRYPT_DECRYPT, /**< Decryption mode */ +} crypt_reencrypt_mode_info; + +/** + * LUKS2 reencryption options. + */ +struct crypt_params_reencrypt { + crypt_reencrypt_mode_info mode; /**< Reencryption mode, immutable after first init. */ + crypt_reencrypt_direction_info direction; /**< Reencryption direction, immutable after first init. */ + const char *resilience; /**< Resilience mode: "none", "checksum", "journal" or "shift" (only "shift" is immutable after init) */ + const char *hash; /**< Used hash for "checksum" resilience type, ignored otherwise. */ + uint64_t data_shift; /**< Used in "shift" mode, must be non-zero, immutable after first init. */ + uint64_t max_hotzone_size; /**< Exact hotzone size for "none" mode. Maximum hotzone size for "checksum" and "journal" modes. */ + uint64_t device_size; /**< Reencrypt only initial part of the data device. */ + const struct crypt_params_luks2 *luks2; /**< LUKS2 parameters for the final reencryption volume.*/ + uint32_t flags; /**< Reencryption flags. */ +}; + +/** + * Initialize reencryption metadata using passphrase. + * + * This function initializes on-disk metadata to include all reencryption segments, + * according to the provided options. + * If metadata already contains ongoing reencryption metadata, it loads these parameters + * (in this situation all parameters except @e name and @e passphrase can be omitted). + * + * @param cd crypt device handle + * @param name name of active device or @e NULL for offline reencryption + * @param passphrase passphrase used to unlock volume key + * @param passphrase_size size of @e passphrase (binary data) + * @param keyslot_old keyslot to unlock existing device or CRYPT_ANY_SLOT + * @param keyslot_new existing (unbound) reencryption keyslot; must be set except for decryption + * @param cipher cipher specification (e.g. "aes") + * @param cipher_mode cipher mode and IV (e.g. "xts-plain64") + * @param params reencryption parameters @link crypt_params_reencrypt @endlink. + * + * @return reencryption key slot number or negative errno otherwise. + */ +int crypt_reencrypt_init_by_passphrase(struct crypt_device *cd, + const char *name, + const char *passphrase, + size_t passphrase_size, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params); + +/** + * Initialize reencryption metadata using passphrase in keyring. + * + * This function initializes on-disk metadata to include all reencryption segments, + * according to the provided options. + * If metadata already contains ongoing reencryption metadata, it loads these parameters + * (in this situation all parameters except @e name and @e key_description can be omitted). + * + * @param cd crypt device handle + * @param name name of active device or @e NULL for offline reencryption + * @param key_description passphrase (key) identification in keyring + * @param keyslot_old keyslot to unlock existing device or CRYPT_ANY_SLOT + * @param keyslot_new existing (unbound) reencryption keyslot; must be set except for decryption + * @param cipher cipher specification (e.g. "aes") + * @param cipher_mode cipher mode and IV (e.g. "xts-plain64") + * @param params reencryption parameters @link crypt_params_reencrypt @endlink. + * + * @return reencryption key slot number or negative errno otherwise. + */ +int crypt_reencrypt_init_by_keyring(struct crypt_device *cd, + const char *name, + const char *key_description, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params); + +/** + * Run data reencryption. + * + * @param cd crypt device handle + * @param progress is a callback function reporting device \b size, + * current \b offset of reencryption and provided \b usrptr identification + * + * @return @e 0 on success or negative errno value otherwise. + */ +int crypt_reencrypt(struct crypt_device *cd, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr)); + +/** + * Reencryption status info + */ +typedef enum { + CRYPT_REENCRYPT_NONE = 0, /**< No reencryption in progress */ + CRYPT_REENCRYPT_CLEAN, /**< Ongoing reencryption in a clean state. */ + CRYPT_REENCRYPT_CRASH, /**< Aborted reencryption that need internal recovery. */ + CRYPT_REENCRYPT_INVALID /**< Invalid state. */ +} crypt_reencrypt_info; + +/** + * LUKS2 reencryption status. + * + * @param cd crypt device handle + * @param params reencryption parameters + * + * @return reencryption status info and parameters. + */ +crypt_reencrypt_info crypt_reencrypt_status(struct crypt_device *cd, + struct crypt_params_reencrypt *params); +/** @} */ + +/** + * @defgroup crypt-memory Safe memory helpers functions + * @addtogroup crypt-memory + * @{ + */ + +/** + * Allocate safe memory (content is safely wiped on deallocation). + * + * @param size size of memory in bytes + * + * @return pointer to allocated memory or @e NULL. + */ +void *crypt_safe_alloc(size_t size); + +/** + * Release safe memory, content is safely wiped. + * The pointer must be allocated with @link crypt_safe_alloc @endlink + * + * @param data pointer to memory to be deallocated + */ +void crypt_safe_free(void *data); + +/** + * Reallocate safe memory (content is copied and safely wiped on deallocation). + * + * @param data pointer to memory to be deallocated + * @param size new size of memory in bytes + * + * @return pointer to allocated memory or @e NULL. + */ +void *crypt_safe_realloc(void *data, size_t size); + +/** + * Safe clear memory area (compile should not compile this call out). + * + * @param data pointer to memory to be cleared + * @param size size of memory in bytes + */ +void crypt_safe_memzero(void *data, size_t size); + +/** @} */ + +#ifdef __cplusplus +} +#endif +#endif /* _LIBCRYPTSETUP_H */ diff --git a/lib/libcryptsetup.pc.in b/lib/libcryptsetup.pc.in new file mode 100644 index 0000000..f3d3fb1 --- /dev/null +++ b/lib/libcryptsetup.pc.in @@ -0,0 +1,10 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ +includedir=@includedir@ + +Name: cryptsetup +Description: cryptsetup library +Version: @LIBCRYPTSETUP_VERSION@ +Cflags: -I${includedir} +Libs: -L${libdir} -lcryptsetup diff --git a/lib/libcryptsetup.sym b/lib/libcryptsetup.sym new file mode 100644 index 0000000..59a998c --- /dev/null +++ b/lib/libcryptsetup.sym @@ -0,0 +1,133 @@ +CRYPTSETUP_2.0 { + global: + crypt_init; + crypt_init_data_device; + crypt_init_by_name; + crypt_init_by_name_and_header; + + crypt_set_log_callback; + crypt_set_confirm_callback; + crypt_set_iteration_time; + crypt_set_uuid; + crypt_set_label; + crypt_set_data_device; + + crypt_set_compatibility; + crypt_get_compatibility; + + crypt_memory_lock; + crypt_metadata_locking; + crypt_format; + crypt_convert; + crypt_load; + crypt_repair; + crypt_resize; + crypt_suspend; + crypt_resume_by_passphrase; + crypt_resume_by_keyfile; + crypt_resume_by_keyfile_offset; + crypt_resume_by_keyfile_device_offset; + crypt_resume_by_volume_key; + crypt_free; + + crypt_keyslot_add_by_passphrase; + crypt_keyslot_change_by_passphrase; + crypt_keyslot_add_by_keyfile; + crypt_keyslot_add_by_keyfile_offset; + crypt_keyslot_add_by_keyfile_device_offset; + crypt_keyslot_add_by_volume_key; + crypt_keyslot_add_by_key; + + crypt_keyslot_set_priority; + crypt_keyslot_get_priority; + + crypt_token_json_get; + crypt_token_json_set; + crypt_token_status; + crypt_token_luks2_keyring_get; + crypt_token_luks2_keyring_set; + crypt_token_assign_keyslot; + crypt_token_unassign_keyslot; + crypt_token_is_assigned; + crypt_token_register; + + crypt_activate_by_token; + + crypt_keyslot_destroy; + crypt_activate_by_passphrase; + crypt_activate_by_keyfile; + crypt_activate_by_keyfile_offset; + crypt_activate_by_keyfile_device_offset; + crypt_activate_by_volume_key; + crypt_activate_by_signed_key; + crypt_activate_by_keyring; + crypt_deactivate; + crypt_deactivate_by_name; + crypt_volume_key_get; + crypt_volume_key_verify; + crypt_volume_key_keyring; + crypt_status; + crypt_dump; + crypt_benchmark; + crypt_benchmark_pbkdf; + crypt_get_cipher; + crypt_get_cipher_mode; + crypt_get_integrity_info; + crypt_get_uuid; + crypt_set_data_offset; + crypt_get_data_offset; + crypt_get_iv_offset; + crypt_get_volume_key_size; + crypt_get_device_name; + crypt_get_metadata_device_name; + crypt_get_metadata_size; + crypt_set_metadata_size; + crypt_get_verity_info; + crypt_get_sector_size; + + crypt_get_type; + crypt_get_default_type; + crypt_get_active_device; + crypt_get_active_integrity_failures; + crypt_persistent_flags_set; + crypt_persistent_flags_get; + + crypt_set_rng_type; + crypt_get_rng_type; + crypt_set_pbkdf_type; + crypt_get_pbkdf_type; + crypt_get_pbkdf_type_params; + crypt_get_pbkdf_default; + + crypt_keyslot_max; + crypt_keyslot_area; + crypt_keyslot_status; + crypt_keyslot_get_key_size; + crypt_keyslot_set_encryption; + crypt_keyslot_get_encryption; + crypt_keyslot_get_pbkdf; + + crypt_get_dir; + crypt_set_debug_level; + crypt_log; + + crypt_header_backup; + crypt_header_restore; + + crypt_keyfile_read; + crypt_keyfile_device_read; + + crypt_wipe; + + crypt_reencrypt_init_by_passphrase; + crypt_reencrypt_init_by_keyring; + crypt_reencrypt; + crypt_reencrypt_status; + + crypt_safe_alloc; + crypt_safe_realloc; + crypt_safe_free; + crypt_safe_memzero; + local: + *; +}; diff --git a/lib/libdevmapper.c b/lib/libdevmapper.c new file mode 100644 index 0000000..62e084f --- /dev/null +++ b/lib/libdevmapper.c @@ -0,0 +1,3165 @@ +/* + * libdevmapper - device-mapper backend for cryptsetup + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef HAVE_SYS_SYSMACROS_H +# include /* for major, minor */ +#endif +#include +#include "internal.h" + +#define DM_UUID_LEN 129 +#define DM_BY_ID_PREFIX "dm-uuid-" +#define DM_BY_ID_PREFIX_LEN 8 +#define DM_UUID_PREFIX "CRYPT-" +#define DM_UUID_PREFIX_LEN 6 +#define DM_CRYPT_TARGET "crypt" +#define DM_VERITY_TARGET "verity" +#define DM_INTEGRITY_TARGET "integrity" +#define DM_LINEAR_TARGET "linear" +#define DM_ERROR_TARGET "error" +#define DM_ZERO_TARGET "zero" +#define RETRY_COUNT 5 + +/* Set if DM target versions were probed */ +static bool _dm_ioctl_checked = false; +static bool _dm_crypt_checked = false; +static bool _dm_verity_checked = false; +static bool _dm_integrity_checked = false; + +static int _quiet_log = 0; +static uint32_t _dm_flags = 0; + +static struct crypt_device *_context = NULL; +static int _dm_use_count = 0; + +/* Check if we have DM flag to instruct kernel to force wipe buffers */ +#if !HAVE_DECL_DM_TASK_SECURE_DATA +static int dm_task_secure_data(struct dm_task *dmt) { return 1; } +#endif + +/* Compatibility for old device-mapper without udev support */ +#if HAVE_DECL_DM_UDEV_DISABLE_DISK_RULES_FLAG +#define CRYPT_TEMP_UDEV_FLAGS DM_UDEV_DISABLE_SUBSYSTEM_RULES_FLAG | \ + DM_UDEV_DISABLE_DISK_RULES_FLAG | \ + DM_UDEV_DISABLE_OTHER_RULES_FLAG +#define _dm_task_set_cookie dm_task_set_cookie +#define _dm_udev_wait dm_udev_wait +#else +#define CRYPT_TEMP_UDEV_FLAGS 0 +static int _dm_task_set_cookie(struct dm_task *dmt, uint32_t *cookie, uint16_t flags) { return 0; } +static int _dm_udev_wait(uint32_t cookie) { return 0; }; +#endif + +static int _dm_use_udev(void) +{ +#ifdef USE_UDEV /* cannot be enabled if devmapper is too old */ + return dm_udev_get_sync_support(); +#else + return 0; +#endif +} + +__attribute__((format(printf, 4, 5))) +static void set_dm_error(int level, + const char *file __attribute__((unused)), + int line __attribute__((unused)), + const char *f, ...) +{ + char *msg = NULL; + va_list va; + + va_start(va, f); + if (vasprintf(&msg, f, va) > 0) { + if (level < 4 && !_quiet_log) { + log_err(_context, "%s", msg); + } else { + /* We do not use DM visual stack backtrace here */ + if (strncmp(msg, "", 11)) + log_dbg(_context, "%s", msg); + } + } + free(msg); + va_end(va); +} + +static int _dm_satisfies_version(unsigned target_maj, unsigned target_min, unsigned target_patch, + unsigned actual_maj, unsigned actual_min, unsigned actual_patch) +{ + if (actual_maj > target_maj) + return 1; + + if (actual_maj == target_maj && actual_min > target_min) + return 1; + + if (actual_maj == target_maj && actual_min == target_min && actual_patch >= target_patch) + return 1; + + return 0; +} + +static void _dm_set_crypt_compat(struct crypt_device *cd, + unsigned crypt_maj, + unsigned crypt_min, + unsigned crypt_patch) +{ + if (_dm_crypt_checked || crypt_maj == 0) + return; + + log_dbg(cd, "Detected dm-crypt version %i.%i.%i.", + crypt_maj, crypt_min, crypt_patch); + + if (_dm_satisfies_version(1, 2, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_KEY_WIPE_SUPPORTED; + else + log_dbg(cd, "Suspend and resume disabled, no wipe key support."); + + if (_dm_satisfies_version(1, 10, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_LMK_SUPPORTED; + + /* not perfect, 2.6.33 supports with 1.7.0 */ + if (_dm_satisfies_version(1, 8, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_PLAIN64_SUPPORTED; + + if (_dm_satisfies_version(1, 11, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_DISCARDS_SUPPORTED; + + if (_dm_satisfies_version(1, 13, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_TCW_SUPPORTED; + + if (_dm_satisfies_version(1, 14, 0, crypt_maj, crypt_min, crypt_patch)) { + _dm_flags |= DM_SAME_CPU_CRYPT_SUPPORTED; + _dm_flags |= DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED; + } + + if (_dm_satisfies_version(1, 18, 1, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_KERNEL_KEYRING_SUPPORTED; + + if (_dm_satisfies_version(1, 17, 0, crypt_maj, crypt_min, crypt_patch)) { + _dm_flags |= DM_SECTOR_SIZE_SUPPORTED; + _dm_flags |= DM_CAPI_STRING_SUPPORTED; + } + + if (_dm_satisfies_version(1, 19, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_BITLK_EBOIV_SUPPORTED; + + if (_dm_satisfies_version(1, 20, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_BITLK_ELEPHANT_SUPPORTED; + + if (_dm_satisfies_version(1, 22, 0, crypt_maj, crypt_min, crypt_patch)) + _dm_flags |= DM_CRYPT_NO_WORKQUEUE_SUPPORTED; + + _dm_crypt_checked = true; +} + +static void _dm_set_verity_compat(struct crypt_device *cd, + unsigned verity_maj, + unsigned verity_min, + unsigned verity_patch) +{ + if (_dm_verity_checked || verity_maj == 0) + return; + + log_dbg(cd, "Detected dm-verity version %i.%i.%i.", + verity_maj, verity_min, verity_patch); + + _dm_flags |= DM_VERITY_SUPPORTED; + + /* + * ignore_corruption, restart_on corruption is available since 1.2 (kernel 4.1) + * ignore_zero_blocks since 1.3 (kernel 4.5) + * (but some dm-verity targets 1.2 don't support it) + * FEC is added in 1.3 as well. + * Check at most once is added in 1.4 (kernel 4.17). + */ + if (_dm_satisfies_version(1, 3, 0, verity_maj, verity_min, verity_patch)) { + _dm_flags |= DM_VERITY_ON_CORRUPTION_SUPPORTED; + _dm_flags |= DM_VERITY_FEC_SUPPORTED; + } + + if (_dm_satisfies_version(1, 5, 0, verity_maj, verity_min, verity_patch)) + _dm_flags |= DM_VERITY_SIGNATURE_SUPPORTED; + + if (_dm_satisfies_version(1, 7, 0, verity_maj, verity_min, verity_patch)) + _dm_flags |= DM_VERITY_PANIC_CORRUPTION_SUPPORTED; + + _dm_verity_checked = true; +} + +static void _dm_set_integrity_compat(struct crypt_device *cd, + unsigned integrity_maj, + unsigned integrity_min, + unsigned integrity_patch) +{ + if (_dm_integrity_checked || integrity_maj == 0) + return; + + log_dbg(cd, "Detected dm-integrity version %i.%i.%i.", + integrity_maj, integrity_min, integrity_patch); + + _dm_flags |= DM_INTEGRITY_SUPPORTED; + + if (_dm_satisfies_version(1, 2, 0, integrity_maj, integrity_min, integrity_patch)) + _dm_flags |= DM_INTEGRITY_RECALC_SUPPORTED; + + if (_dm_satisfies_version(1, 3, 0, integrity_maj, integrity_min, integrity_patch)) + _dm_flags |= DM_INTEGRITY_BITMAP_SUPPORTED; + + if (_dm_satisfies_version(1, 4, 0, integrity_maj, integrity_min, integrity_patch)) + _dm_flags |= DM_INTEGRITY_FIX_PADDING_SUPPORTED; + + if (_dm_satisfies_version(1, 6, 0, integrity_maj, integrity_min, integrity_patch)) + _dm_flags |= DM_INTEGRITY_DISCARDS_SUPPORTED; + + if (_dm_satisfies_version(1, 7, 0, integrity_maj, integrity_min, integrity_patch)) + _dm_flags |= DM_INTEGRITY_FIX_HMAC_SUPPORTED; + + _dm_integrity_checked = true; +} + +/* We use this for loading target module */ +static void _dm_check_target(dm_target_type target_type) +{ +#if HAVE_DECL_DM_DEVICE_GET_TARGET_VERSION + struct dm_task *dmt; + const char *target_name = NULL; + + if (!(_dm_flags & DM_GET_TARGET_VERSION_SUPPORTED)) + return; + + if (target_type == DM_CRYPT) + target_name = DM_CRYPT_TARGET; + else if (target_type == DM_VERITY) + target_name = DM_VERITY_TARGET; + else if (target_type == DM_INTEGRITY) + target_name = DM_INTEGRITY_TARGET; + else + return; + + if (!(dmt = dm_task_create(DM_DEVICE_GET_TARGET_VERSION))) + goto out; + + if (!dm_task_set_name(dmt, target_name)) + goto out; + + if (!dm_task_run(dmt)) + goto out; +out: + if (dmt) + dm_task_destroy(dmt); +#endif +} + +static int _dm_check_versions(struct crypt_device *cd, dm_target_type target_type) +{ + struct dm_task *dmt; + struct dm_versions *target, *last_target; + char dm_version[16]; + unsigned dm_maj, dm_min, dm_patch; + int r = 0; + + if ((target_type == DM_CRYPT && _dm_crypt_checked) || + (target_type == DM_VERITY && _dm_verity_checked) || + (target_type == DM_INTEGRITY && _dm_integrity_checked) || + (target_type == DM_LINEAR) || (target_type == DM_ZERO) || + (_dm_crypt_checked && _dm_verity_checked && _dm_integrity_checked)) + return 1; + + /* Shut up DM while checking */ + _quiet_log = 1; + + _dm_check_target(target_type); + + /* FIXME: add support to DM so it forces crypt target module load here */ + if (!(dmt = dm_task_create(DM_DEVICE_LIST_VERSIONS))) + goto out; + + if (!dm_task_run(dmt)) + goto out; + + if (!dm_task_get_driver_version(dmt, dm_version, sizeof(dm_version))) + goto out; + + if (!_dm_ioctl_checked) { + if (sscanf(dm_version, "%u.%u.%u", &dm_maj, &dm_min, &dm_patch) != 3) + goto out; + log_dbg(cd, "Detected dm-ioctl version %u.%u.%u.", dm_maj, dm_min, dm_patch); + + if (_dm_satisfies_version(4, 20, 0, dm_maj, dm_min, dm_patch)) + _dm_flags |= DM_SECURE_SUPPORTED; +#if HAVE_DECL_DM_TASK_DEFERRED_REMOVE + if (_dm_satisfies_version(4, 27, 0, dm_maj, dm_min, dm_patch)) + _dm_flags |= DM_DEFERRED_SUPPORTED; +#endif +#if HAVE_DECL_DM_DEVICE_GET_TARGET_VERSION + if (_dm_satisfies_version(4, 41, 0, dm_maj, dm_min, dm_patch)) + _dm_flags |= DM_GET_TARGET_VERSION_SUPPORTED; +#endif + } + + target = dm_task_get_versions(dmt); + do { + last_target = target; + if (!strcmp(DM_CRYPT_TARGET, target->name)) { + _dm_set_crypt_compat(cd, (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } else if (!strcmp(DM_VERITY_TARGET, target->name)) { + _dm_set_verity_compat(cd, (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } else if (!strcmp(DM_INTEGRITY_TARGET, target->name)) { + _dm_set_integrity_compat(cd, (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } + target = (struct dm_versions *)((char *) target + target->next); + } while (last_target != target); + + r = 1; + if (!_dm_ioctl_checked) + log_dbg(cd, "Device-mapper backend running with UDEV support %sabled.", + _dm_use_udev() ? "en" : "dis"); + + _dm_ioctl_checked = true; +out: + if (dmt) + dm_task_destroy(dmt); + + _quiet_log = 0; + return r; +} + +int dm_flags(struct crypt_device *cd, dm_target_type target, uint32_t *flags) +{ + _dm_check_versions(cd, target); + *flags = _dm_flags; + + if (target == DM_UNKNOWN && + _dm_crypt_checked && _dm_verity_checked && _dm_integrity_checked) + return 0; + + if ((target == DM_CRYPT && _dm_crypt_checked) || + (target == DM_VERITY && _dm_verity_checked) || + (target == DM_INTEGRITY && _dm_integrity_checked) || + (target == DM_LINEAR) || (target == DM_ZERO)) /* nothing to check */ + return 0; + + return -ENODEV; +} + +/* This doesn't run any kernel checks, just set up userspace libdevmapper */ +void dm_backend_init(struct crypt_device *cd) +{ + if (!_dm_use_count++) { + log_dbg(cd, "Initialising device-mapper backend library."); + dm_log_init(set_dm_error); + dm_log_init_verbose(10); + } +} + +void dm_backend_exit(struct crypt_device *cd) +{ + if (_dm_use_count && (!--_dm_use_count)) { + log_dbg(cd, "Releasing device-mapper backend."); + dm_log_init_verbose(0); + dm_log_init(NULL); + dm_lib_release(); + } +} + +/* + * libdevmapper is not context friendly, switch context on every DM call. + * FIXME: this is not safe if called in parallel but neither is DM lib. + */ +static int dm_init_context(struct crypt_device *cd, dm_target_type target) +{ + _context = cd; + if (!_dm_check_versions(cd, target)) { + if (getuid() || geteuid()) + log_err(cd, _("Cannot initialize device-mapper, " + "running as non-root user.")); + else + log_err(cd, _("Cannot initialize device-mapper. " + "Is dm_mod kernel module loaded?")); + _context = NULL; + return -ENOTSUP; + } + return 0; +} +static void dm_exit_context(void) +{ + _context = NULL; +} + +/* Return path to DM device */ +char *dm_device_path(const char *prefix, int major, int minor) +{ + struct dm_task *dmt; + const char *name; + char path[PATH_MAX]; + + if (!(dmt = dm_task_create(DM_DEVICE_STATUS))) + return NULL; + if (!dm_task_set_minor(dmt, minor) || + !dm_task_set_major(dmt, major) || + !dm_task_no_flush(dmt) || + !dm_task_run(dmt) || + !(name = dm_task_get_name(dmt))) { + dm_task_destroy(dmt); + return NULL; + } + + if (snprintf(path, sizeof(path), "%s%s", prefix ?: "", name) < 0) + path[0] = '\0'; + + dm_task_destroy(dmt); + + return strdup(path); +} + +char *dm_device_name(const char *path) +{ + struct stat st; + + if (stat(path, &st) < 0 || !S_ISBLK(st.st_mode)) + return NULL; + + return dm_device_path(NULL, major(st.st_rdev), minor(st.st_rdev)); +} + +static void hex_key(char *hexkey, size_t key_size, const char *key) +{ + unsigned i; + + for(i = 0; i < key_size; i++) + sprintf(&hexkey[i * 2], "%02x", (unsigned char)key[i]); +} + +static size_t int_log10(uint64_t x) +{ + uint64_t r = 0; + for (x /= 10; x > 0; x /= 10) + r++; + return r; +} + +#define CLEN 64 /* 2*MAX_CIPHER_LEN */ +#define CLENS "63" /* for sscanf length + '\0' */ +#define CAPIL 144 /* should be enough to fit whole capi string */ +#define CAPIS "143" /* for sscanf of crypto API string + 16 + \0 */ + +static int cipher_c2dm(const char *org_c, const char *org_i, unsigned tag_size, + char *c_dm, int c_dm_size, + char *i_dm, int i_dm_size) +{ + int c_size = 0, i_size = 0, i; + char cipher[CLEN], mode[CLEN], iv[CLEN+1], tmp[CLEN]; + char capi[CAPIL]; + + if (!c_dm || !c_dm_size || !i_dm || !i_dm_size) + return -EINVAL; + + i = sscanf(org_c, "%" CLENS "[^-]-%" CLENS "s", cipher, tmp); + if (i != 2) + return -EINVAL; + + i = sscanf(tmp, "%" CLENS "[^-]-%" CLENS "s", mode, iv); + if (i == 1) { + memset(iv, 0, sizeof(iv)); + strncpy(iv, mode, sizeof(iv)-1); + *mode = '\0'; + if (snprintf(capi, sizeof(capi), "%s", cipher) < 0) + return -EINVAL; + } else if (i == 2) { + if (snprintf(capi, sizeof(capi), "%s(%s)", mode, cipher) < 0) + return -EINVAL; + } else + return -EINVAL; + + if (!org_i) { + /* legacy mode: CIPHER-MODE-IV*/ + i_size = snprintf(i_dm, i_dm_size, "%s", ""); + c_size = snprintf(c_dm, c_dm_size, "%s", org_c); + } else if (!strcmp(org_i, "none")) { + /* IV only: capi:MODE(CIPHER)-IV */ + i_size = snprintf(i_dm, i_dm_size, " integrity:%u:none", tag_size); + c_size = snprintf(c_dm, c_dm_size, "capi:%s-%s", capi, iv); + } else if (!strcmp(org_i, "aead") && !strcmp(mode, "ccm")) { + /* CCM AEAD: capi:rfc4309(MODE(CIPHER))-IV */ + i_size = snprintf(i_dm, i_dm_size, " integrity:%u:aead", tag_size); + c_size = snprintf(c_dm, c_dm_size, "capi:rfc4309(%s)-%s", capi, iv); + } else if (!strcmp(org_i, "aead")) { + /* AEAD: capi:MODE(CIPHER))-IV */ + i_size = snprintf(i_dm, i_dm_size, " integrity:%u:aead", tag_size); + c_size = snprintf(c_dm, c_dm_size, "capi:%s-%s", capi, iv); + } else if (!strcmp(org_i, "poly1305")) { + /* POLY1305 AEAD: capi:rfc7539(MODE(CIPHER),POLY1305)-IV */ + i_size = snprintf(i_dm, i_dm_size, " integrity:%u:aead", tag_size); + c_size = snprintf(c_dm, c_dm_size, "capi:rfc7539(%s,poly1305)-%s", capi, iv); + } else { + /* other AEAD: capi:authenc(,MODE(CIPHER))-IV */ + i_size = snprintf(i_dm, i_dm_size, " integrity:%u:aead", tag_size); + c_size = snprintf(c_dm, c_dm_size, "capi:authenc(%s,%s)-%s", org_i, capi, iv); + } + + if (c_size < 0 || c_size == c_dm_size) + return -EINVAL; + if (i_size < 0 || i_size == i_dm_size) + return -EINVAL; + + return 0; +} + +static int cipher_dm2c(char **org_c, char **org_i, const char *c_dm, const char *i_dm) +{ + char cipher[CLEN], mode[CLEN], iv[CLEN], auth[CLEN]; + char tmp[CAPIL], dmcrypt_tmp[CAPIL*2], capi[CAPIL+1]; + size_t len; + int i; + + if (!c_dm) + return -EINVAL; + + /* legacy mode */ + if (strncmp(c_dm, "capi:", 4)) { + if (!(*org_c = strdup(c_dm))) + return -ENOMEM; + *org_i = NULL; + return 0; + } + + /* modes with capi: prefix */ + i = sscanf(c_dm, "capi:%" CAPIS "[^-]-%" CLENS "s", tmp, iv); + if (i != 2) + return -EINVAL; + + len = strlen(tmp); + if (len < 2) + return -EINVAL; + + if (tmp[len-1] == ')') + tmp[len-1] = '\0'; + + if (sscanf(tmp, "rfc4309(%" CAPIS "s", capi) == 1) { + if (!(*org_i = strdup("aead"))) + return -ENOMEM; + } else if (sscanf(tmp, "rfc7539(%" CAPIS "[^,],%" CLENS "s", capi, auth) == 2) { + if (!(*org_i = strdup(auth))) + return -ENOMEM; + } else if (sscanf(tmp, "authenc(%" CLENS "[^,],%" CAPIS "s", auth, capi) == 2) { + if (!(*org_i = strdup(auth))) + return -ENOMEM; + } else { + if (i_dm) { + if (!(*org_i = strdup(i_dm))) + return -ENOMEM; + } else + *org_i = NULL; + memset(capi, 0, sizeof(capi)); + strncpy(capi, tmp, sizeof(capi)-1); + } + + i = sscanf(capi, "%" CLENS "[^(](%" CLENS "[^)])", mode, cipher); + if (i == 2) + i = snprintf(dmcrypt_tmp, sizeof(dmcrypt_tmp), "%s-%s-%s", cipher, mode, iv); + else + i = snprintf(dmcrypt_tmp, sizeof(dmcrypt_tmp), "%s-%s", capi, iv); + if (i < 0 || (size_t)i >= sizeof(dmcrypt_tmp)) { + free(*org_i); + *org_i = NULL; + return -EINVAL; + } + + if (!(*org_c = strdup(dmcrypt_tmp))) { + free(*org_i); + *org_i = NULL; + return -ENOMEM; + } + + return 0; +} + +static char *_uf(char *buf, size_t buf_size, const char *s, unsigned u) +{ + size_t r = snprintf(buf, buf_size, " %s:%u", s, u); + assert(r > 0 && r < buf_size); + return buf; +} + +/* https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt */ +static char *get_dm_crypt_params(const struct dm_target *tgt, uint32_t flags) +{ + int r, max_size, null_cipher = 0, num_options = 0, keystr_len = 0; + char *params = NULL, *hexkey = NULL; + char sector_feature[32], features[512], integrity_dm[256], cipher_dm[256]; + + if (!tgt) + return NULL; + + r = cipher_c2dm(tgt->u.crypt.cipher, tgt->u.crypt.integrity, tgt->u.crypt.tag_size, + cipher_dm, sizeof(cipher_dm), integrity_dm, sizeof(integrity_dm)); + if (r < 0) + return NULL; + + if (flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) + num_options++; + if (flags & CRYPT_ACTIVATE_SAME_CPU_CRYPT) + num_options++; + if (flags & CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS) + num_options++; + if (flags & CRYPT_ACTIVATE_NO_READ_WORKQUEUE) + num_options++; + if (flags & CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE) + num_options++; + if (flags & CRYPT_ACTIVATE_IV_LARGE_SECTORS) + num_options++; + if (tgt->u.crypt.integrity) + num_options++; + if (tgt->u.crypt.sector_size != SECTOR_SIZE) + num_options++; + + if (num_options) { /* MAX length int32 + 15 + 15 + 23 + 18 + 19 + 17 + 13 + int32 + integrity_str */ + r = snprintf(features, sizeof(features), " %d%s%s%s%s%s%s%s%s", num_options, + (flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) ? " allow_discards" : "", + (flags & CRYPT_ACTIVATE_SAME_CPU_CRYPT) ? " same_cpu_crypt" : "", + (flags & CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS) ? " submit_from_crypt_cpus" : "", + (flags & CRYPT_ACTIVATE_NO_READ_WORKQUEUE) ? " no_read_workqueue" : "", + (flags & CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE) ? " no_write_workqueue" : "", + (flags & CRYPT_ACTIVATE_IV_LARGE_SECTORS) ? " iv_large_sectors" : "", + (tgt->u.crypt.sector_size != SECTOR_SIZE) ? + _uf(sector_feature, sizeof(sector_feature), "sector_size", tgt->u.crypt.sector_size) : "", + integrity_dm); + if (r < 0 || (size_t)r >= sizeof(features)) + goto out; + } else + *features = '\0'; + + if (crypt_is_cipher_null(cipher_dm)) + null_cipher = 1; + + if (null_cipher) + hexkey = crypt_safe_alloc(2); + else if (flags & CRYPT_ACTIVATE_KEYRING_KEY) { + keystr_len = strlen(tgt->u.crypt.vk->key_description) + int_log10(tgt->u.crypt.vk->keylength) + 10; + hexkey = crypt_safe_alloc(keystr_len); + } else + hexkey = crypt_safe_alloc(tgt->u.crypt.vk->keylength * 2 + 1); + + if (!hexkey) + goto out; + + if (null_cipher) + strncpy(hexkey, "-", 2); + else if (flags & CRYPT_ACTIVATE_KEYRING_KEY) { + r = snprintf(hexkey, keystr_len, ":%zu:logon:%s", tgt->u.crypt.vk->keylength, tgt->u.crypt.vk->key_description); + if (r < 0 || r >= keystr_len) + goto out; + } else + hex_key(hexkey, tgt->u.crypt.vk->keylength, tgt->u.crypt.vk->key); + + max_size = strlen(hexkey) + strlen(cipher_dm) + + strlen(device_block_path(tgt->data_device)) + + strlen(features) + 64; + params = crypt_safe_alloc(max_size); + if (!params) + goto out; + + r = snprintf(params, max_size, "%s %s %" PRIu64 " %s %" PRIu64 "%s", + cipher_dm, hexkey, tgt->u.crypt.iv_offset, + device_block_path(tgt->data_device), tgt->u.crypt.offset, + features); + if (r < 0 || r >= max_size) { + crypt_safe_free(params); + params = NULL; + } +out: + crypt_safe_free(hexkey); + return params; +} + +/* https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity */ +static char *get_dm_verity_params(const struct dm_target *tgt, uint32_t flags) +{ + int max_size, max_fec_size, max_verify_size, r, num_options = 0; + struct crypt_params_verity *vp; + char *params = NULL, *hexroot = NULL, *hexsalt = NULL; + char features[256], *fec_features = NULL, *verity_verify_args = NULL; + + if (!tgt || !tgt->u.verity.vp) + return NULL; + + vp = tgt->u.verity.vp; + + /* These flags are not compatible */ + if ((flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) && + (flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION)) + flags &= ~CRYPT_ACTIVATE_RESTART_ON_CORRUPTION; + if ((flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) && + (flags & (CRYPT_ACTIVATE_RESTART_ON_CORRUPTION|CRYPT_ACTIVATE_PANIC_ON_CORRUPTION))) + flags &= ~CRYPT_ACTIVATE_IGNORE_CORRUPTION; + + if (flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) + num_options++; + if (flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) + num_options++; + if (flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION) + num_options++; + if (flags & CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS) + num_options++; + if (flags & CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) + num_options++; + + max_fec_size = (tgt->u.verity.fec_device ? strlen(device_block_path(tgt->u.verity.fec_device)) : 0) + 256; + fec_features = crypt_safe_alloc(max_fec_size); + if (!fec_features) + goto out; + + if (tgt->u.verity.fec_device) { /* MAX length 21 + path + 11 + int64 + 12 + int64 + 11 + int32 */ + num_options += 8; + r = snprintf(fec_features, max_fec_size, + " use_fec_from_device %s fec_start %" PRIu64 " fec_blocks %" PRIu64 " fec_roots %" PRIu32, + device_block_path(tgt->u.verity.fec_device), tgt->u.verity.fec_offset, + tgt->u.verity.fec_blocks, vp->fec_roots); + if (r < 0 || r >= max_fec_size) + goto out; + } else + *fec_features = '\0'; + + max_verify_size = (tgt->u.verity.root_hash_sig_key_desc ? strlen(tgt->u.verity.root_hash_sig_key_desc) : 0) + 32; + verity_verify_args = crypt_safe_alloc(max_verify_size); + if (!verity_verify_args) + goto out; + if (tgt->u.verity.root_hash_sig_key_desc) { /* MAX length 24 + key_str */ + num_options += 2; + r = snprintf(verity_verify_args, max_verify_size, + " root_hash_sig_key_desc %s", tgt->u.verity.root_hash_sig_key_desc); + if (r < 0 || r >= max_verify_size) + goto out; + } else + *verity_verify_args = '\0'; + + if (num_options) { /* MAX length int32 + 18 + 22 + 20 + 19 + 19 */ + r = snprintf(features, sizeof(features), " %d%s%s%s%s%s", num_options, + (flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) ? " ignore_corruption" : "", + (flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) ? " restart_on_corruption" : "", + (flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION) ? " panic_on_corruption" : "", + (flags & CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS) ? " ignore_zero_blocks" : "", + (flags & CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) ? " check_at_most_once" : ""); + if (r < 0 || (size_t)r >= sizeof(features)) + goto out; + } else + *features = '\0'; + + hexroot = crypt_safe_alloc(tgt->u.verity.root_hash_size * 2 + 1); + if (!hexroot) + goto out; + hex_key(hexroot, tgt->u.verity.root_hash_size, tgt->u.verity.root_hash); + + hexsalt = crypt_safe_alloc(vp->salt_size ? vp->salt_size * 2 + 1 : 2); + if (!hexsalt) + goto out; + if (vp->salt_size) + hex_key(hexsalt, vp->salt_size, vp->salt); + else + strncpy(hexsalt, "-", 2); + + max_size = strlen(hexroot) + strlen(hexsalt) + + strlen(device_block_path(tgt->data_device)) + + strlen(device_block_path(tgt->u.verity.hash_device)) + + strlen(vp->hash_name) + strlen(features) + strlen(fec_features) + 128 + + strlen(verity_verify_args); + + params = crypt_safe_alloc(max_size); + if (!params) + goto out; + + r = snprintf(params, max_size, + "%u %s %s %u %u %" PRIu64 " %" PRIu64 " %s %s %s%s%s%s", + vp->hash_type, device_block_path(tgt->data_device), + device_block_path(tgt->u.verity.hash_device), + vp->data_block_size, vp->hash_block_size, + vp->data_size, tgt->u.verity.hash_offset, + vp->hash_name, hexroot, hexsalt, features, fec_features, + verity_verify_args); + if (r < 0 || r >= max_size) { + crypt_safe_free(params); + params = NULL; + } +out: + crypt_safe_free(fec_features); + crypt_safe_free(verity_verify_args); + crypt_safe_free(hexroot); + crypt_safe_free(hexsalt); + return params; +} + +static char *get_dm_integrity_params(const struct dm_target *tgt, uint32_t flags) +{ + int r, max_size, max_integrity, max_journal_integrity, max_journal_crypt, num_options = 0; + char *params_out = NULL, *params, *hexkey, mode, feature[6][32]; + char *features, *integrity, *journal_integrity, *journal_crypt; + + if (!tgt) + return NULL; + + max_integrity = (tgt->u.integrity.integrity && tgt->u.integrity.vk ? tgt->u.integrity.vk->keylength * 2 : 0) + + (tgt->u.integrity.integrity ? strlen(tgt->u.integrity.integrity) : 0) + 32; + max_journal_integrity = (tgt->u.integrity.journal_integrity && tgt->u.integrity.journal_integrity_key ? + tgt->u.integrity.journal_integrity_key->keylength * 2 : 0) + + (tgt->u.integrity.journal_integrity ? strlen(tgt->u.integrity.journal_integrity) : 0) + 32; + max_journal_crypt = (tgt->u.integrity.journal_crypt && tgt->u.integrity.journal_crypt_key ? + tgt->u.integrity.journal_crypt_key->keylength * 2 : 0) + + (tgt->u.integrity.journal_crypt ? strlen(tgt->u.integrity.journal_crypt) : 0) + 32; + max_size = strlen(device_block_path(tgt->data_device)) + + (tgt->u.integrity.meta_device ? strlen(device_block_path(tgt->u.integrity.meta_device)) : 0) + + max_integrity + max_journal_integrity + max_journal_crypt + 512; + + params = crypt_safe_alloc(max_size); + features = crypt_safe_alloc(max_size); + integrity = crypt_safe_alloc(max_integrity); + journal_integrity = crypt_safe_alloc(max_journal_integrity); + journal_crypt = crypt_safe_alloc(max_journal_crypt); + if (!params || !features || !integrity || !journal_integrity || !journal_crypt) + goto out; + + if (tgt->u.integrity.integrity) { /* MAX length 16 + str_integrity + str_key */ + num_options++; + + if (tgt->u.integrity.vk) { + hexkey = crypt_safe_alloc(tgt->u.integrity.vk->keylength * 2 + 1); + if (!hexkey) + goto out; + hex_key(hexkey, tgt->u.integrity.vk->keylength, tgt->u.integrity.vk->key); + } else + hexkey = NULL; + + r = snprintf(integrity, max_integrity, " internal_hash:%s%s%s", + tgt->u.integrity.integrity, hexkey ? ":" : "", hexkey ?: ""); + crypt_safe_free(hexkey); + if (r < 0 || r >= max_integrity) + goto out; + } + + if (tgt->u.integrity.journal_integrity) { /* MAX length 14 + str_journal_integrity + str_key */ + num_options++; + + if (tgt->u.integrity.journal_integrity_key) { + hexkey = crypt_safe_alloc(tgt->u.integrity.journal_integrity_key->keylength * 2 + 1); + if (!hexkey) + goto out; + hex_key(hexkey, tgt->u.integrity.journal_integrity_key->keylength, + tgt->u.integrity.journal_integrity_key->key); + } else + hexkey = NULL; + + r = snprintf(journal_integrity, max_journal_integrity, " journal_mac:%s%s%s", + tgt->u.integrity.journal_integrity, hexkey ? ":" : "", hexkey ?: ""); + crypt_safe_free(hexkey); + if (r < 0 || r >= max_journal_integrity) + goto out; + } + + if (tgt->u.integrity.journal_crypt) { /* MAX length 15 + str_journal_crypt + str_key */ + num_options++; + + if (tgt->u.integrity.journal_crypt_key) { + hexkey = crypt_safe_alloc(tgt->u.integrity.journal_crypt_key->keylength * 2 + 1); + if (!hexkey) + goto out; + hex_key(hexkey, tgt->u.integrity.journal_crypt_key->keylength, + tgt->u.integrity.journal_crypt_key->key); + } else + hexkey = NULL; + + r = snprintf(journal_crypt, max_journal_crypt, " journal_crypt:%s%s%s", + tgt->u.integrity.journal_crypt, hexkey ? ":" : "", hexkey ?: ""); + crypt_safe_free(hexkey); + if (r < 0 || r >= max_journal_crypt) + goto out; + } + + if (tgt->u.integrity.journal_size) + num_options++; + if (tgt->u.integrity.journal_watermark) + num_options++; + if (tgt->u.integrity.journal_commit_time) + num_options++; + if (tgt->u.integrity.interleave_sectors) + num_options++; + if (tgt->u.integrity.sector_size) + num_options++; + if (tgt->u.integrity.buffer_sectors) + num_options++; + if (tgt->u.integrity.fix_padding) + num_options++; + if (tgt->u.integrity.fix_hmac) + num_options++; + if (tgt->u.integrity.legacy_recalc) + num_options++; + if (tgt->u.integrity.meta_device) + num_options++; + if (flags & CRYPT_ACTIVATE_RECALCULATE) + num_options++; + if (flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) + num_options++; + + r = snprintf(features, max_size, "%d%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s", num_options, + tgt->u.integrity.journal_size ? _uf(feature[0], sizeof(feature[0]), /* MAX length 17 + int32 */ + "journal_sectors", (unsigned)(tgt->u.integrity.journal_size / SECTOR_SIZE)) : "", + tgt->u.integrity.journal_watermark ? _uf(feature[1], sizeof(feature[1]), /* MAX length 19 + int32 */ + /* bitmap overloaded values */ + (flags & CRYPT_ACTIVATE_NO_JOURNAL_BITMAP) ? "sectors_per_bit" : "journal_watermark", + tgt->u.integrity.journal_watermark) : "", + tgt->u.integrity.journal_commit_time ? _uf(feature[2], sizeof(feature[2]), /* MAX length 23 + int32 */ + /* bitmap overloaded values */ + (flags & CRYPT_ACTIVATE_NO_JOURNAL_BITMAP) ? "bitmap_flush_interval" : "commit_time", + tgt->u.integrity.journal_commit_time) : "", + tgt->u.integrity.interleave_sectors ? _uf(feature[3], sizeof(feature[3]), /* MAX length 20 + int32 */ + "interleave_sectors", tgt->u.integrity.interleave_sectors) : "", + tgt->u.integrity.sector_size ? _uf(feature[4], sizeof(feature[4]), /* MAX length 12 + int32 */ + "block_size", tgt->u.integrity.sector_size) : "", + tgt->u.integrity.buffer_sectors ? _uf(feature[5], sizeof(feature[5]), /* MAX length 16 + int32 */ + "buffer_sectors", tgt->u.integrity.buffer_sectors) : "", + tgt->u.integrity.integrity ? integrity : "", + tgt->u.integrity.journal_integrity ? journal_integrity : "", + tgt->u.integrity.journal_crypt ? journal_crypt : "", + tgt->u.integrity.fix_padding ? " fix_padding" : "", /* MAX length 12 */ + tgt->u.integrity.fix_hmac ? " fix_hmac" : "", /* MAX length 9 */ + tgt->u.integrity.legacy_recalc ? " legacy_recalculate" : "", /* MAX length 19 */ + flags & CRYPT_ACTIVATE_RECALCULATE ? " recalculate" : "", /* MAX length 12 */ + flags & CRYPT_ACTIVATE_ALLOW_DISCARDS ? " allow_discards" : "", /* MAX length 15 */ + tgt->u.integrity.meta_device ? " meta_device:" : "", /* MAX length 13 + str_device */ + tgt->u.integrity.meta_device ? device_block_path(tgt->u.integrity.meta_device) : ""); + if (r < 0 || r >= max_size) + goto out; + + if (flags & CRYPT_ACTIVATE_NO_JOURNAL_BITMAP) + mode = 'B'; + else if (flags & CRYPT_ACTIVATE_RECOVERY) + mode = 'R'; + else if (flags & CRYPT_ACTIVATE_NO_JOURNAL) + mode = 'D'; + else + mode = 'J'; + + r = snprintf(params, max_size, "%s %" PRIu64 " %d %c %s", + device_block_path(tgt->data_device), tgt->u.integrity.offset, + tgt->u.integrity.tag_size, mode, features); + if (r < 0 || r >= max_size) + goto out; + + params_out = params; +out: + crypt_safe_free(features); + crypt_safe_free(integrity); + crypt_safe_free(journal_integrity); + crypt_safe_free(journal_crypt); + if (!params_out) + crypt_safe_free(params); + + return params_out; +} + +static char *get_dm_linear_params(const struct dm_target *tgt, uint32_t flags) +{ + char *params; + int r; + int max_size = strlen(device_block_path(tgt->data_device)) + int_log10(tgt->u.linear.offset) + 3; + + params = crypt_safe_alloc(max_size); + if (!params) + return NULL; + + r = snprintf(params, max_size, "%s %" PRIu64, + device_block_path(tgt->data_device), tgt->u.linear.offset); + + if (r < 0 || r >= max_size) { + crypt_safe_free(params); + params = NULL; + } + + return params; +} + +static char *get_dm_zero_params(const struct dm_target *tgt, uint32_t flags) +{ + char *params = crypt_safe_alloc(1); + if (!params) + return NULL; + + params[0] = 0; + return params; +} + +/* DM helpers */ +static int _dm_remove(const char *name, int udev_wait, int deferred) +{ + int r = 0; + struct dm_task *dmt; + uint32_t cookie = 0; + + if (!_dm_use_udev()) + udev_wait = 0; + + if (!(dmt = dm_task_create(DM_DEVICE_REMOVE))) + return 0; + + if (!dm_task_set_name(dmt, name)) + goto out; + +#if HAVE_DECL_DM_TASK_RETRY_REMOVE + if (!dm_task_retry_remove(dmt)) + goto out; +#endif +#if HAVE_DECL_DM_TASK_DEFERRED_REMOVE + if (deferred && !dm_task_deferred_remove(dmt)) + goto out; +#endif + if (udev_wait && !_dm_task_set_cookie(dmt, &cookie, DM_UDEV_DISABLE_LIBRARY_FALLBACK)) + goto out; + + r = dm_task_run(dmt); + + if (udev_wait) + (void)_dm_udev_wait(cookie); +out: + dm_task_destroy(dmt); + return r; +} + +static int _dm_simple(int task, const char *name, uint32_t dmflags) +{ + int r = 0; + struct dm_task *dmt; + + if (!(dmt = dm_task_create(task))) + return 0; + + if (name && !dm_task_set_name(dmt, name)) + goto out; + + if (task == DM_DEVICE_SUSPEND && + (dmflags & DM_SUSPEND_SKIP_LOCKFS) && !dm_task_skip_lockfs(dmt)) + goto out; + + if (task == DM_DEVICE_SUSPEND && + (dmflags & DM_SUSPEND_NOFLUSH) && !dm_task_no_flush(dmt)) + goto out; + + r = dm_task_run(dmt); +out: + dm_task_destroy(dmt); + return r; +} + +static int _dm_resume_device(const char *name, uint32_t flags); + +static int _error_device(const char *name, size_t size) +{ + struct dm_task *dmt; + int r = 0; + + if (!(dmt = dm_task_create(DM_DEVICE_RELOAD))) + return 0; + + if (!dm_task_set_name(dmt, name)) + goto error; + + if (!dm_task_add_target(dmt, UINT64_C(0), size, "error", "")) + goto error; + + if (!dm_task_set_ro(dmt)) + goto error; + + if (!dm_task_no_open_count(dmt)) + goto error; + + if (!dm_task_run(dmt)) + goto error; + + if (_dm_resume_device(name, 0)) { + _dm_simple(DM_DEVICE_CLEAR, name, 0); + goto error; + } + + r = 1; + +error: + dm_task_destroy(dmt); + return r; +} + +int dm_error_device(struct crypt_device *cd, const char *name) +{ + int r; + struct crypt_dm_active_device dmd; + + if (!name) + return -EINVAL; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + if ((dm_query_device(cd, name, 0, &dmd) >= 0) && _error_device(name, dmd.size)) + r = 0; + else + r = -EINVAL; + + dm_targets_free(cd, &dmd); + + dm_exit_context(); + + return r; +} + +int dm_clear_device(struct crypt_device *cd, const char *name) +{ + int r; + + if (!name) + return -EINVAL; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + if (_dm_simple(DM_DEVICE_CLEAR, name, 0)) + r = 0; + else + r = -EINVAL; + + dm_exit_context(); + + return r; +} + +int dm_remove_device(struct crypt_device *cd, const char *name, uint32_t flags) +{ + struct crypt_dm_active_device dmd = {}; + int r = -EINVAL; + int retries = (flags & CRYPT_DEACTIVATE_FORCE) ? RETRY_COUNT : 1; + int deferred = (flags & CRYPT_DEACTIVATE_DEFERRED) ? 1 : 0; + int error_target = 0; + uint32_t dmt_flags; + + if (!name) + return -EINVAL; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + if (deferred && !dm_flags(cd, DM_UNKNOWN, &dmt_flags) && !(dmt_flags & DM_DEFERRED_SUPPORTED)) { + log_err(cd, _("Requested deferred flag is not supported.")); + dm_exit_context(); + return -ENOTSUP; + } + + do { + r = _dm_remove(name, 1, deferred) ? 0 : -EINVAL; + if (--retries && r) { + log_dbg(cd, "WARNING: other process locked internal device %s, %s.", + name, retries ? "retrying remove" : "giving up"); + sleep(1); + if ((flags & CRYPT_DEACTIVATE_FORCE) && !error_target) { + /* If force flag is set, replace device with error, read-only target. + * it should stop processes from reading it and also removed underlying + * device from mapping, so it is usable again. + * Anyway, if some process try to read temporary cryptsetup device, + * it is bug - no other process should try touch it (e.g. udev). + */ + if (!dm_query_device(cd, name, 0, &dmd)) { + _error_device(name, dmd.size); + error_target = 1; + } + } + } + } while (r == -EINVAL && retries); + + dm_task_update_nodes(); + dm_exit_context(); + + return r; +} + +#define UUID_LEN 37 /* 36 + \0, libuuid ... */ +/* + * UUID has format: CRYPT--[-] + * CRYPT-PLAIN-name + * CRYPT-LUKS1-00000000000000000000000000000000-name + * CRYPT-TEMP-name + */ +static int dm_prepare_uuid(struct crypt_device *cd, const char *name, const char *type, + const char *uuid, char *buf, size_t buflen) +{ + char *ptr, uuid2[UUID_LEN] = {0}; + uuid_t uu; + int i = 0; + + /* Remove '-' chars */ + if (uuid) { + if (uuid_parse(uuid, uu) < 0) { + log_dbg(cd, "Requested UUID %s has invalid format.", uuid); + return 0; + } + + for (ptr = uuid2, i = 0; i < UUID_LEN; i++) + if (uuid[i] != '-') { + *ptr = uuid[i]; + ptr++; + } + } + + i = snprintf(buf, buflen, DM_UUID_PREFIX "%s%s%s%s%s", + type ?: "", type ? "-" : "", + uuid2[0] ? uuid2 : "", uuid2[0] ? "-" : "", + name); + if (i < 0) + return 0; + + log_dbg(cd, "DM-UUID is %s", buf); + if ((size_t)i >= buflen) + log_err(cd, _("DM-UUID for device %s was truncated."), name); + + return 1; +} + +int lookup_dm_dev_by_uuid(struct crypt_device *cd, const char *uuid, const char *type) +{ + int r; + char *c; + char dev_uuid[DM_UUID_LEN + DM_BY_ID_PREFIX_LEN] = DM_BY_ID_PREFIX; + + if (!dm_prepare_uuid(cd, "", type, uuid, dev_uuid + DM_BY_ID_PREFIX_LEN, DM_UUID_LEN)) + return -EINVAL; + + c = strrchr(dev_uuid, '-'); + if (!c) + return -EINVAL; + + /* cut of dm name */ + *c = '\0'; + + r = lookup_by_disk_id(dev_uuid); + if (r == -ENOENT) { + log_dbg(cd, "Search by disk id not available. Using sysfs instead."); + r = lookup_by_sysfs_uuid_field(dev_uuid + DM_BY_ID_PREFIX_LEN, DM_UUID_LEN); + } + + return r; +} + +static int _add_dm_targets(struct dm_task *dmt, struct crypt_dm_active_device *dmd) +{ + const char *target; + struct dm_target *tgt = &dmd->segment; + + do { + switch (tgt->type) { + case DM_CRYPT: + target = DM_CRYPT_TARGET; + break; + case DM_VERITY: + target = DM_VERITY_TARGET; + break; + case DM_INTEGRITY: + target = DM_INTEGRITY_TARGET; + break; + case DM_LINEAR: + target = DM_LINEAR_TARGET; + break; + case DM_ZERO: + target = DM_ZERO_TARGET; + break; + default: + return -ENOTSUP; + } + + if (!dm_task_add_target(dmt, tgt->offset, tgt->size, target, tgt->params)) + return -EINVAL; + + tgt = tgt->next; + } while (tgt); + + return 0; +} + +static void _destroy_dm_targets_params(struct crypt_dm_active_device *dmd) +{ + struct dm_target *t = &dmd->segment; + + do { + crypt_safe_free(t->params); + t->params = NULL; + t = t->next; + } while (t); +} + +static int _create_dm_targets_params(struct crypt_dm_active_device *dmd) +{ + int r; + struct dm_target *tgt = &dmd->segment; + + do { + if (tgt->type == DM_CRYPT) + tgt->params = get_dm_crypt_params(tgt, dmd->flags); + else if (tgt->type == DM_VERITY) + tgt->params = get_dm_verity_params(tgt, dmd->flags); + else if (tgt->type == DM_INTEGRITY) + tgt->params = get_dm_integrity_params(tgt, dmd->flags); + else if (tgt->type == DM_LINEAR) + tgt->params = get_dm_linear_params(tgt, dmd->flags); + else if (tgt->type == DM_ZERO) + tgt->params = get_dm_zero_params(tgt, dmd->flags); + else { + r = -ENOTSUP; + goto err; + } + + if (!tgt->params) { + r = -EINVAL; + goto err; + } + tgt = tgt->next; + } while (tgt); + + return 0; +err: + _destroy_dm_targets_params(dmd); + return r; +} + +static bool dm_device_exists(struct crypt_device *cd, const char *name) +{ + int r = dm_status_device(cd, name); + return (r >= 0 || r == -EEXIST); +} + +static int _dm_create_device(struct crypt_device *cd, const char *name, const char *type, + const char *uuid, struct crypt_dm_active_device *dmd) +{ + struct dm_task *dmt = NULL; + struct dm_info dmi; + char dev_uuid[DM_UUID_LEN] = {0}; + int r = -EINVAL; + uint32_t cookie = 0, read_ahead = 0; + uint16_t udev_flags = DM_UDEV_DISABLE_LIBRARY_FALLBACK; + + if (dmd->flags & CRYPT_ACTIVATE_PRIVATE) + udev_flags |= CRYPT_TEMP_UDEV_FLAGS; + + /* All devices must have DM_UUID, only resize on old device is exception */ + if (!dm_prepare_uuid(cd, name, type, dmd->uuid, dev_uuid, sizeof(dev_uuid))) + goto out; + + if (!(dmt = dm_task_create(DM_DEVICE_CREATE))) + goto out; + + if (!dm_task_set_name(dmt, name)) + goto out; + + if (!dm_task_set_uuid(dmt, dev_uuid)) + goto out; + + if (!dm_task_secure_data(dmt)) + goto out; + if ((dmd->flags & CRYPT_ACTIVATE_READONLY) && !dm_task_set_ro(dmt)) + goto out; + + r = _create_dm_targets_params(dmd); + if (r) + goto out; + + r = _add_dm_targets(dmt, dmd); + if (r) + goto out; + + r = -EINVAL; + +#ifdef DM_READ_AHEAD_MINIMUM_FLAG + if (device_read_ahead(dmd->segment.data_device, &read_ahead) && + !dm_task_set_read_ahead(dmt, read_ahead, DM_READ_AHEAD_MINIMUM_FLAG)) + goto out; +#endif + if (_dm_use_udev() && !_dm_task_set_cookie(dmt, &cookie, udev_flags)) + goto out; + + if (!dm_task_run(dmt)) { + if (dm_device_exists(cd, name)) + r = -EEXIST; + goto out; + } + + if (dm_task_get_info(dmt, &dmi)) + r = 0; + + if (_dm_use_udev()) { + (void)_dm_udev_wait(cookie); + cookie = 0; + } + + if (r < 0) + _dm_remove(name, 1, 0); + +out: + if (cookie && _dm_use_udev()) + (void)_dm_udev_wait(cookie); + + if (dmt) + dm_task_destroy(dmt); + + dm_task_update_nodes(); + + /* If code just loaded target module, update versions */ + _dm_check_versions(cd, dmd->segment.type); + + _destroy_dm_targets_params(dmd); + + return r; +} + +static int _dm_resume_device(const char *name, uint32_t dmflags) +{ + struct dm_task *dmt; + int r = -EINVAL; + uint32_t cookie = 0; + uint16_t udev_flags = DM_UDEV_DISABLE_LIBRARY_FALLBACK; + + if (dmflags & DM_RESUME_PRIVATE) + udev_flags |= CRYPT_TEMP_UDEV_FLAGS; + + if (!(dmt = dm_task_create(DM_DEVICE_RESUME))) + return r; + + if (!dm_task_set_name(dmt, name)) + goto out; + + if ((dmflags & DM_SUSPEND_SKIP_LOCKFS) && !dm_task_skip_lockfs(dmt)) + goto out; + + if ((dmflags & DM_SUSPEND_NOFLUSH) && !dm_task_no_flush(dmt)) + goto out; + + if (_dm_use_udev() && !_dm_task_set_cookie(dmt, &cookie, udev_flags)) + goto out; + + if (dm_task_run(dmt)) + r = 0; +out: + if (cookie && _dm_use_udev()) + (void)_dm_udev_wait(cookie); + + dm_task_destroy(dmt); + + dm_task_update_nodes(); + + return r; +} + +static int _dm_reload_device(struct crypt_device *cd, const char *name, + struct crypt_dm_active_device *dmd) +{ + int r = -EINVAL; + struct dm_task *dmt = NULL; + uint32_t read_ahead = 0; + + /* All devices must have DM_UUID, only resize on old device is exception */ + if (!(dmt = dm_task_create(DM_DEVICE_RELOAD))) + goto out; + + if (!dm_task_set_name(dmt, name)) + goto out; + + if (!dm_task_secure_data(dmt)) + goto out; + if ((dmd->flags & CRYPT_ACTIVATE_READONLY) && !dm_task_set_ro(dmt)) + goto out; + + r = _create_dm_targets_params(dmd); + if (r) + goto out; + + r = _add_dm_targets(dmt, dmd); + if (r) + goto out; + + r = -EINVAL; + +#ifdef DM_READ_AHEAD_MINIMUM_FLAG + if (device_read_ahead(dmd->segment.data_device, &read_ahead) && + !dm_task_set_read_ahead(dmt, read_ahead, DM_READ_AHEAD_MINIMUM_FLAG)) + goto out; +#endif + + if (dm_task_run(dmt)) + r = 0; +out: + if (dmt) + dm_task_destroy(dmt); + + /* If code just loaded target module, update versions */ + _dm_check_versions(cd, dmd->segment.type); + + _destroy_dm_targets_params(dmd); + + return r; +} + +static void crypt_free_verity_params(struct crypt_params_verity *vp) +{ + if (!vp) + return; + + free(CONST_CAST(void*)vp->hash_name); + free(CONST_CAST(void*)vp->data_device); + free(CONST_CAST(void*)vp->hash_device); + free(CONST_CAST(void*)vp->fec_device); + free(CONST_CAST(void*)vp->salt); + free(vp); +} + +static void _dm_target_free_query_path(struct crypt_device *cd, struct dm_target *tgt) +{ + switch(tgt->type) { + case DM_CRYPT: + crypt_free_volume_key(tgt->u.crypt.vk); + free(CONST_CAST(void*)tgt->u.crypt.cipher); + break; + case DM_INTEGRITY: + free(CONST_CAST(void*)tgt->u.integrity.integrity); + crypt_free_volume_key(tgt->u.integrity.vk); + + free(CONST_CAST(void*)tgt->u.integrity.journal_integrity); + crypt_free_volume_key(tgt->u.integrity.journal_integrity_key); + + free(CONST_CAST(void*)tgt->u.integrity.journal_crypt); + crypt_free_volume_key(tgt->u.integrity.journal_crypt_key); + + device_free(cd, tgt->u.integrity.meta_device); + break; + case DM_VERITY: + crypt_free_verity_params(tgt->u.verity.vp); + device_free(cd, tgt->u.verity.hash_device); + free(CONST_CAST(void*)tgt->u.verity.root_hash); + free(CONST_CAST(void*)tgt->u.verity.root_hash_sig_key_desc); + /* fall through */ + case DM_LINEAR: + /* fall through */ + case DM_ERROR: + /* fall through */ + case DM_ZERO: + break; + default: + log_err(cd, _("Unknown dm target type.")); + return; + } + + device_free(cd, tgt->data_device); +} + +static void _dm_target_erase(struct crypt_device *cd, struct dm_target *tgt) +{ + if (tgt->direction == TARGET_QUERY) + _dm_target_free_query_path(cd, tgt); + + if (tgt->type == DM_CRYPT) + free(CONST_CAST(void*)tgt->u.crypt.integrity); +} + +void dm_targets_free(struct crypt_device *cd, struct crypt_dm_active_device *dmd) +{ + struct dm_target *t = &dmd->segment, *next = t->next; + + _dm_target_erase(cd, t); + + while (next) { + t = next; + next = t->next; + _dm_target_erase(cd, t); + free(t); + } + + memset(&dmd->segment, 0, sizeof(dmd->segment)); +} + +int dm_targets_allocate(struct dm_target *first, unsigned count) +{ + if (!first || first->next || !count) + return -EINVAL; + + while (--count) { + first->next = crypt_zalloc(sizeof(*first)); + if (!first->next) + return -ENOMEM; + first = first->next; + } + + return 0; +} + +static int check_retry(struct crypt_device *cd, uint32_t *dmd_flags, uint32_t dmt_flags) +{ + int ret = 0; + + /* If discard not supported try to load without discard */ + if ((*dmd_flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) && + !(dmt_flags & DM_DISCARDS_SUPPORTED)) { + log_dbg(cd, "Discard/TRIM is not supported"); + *dmd_flags = *dmd_flags & ~CRYPT_ACTIVATE_ALLOW_DISCARDS; + ret = 1; + } + + /* If kernel keyring is not supported load key directly in dm-crypt */ + if ((*dmd_flags & CRYPT_ACTIVATE_KEYRING_KEY) && + !(dmt_flags & DM_KERNEL_KEYRING_SUPPORTED)) { + log_dbg(cd, "dm-crypt does not support kernel keyring"); + *dmd_flags = *dmd_flags & ~CRYPT_ACTIVATE_KEYRING_KEY; + ret = 1; + } + + /* Drop performance options if not supported */ + if ((*dmd_flags & (CRYPT_ACTIVATE_SAME_CPU_CRYPT | CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS)) && + !(dmt_flags & (DM_SAME_CPU_CRYPT_SUPPORTED | DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED))) { + log_dbg(cd, "dm-crypt does not support performance options"); + *dmd_flags = *dmd_flags & ~(CRYPT_ACTIVATE_SAME_CPU_CRYPT | CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS); + ret = 1; + } + + /* Drop no workqueue options if not supported */ + if ((*dmd_flags & (CRYPT_ACTIVATE_NO_READ_WORKQUEUE | CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE)) && + !(dmt_flags & DM_CRYPT_NO_WORKQUEUE_SUPPORTED)) { + log_dbg(cd, "dm-crypt does not support performance options"); + *dmd_flags = *dmd_flags & ~(CRYPT_ACTIVATE_NO_READ_WORKQUEUE | CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE); + ret = 1; + } + + return ret; +} + +int dm_create_device(struct crypt_device *cd, const char *name, + const char *type, + struct crypt_dm_active_device *dmd) +{ + uint32_t dmt_flags = 0; + int r = -EINVAL; + + if (!type || !dmd) + return -EINVAL; + + if (dm_init_context(cd, dmd->segment.type)) + return -ENOTSUP; + + r = _dm_create_device(cd, name, type, dmd->uuid, dmd); + + if (r < 0 && dm_flags(cd, dmd->segment.type, &dmt_flags)) + goto out; + + if (r && (dmd->segment.type == DM_CRYPT || dmd->segment.type == DM_LINEAR || dmd->segment.type == DM_ZERO) && + check_retry(cd, &dmd->flags, dmt_flags)) { + log_dbg(cd, "Retrying open without incompatible options."); + r = _dm_create_device(cd, name, type, dmd->uuid, dmd); + } + + /* + * Print warning if activating dm-crypt cipher_null device unless it's reencryption helper or + * keyslot encryption helper device (LUKS1 cipher_null devices). + */ + if (!r && !(dmd->flags & CRYPT_ACTIVATE_PRIVATE) && single_segment(dmd) && dmd->segment.type == DM_CRYPT && + crypt_is_cipher_null(dmd->segment.u.crypt.cipher)) + log_dbg(cd, "Activated dm-crypt device with cipher_null. Device is not encrypted."); + + if (r == -EINVAL && + dmd->flags & (CRYPT_ACTIVATE_SAME_CPU_CRYPT|CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS) && + !(dmt_flags & (DM_SAME_CPU_CRYPT_SUPPORTED|DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED))) + log_err(cd, _("Requested dm-crypt performance options are not supported.")); + + if (r == -EINVAL && + dmd->flags & (CRYPT_ACTIVATE_NO_READ_WORKQUEUE | CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE) && + !(dmt_flags & DM_CRYPT_NO_WORKQUEUE_SUPPORTED)) + log_err(cd, _("Requested dm-crypt performance options are not supported.")); + + if (r == -EINVAL && dmd->flags & (CRYPT_ACTIVATE_IGNORE_CORRUPTION| + CRYPT_ACTIVATE_RESTART_ON_CORRUPTION| + CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS| + CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) && + !(dmt_flags & DM_VERITY_ON_CORRUPTION_SUPPORTED)) + log_err(cd, _("Requested dm-verity data corruption handling options are not supported.")); + + if (r == -EINVAL && dmd->flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION && + !(dmt_flags & DM_VERITY_PANIC_CORRUPTION_SUPPORTED)) + log_err(cd, _("Requested dm-verity data corruption handling options are not supported.")); + + if (r == -EINVAL && dmd->segment.type == DM_VERITY && + dmd->segment.u.verity.fec_device && !(dmt_flags & DM_VERITY_FEC_SUPPORTED)) + log_err(cd, _("Requested dm-verity FEC options are not supported.")); + + if (r == -EINVAL && dmd->segment.type == DM_CRYPT) { + if (dmd->segment.u.crypt.integrity && !(dmt_flags & DM_INTEGRITY_SUPPORTED)) + log_err(cd, _("Requested data integrity options are not supported.")); + if (dmd->segment.u.crypt.sector_size != SECTOR_SIZE && !(dmt_flags & DM_SECTOR_SIZE_SUPPORTED)) + log_err(cd, _("Requested sector_size option is not supported.")); + } + + if (r == -EINVAL && dmd->segment.type == DM_INTEGRITY && (dmd->flags & CRYPT_ACTIVATE_RECALCULATE) && + !(dmt_flags & DM_INTEGRITY_RECALC_SUPPORTED)) + log_err(cd, _("Requested automatic recalculation of integrity tags is not supported.")); + + if (r == -EINVAL && dmd->segment.type == DM_INTEGRITY && (dmd->flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) && + !(dmt_flags & DM_INTEGRITY_DISCARDS_SUPPORTED)) + log_err(cd, _("Discard/TRIM is not supported.")); + + if (r == -EINVAL && dmd->segment.type == DM_INTEGRITY && (dmd->flags & CRYPT_ACTIVATE_NO_JOURNAL_BITMAP) && + !(dmt_flags & DM_INTEGRITY_BITMAP_SUPPORTED)) + log_err(cd, _("Requested dm-integrity bitmap mode is not supported.")); +out: + dm_exit_context(); + return r; +} + +int dm_reload_device(struct crypt_device *cd, const char *name, + struct crypt_dm_active_device *dmd, uint32_t dmflags, unsigned resume) +{ + int r; + uint32_t dmt_flags; + + if (!dmd) + return -EINVAL; + + if (dm_init_context(cd, dmd->segment.type)) + return -ENOTSUP; + + if (dm_flags(cd, DM_INTEGRITY, &dmt_flags) || !(dmt_flags & DM_INTEGRITY_RECALC_SUPPORTED)) + dmd->flags &= ~CRYPT_ACTIVATE_RECALCULATE; + + r = _dm_reload_device(cd, name, dmd); + + if (r == -EINVAL && (dmd->segment.type == DM_CRYPT || dmd->segment.type == DM_LINEAR)) { + if ((dmd->flags & (CRYPT_ACTIVATE_SAME_CPU_CRYPT|CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS)) && + !dm_flags(cd, DM_CRYPT, &dmt_flags) && !(dmt_flags & (DM_SAME_CPU_CRYPT_SUPPORTED | DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED))) + log_err(cd, _("Requested dm-crypt performance options are not supported.")); + if ((dmd->flags & (CRYPT_ACTIVATE_NO_READ_WORKQUEUE | CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE)) && + !dm_flags(cd, DM_CRYPT, &dmt_flags) && !(dmt_flags & DM_CRYPT_NO_WORKQUEUE_SUPPORTED)) + log_err(cd, _("Requested dm-crypt performance options are not supported.")); + if ((dmd->flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) && + !dm_flags(cd, DM_CRYPT, &dmt_flags) && !(dmt_flags & DM_DISCARDS_SUPPORTED)) + log_err(cd, _("Discard/TRIM is not supported.")); + if ((dmd->flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) && + !dm_flags(cd, DM_INTEGRITY, &dmt_flags) && !(dmt_flags & DM_INTEGRITY_DISCARDS_SUPPORTED)) + log_err(cd, _("Discard/TRIM is not supported.")); + } + + if (!r && resume) + r = _dm_resume_device(name, dmflags | act2dmflags(dmd->flags)); + + dm_exit_context(); + return r; +} + +static int dm_status_dmi(const char *name, struct dm_info *dmi, + const char *target, char **status_line) +{ + struct dm_task *dmt; + uint64_t start, length; + char *target_type, *params = NULL; + int r = -EINVAL; + + if (!(dmt = dm_task_create(DM_DEVICE_STATUS))) + goto out; + + if (!dm_task_no_flush(dmt)) + goto out; + + if (!dm_task_set_name(dmt, name)) + goto out; + + if (!dm_task_run(dmt)) + goto out; + + if (!dm_task_get_info(dmt, dmi)) + goto out; + + if (!dmi->exists) { + r = -ENODEV; + goto out; + } + + r = -EEXIST; + dm_get_next_target(dmt, NULL, &start, &length, + &target_type, ¶ms); + + if (!target_type || start != 0) + goto out; + + if (target && strcmp(target_type, target)) + goto out; + + /* for target == NULL check all supported */ + if (!target && (strcmp(target_type, DM_CRYPT_TARGET) && + strcmp(target_type, DM_VERITY_TARGET) && + strcmp(target_type, DM_INTEGRITY_TARGET) && + strcmp(target_type, DM_LINEAR_TARGET) && + strcmp(target_type, DM_ZERO_TARGET) && + strcmp(target_type, DM_ERROR_TARGET))) + goto out; + r = 0; +out: + if (!r && status_line && !(*status_line = strdup(params))) + r = -ENOMEM; + + if (dmt) + dm_task_destroy(dmt); + + return r; +} + +int dm_status_device(struct crypt_device *cd, const char *name) +{ + int r; + struct dm_info dmi; + struct stat st; + + /* libdevmapper is too clever and handles + * path argument differently with error. + * Fail early here if parameter is non-existent path. + */ + if (strchr(name, '/') && stat(name, &st) < 0) + return -ENODEV; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + r = dm_status_dmi(name, &dmi, NULL, NULL); + dm_exit_context(); + + if (r < 0) + return r; + + return (dmi.open_count > 0) ? 1 : 0; +} + +int dm_status_suspended(struct crypt_device *cd, const char *name) +{ + int r; + struct dm_info dmi; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + r = dm_status_dmi(name, &dmi, NULL, NULL); + dm_exit_context(); + + if (r < 0) + return r; + + return dmi.suspended ? 1 : 0; +} + +static int _dm_status_verity_ok(struct crypt_device *cd, const char *name) +{ + int r; + struct dm_info dmi; + char *status_line = NULL; + + r = dm_status_dmi(name, &dmi, DM_VERITY_TARGET, &status_line); + if (r < 0 || !status_line) { + free(status_line); + return r; + } + + log_dbg(cd, "Verity volume %s status is %s.", name, status_line ?: ""); + r = status_line[0] == 'V' ? 1 : 0; + free(status_line); + + return r; +} + +int dm_status_verity_ok(struct crypt_device *cd, const char *name) +{ + int r; + + if (dm_init_context(cd, DM_VERITY)) + return -ENOTSUP; + r = _dm_status_verity_ok(cd, name); + dm_exit_context(); + return r; +} + +int dm_status_integrity_failures(struct crypt_device *cd, const char *name, uint64_t *count) +{ + int r; + struct dm_info dmi; + char *status_line = NULL; + + if (dm_init_context(cd, DM_INTEGRITY)) + return -ENOTSUP; + + r = dm_status_dmi(name, &dmi, DM_INTEGRITY_TARGET, &status_line); + if (r < 0 || !status_line) { + free(status_line); + dm_exit_context(); + return r; + } + + log_dbg(cd, "Integrity volume %s failure status is %s.", name, status_line ?: ""); + *count = strtoull(status_line, NULL, 10); + free(status_line); + dm_exit_context(); + + return 0; +} + +/* FIXME use hex wrapper, user val wrappers for line parsing */ +static int _dm_target_query_crypt(struct crypt_device *cd, uint32_t get_flags, + char *params, struct dm_target *tgt, + uint32_t *act_flags) +{ + uint64_t val64; + char *rcipher, *rintegrity, *key_, *rdevice, *endp, buffer[3], *arg, *key_desc; + unsigned int i, val; + int r; + size_t key_size; + struct device *data_device = NULL; + char *cipher = NULL, *integrity = NULL; + struct volume_key *vk = NULL; + + tgt->type = DM_CRYPT; + tgt->direction = TARGET_QUERY; + tgt->u.crypt.sector_size = SECTOR_SIZE; + + r = -EINVAL; + + rcipher = strsep(¶ms, " "); + rintegrity = NULL; + + /* skip */ + key_ = strsep(¶ms, " "); + if (!params) + goto err; + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + params++; + + tgt->u.crypt.iv_offset = val64; + + /* device */ + rdevice = strsep(¶ms, " "); + if (get_flags & DM_ACTIVE_DEVICE) { + arg = crypt_lookup_dev(rdevice); + r = device_alloc(cd, &data_device, arg); + free(arg); + if (r < 0 && r != -ENOTBLK) + goto err; + } + + r = -EINVAL; + + /*offset */ + if (!params) + goto err; + val64 = strtoull(params, ¶ms, 10); + tgt->u.crypt.offset = val64; + + tgt->u.crypt.tag_size = 0; + + /* Features section, available since crypt target version 1.11 */ + if (*params) { + if (*params != ' ') + goto err; + params++; + + /* Number of arguments */ + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + params++; + + for (i = 0; i < val64; i++) { + if (!params) + goto err; + arg = strsep(¶ms, " "); + if (!strcasecmp(arg, "allow_discards")) + *act_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS; + else if (!strcasecmp(arg, "same_cpu_crypt")) + *act_flags |= CRYPT_ACTIVATE_SAME_CPU_CRYPT; + else if (!strcasecmp(arg, "submit_from_crypt_cpus")) + *act_flags |= CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS; + else if (!strcasecmp(arg, "no_read_workqueue")) + *act_flags |= CRYPT_ACTIVATE_NO_READ_WORKQUEUE; + else if (!strcasecmp(arg, "no_write_workqueue")) + *act_flags |= CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE; + else if (!strcasecmp(arg, "iv_large_sectors")) + *act_flags |= CRYPT_ACTIVATE_IV_LARGE_SECTORS; + else if (sscanf(arg, "integrity:%u:", &val) == 1) { + tgt->u.crypt.tag_size = val; + rintegrity = strchr(arg + strlen("integrity:"), ':'); + if (!rintegrity) + goto err; + rintegrity++; + } else if (sscanf(arg, "sector_size:%u", &val) == 1) { + tgt->u.crypt.sector_size = val; + } else /* unknown option */ + goto err; + } + + /* All parameters should be processed */ + if (params) + goto err; + } + + /* cipher */ + if (get_flags & DM_ACTIVE_CRYPT_CIPHER) { + r = cipher_dm2c(CONST_CAST(char**)&cipher, + CONST_CAST(char**)&integrity, + rcipher, rintegrity); + if (r < 0) + goto err; + } + + r = -EINVAL; + + if (key_[0] == ':') + *act_flags |= CRYPT_ACTIVATE_KEYRING_KEY; + + if (get_flags & DM_ACTIVE_CRYPT_KEYSIZE) { + /* we will trust kernel the key_string is in expected format */ + if (key_[0] == ':') { + if (sscanf(key_ + 1, "%zu", &key_size) != 1) + goto err; + } else + key_size = strlen(key_) / 2; + + vk = crypt_alloc_volume_key(key_size, NULL); + if (!vk) { + r = -ENOMEM; + goto err; + } + + if (get_flags & DM_ACTIVE_CRYPT_KEY) { + if (key_[0] == ':') { + /* ::: */ + key_desc = NULL; + endp = strpbrk(key_ + 1, ":"); + if (endp) + key_desc = strpbrk(endp + 1, ":"); + if (!key_desc) { + r = -ENOMEM; + goto err; + } + key_desc++; + crypt_volume_key_set_description(vk, key_desc); + } else { + buffer[2] = '\0'; + for(i = 0; i < vk->keylength; i++) { + memcpy(buffer, &key_[i * 2], 2); + vk->key[i] = strtoul(buffer, &endp, 16); + if (endp != &buffer[2]) { + r = -EINVAL; + goto err; + } + } + } + } + } + memset(key_, 0, strlen(key_)); + + if (cipher) + tgt->u.crypt.cipher = cipher; + if (integrity) + tgt->u.crypt.integrity = integrity; + if (data_device) + tgt->data_device = data_device; + if (vk) + tgt->u.crypt.vk = vk; + return 0; +err: + free(cipher); + free(integrity); + device_free(cd, data_device); + crypt_free_volume_key(vk); + return r; +} + +static int _dm_target_query_verity(struct crypt_device *cd, + uint32_t get_flags, + char *params, + struct dm_target *tgt, + uint32_t *act_flags) +{ + struct crypt_params_verity *vp = NULL; + uint32_t val32; + uint64_t val64; + ssize_t len; + char *str, *str2, *arg; + unsigned int i, features; + int r; + struct device *data_device = NULL, *hash_device = NULL, *fec_device = NULL; + char *hash_name = NULL, *root_hash = NULL, *salt = NULL, *fec_dev_str = NULL; + char *root_hash_sig_key_desc = NULL; + + if (get_flags & DM_ACTIVE_VERITY_PARAMS) { + vp = crypt_zalloc(sizeof(*vp)); + if (!vp) + return -ENOMEM; + } + + tgt->type = DM_VERITY; + tgt->direction = TARGET_QUERY; + tgt->u.verity.vp = vp; + + /* version */ + val32 = strtoul(params, ¶ms, 10); + if (*params != ' ') + return -EINVAL; + if (vp) + vp->hash_type = val32; + params++; + + /* data device */ + str = strsep(¶ms, " "); + if (!params) + return -EINVAL; + if (get_flags & DM_ACTIVE_DEVICE) { + str2 = crypt_lookup_dev(str); + r = device_alloc(cd, &data_device, str2); + free(str2); + if (r < 0 && r != -ENOTBLK) + return r; + } + + r = -EINVAL; + + /* hash device */ + str = strsep(¶ms, " "); + if (!params) + goto err; + if (get_flags & DM_ACTIVE_VERITY_HASH_DEVICE) { + str2 = crypt_lookup_dev(str); + r = device_alloc(cd, &hash_device, str2); + free(str2); + if (r < 0 && r != -ENOTBLK) + goto err; + } + + r = -EINVAL; + + /* data block size*/ + val32 = strtoul(params, ¶ms, 10); + if (*params != ' ') + goto err; + if (vp) + vp->data_block_size = val32; + params++; + + /* hash block size */ + val32 = strtoul(params, ¶ms, 10); + if (*params != ' ') + goto err; + if (vp) + vp->hash_block_size = val32; + params++; + + /* data blocks */ + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + if (vp) + vp->data_size = val64; + params++; + + /* hash start */ + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + tgt->u.verity.hash_offset = val64; + params++; + + /* hash algorithm */ + str = strsep(¶ms, " "); + if (!params) + goto err; + if (vp) { + hash_name = strdup(str); + if (!hash_name) { + r = -ENOMEM; + goto err; + } + } + + /* root digest */ + str = strsep(¶ms, " "); + if (!params) + goto err; + len = crypt_hex_to_bytes(str, &str2, 0); + if (len < 0) { + r = len; + goto err; + } + tgt->u.verity.root_hash_size = len; + if (get_flags & DM_ACTIVE_VERITY_ROOT_HASH) + root_hash = str2; + else + free(str2); + + /* salt */ + str = strsep(¶ms, " "); + if (vp) { + if (!strcmp(str, "-")) { + vp->salt_size = 0; + vp->salt = NULL; + } else { + len = crypt_hex_to_bytes(str, &str2, 0); + if (len < 0) { + r = len; + goto err; + } + vp->salt_size = len; + salt = str2; + } + } + + r = -EINVAL; + + /* Features section, available since verity target version 1.3 */ + if (params) { + /* Number of arguments */ + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + params++; + + features = (int)val64; + for (i = 0; i < features; i++) { + r = -EINVAL; + if (!params) + goto err; + arg = strsep(¶ms, " "); + if (!strcasecmp(arg, "ignore_corruption")) + *act_flags |= CRYPT_ACTIVATE_IGNORE_CORRUPTION; + else if (!strcasecmp(arg, "restart_on_corruption")) + *act_flags |= CRYPT_ACTIVATE_RESTART_ON_CORRUPTION; + else if (!strcasecmp(arg, "panic_on_corruption")) + *act_flags |= CRYPT_ACTIVATE_PANIC_ON_CORRUPTION; + else if (!strcasecmp(arg, "ignore_zero_blocks")) + *act_flags |= CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS; + else if (!strcasecmp(arg, "check_at_most_once")) + *act_flags |= CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE; + else if (!strcasecmp(arg, "use_fec_from_device")) { + str = strsep(¶ms, " "); + str2 = crypt_lookup_dev(str); + if (get_flags & DM_ACTIVE_VERITY_HASH_DEVICE) { + r = device_alloc(cd, &fec_device, str2); + if (r < 0 && r != -ENOTBLK) { + free(str2); + goto err; + } + } + if (vp) { + free(fec_dev_str); + fec_dev_str = str2; + } else + free(str2); + i++; + } else if (!strcasecmp(arg, "fec_start")) { + val64 = strtoull(params, ¶ms, 10); + if (*params) + params++; + tgt->u.verity.fec_offset = val64; + if (vp) + vp->fec_area_offset = val64 * vp->hash_block_size; + i++; + } else if (!strcasecmp(arg, "fec_blocks")) { + val64 = strtoull(params, ¶ms, 10); + if (*params) + params++; + tgt->u.verity.fec_blocks = val64; + i++; + } else if (!strcasecmp(arg, "fec_roots")) { + val32 = strtoul(params, ¶ms, 10); + if (*params) + params++; + if (vp) + vp->fec_roots = val32; + i++; + } else if (!strcasecmp(arg, "root_hash_sig_key_desc")) { + str = strsep(¶ms, " "); + if (!str) + goto err; + if (!root_hash_sig_key_desc) { + root_hash_sig_key_desc = strdup(str); + if (!root_hash_sig_key_desc) { + r = -ENOMEM; + goto err; + } + } + i++; + if (vp) + vp->flags |= CRYPT_VERITY_ROOT_HASH_SIGNATURE; + } else /* unknown option */ + goto err; + } + + /* All parameters should be processed */ + if (params && *params) { + r = -EINVAL; + goto err; + } + } + + if (data_device) + tgt->data_device = data_device; + if (hash_device) + tgt->u.verity.hash_device = hash_device; + if (fec_device) + tgt->u.verity.fec_device = fec_device; + if (root_hash) + tgt->u.verity.root_hash = root_hash; + if (vp && hash_name) + vp->hash_name = hash_name; + if (vp && salt) + vp->salt = salt; + if (vp && fec_dev_str) + vp->fec_device = fec_dev_str; + if (root_hash_sig_key_desc) + tgt->u.verity.root_hash_sig_key_desc = root_hash_sig_key_desc; + + return 0; +err: + device_free(cd, data_device); + device_free(cd, hash_device); + device_free(cd, fec_device); + free(root_hash_sig_key_desc); + free(root_hash); + free(hash_name); + free(salt); + free(fec_dev_str); + free(vp); + return r; +} + +static int _dm_target_query_integrity(struct crypt_device *cd, + uint32_t get_flags, + char *params, + struct dm_target *tgt, + uint32_t *act_flags) +{ + uint32_t val32; + uint64_t val64; + char c, *str, *str2, *arg; + unsigned int i, features, val; + ssize_t len; + int r; + struct device *data_device = NULL, *meta_device = NULL; + char *integrity = NULL, *journal_crypt = NULL, *journal_integrity = NULL; + struct volume_key *vk = NULL; + + tgt->type = DM_INTEGRITY; + tgt->direction = TARGET_QUERY; + + /* data device */ + str = strsep(¶ms, " "); + if (get_flags & DM_ACTIVE_DEVICE) { + str2 = crypt_lookup_dev(str); + r = device_alloc(cd, &data_device, str2); + free(str2); + if (r < 0 && r != -ENOTBLK) + return r; + } + + r = -EINVAL; + + /*offset */ + if (!params) + goto err; + val64 = strtoull(params, ¶ms, 10); + if (!*params || *params != ' ') + goto err; + tgt->u.integrity.offset = val64; + + /* tag size*/ + val32 = strtoul(params, ¶ms, 10); + tgt->u.integrity.tag_size = val32; + if (!*params || *params != ' ') + goto err; + + /* journal */ + c = toupper(*(++params)); + if (!*params || *(++params) != ' ' || (c != 'D' && c != 'J' && c != 'R' && c != 'B')) + goto err; + if (c == 'D') + *act_flags |= CRYPT_ACTIVATE_NO_JOURNAL; + if (c == 'R') + *act_flags |= CRYPT_ACTIVATE_RECOVERY; + if (c == 'B') { + *act_flags |= CRYPT_ACTIVATE_NO_JOURNAL; + *act_flags |= CRYPT_ACTIVATE_NO_JOURNAL_BITMAP; + } + + tgt->u.integrity.sector_size = SECTOR_SIZE; + + /* Features section */ + if (params) { + /* Number of arguments */ + val64 = strtoull(params, ¶ms, 10); + if (*params != ' ') + goto err; + params++; + + features = (int)val64; + for (i = 0; i < features; i++) { + r = -EINVAL; + if (!params) + goto err; + arg = strsep(¶ms, " "); + if (sscanf(arg, "journal_sectors:%u", &val) == 1) + tgt->u.integrity.journal_size = val * SECTOR_SIZE; + else if (sscanf(arg, "journal_watermark:%u", &val) == 1) + tgt->u.integrity.journal_watermark = val; + else if (sscanf(arg, "sectors_per_bit:%" PRIu64, &val64) == 1) { + if (val64 > UINT_MAX) + goto err; + /* overloaded value for bitmap mode */ + tgt->u.integrity.journal_watermark = (unsigned int)val64; + } else if (sscanf(arg, "commit_time:%u", &val) == 1) + tgt->u.integrity.journal_commit_time = val; + else if (sscanf(arg, "bitmap_flush_interval:%u", &val) == 1) + /* overloaded value for bitmap mode */ + tgt->u.integrity.journal_commit_time = val; + else if (sscanf(arg, "interleave_sectors:%u", &val) == 1) + tgt->u.integrity.interleave_sectors = val; + else if (sscanf(arg, "block_size:%u", &val) == 1) + tgt->u.integrity.sector_size = val; + else if (sscanf(arg, "buffer_sectors:%u", &val) == 1) + tgt->u.integrity.buffer_sectors = val; + else if (!strncmp(arg, "internal_hash:", 14) && !integrity) { + str = &arg[14]; + arg = strsep(&str, ":"); + if (get_flags & DM_ACTIVE_INTEGRITY_PARAMS) { + integrity = strdup(arg); + if (!integrity) { + r = -ENOMEM; + goto err; + } + } + + if (str) { + len = crypt_hex_to_bytes(str, &str2, 1); + if (len < 0) { + r = len; + goto err; + } + + r = 0; + if (get_flags & DM_ACTIVE_CRYPT_KEY) { + vk = crypt_alloc_volume_key(len, str2); + if (!vk) + r = -ENOMEM; + } else if (get_flags & DM_ACTIVE_CRYPT_KEYSIZE) { + vk = crypt_alloc_volume_key(len, NULL); + if (!vk) + r = -ENOMEM; + } + crypt_safe_free(str2); + if (r < 0) + goto err; + } + } else if (!strncmp(arg, "meta_device:", 12) && !meta_device) { + if (get_flags & DM_ACTIVE_DEVICE) { + str = crypt_lookup_dev(&arg[12]); + r = device_alloc(cd, &meta_device, str); + free(str); + if (r < 0 && r != -ENOTBLK) + goto err; + } + } else if (!strncmp(arg, "journal_crypt:", 14) && !journal_crypt) { + str = &arg[14]; + arg = strsep(&str, ":"); + if (get_flags & DM_ACTIVE_INTEGRITY_PARAMS) { + journal_crypt = strdup(arg); + if (!journal_crypt) { + r = -ENOMEM; + goto err; + } + } + } else if (!strncmp(arg, "journal_mac:", 12) && !journal_integrity) { + str = &arg[12]; + arg = strsep(&str, ":"); + if (get_flags & DM_ACTIVE_INTEGRITY_PARAMS) { + journal_integrity = strdup(arg); + if (!journal_integrity) { + r = -ENOMEM; + goto err; + } + } + } else if (!strcmp(arg, "recalculate")) { + *act_flags |= CRYPT_ACTIVATE_RECALCULATE; + } else if (!strcmp(arg, "fix_padding")) { + tgt->u.integrity.fix_padding = true; + } else if (!strcmp(arg, "fix_hmac")) { + tgt->u.integrity.fix_hmac = true; + } else if (!strcmp(arg, "legacy_recalculate")) { + tgt->u.integrity.legacy_recalc = true; + } else if (!strcmp(arg, "allow_discards")) { + *act_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS; + } else /* unknown option */ + goto err; + } + + /* All parameters should be processed */ + if (params && *params) { + r = -EINVAL; + goto err; + } + } + + if (data_device) + tgt->data_device = data_device; + if (meta_device) + tgt->u.integrity.meta_device = meta_device; + if (integrity) + tgt->u.integrity.integrity = integrity; + if (journal_crypt) + tgt->u.integrity.journal_crypt = journal_crypt; + if (journal_integrity) + tgt->u.integrity.journal_integrity = journal_integrity; + if (vk) + tgt->u.integrity.vk = vk; + return 0; +err: + device_free(cd, data_device); + device_free(cd, meta_device); + free(integrity); + free(journal_crypt); + free(journal_integrity); + crypt_free_volume_key(vk); + return r; +} + +static int _dm_target_query_linear(struct crypt_device *cd, struct dm_target *tgt, + uint32_t get_flags, char *params) +{ + uint64_t val64; + char *rdevice, *arg; + int r; + struct device *device = NULL; + + /* device */ + rdevice = strsep(¶ms, " "); + if (get_flags & DM_ACTIVE_DEVICE) { + arg = crypt_lookup_dev(rdevice); + r = device_alloc(cd, &device, arg); + free(arg); + if (r < 0 && r != -ENOTBLK) + return r; + } + + r = -EINVAL; + + /*offset */ + if (!params) + goto err; + val64 = strtoull(params, ¶ms, 10); + + /* params should be empty now */ + if (*params) + goto err; + + tgt->type = DM_LINEAR; + tgt->direction = TARGET_QUERY; + tgt->data_device = device; + tgt->u.linear.offset = val64; + + return 0; +err: + device_free(cd, device); + return r; +} + +static int _dm_target_query_error(struct crypt_device *cd, struct dm_target *tgt) +{ + tgt->type = DM_ERROR; + tgt->direction = TARGET_QUERY; + + return 0; +} + +static int _dm_target_query_zero(struct crypt_device *cd, struct dm_target *tgt) +{ + tgt->type = DM_ZERO; + tgt->direction = TARGET_QUERY; + + return 0; +} + +/* + * on error retval has to be negative + * + * also currently any _dm_target_query fn does not perform cleanup on error + */ +static int dm_target_query(struct crypt_device *cd, struct dm_target *tgt, const uint64_t *start, + const uint64_t *length, const char *target_type, + char *params, uint32_t get_flags, uint32_t *act_flags) +{ + int r = -ENOTSUP; + + if (!strcmp(target_type, DM_CRYPT_TARGET)) + r = _dm_target_query_crypt(cd, get_flags, params, tgt, act_flags); + else if (!strcmp(target_type, DM_VERITY_TARGET)) + r = _dm_target_query_verity(cd, get_flags, params, tgt, act_flags); + else if (!strcmp(target_type, DM_INTEGRITY_TARGET)) + r = _dm_target_query_integrity(cd, get_flags, params, tgt, act_flags); + else if (!strcmp(target_type, DM_LINEAR_TARGET)) + r = _dm_target_query_linear(cd, tgt, get_flags, params); + else if (!strcmp(target_type, DM_ERROR_TARGET)) + r = _dm_target_query_error(cd, tgt); + else if (!strcmp(target_type, DM_ZERO_TARGET)) + r = _dm_target_query_zero(cd, tgt); + + if (!r) { + tgt->offset = *start; + tgt->size = *length; + } + + return r; +} + +static int _dm_query_device(struct crypt_device *cd, const char *name, + uint32_t get_flags, struct crypt_dm_active_device *dmd) +{ + struct dm_target *t; + struct dm_task *dmt; + struct dm_info dmi; + uint64_t start, length; + char *target_type, *params; + const char *tmp_uuid; + void *next = NULL; + int r = -EINVAL; + + t = &dmd->segment; + + if (!(dmt = dm_task_create(DM_DEVICE_TABLE))) + return r; + if (!dm_task_secure_data(dmt)) + goto out; + if (!dm_task_set_name(dmt, name)) + goto out; + r = -ENODEV; + if (!dm_task_run(dmt)) + goto out; + + r = -EINVAL; + if (!dm_task_get_info(dmt, &dmi)) + goto out; + + if (!dmi.exists) { + r = -ENODEV; + goto out; + } + + if (dmi.target_count <= 0) { + r = -EINVAL; + goto out; + } + + /* Never allow to return empty key */ + if ((get_flags & DM_ACTIVE_CRYPT_KEY) && dmi.suspended) { + log_dbg(cd, "Cannot read volume key while suspended."); + r = -EINVAL; + goto out; + } + + r = dm_targets_allocate(&dmd->segment, dmi.target_count); + if (r) + goto out; + + do { + next = dm_get_next_target(dmt, next, &start, &length, + &target_type, ¶ms); + + r = dm_target_query(cd, t, &start, &length, target_type, params, get_flags, &dmd->flags); + if (!r && t->type == DM_VERITY) { + r = _dm_status_verity_ok(cd, name); + if (r == 0) + dmd->flags |= CRYPT_ACTIVATE_CORRUPTED; + } + + if (r < 0) { + if (r != -ENOTSUP) + log_err(cd, _("Failed to query dm-%s segment."), target_type); + goto out; + } + + dmd->size += length; + t = t->next; + } while (next && t); + + if (dmi.read_only) + dmd->flags |= CRYPT_ACTIVATE_READONLY; + + if (dmi.suspended) + dmd->flags |= CRYPT_ACTIVATE_SUSPENDED; + + tmp_uuid = dm_task_get_uuid(dmt); + if (!tmp_uuid) + dmd->flags |= CRYPT_ACTIVATE_NO_UUID; + else if (get_flags & DM_ACTIVE_UUID) { + if (!strncmp(tmp_uuid, DM_UUID_PREFIX, DM_UUID_PREFIX_LEN)) + dmd->uuid = strdup(tmp_uuid + DM_UUID_PREFIX_LEN); + } + + dmd->holders = 0; +#if (HAVE_DECL_DM_DEVICE_HAS_HOLDERS && HAVE_DECL_DM_DEVICE_HAS_MOUNTED_FS) + if (get_flags & DM_ACTIVE_HOLDERS) + dmd->holders = (dm_device_has_mounted_fs(dmi.major, dmi.minor) || + dm_device_has_holders(dmi.major, dmi.minor)); +#endif + + r = (dmi.open_count > 0); +out: + if (dmt) + dm_task_destroy(dmt); + + if (r < 0) + dm_targets_free(cd, dmd); + + return r; +} + +int dm_query_device(struct crypt_device *cd, const char *name, + uint32_t get_flags, struct crypt_dm_active_device *dmd) +{ + int r; + + if (!dmd) + return -EINVAL; + + memset(dmd, 0, sizeof(*dmd)); + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + r = _dm_query_device(cd, name, get_flags, dmd); + + dm_exit_context(); + return r; +} + +static int _process_deps(struct crypt_device *cd, const char *prefix, struct dm_deps *deps, char **names, size_t names_offset, size_t names_length) +{ +#if HAVE_DECL_DM_DEVICE_GET_NAME + struct crypt_dm_active_device dmd; + char dmname[PATH_MAX]; + unsigned i; + int r, major, minor, count = 0; + + if (!prefix || !deps) + return -EINVAL; + + for (i = 0; i < deps->count; i++) { + major = major(deps->device[i]); + if (!dm_is_dm_major(major)) + continue; + + minor = minor(deps->device[i]); + if (!dm_device_get_name(major, minor, 0, dmname, PATH_MAX)) + return -EINVAL; + + memset(&dmd, 0, sizeof(dmd)); + r = _dm_query_device(cd, dmname, DM_ACTIVE_UUID, &dmd); + if (r < 0) + continue; + + if (!dmd.uuid || + strncmp(prefix, dmd.uuid, strlen(prefix)) || + crypt_string_in(dmname, names, names_length)) + *dmname = '\0'; + + dm_targets_free(cd, &dmd); + free(CONST_CAST(void*)dmd.uuid); + + if ((size_t)count >= (names_length - names_offset)) + return -ENOMEM; + + if (*dmname && !(names[names_offset + count++] = strdup(dmname))) + return -ENOMEM; + } + + return count; +#else + return -EINVAL; +#endif +} + +int dm_device_deps(struct crypt_device *cd, const char *name, const char *prefix, char **names, size_t names_length) +{ + struct dm_task *dmt; + struct dm_info dmi; + struct dm_deps *deps; + int r = -EINVAL; + size_t i, last = 0, offset = 0; + + if (!name || !names_length || !names) + return -EINVAL; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + while (name) { + if (!(dmt = dm_task_create(DM_DEVICE_DEPS))) + goto out; + if (!dm_task_set_name(dmt, name)) + goto out; + + r = -ENODEV; + if (!dm_task_run(dmt)) + goto out; + + r = -EINVAL; + if (!dm_task_get_info(dmt, &dmi)) + goto out; + if (!(deps = dm_task_get_deps(dmt))) + goto out; + + r = -ENODEV; + if (!dmi.exists) + goto out; + + r = _process_deps(cd, prefix, deps, names, offset, names_length - 1); + if (r < 0) + goto out; + + dm_task_destroy(dmt); + dmt = NULL; + + offset += r; + name = names[last++]; + } + + r = 0; +out: + if (r < 0) { + for (i = 0; i < names_length - 1; i++) + free(names[i]); + *names = NULL; + } + + if (dmt) + dm_task_destroy(dmt); + + dm_exit_context(); + return r; +} + +static int _dm_message(const char *name, const char *msg) +{ + int r = 0; + struct dm_task *dmt; + + if (!(dmt = dm_task_create(DM_DEVICE_TARGET_MSG))) + return 0; + + if (!dm_task_secure_data(dmt)) + goto out; + + if (name && !dm_task_set_name(dmt, name)) + goto out; + + if (!dm_task_set_sector(dmt, (uint64_t) 0)) + goto out; + + if (!dm_task_set_message(dmt, msg)) + goto out; + + r = dm_task_run(dmt); +out: + dm_task_destroy(dmt); + return r; +} + +int dm_suspend_device(struct crypt_device *cd, const char *name, uint32_t dmflags) +{ + uint32_t dmt_flags; + int r = -ENOTSUP; + + if (dm_init_context(cd, DM_UNKNOWN)) + return r; + + if (dmflags & DM_SUSPEND_WIPE_KEY) { + if (dm_flags(cd, DM_CRYPT, &dmt_flags)) + goto out; + + if (!(dmt_flags & DM_KEY_WIPE_SUPPORTED)) + goto out; + } + + r = -EINVAL; + + if (!_dm_simple(DM_DEVICE_SUSPEND, name, dmflags)) + goto out; + + if (dmflags & DM_SUSPEND_WIPE_KEY) { + if (!_dm_message(name, "key wipe")) { + _dm_resume_device(name, 0); + goto out; + } + } + + r = 0; +out: + dm_exit_context(); + return r; +} + +int dm_resume_device(struct crypt_device *cd, const char *name, uint32_t dmflags) +{ + int r; + + if (dm_init_context(cd, DM_UNKNOWN)) + return -ENOTSUP; + + r = _dm_resume_device(name, dmflags); + + dm_exit_context(); + + return r; +} + +int dm_resume_and_reinstate_key(struct crypt_device *cd, const char *name, + const struct volume_key *vk) +{ + uint32_t dmt_flags; + int msg_size; + char *msg = NULL; + int r = -ENOTSUP; + + if (dm_init_context(cd, DM_CRYPT) || dm_flags(cd, DM_CRYPT, &dmt_flags)) + return -ENOTSUP; + + if (!(dmt_flags & DM_KEY_WIPE_SUPPORTED)) + goto out; + + if (!vk->keylength) + msg_size = 11; // key set - + else if (vk->key_description) + msg_size = strlen(vk->key_description) + int_log10(vk->keylength) + 18; + else + msg_size = vk->keylength * 2 + 10; // key set + + msg = crypt_safe_alloc(msg_size); + if (!msg) { + r = -ENOMEM; + goto out; + } + + strcpy(msg, "key set "); + if (!vk->keylength) + snprintf(msg + 8, msg_size - 8, "-"); + else if (vk->key_description) + snprintf(msg + 8, msg_size - 8, ":%zu:logon:%s", vk->keylength, vk->key_description); + else + hex_key(&msg[8], vk->keylength, vk->key); + + if (!_dm_message(name, msg) || + _dm_resume_device(name, 0)) { + r = -EINVAL; + goto out; + } + r = 0; +out: + crypt_safe_free(msg); + dm_exit_context(); + return r; +} + +const char *dm_get_dir(void) +{ + return dm_dir(); +} + +int dm_is_dm_device(int major) +{ + return dm_is_dm_major((uint32_t)major); +} + +int dm_is_dm_kernel_name(const char *name) +{ + return strncmp(name, "dm-", 3) ? 0 : 1; +} + +int dm_crypt_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, struct volume_key *vk, const char *cipher, + uint64_t iv_offset, uint64_t data_offset, const char *integrity, uint32_t tag_size, + uint32_t sector_size) +{ + int r = -EINVAL; + + /* free on error */ + char *dm_integrity = NULL; + + if (tag_size) { + /* Space for IV metadata only */ + dm_integrity = strdup(integrity ?: "none"); + if (!dm_integrity) { + r = -ENOMEM; + goto err; + } + } + + tgt->data_device = data_device; + + tgt->type = DM_CRYPT; + tgt->direction = TARGET_SET; + tgt->u.crypt.vk = vk; + tgt->offset = seg_offset; + tgt->size = seg_size; + + tgt->u.crypt.cipher = cipher; + tgt->u.crypt.integrity = dm_integrity; + tgt->u.crypt.iv_offset = iv_offset; + tgt->u.crypt.offset = data_offset; + tgt->u.crypt.tag_size = tag_size; + tgt->u.crypt.sector_size = sector_size; + + return 0; +err: + free(dm_integrity); + + return r; +} + +int dm_verity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, struct device *hash_device, struct device *fec_device, + const char *root_hash, uint32_t root_hash_size, const char* root_hash_sig_key_desc, + uint64_t hash_offset_block, uint64_t fec_blocks, struct crypt_params_verity *vp) +{ + if (!data_device || !hash_device || !vp) + return -EINVAL; + + tgt->type = DM_VERITY; + tgt->direction = TARGET_SET; + tgt->offset = seg_offset; + tgt->size = seg_size; + tgt->data_device = data_device; + + tgt->u.verity.hash_device = hash_device; + tgt->u.verity.fec_device = fec_device; + tgt->u.verity.root_hash = root_hash; + tgt->u.verity.root_hash_size = root_hash_size; + tgt->u.verity.root_hash_sig_key_desc = root_hash_sig_key_desc; + tgt->u.verity.hash_offset = hash_offset_block; + tgt->u.verity.fec_offset = vp->fec_area_offset / vp->hash_block_size; + tgt->u.verity.fec_blocks = fec_blocks; + tgt->u.verity.vp = vp; + + return 0; +} + +int dm_integrity_target_set(struct crypt_device *cd, + struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *meta_device, + struct device *data_device, uint64_t tag_size, uint64_t offset, + uint32_t sector_size, struct volume_key *vk, + struct volume_key *journal_crypt_key, struct volume_key *journal_mac_key, + const struct crypt_params_integrity *ip) +{ + uint32_t dmi_flags; + + if (!data_device) + return -EINVAL; + + _dm_check_versions(cd, DM_INTEGRITY); + + tgt->type = DM_INTEGRITY; + tgt->direction = TARGET_SET; + tgt->offset = seg_offset; + tgt->size = seg_size; + tgt->data_device = data_device; + if (meta_device != data_device) + tgt->u.integrity.meta_device = meta_device; + tgt->u.integrity.tag_size = tag_size; + tgt->u.integrity.offset = offset; + tgt->u.integrity.sector_size = sector_size; + + tgt->u.integrity.vk = vk; + tgt->u.integrity.journal_crypt_key = journal_crypt_key; + tgt->u.integrity.journal_integrity_key = journal_mac_key; + + if (!dm_flags(cd, DM_INTEGRITY, &dmi_flags) && + (dmi_flags & DM_INTEGRITY_FIX_PADDING_SUPPORTED) && + !(crypt_get_compatibility(cd) & CRYPT_COMPAT_LEGACY_INTEGRITY_PADDING)) + tgt->u.integrity.fix_padding = true; + + if (!dm_flags(cd, DM_INTEGRITY, &dmi_flags) && + (dmi_flags & DM_INTEGRITY_FIX_HMAC_SUPPORTED) && + !(crypt_get_compatibility(cd) & CRYPT_COMPAT_LEGACY_INTEGRITY_HMAC)) + tgt->u.integrity.fix_hmac = true; + + /* This flag can be backported, just try to set it always */ + if (crypt_get_compatibility(cd) & CRYPT_COMPAT_LEGACY_INTEGRITY_RECALC) + tgt->u.integrity.legacy_recalc = true; + + if (ip) { + tgt->u.integrity.journal_size = ip->journal_size; + tgt->u.integrity.journal_watermark = ip->journal_watermark; + tgt->u.integrity.journal_commit_time = ip->journal_commit_time; + tgt->u.integrity.interleave_sectors = ip->interleave_sectors; + tgt->u.integrity.buffer_sectors = ip->buffer_sectors; + tgt->u.integrity.journal_integrity = ip->journal_integrity; + tgt->u.integrity.journal_crypt = ip->journal_crypt; + tgt->u.integrity.integrity = ip->integrity; + } + + return 0; +} + +int dm_linear_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, uint64_t data_offset) +{ + if (!data_device) + return -EINVAL; + + tgt->type = DM_LINEAR; + tgt->direction = TARGET_SET; + tgt->offset = seg_offset; + tgt->size = seg_size; + tgt->data_device = data_device; + + tgt->u.linear.offset = data_offset; + + return 0; +} + +int dm_zero_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size) +{ + tgt->type = DM_ZERO; + tgt->direction = TARGET_SET; + tgt->offset = seg_offset; + tgt->size = seg_size; + + return 0; +} diff --git a/lib/loopaes/loopaes.c b/lib/loopaes/loopaes.c new file mode 100644 index 0000000..e281fc8 --- /dev/null +++ b/lib/loopaes/loopaes.c @@ -0,0 +1,253 @@ +/* + * loop-AES compatible volume handling + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2011-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "loopaes.h" +#include "internal.h" + +static const char *get_hash(unsigned int key_size) +{ + const char *hash; + + switch (key_size) { + case 16: hash = "sha256"; break; + case 24: hash = "sha384"; break; + case 32: hash = "sha512"; break; + default: hash = NULL; + } + + return hash; +} + +static unsigned char get_tweak(unsigned int keys_count) +{ + switch (keys_count) { + case 64: return 0x55; + case 65: return 0xF4; + default: break; + } + return 0x00; +} + +static int hash_key(const char *src, size_t src_len, + char *dst, size_t dst_len, + const char *hash_name) +{ + struct crypt_hash *hd = NULL; + int r; + + if (crypt_hash_init(&hd, hash_name)) + return -EINVAL; + + r = crypt_hash_write(hd, src, src_len); + if (!r) + r = crypt_hash_final(hd, dst, dst_len); + + crypt_hash_destroy(hd); + return r; +} + +static int hash_keys(struct crypt_device *cd, + struct volume_key **vk, + const char *hash_override, + const char **input_keys, + unsigned int keys_count, + unsigned int key_len_output, + unsigned int key_len_input) +{ + const char *hash_name; + char tweak, *key_ptr; + unsigned int i; + int r = 0; + + hash_name = hash_override ?: get_hash(key_len_output); + tweak = get_tweak(keys_count); + + if (!keys_count || !key_len_output || !hash_name || !key_len_input) { + log_err(cd, _("Key processing error (using hash %s)."), + hash_name ?: "[none]"); + return -EINVAL; + } + + *vk = crypt_alloc_volume_key((size_t)key_len_output * keys_count, NULL); + if (!*vk) + return -ENOMEM; + + for (i = 0; i < keys_count; i++) { + key_ptr = &(*vk)->key[i * key_len_output]; + r = hash_key(input_keys[i], key_len_input, key_ptr, + key_len_output, hash_name); + if (r < 0) + break; + + key_ptr[0] ^= tweak; + } + + if (r < 0 && *vk) { + crypt_free_volume_key(*vk); + *vk = NULL; + } + return r; +} + +static int keyfile_is_gpg(char *buffer, size_t buffer_len) +{ + int r = 0; + int index = buffer_len < 100 ? buffer_len - 1 : 100; + char eos = buffer[index]; + + buffer[index] = '\0'; + if (strstr(buffer, "BEGIN PGP MESSAGE")) + r = 1; + buffer[index] = eos; + return r; +} + +int LOOPAES_parse_keyfile(struct crypt_device *cd, + struct volume_key **vk, + const char *hash, + unsigned int *keys_count, + char *buffer, + size_t buffer_len) +{ + const char *keys[LOOPAES_KEYS_MAX]; + unsigned int key_lengths[LOOPAES_KEYS_MAX]; + unsigned int i, key_index, key_len, offset; + + log_dbg(cd, "Parsing loop-AES keyfile of size %zu.", buffer_len); + + if (!buffer_len) + return -EINVAL; + + if (keyfile_is_gpg(buffer, buffer_len)) { + log_err(cd, _("Detected not yet supported GPG encrypted keyfile.")); + log_std(cd, _("Please use gpg --decrypt | cryptsetup --keyfile=- ...\n")); + return -EINVAL; + } + + /* Remove EOL in buffer */ + for (i = 0; i < buffer_len; i++) + if (buffer[i] == '\n' || buffer[i] == '\r') + buffer[i] = '\0'; + + offset = 0; + key_index = 0; + key_lengths[0] = 0; + while (offset < buffer_len && key_index < LOOPAES_KEYS_MAX) { + keys[key_index] = &buffer[offset]; + key_lengths[key_index] = 0;; + while (offset < buffer_len && buffer[offset]) { + offset++; + key_lengths[key_index]++; + } + if (offset == buffer_len) { + log_dbg(cd, "Unterminated key #%d in keyfile.", key_index); + log_err(cd, _("Incompatible loop-AES keyfile detected.")); + return -EINVAL; + } + while (offset < buffer_len && !buffer[offset]) + offset++; + key_index++; + } + + /* All keys must be the same length */ + key_len = key_lengths[0]; + for (i = 0; i < key_index; i++) + if (!key_lengths[i] || (key_lengths[i] != key_len)) { + log_dbg(cd, "Unexpected length %d of key #%d (should be %d).", + key_lengths[i], i, key_len); + key_len = 0; + break; + } + + if (offset != buffer_len || key_len == 0 || + (key_index != 1 && key_index !=64 && key_index != 65)) { + log_err(cd, _("Incompatible loop-AES keyfile detected.")); + return -EINVAL; + } + + log_dbg(cd, "Keyfile: %d keys of length %d.", key_index, key_len); + + *keys_count = key_index; + return hash_keys(cd, vk, hash, keys, key_index, + crypt_get_volume_key_size(cd), key_len); +} + +int LOOPAES_activate(struct crypt_device *cd, + const char *name, + const char *base_cipher, + unsigned int keys_count, + struct volume_key *vk, + uint32_t flags) +{ + int r; + uint32_t req_flags, dmc_flags; + char *cipher = NULL; + struct crypt_dm_active_device dmd = { + .flags = flags, + }; + + r = device_block_adjust(cd, crypt_data_device(cd), DEV_EXCL, + crypt_get_data_offset(cd), &dmd.size, &dmd.flags); + if (r) + return r; + + if (keys_count == 1) { + req_flags = DM_PLAIN64_SUPPORTED; + r = asprintf(&cipher, "%s-%s", base_cipher, "cbc-plain64"); + } else { + req_flags = DM_LMK_SUPPORTED; + r = asprintf(&cipher, "%s:%d-%s", base_cipher, 64, "cbc-lmk"); + } + if (r < 0) + return -ENOMEM; + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), + vk, cipher, crypt_get_iv_offset(cd), + crypt_get_data_offset(cd), crypt_get_integrity(cd), + crypt_get_integrity_tag_size(cd), crypt_get_sector_size(cd)); + + if (r) { + free(cipher); + return r; + } + + log_dbg(cd, "Trying to activate loop-AES device %s using cipher %s.", + name, cipher); + + r = dm_create_device(cd, name, CRYPT_LOOPAES, &dmd); + + if (r < 0 && !dm_flags(cd, DM_CRYPT, &dmc_flags) && + (dmc_flags & req_flags) != req_flags) { + log_err(cd, _("Kernel does not support loop-AES compatible mapping.")); + r = -ENOTSUP; + } + + dm_targets_free(cd, &dmd); + free(cipher); + + return r; +} diff --git a/lib/loopaes/loopaes.h b/lib/loopaes/loopaes.h new file mode 100644 index 0000000..e538d19 --- /dev/null +++ b/lib/loopaes/loopaes.h @@ -0,0 +1,46 @@ +/* + * loop-AES compatible volume handling + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2011-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _LOOPAES_H +#define _LOOPAES_H + +#include +#include + +struct crypt_device; +struct volume_key; + +#define LOOPAES_KEYS_MAX 65 + +int LOOPAES_parse_keyfile(struct crypt_device *cd, + struct volume_key **vk, + const char *hash, + unsigned int *keys_count, + char *buffer, + size_t buffer_len); + +int LOOPAES_activate(struct crypt_device *cd, + const char *name, + const char *base_cipher, + unsigned int keys_count, + struct volume_key *vk, + uint32_t flags); +#endif diff --git a/lib/luks1/af.c b/lib/luks1/af.c new file mode 100644 index 0000000..3aa319d --- /dev/null +++ b/lib/luks1/af.c @@ -0,0 +1,170 @@ +/* + * AFsplitter - Anti forensic information splitter + * + * Copyright (C) 2004 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * + * AFsplitter diffuses information over a large stripe of data, + * therefore supporting secure data destruction. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Library General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include "internal.h" +#include "af.h" + +static void XORblock(const char *src1, const char *src2, char *dst, size_t n) +{ + size_t j; + + for (j = 0; j < n; j++) + dst[j] = src1[j] ^ src2[j]; +} + +static int hash_buf(const char *src, char *dst, uint32_t iv, + size_t len, const char *hash_name) +{ + struct crypt_hash *hd = NULL; + char *iv_char = (char *)&iv; + int r; + + iv = be32_to_cpu(iv); + if (crypt_hash_init(&hd, hash_name)) + return -EINVAL; + + if ((r = crypt_hash_write(hd, iv_char, sizeof(uint32_t)))) + goto out; + + if ((r = crypt_hash_write(hd, src, len))) + goto out; + + r = crypt_hash_final(hd, dst, len); +out: + crypt_hash_destroy(hd); + return r; +} + +/* + * diffuse: Information spreading over the whole dataset with + * the help of hash function. + */ +static int diffuse(char *src, char *dst, size_t size, const char *hash_name) +{ + int r, hash_size = crypt_hash_size(hash_name); + unsigned int digest_size; + unsigned int i, blocks, padding; + + if (hash_size <= 0) + return -EINVAL; + digest_size = hash_size; + + blocks = size / digest_size; + padding = size % digest_size; + + for (i = 0; i < blocks; i++) { + r = hash_buf(src + digest_size * i, + dst + digest_size * i, + i, (size_t)digest_size, hash_name); + if (r < 0) + return r; + } + + if (padding) { + r = hash_buf(src + digest_size * i, + dst + digest_size * i, + i, (size_t)padding, hash_name); + if (r < 0) + return r; + } + + return 0; +} + +/* + * Information splitting. The amount of data is multiplied by + * blocknumbers. The same blocksize and blocknumbers values + * must be supplied to AF_merge to recover information. + */ +int AF_split(struct crypt_device *ctx, const char *src, char *dst, + size_t blocksize, unsigned int blocknumbers, const char *hash) +{ + unsigned int i; + char *bufblock; + int r; + + bufblock = crypt_safe_alloc(blocksize); + if (!bufblock) + return -ENOMEM; + + /* process everything except the last block */ + for (i = 0; i < blocknumbers - 1; i++) { + r = crypt_random_get(ctx, dst + blocksize * i, blocksize, CRYPT_RND_NORMAL); + if (r < 0) + goto out; + + XORblock(dst + blocksize * i, bufblock, bufblock, blocksize); + r = diffuse(bufblock, bufblock, blocksize, hash); + if (r < 0) + goto out; + } + /* the last block is computed */ + XORblock(src, bufblock, dst + blocksize * i, blocksize); + r = 0; +out: + crypt_safe_free(bufblock); + return r; +} + +int AF_merge(struct crypt_device *ctx __attribute__((unused)), const char *src, char *dst, + size_t blocksize, unsigned int blocknumbers, const char *hash) +{ + unsigned int i; + char *bufblock; + int r; + + bufblock = crypt_safe_alloc(blocksize); + if (!bufblock) + return -ENOMEM; + + for(i = 0; i < blocknumbers - 1; i++) { + XORblock(src + blocksize * i, bufblock, bufblock, blocksize); + r = diffuse(bufblock, bufblock, blocksize, hash); + if (r < 0) + goto out; + } + XORblock(src + blocksize * i, bufblock, dst, blocksize); + r = 0; +out: + crypt_safe_free(bufblock); + return r; +} + +/* Size of final split data including sector alignment */ +size_t AF_split_sectors(size_t blocksize, unsigned int blocknumbers) +{ + size_t af_size; + + /* data material * stripes */ + af_size = blocksize * blocknumbers; + + /* round up to sector */ + af_size = (af_size + (SECTOR_SIZE - 1)) / SECTOR_SIZE; + + return af_size; +} diff --git a/lib/luks1/af.h b/lib/luks1/af.h new file mode 100644 index 0000000..e63de3e --- /dev/null +++ b/lib/luks1/af.h @@ -0,0 +1,64 @@ +/* + * AFsplitter - Anti forensic information splitter + * + * Copyright (C) 2004 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * + * AFsplitter diffuses information over a large stripe of data, + * therefore supporting secure data destruction. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Library General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#ifndef INCLUDED_CRYPTSETUP_LUKS_AF_H +#define INCLUDED_CRYPTSETUP_LUKS_AF_H + +#include + +/* + * AF_split operates on src and produces information split data in + * dst. src is assumed to be of the length blocksize. The data stripe + * dst points to must be capable of storing blocksize*blocknumbers. + * blocknumbers is the data multiplication factor. + * + * AF_merge does just the opposite: reproduces the information stored in + * src of the length blocksize*blocknumbers into dst of the length + * blocksize. + * + * On error, both functions return -1, 0 otherwise. + */ + +int AF_split(struct crypt_device *ctx, const char *src, char *dst, + size_t blocksize, unsigned int blocknumbers, const char *hash); +int AF_merge(struct crypt_device *ctx, const char *src, char *dst, size_t blocksize, + unsigned int blocknumbers, const char *hash); +size_t AF_split_sectors(size_t blocksize, unsigned int blocknumbers); + +int LUKS_encrypt_to_storage( + char *src, size_t srcLength, + const char *cipher, + const char *cipher_mode, + struct volume_key *vk, + unsigned int sector, + struct crypt_device *ctx); + +int LUKS_decrypt_from_storage( + char *dst, size_t dstLength, + const char *cipher, + const char *cipher_mode, + struct volume_key *vk, + unsigned int sector, + struct crypt_device *ctx); + +#endif diff --git a/lib/luks1/keyencryption.c b/lib/luks1/keyencryption.c new file mode 100644 index 0000000..e7a3836 --- /dev/null +++ b/lib/luks1/keyencryption.c @@ -0,0 +1,268 @@ +/* + * LUKS - Linux Unified Key Setup + * + * Copyright (C) 2004-2006 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include "luks.h" +#include "af.h" +#include "internal.h" + +static void _error_hint(struct crypt_device *ctx, const char *device, + const char *cipher, const char *mode, size_t keyLength) +{ + char *c, cipher_spec[MAX_CIPHER_LEN * 3]; + + if (snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", cipher, mode) < 0) + return; + + log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n" + "Check that kernel supports %s cipher (check syslog for more info)."), + device, cipher_spec); + + if (!strncmp(mode, "xts", 3) && (keyLength != 256 && keyLength != 512)) + log_err(ctx, _("Key size in XTS mode must be 256 or 512 bits.")); + else if (!(c = strchr(mode, '-')) || strlen(c) < 4) + log_err(ctx, _("Cipher specification should be in [cipher]-[mode]-[iv] format.")); +} + +static int LUKS_endec_template(char *src, size_t srcLength, + const char *cipher, const char *cipher_mode, + struct volume_key *vk, + unsigned int sector, + ssize_t (*func)(int, size_t, size_t, void *, size_t), + int mode, + struct crypt_device *ctx) +{ + char name[PATH_MAX], path[PATH_MAX]; + char cipher_spec[MAX_CIPHER_LEN * 3]; + struct crypt_dm_active_device dmd = { + .flags = CRYPT_ACTIVATE_PRIVATE, + }; + int r, devfd = -1, remove_dev = 0; + size_t bsize, keyslot_alignment, alignment; + + log_dbg(ctx, "Using dmcrypt to access keyslot area."); + + bsize = device_block_size(ctx, crypt_metadata_device(ctx)); + alignment = device_alignment(crypt_metadata_device(ctx)); + if (!bsize || !alignment) + return -EINVAL; + + if (bsize > LUKS_ALIGN_KEYSLOTS) + keyslot_alignment = LUKS_ALIGN_KEYSLOTS; + else + keyslot_alignment = bsize; + dmd.size = size_round_up(srcLength, keyslot_alignment) / SECTOR_SIZE; + + if (mode == O_RDONLY) + dmd.flags |= CRYPT_ACTIVATE_READONLY; + + if (snprintf(name, sizeof(name), "temporary-cryptsetup-%d", getpid()) < 0) + return -ENOMEM; + if (snprintf(path, sizeof(path), "%s/%s", dm_get_dir(), name) < 0) + return -ENOMEM; + if (snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", cipher, cipher_mode) < 0) + return -ENOMEM; + + r = device_block_adjust(ctx, crypt_metadata_device(ctx), DEV_OK, + sector, &dmd.size, &dmd.flags); + if (r < 0) { + log_err(ctx, _("Device %s does not exist or access denied."), + device_path(crypt_metadata_device(ctx))); + return -EIO; + } + + if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) { + log_err(ctx, _("Cannot write to device %s, permission denied."), + device_path(crypt_metadata_device(ctx))); + return -EACCES; + } + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, + crypt_metadata_device(ctx), vk, cipher_spec, 0, sector, + NULL, 0, SECTOR_SIZE); + if (r) + goto out; + + r = dm_create_device(ctx, name, "TEMP", &dmd); + if (r < 0) { + if (r != -EACCES && r != -ENOTSUP) + _error_hint(ctx, device_path(crypt_metadata_device(ctx)), + cipher, cipher_mode, vk->keylength * 8); + r = -EIO; + goto out; + } + remove_dev = 1; + + devfd = open(path, mode | O_DIRECT | O_SYNC); + if (devfd == -1) { + log_err(ctx, _("Failed to open temporary keystore device.")); + r = -EIO; + goto out; + } + + r = func(devfd, bsize, alignment, src, srcLength); + if (r < 0) { + log_err(ctx, _("Failed to access temporary keystore device.")); + r = -EIO; + } else + r = 0; + out: + dm_targets_free(ctx, &dmd); + if (devfd != -1) + close(devfd); + if (remove_dev) + dm_remove_device(ctx, name, CRYPT_DEACTIVATE_FORCE); + return r; +} + +int LUKS_encrypt_to_storage(char *src, size_t srcLength, + const char *cipher, + const char *cipher_mode, + struct volume_key *vk, + unsigned int sector, + struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + struct crypt_storage *s; + int devfd, r = 0; + + /* Only whole sector writes supported */ + if (MISALIGNED_512(srcLength)) + return -EINVAL; + + /* Encrypt buffer */ + r = crypt_storage_init(&s, SECTOR_SIZE, cipher, cipher_mode, vk->key, vk->keylength, false); + + if (r) + log_dbg(ctx, "Userspace crypto wrapper cannot use %s-%s (%d).", + cipher, cipher_mode, r); + + /* Fallback to old temporary dmcrypt device */ + if (r == -ENOTSUP || r == -ENOENT) + return LUKS_endec_template(src, srcLength, cipher, cipher_mode, + vk, sector, write_blockwise, O_RDWR, ctx); + + if (r) { + _error_hint(ctx, device_path(device), cipher, cipher_mode, + vk->keylength * 8); + return r; + } + + log_dbg(ctx, "Using userspace crypto wrapper to access keyslot area."); + + r = crypt_storage_encrypt(s, 0, srcLength, src); + crypt_storage_destroy(s); + + if (r) + return r; + + r = -EIO; + + /* Write buffer to device */ + if (device_is_locked(device)) + devfd = device_open_locked(ctx, device, O_RDWR); + else + devfd = device_open(ctx, device, O_RDWR); + if (devfd < 0) + goto out; + + if (write_lseek_blockwise(devfd, device_block_size(ctx, device), + device_alignment(device), src, srcLength, + sector * SECTOR_SIZE) < 0) + goto out; + + r = 0; +out: + device_sync(ctx, device); + if (r) + log_err(ctx, _("IO error while encrypting keyslot.")); + + return r; +} + +int LUKS_decrypt_from_storage(char *dst, size_t dstLength, + const char *cipher, + const char *cipher_mode, + struct volume_key *vk, + unsigned int sector, + struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + struct crypt_storage *s; + struct stat st; + int devfd, r = 0; + + /* Only whole sector reads supported */ + if (MISALIGNED_512(dstLength)) + return -EINVAL; + + r = crypt_storage_init(&s, SECTOR_SIZE, cipher, cipher_mode, vk->key, vk->keylength, false); + + if (r) + log_dbg(ctx, "Userspace crypto wrapper cannot use %s-%s (%d).", + cipher, cipher_mode, r); + + /* Fallback to old temporary dmcrypt device */ + if (r == -ENOTSUP || r == -ENOENT) + return LUKS_endec_template(dst, dstLength, cipher, cipher_mode, + vk, sector, read_blockwise, O_RDONLY, ctx); + + if (r) { + _error_hint(ctx, device_path(device), cipher, cipher_mode, + vk->keylength * 8); + return r; + } + + log_dbg(ctx, "Using userspace crypto wrapper to access keyslot area."); + + /* Read buffer from device */ + if (device_is_locked(device)) + devfd = device_open_locked(ctx, device, O_RDONLY); + else + devfd = device_open(ctx, device, O_RDONLY); + if (devfd < 0) { + log_err(ctx, _("Cannot open device %s."), device_path(device)); + crypt_storage_destroy(s); + return -EIO; + } + + if (read_lseek_blockwise(devfd, device_block_size(ctx, device), + device_alignment(device), dst, dstLength, + sector * SECTOR_SIZE) < 0) { + if (!fstat(devfd, &st) && (st.st_size < (off_t)dstLength)) + log_err(ctx, _("Device %s is too small."), device_path(device)); + else + log_err(ctx, _("IO error while decrypting keyslot.")); + + crypt_storage_destroy(s); + return -EIO; + } + + /* Decrypt buffer */ + r = crypt_storage_decrypt(s, 0, dstLength, dst); + crypt_storage_destroy(s); + + return r; +} diff --git a/lib/luks1/keymanage.c b/lib/luks1/keymanage.c new file mode 100644 index 0000000..180407e --- /dev/null +++ b/lib/luks1/keymanage.c @@ -0,0 +1,1258 @@ +/* + * LUKS - Linux Unified Key Setup + * + * Copyright (C) 2004-2006 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2013-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "luks.h" +#include "af.h" +#include "internal.h" + +int LUKS_keyslot_area(const struct luks_phdr *hdr, + int keyslot, + uint64_t *offset, + uint64_t *length) +{ + if(keyslot >= LUKS_NUMKEYS || keyslot < 0) + return -EINVAL; + + *offset = (uint64_t)hdr->keyblock[keyslot].keyMaterialOffset * SECTOR_SIZE; + *length = AF_split_sectors(hdr->keyBytes, LUKS_STRIPES) * SECTOR_SIZE; + + return 0; +} + +/* insertsort: because the array has 8 elements and it's mostly sorted. that's why */ +static void LUKS_sort_keyslots(const struct luks_phdr *hdr, int *array) +{ + int i, j, x; + + for (i = 1; i < LUKS_NUMKEYS; i++) { + j = i; + while (j > 0 && hdr->keyblock[array[j-1]].keyMaterialOffset > hdr->keyblock[array[j]].keyMaterialOffset) { + x = array[j]; + array[j] = array[j-1]; + array[j-1] = x; + j--; + } + } +} + +size_t LUKS_device_sectors(const struct luks_phdr *hdr) +{ + int sorted_areas[LUKS_NUMKEYS] = { 0, 1, 2, 3, 4, 5, 6, 7 }; + + LUKS_sort_keyslots(hdr, sorted_areas); + + return hdr->keyblock[sorted_areas[LUKS_NUMKEYS-1]].keyMaterialOffset + AF_split_sectors(hdr->keyBytes, LUKS_STRIPES); +} + +size_t LUKS_keyslots_offset(const struct luks_phdr *hdr) +{ + int sorted_areas[LUKS_NUMKEYS] = { 0, 1, 2, 3, 4, 5, 6, 7 }; + + LUKS_sort_keyslots(hdr, sorted_areas); + + return hdr->keyblock[sorted_areas[0]].keyMaterialOffset; +} + +static int LUKS_check_device_size(struct crypt_device *ctx, const struct luks_phdr *hdr, int falloc) +{ + struct device *device = crypt_metadata_device(ctx); + uint64_t dev_sectors, hdr_sectors; + + if (!hdr->keyBytes) + return -EINVAL; + + if (device_size(device, &dev_sectors)) { + log_dbg(ctx, "Cannot get device size for device %s.", device_path(device)); + return -EIO; + } + + dev_sectors >>= SECTOR_SHIFT; + hdr_sectors = LUKS_device_sectors(hdr); + log_dbg(ctx, "Key length %u, device size %" PRIu64 " sectors, header size %" + PRIu64 " sectors.", hdr->keyBytes, dev_sectors, hdr_sectors); + + if (hdr_sectors > dev_sectors) { + /* If it is header file, increase its size */ + if (falloc && !device_fallocate(device, hdr_sectors << SECTOR_SHIFT)) + return 0; + + log_err(ctx, _("Device %s is too small. (LUKS1 requires at least %" PRIu64 " bytes.)"), + device_path(device), hdr_sectors * SECTOR_SIZE); + return -EINVAL; + } + + return 0; +} + +static int LUKS_check_keyslots(struct crypt_device *ctx, const struct luks_phdr *phdr) +{ + int i, prev, next, sorted_areas[LUKS_NUMKEYS] = { 0, 1, 2, 3, 4, 5, 6, 7 }; + uint32_t secs_per_stripes = AF_split_sectors(phdr->keyBytes, LUKS_STRIPES); + + LUKS_sort_keyslots(phdr, sorted_areas); + + /* Check keyslot to prevent access outside of header and keyslot area */ + for (i = 0; i < LUKS_NUMKEYS; i++) { + /* enforce stripes == 4000 */ + if (phdr->keyblock[i].stripes != LUKS_STRIPES) { + log_dbg(ctx, "Invalid stripes count %u in keyslot %u.", + phdr->keyblock[i].stripes, i); + log_err(ctx, _("LUKS keyslot %u is invalid."), i); + return -1; + } + + /* First sectors is the header itself */ + if (phdr->keyblock[i].keyMaterialOffset * SECTOR_SIZE < sizeof(*phdr)) { + log_dbg(ctx, "Invalid offset %u in keyslot %u.", + phdr->keyblock[i].keyMaterialOffset, i); + log_err(ctx, _("LUKS keyslot %u is invalid."), i); + return -1; + } + + /* Ignore following check for detached header where offset can be zero. */ + if (phdr->payloadOffset == 0) + continue; + + if (phdr->payloadOffset <= phdr->keyblock[i].keyMaterialOffset) { + log_dbg(ctx, "Invalid offset %u in keyslot %u (beyond data area offset %u).", + phdr->keyblock[i].keyMaterialOffset, i, + phdr->payloadOffset); + log_err(ctx, _("LUKS keyslot %u is invalid."), i); + return -1; + } + + if (phdr->payloadOffset < (phdr->keyblock[i].keyMaterialOffset + secs_per_stripes)) { + log_dbg(ctx, "Invalid keyslot size %u (offset %u, stripes %u) in " + "keyslot %u (beyond data area offset %u).", + secs_per_stripes, + phdr->keyblock[i].keyMaterialOffset, + phdr->keyblock[i].stripes, + i, phdr->payloadOffset); + log_err(ctx, _("LUKS keyslot %u is invalid."), i); + return -1; + } + } + + /* check no keyslot overlaps with each other */ + for (i = 1; i < LUKS_NUMKEYS; i++) { + prev = sorted_areas[i-1]; + next = sorted_areas[i]; + if (phdr->keyblock[next].keyMaterialOffset < + (phdr->keyblock[prev].keyMaterialOffset + secs_per_stripes)) { + log_dbg(ctx, "Not enough space in LUKS keyslot %d.", prev); + log_err(ctx, _("LUKS keyslot %u is invalid."), prev); + return -1; + } + } + /* do not check last keyslot on purpose, it must be tested in device size check */ + + return 0; +} + +static const char *dbg_slot_state(crypt_keyslot_info ki) +{ + switch(ki) { + case CRYPT_SLOT_INACTIVE: + return "INACTIVE"; + case CRYPT_SLOT_ACTIVE: + return "ACTIVE"; + case CRYPT_SLOT_ACTIVE_LAST: + return "ACTIVE_LAST"; + case CRYPT_SLOT_INVALID: + default: + return "INVALID"; + } +} + +int LUKS_hdr_backup(const char *backup_file, struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + struct luks_phdr hdr; + int fd, devfd, r = 0; + size_t hdr_size; + size_t buffer_size; + ssize_t ret; + char *buffer = NULL; + + r = LUKS_read_phdr(&hdr, 1, 0, ctx); + if (r) + return r; + + hdr_size = LUKS_device_sectors(&hdr) << SECTOR_SHIFT; + buffer_size = size_round_up(hdr_size, crypt_getpagesize()); + + buffer = crypt_safe_alloc(buffer_size); + if (!buffer || hdr_size < LUKS_ALIGN_KEYSLOTS || hdr_size > buffer_size) { + r = -ENOMEM; + goto out; + } + + log_dbg(ctx, "Storing backup of header (%zu bytes) and keyslot area (%zu bytes).", + sizeof(hdr), hdr_size - LUKS_ALIGN_KEYSLOTS); + + log_dbg(ctx, "Output backup file size: %zu bytes.", buffer_size); + + devfd = device_open(ctx, device, O_RDONLY); + if (devfd < 0) { + log_err(ctx, _("Device %s is not a valid LUKS device."), device_path(device)); + r = -EINVAL; + goto out; + } + + if (read_lseek_blockwise(devfd, device_block_size(ctx, device), device_alignment(device), + buffer, hdr_size, 0) < (ssize_t)hdr_size) { + r = -EIO; + goto out; + } + + /* Wipe unused area, so backup cannot contain old signatures */ + if (hdr.keyblock[0].keyMaterialOffset * SECTOR_SIZE == LUKS_ALIGN_KEYSLOTS) + memset(buffer + sizeof(hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(hdr)); + + fd = open(backup_file, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR); + if (fd == -1) { + if (errno == EEXIST) + log_err(ctx, _("Requested header backup file %s already exists."), backup_file); + else + log_err(ctx, _("Cannot create header backup file %s."), backup_file); + r = -EINVAL; + goto out; + } + ret = write_buffer(fd, buffer, buffer_size); + close(fd); + if (ret < (ssize_t)buffer_size) { + log_err(ctx, _("Cannot write header backup file %s."), backup_file); + r = -EIO; + goto out; + } + + r = 0; +out: + crypt_safe_memzero(&hdr, sizeof(hdr)); + crypt_safe_free(buffer); + return r; +} + +int LUKS_hdr_restore( + const char *backup_file, + struct luks_phdr *hdr, + struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + int fd, r = 0, devfd = -1, diff_uuid = 0; + ssize_t ret, buffer_size = 0; + char *buffer = NULL, msg[200]; + struct luks_phdr hdr_file; + + r = LUKS_read_phdr_backup(backup_file, &hdr_file, 0, ctx); + if (r == -ENOENT) + return r; + + if (!r) + buffer_size = LUKS_device_sectors(&hdr_file) << SECTOR_SHIFT; + + if (r || buffer_size < LUKS_ALIGN_KEYSLOTS) { + log_err(ctx, _("Backup file does not contain valid LUKS header.")); + r = -EINVAL; + goto out; + } + + buffer = crypt_safe_alloc(buffer_size); + if (!buffer) { + r = -ENOMEM; + goto out; + } + + fd = open(backup_file, O_RDONLY); + if (fd == -1) { + log_err(ctx, _("Cannot open header backup file %s."), backup_file); + r = -EINVAL; + goto out; + } + + ret = read_buffer(fd, buffer, buffer_size); + close(fd); + if (ret < buffer_size) { + log_err(ctx, _("Cannot read header backup file %s."), backup_file); + r = -EIO; + goto out; + } + + r = LUKS_read_phdr(hdr, 0, 0, ctx); + if (r == 0) { + log_dbg(ctx, "Device %s already contains LUKS header, checking UUID and offset.", device_path(device)); + if(hdr->payloadOffset != hdr_file.payloadOffset || + hdr->keyBytes != hdr_file.keyBytes) { + log_err(ctx, _("Data offset or key size differs on device and backup, restore failed.")); + r = -EINVAL; + goto out; + } + if (memcmp(hdr->uuid, hdr_file.uuid, UUID_STRING_L)) + diff_uuid = 1; + } + + if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device_path(device), + r ? _("does not contain LUKS header. Replacing header can destroy data on that device.") : + _("already contains LUKS header. Replacing header will destroy existing keyslots."), + diff_uuid ? _("\nWARNING: real device header has different UUID than backup!") : "") < 0) { + r = -ENOMEM; + goto out; + } + + if (!crypt_confirm(ctx, msg)) { + r = -EINVAL; + goto out; + } + + log_dbg(ctx, "Storing backup of header (%zu bytes) and keyslot area (%zu bytes) to device %s.", + sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device_path(device)); + + devfd = device_open(ctx, device, O_RDWR); + if (devfd < 0) { + if (errno == EACCES) + log_err(ctx, _("Cannot write to device %s, permission denied."), + device_path(device)); + else + log_err(ctx, _("Cannot open device %s."), device_path(device)); + r = -EINVAL; + goto out; + } + + if (write_lseek_blockwise(devfd, device_block_size(ctx, device), device_alignment(device), + buffer, buffer_size, 0) < buffer_size) { + r = -EIO; + goto out; + } + + /* Be sure to reload new data */ + r = LUKS_read_phdr(hdr, 1, 0, ctx); +out: + device_sync(ctx, device); + crypt_safe_free(buffer); + return r; +} + +/* This routine should do some just basic recovery for known problems. */ +static int _keyslot_repair(struct luks_phdr *phdr, struct crypt_device *ctx) +{ + struct luks_phdr temp_phdr; + const unsigned char *sector = (const unsigned char*)phdr; + struct volume_key *vk; + int i, bad, r, need_write = 0; + + if (phdr->keyBytes != 16 && phdr->keyBytes != 32 && phdr->keyBytes != 64) { + log_err(ctx, _("Non standard key size, manual repair required.")); + return -EINVAL; + } + + /* + * cryptsetup 1.0 did not align keyslots to 4k, cannot repair this one + * Also we cannot trust possibly broken keyslots metadata here through LUKS_keyslots_offset(). + * Expect first keyslot is aligned, if not, then manual repair is neccessary. + */ + if (phdr->keyblock[0].keyMaterialOffset < (LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE)) { + log_err(ctx, _("Non standard keyslots alignment, manual repair required.")); + return -EINVAL; + } + + r = LUKS_check_cipher(ctx, phdr->keyBytes, phdr->cipherName, phdr->cipherMode); + if (r < 0) + return -EINVAL; + + vk = crypt_alloc_volume_key(phdr->keyBytes, NULL); + if (!vk) + return -ENOMEM; + + log_verbose(ctx, _("Repairing keyslots.")); + + log_dbg(ctx, "Generating second header with the same parameters for check."); + /* cipherName, cipherMode, hashSpec, uuid are already null terminated */ + /* payloadOffset - cannot check */ + r = LUKS_generate_phdr(&temp_phdr, vk, phdr->cipherName, phdr->cipherMode, + phdr->hashSpec, phdr->uuid, + phdr->payloadOffset * SECTOR_SIZE, 0, 0, ctx); + if (r < 0) + goto out; + + for(i = 0; i < LUKS_NUMKEYS; ++i) { + if (phdr->keyblock[i].active == LUKS_KEY_ENABLED) { + log_dbg(ctx, "Skipping repair for active keyslot %i.", i); + continue; + } + + bad = 0; + if (phdr->keyblock[i].keyMaterialOffset != temp_phdr.keyblock[i].keyMaterialOffset) { + log_err(ctx, _("Keyslot %i: offset repaired (%u -> %u)."), i, + (unsigned)phdr->keyblock[i].keyMaterialOffset, + (unsigned)temp_phdr.keyblock[i].keyMaterialOffset); + phdr->keyblock[i].keyMaterialOffset = temp_phdr.keyblock[i].keyMaterialOffset; + bad = 1; + } + + if (phdr->keyblock[i].stripes != temp_phdr.keyblock[i].stripes) { + log_err(ctx, _("Keyslot %i: stripes repaired (%u -> %u)."), i, + (unsigned)phdr->keyblock[i].stripes, + (unsigned)temp_phdr.keyblock[i].stripes); + phdr->keyblock[i].stripes = temp_phdr.keyblock[i].stripes; + bad = 1; + } + + /* Known case - MSDOS partition table signature */ + if (i == 6 && sector[0x1fe] == 0x55 && sector[0x1ff] == 0xaa) { + log_err(ctx, _("Keyslot %i: bogus partition signature."), i); + bad = 1; + } + + if(bad) { + log_err(ctx, _("Keyslot %i: salt wiped."), i); + phdr->keyblock[i].active = LUKS_KEY_DISABLED; + memset(&phdr->keyblock[i].passwordSalt, 0x00, LUKS_SALTSIZE); + phdr->keyblock[i].passwordIterations = 0; + } + + if (bad) + need_write = 1; + } + + /* + * check repair result before writing because repair can't fix out of order + * keyslot offsets and would corrupt header again + */ + if (LUKS_check_keyslots(ctx, phdr)) + r = -EINVAL; + else if (need_write) { + log_verbose(ctx, _("Writing LUKS header to disk.")); + r = LUKS_write_phdr(phdr, ctx); + } +out: + if (r) + log_err(ctx, _("Repair failed.")); + crypt_free_volume_key(vk); + crypt_safe_memzero(&temp_phdr, sizeof(temp_phdr)); + return r; +} + +static int _check_and_convert_hdr(const char *device, + struct luks_phdr *hdr, + int require_luks_device, + int repair, + struct crypt_device *ctx) +{ + int r = 0; + unsigned int i; + char luksMagic[] = LUKS_MAGIC; + + if(memcmp(hdr->magic, luksMagic, LUKS_MAGIC_L)) { /* Check magic */ + log_dbg(ctx, "LUKS header not detected."); + if (require_luks_device) + log_err(ctx, _("Device %s is not a valid LUKS device."), device); + return -EINVAL; + } else if((hdr->version = ntohs(hdr->version)) != 1) { /* Convert every uint16/32_t item from network byte order */ + log_err(ctx, _("Unsupported LUKS version %d."), hdr->version); + return -EINVAL; + } + + hdr->hashSpec[LUKS_HASHSPEC_L - 1] = '\0'; + if (crypt_hmac_size(hdr->hashSpec) < LUKS_DIGESTSIZE) { + log_err(ctx, _("Requested LUKS hash %s is not supported."), hdr->hashSpec); + return -EINVAL; + } + + /* Header detected */ + hdr->payloadOffset = ntohl(hdr->payloadOffset); + hdr->keyBytes = ntohl(hdr->keyBytes); + hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations); + + for(i = 0; i < LUKS_NUMKEYS; ++i) { + hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active); + hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations); + hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset); + hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes); + } + + if (LUKS_check_keyslots(ctx, hdr)) + r = -EINVAL; + + /* Avoid unterminated strings */ + hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0'; + hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0'; + hdr->uuid[UUID_STRING_L - 1] = '\0'; + + if (repair) { + if (r == -EINVAL) + r = _keyslot_repair(hdr, ctx); + else + log_verbose(ctx, _("No known problems detected for LUKS header.")); + } + + return r; +} + +static void _to_lower(char *str, unsigned max_len) +{ + for(; *str && max_len; str++, max_len--) + if (isupper(*str)) + *str = tolower(*str); +} + +static void LUKS_fix_header_compatible(struct luks_phdr *header) +{ + /* Old cryptsetup expects "sha1", gcrypt allows case insensitive names, + * so always convert hash to lower case in header */ + _to_lower(header->hashSpec, LUKS_HASHSPEC_L); + + /* ECB mode does not use IV but dmcrypt silently allows it. + * Drop any IV here if ECB is used (that is not secure anyway).*/ + if (!strncmp(header->cipherMode, "ecb-", 4)) { + memset(header->cipherMode, 0, LUKS_CIPHERMODE_L); + strcpy(header->cipherMode, "ecb"); + } +} + +int LUKS_read_phdr_backup(const char *backup_file, + struct luks_phdr *hdr, + int require_luks_device, + struct crypt_device *ctx) +{ + ssize_t hdr_size = sizeof(struct luks_phdr); + int devfd = 0, r = 0; + + log_dbg(ctx, "Reading LUKS header of size %d from backup file %s", + (int)hdr_size, backup_file); + + devfd = open(backup_file, O_RDONLY); + if (devfd == -1) { + log_err(ctx, _("Cannot open header backup file %s."), backup_file); + return -ENOENT; + } + + if (read_buffer(devfd, hdr, hdr_size) < hdr_size) + r = -EIO; + else { + LUKS_fix_header_compatible(hdr); + r = _check_and_convert_hdr(backup_file, hdr, + require_luks_device, 0, ctx); + } + + close(devfd); + return r; +} + +int LUKS_read_phdr(struct luks_phdr *hdr, + int require_luks_device, + int repair, + struct crypt_device *ctx) +{ + int devfd, r = 0; + struct device *device = crypt_metadata_device(ctx); + ssize_t hdr_size = sizeof(struct luks_phdr); + + /* LUKS header starts at offset 0, first keyslot on LUKS_ALIGN_KEYSLOTS */ + assert(sizeof(struct luks_phdr) <= LUKS_ALIGN_KEYSLOTS); + + /* Stripes count cannot be changed without additional code fixes yet */ + assert(LUKS_STRIPES == 4000); + + if (repair && !require_luks_device) + return -EINVAL; + + log_dbg(ctx, "Reading LUKS header of size %zu from device %s", + hdr_size, device_path(device)); + + devfd = device_open(ctx, device, O_RDONLY); + if (devfd < 0) { + log_err(ctx, _("Cannot open device %s."), device_path(device)); + return -EINVAL; + } + + if (read_lseek_blockwise(devfd, device_block_size(ctx, device), device_alignment(device), + hdr, hdr_size, 0) < hdr_size) + r = -EIO; + else + r = _check_and_convert_hdr(device_path(device), hdr, require_luks_device, + repair, ctx); + + if (!r) + r = LUKS_check_device_size(ctx, hdr, 0); + + /* + * Cryptsetup 1.0.0 did not align keyslots to 4k (very rare version). + * Disable direct-io to avoid possible IO errors if underlying device + * has bigger sector size. + */ + if (!r && hdr->keyblock[0].keyMaterialOffset * SECTOR_SIZE < LUKS_ALIGN_KEYSLOTS) { + log_dbg(ctx, "Old unaligned LUKS keyslot detected, disabling direct-io."); + device_disable_direct_io(device); + } + + return r; +} + +int LUKS_write_phdr(struct luks_phdr *hdr, + struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + ssize_t hdr_size = sizeof(struct luks_phdr); + int devfd = 0; + unsigned int i; + struct luks_phdr convHdr; + int r; + + log_dbg(ctx, "Updating LUKS header of size %zu on device %s", + sizeof(struct luks_phdr), device_path(device)); + + r = LUKS_check_device_size(ctx, hdr, 1); + if (r) + return r; + + devfd = device_open(ctx, device, O_RDWR); + if (devfd < 0) { + if (errno == EACCES) + log_err(ctx, _("Cannot write to device %s, permission denied."), + device_path(device)); + else + log_err(ctx, _("Cannot open device %s."), device_path(device)); + return -EINVAL; + } + + memcpy(&convHdr, hdr, hdr_size); + memset(&convHdr._padding, 0, sizeof(convHdr._padding)); + + /* Convert every uint16/32_t item to network byte order */ + convHdr.version = htons(hdr->version); + convHdr.payloadOffset = htonl(hdr->payloadOffset); + convHdr.keyBytes = htonl(hdr->keyBytes); + convHdr.mkDigestIterations = htonl(hdr->mkDigestIterations); + for(i = 0; i < LUKS_NUMKEYS; ++i) { + convHdr.keyblock[i].active = htonl(hdr->keyblock[i].active); + convHdr.keyblock[i].passwordIterations = htonl(hdr->keyblock[i].passwordIterations); + convHdr.keyblock[i].keyMaterialOffset = htonl(hdr->keyblock[i].keyMaterialOffset); + convHdr.keyblock[i].stripes = htonl(hdr->keyblock[i].stripes); + } + + r = write_lseek_blockwise(devfd, device_block_size(ctx, device), device_alignment(device), + &convHdr, hdr_size, 0) < hdr_size ? -EIO : 0; + if (r) + log_err(ctx, _("Error during update of LUKS header on device %s."), device_path(device)); + + device_sync(ctx, device); + + /* Re-read header from disk to be sure that in-memory and on-disk data are the same. */ + if (!r) { + r = LUKS_read_phdr(hdr, 1, 0, ctx); + if (r) + log_err(ctx, _("Error re-reading LUKS header after update on device %s."), + device_path(device)); + } + + return r; +} + +/* Check that kernel supports requested cipher by decryption of one sector */ +int LUKS_check_cipher(struct crypt_device *ctx, size_t keylength, const char *cipher, const char *cipher_mode) +{ + int r; + struct volume_key *empty_key; + char buf[SECTOR_SIZE]; + + log_dbg(ctx, "Checking if cipher %s-%s is usable.", cipher, cipher_mode); + + empty_key = crypt_alloc_volume_key(keylength, NULL); + if (!empty_key) + return -ENOMEM; + + /* No need to get KEY quality random but it must avoid known weak keys. */ + r = crypt_random_get(ctx, empty_key->key, empty_key->keylength, CRYPT_RND_NORMAL); + if (!r) + r = LUKS_decrypt_from_storage(buf, sizeof(buf), cipher, cipher_mode, empty_key, 0, ctx); + + crypt_free_volume_key(empty_key); + crypt_safe_memzero(buf, sizeof(buf)); + return r; +} + +int LUKS_generate_phdr(struct luks_phdr *header, + const struct volume_key *vk, + const char *cipherName, + const char *cipherMode, + const char *hashSpec, + const char *uuid, + uint64_t data_offset, /* in bytes */ + uint64_t align_offset, /* in bytes */ + uint64_t required_alignment, /* in bytes */ + struct crypt_device *ctx) +{ + int i, r; + size_t keyslot_sectors, header_sectors; + uuid_t partitionUuid; + struct crypt_pbkdf_type *pbkdf; + double PBKDF2_temp; + char luksMagic[] = LUKS_MAGIC; + + if (data_offset % SECTOR_SIZE || align_offset % SECTOR_SIZE || + required_alignment % SECTOR_SIZE) + return -EINVAL; + + memset(header, 0, sizeof(struct luks_phdr)); + + keyslot_sectors = AF_split_sectors(vk->keylength, LUKS_STRIPES); + header_sectors = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE; + + for (i = 0; i < LUKS_NUMKEYS; i++) { + header->keyblock[i].active = LUKS_KEY_DISABLED; + header->keyblock[i].keyMaterialOffset = header_sectors; + header->keyblock[i].stripes = LUKS_STRIPES; + header_sectors = size_round_up(header_sectors + keyslot_sectors, + LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE); + } + /* In sector is now size of all keyslot material space */ + + /* Data offset has priority */ + if (data_offset) + header->payloadOffset = data_offset / SECTOR_SIZE; + else if (required_alignment) { + header->payloadOffset = size_round_up(header_sectors, (required_alignment / SECTOR_SIZE)); + header->payloadOffset += (align_offset / SECTOR_SIZE); + } else + header->payloadOffset = 0; + + if (header->payloadOffset && header->payloadOffset < header_sectors) { + log_err(ctx, _("Data offset for LUKS header must be " + "either 0 or higher than header size.")); + return -EINVAL; + } + + if (crypt_hmac_size(hashSpec) < LUKS_DIGESTSIZE) { + log_err(ctx, _("Requested LUKS hash %s is not supported."), hashSpec); + return -EINVAL; + } + + if (uuid && uuid_parse(uuid, partitionUuid) == -1) { + log_err(ctx, _("Wrong LUKS UUID format provided.")); + return -EINVAL; + } + if (!uuid) + uuid_generate(partitionUuid); + + /* Set Magic */ + memcpy(header->magic,luksMagic,LUKS_MAGIC_L); + header->version=1; + strncpy(header->cipherName,cipherName,LUKS_CIPHERNAME_L-1); + strncpy(header->cipherMode,cipherMode,LUKS_CIPHERMODE_L-1); + strncpy(header->hashSpec,hashSpec,LUKS_HASHSPEC_L-1); + + header->keyBytes=vk->keylength; + + LUKS_fix_header_compatible(header); + + log_dbg(ctx, "Generating LUKS header version %d using hash %s, %s, %s, MK %d bytes", + header->version, header->hashSpec ,header->cipherName, header->cipherMode, + header->keyBytes); + + r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_SALT); + if(r < 0) { + log_err(ctx, _("Cannot create LUKS header: reading random salt failed.")); + return r; + } + + /* Compute master key digest */ + pbkdf = crypt_get_pbkdf(ctx); + r = crypt_benchmark_pbkdf_internal(ctx, pbkdf, vk->keylength); + if (r < 0) + return r; + assert(pbkdf->iterations); + + if (pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK && pbkdf->time_ms == 0) + PBKDF2_temp = LUKS_MKD_ITERATIONS_MIN; + else /* iterations per ms * LUKS_MKD_ITERATIONS_MS */ + PBKDF2_temp = (double)pbkdf->iterations * LUKS_MKD_ITERATIONS_MS / pbkdf->time_ms; + + if (PBKDF2_temp > (double)UINT32_MAX) + return -EINVAL; + header->mkDigestIterations = at_least((uint32_t)PBKDF2_temp, LUKS_MKD_ITERATIONS_MIN); + assert(header->mkDigestIterations); + + r = crypt_pbkdf(CRYPT_KDF_PBKDF2, header->hashSpec, vk->key,vk->keylength, + header->mkDigestSalt, LUKS_SALTSIZE, + header->mkDigest,LUKS_DIGESTSIZE, + header->mkDigestIterations, 0, 0); + if (r < 0) { + log_err(ctx, _("Cannot create LUKS header: header digest failed (using hash %s)."), + header->hashSpec); + return r; + } + + uuid_unparse(partitionUuid, header->uuid); + + log_dbg(ctx, "Data offset %d, UUID %s, digest iterations %" PRIu32, + header->payloadOffset, header->uuid, header->mkDigestIterations); + + return 0; +} + +int LUKS_hdr_uuid_set( + struct luks_phdr *hdr, + const char *uuid, + struct crypt_device *ctx) +{ + uuid_t partitionUuid; + + if (uuid && uuid_parse(uuid, partitionUuid) == -1) { + log_err(ctx, _("Wrong LUKS UUID format provided.")); + return -EINVAL; + } + if (!uuid) + uuid_generate(partitionUuid); + + uuid_unparse(partitionUuid, hdr->uuid); + + return LUKS_write_phdr(hdr, ctx); +} + +int LUKS_set_key(unsigned int keyIndex, + const char *password, size_t passwordLen, + struct luks_phdr *hdr, struct volume_key *vk, + struct crypt_device *ctx) +{ + struct volume_key *derived_key; + char *AfKey = NULL; + size_t AFEKSize; + struct crypt_pbkdf_type *pbkdf; + int r; + + if(hdr->keyblock[keyIndex].active != LUKS_KEY_DISABLED) { + log_err(ctx, _("Key slot %d active, purge first."), keyIndex); + return -EINVAL; + } + + /* LUKS keyslot has always at least 4000 stripes according to specification */ + if(hdr->keyblock[keyIndex].stripes < 4000) { + log_err(ctx, _("Key slot %d material includes too few stripes. Header manipulation?"), + keyIndex); + return -EINVAL; + } + + log_dbg(ctx, "Calculating data for key slot %d", keyIndex); + pbkdf = crypt_get_pbkdf(ctx); + r = crypt_benchmark_pbkdf_internal(ctx, pbkdf, vk->keylength); + if (r < 0) + return r; + assert(pbkdf->iterations); + + /* + * Final iteration count is at least LUKS_SLOT_ITERATIONS_MIN + */ + hdr->keyblock[keyIndex].passwordIterations = + at_least(pbkdf->iterations, LUKS_SLOT_ITERATIONS_MIN); + log_dbg(ctx, "Key slot %d use %" PRIu32 " password iterations.", keyIndex, + hdr->keyblock[keyIndex].passwordIterations); + + derived_key = crypt_alloc_volume_key(hdr->keyBytes, NULL); + if (!derived_key) + return -ENOMEM; + + r = crypt_random_get(ctx, hdr->keyblock[keyIndex].passwordSalt, + LUKS_SALTSIZE, CRYPT_RND_SALT); + if (r < 0) + goto out; + + r = crypt_pbkdf(CRYPT_KDF_PBKDF2, hdr->hashSpec, password, passwordLen, + hdr->keyblock[keyIndex].passwordSalt, LUKS_SALTSIZE, + derived_key->key, hdr->keyBytes, + hdr->keyblock[keyIndex].passwordIterations, 0, 0); + if (r < 0) + goto out; + + /* + * AF splitting, the masterkey stored in vk->key is split to AfKey + */ + assert(vk->keylength == hdr->keyBytes); + AFEKSize = AF_split_sectors(vk->keylength, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE; + AfKey = crypt_safe_alloc(AFEKSize); + if (!AfKey) { + r = -ENOMEM; + goto out; + } + + log_dbg(ctx, "Using hash %s for AF in key slot %d, %d stripes", + hdr->hashSpec, keyIndex, hdr->keyblock[keyIndex].stripes); + r = AF_split(ctx, vk->key, AfKey, vk->keylength, hdr->keyblock[keyIndex].stripes, hdr->hashSpec); + if (r < 0) + goto out; + + log_dbg(ctx, "Updating key slot %d [0x%04x] area.", keyIndex, + hdr->keyblock[keyIndex].keyMaterialOffset << 9); + /* Encryption via dm */ + r = LUKS_encrypt_to_storage(AfKey, + AFEKSize, + hdr->cipherName, hdr->cipherMode, + derived_key, + hdr->keyblock[keyIndex].keyMaterialOffset, + ctx); + if (r < 0) + goto out; + + /* Mark the key as active in phdr */ + r = LUKS_keyslot_set(hdr, (int)keyIndex, 1, ctx); + if (r < 0) + goto out; + + r = LUKS_write_phdr(hdr, ctx); + if (r < 0) + goto out; + + r = 0; +out: + crypt_safe_free(AfKey); + crypt_free_volume_key(derived_key); + return r; +} + +/* Check whether a volume key is invalid. */ +int LUKS_verify_volume_key(const struct luks_phdr *hdr, + const struct volume_key *vk) +{ + char checkHashBuf[LUKS_DIGESTSIZE]; + + if (crypt_pbkdf(CRYPT_KDF_PBKDF2, hdr->hashSpec, vk->key, vk->keylength, + hdr->mkDigestSalt, LUKS_SALTSIZE, + checkHashBuf, LUKS_DIGESTSIZE, + hdr->mkDigestIterations, 0, 0) < 0) + return -EINVAL; + + if (memcmp(checkHashBuf, hdr->mkDigest, LUKS_DIGESTSIZE)) + return -EPERM; + + return 0; +} + +/* Try to open a particular key slot */ +static int LUKS_open_key(unsigned int keyIndex, + const char *password, + size_t passwordLen, + struct luks_phdr *hdr, + struct volume_key **vk, + struct crypt_device *ctx) +{ + crypt_keyslot_info ki = LUKS_keyslot_info(hdr, keyIndex); + struct volume_key *derived_key; + char *AfKey = NULL; + size_t AFEKSize; + int r; + + log_dbg(ctx, "Trying to open key slot %d [%s].", keyIndex, + dbg_slot_state(ki)); + + if (ki < CRYPT_SLOT_ACTIVE) + return -ENOENT; + + derived_key = crypt_alloc_volume_key(hdr->keyBytes, NULL); + if (!derived_key) + return -ENOMEM; + + *vk = crypt_alloc_volume_key(hdr->keyBytes, NULL); + if (!*vk) { + r = -ENOMEM; + goto out; + } + + AFEKSize = AF_split_sectors(hdr->keyBytes, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE; + AfKey = crypt_safe_alloc(AFEKSize); + if (!AfKey) { + r = -ENOMEM; + goto out; + } + + r = crypt_pbkdf(CRYPT_KDF_PBKDF2, hdr->hashSpec, password, passwordLen, + hdr->keyblock[keyIndex].passwordSalt, LUKS_SALTSIZE, + derived_key->key, hdr->keyBytes, + hdr->keyblock[keyIndex].passwordIterations, 0, 0); + if (r < 0) { + log_err(ctx, _("Cannot open keyslot (using hash %s)."), hdr->hashSpec); + goto out; + } + + log_dbg(ctx, "Reading key slot %d area.", keyIndex); + r = LUKS_decrypt_from_storage(AfKey, + AFEKSize, + hdr->cipherName, hdr->cipherMode, + derived_key, + hdr->keyblock[keyIndex].keyMaterialOffset, + ctx); + if (r < 0) + goto out; + + r = AF_merge(ctx, AfKey, (*vk)->key, (*vk)->keylength, hdr->keyblock[keyIndex].stripes, hdr->hashSpec); + if (r < 0) + goto out; + + r = LUKS_verify_volume_key(hdr, *vk); + + /* Allow only empty passphrase with null cipher */ + if (!r && crypt_is_cipher_null(hdr->cipherName) && passwordLen) + r = -EPERM; +out: + if (r < 0) { + crypt_free_volume_key(*vk); + *vk = NULL; + } + crypt_safe_free(AfKey); + crypt_free_volume_key(derived_key); + return r; +} + +int LUKS_open_key_with_hdr(int keyIndex, + const char *password, + size_t passwordLen, + struct luks_phdr *hdr, + struct volume_key **vk, + struct crypt_device *ctx) +{ + unsigned int i, tried = 0; + int r; + + if (keyIndex >= 0) { + r = LUKS_open_key(keyIndex, password, passwordLen, hdr, vk, ctx); + return (r < 0) ? r : keyIndex; + } + + for (i = 0; i < LUKS_NUMKEYS; i++) { + r = LUKS_open_key(i, password, passwordLen, hdr, vk, ctx); + if (r == 0) + return i; + + /* Do not retry for errors that are no -EPERM or -ENOENT, + former meaning password wrong, latter key slot inactive */ + if ((r != -EPERM) && (r != -ENOENT)) + return r; + if (r == -EPERM) + tried++; + } + /* Warning, early returns above */ + return tried ? -EPERM : -ENOENT; +} + +int LUKS_del_key(unsigned int keyIndex, + struct luks_phdr *hdr, + struct crypt_device *ctx) +{ + struct device *device = crypt_metadata_device(ctx); + unsigned int startOffset, endOffset; + int r; + + r = LUKS_read_phdr(hdr, 1, 0, ctx); + if (r) + return r; + + r = LUKS_keyslot_set(hdr, keyIndex, 0, ctx); + if (r) { + log_err(ctx, _("Key slot %d is invalid, please select keyslot between 0 and %d."), + keyIndex, LUKS_NUMKEYS - 1); + return r; + } + + /* secure deletion of key material */ + startOffset = hdr->keyblock[keyIndex].keyMaterialOffset; + endOffset = startOffset + AF_split_sectors(hdr->keyBytes, hdr->keyblock[keyIndex].stripes); + + r = crypt_wipe_device(ctx, device, CRYPT_WIPE_SPECIAL, startOffset * SECTOR_SIZE, + (endOffset - startOffset) * SECTOR_SIZE, + (endOffset - startOffset) * SECTOR_SIZE, NULL, NULL); + if (r) { + if (r == -EACCES) { + log_err(ctx, _("Cannot write to device %s, permission denied."), + device_path(device)); + r = -EINVAL; + } else + log_err(ctx, _("Cannot wipe device %s."), + device_path(device)); + return r; + } + + /* Wipe keyslot info */ + memset(&hdr->keyblock[keyIndex].passwordSalt, 0, LUKS_SALTSIZE); + hdr->keyblock[keyIndex].passwordIterations = 0; + + r = LUKS_write_phdr(hdr, ctx); + + return r; +} + +crypt_keyslot_info LUKS_keyslot_info(struct luks_phdr *hdr, int keyslot) +{ + int i; + + if(keyslot >= LUKS_NUMKEYS || keyslot < 0) + return CRYPT_SLOT_INVALID; + + if (hdr->keyblock[keyslot].active == LUKS_KEY_DISABLED) + return CRYPT_SLOT_INACTIVE; + + if (hdr->keyblock[keyslot].active != LUKS_KEY_ENABLED) + return CRYPT_SLOT_INVALID; + + for(i = 0; i < LUKS_NUMKEYS; i++) + if(i != keyslot && hdr->keyblock[i].active == LUKS_KEY_ENABLED) + return CRYPT_SLOT_ACTIVE; + + return CRYPT_SLOT_ACTIVE_LAST; +} + +int LUKS_keyslot_find_empty(struct luks_phdr *hdr) +{ + int i; + + for (i = 0; i < LUKS_NUMKEYS; i++) + if(hdr->keyblock[i].active == LUKS_KEY_DISABLED) + break; + + if (i == LUKS_NUMKEYS) + return -EINVAL; + + return i; +} + +int LUKS_keyslot_active_count(struct luks_phdr *hdr) +{ + int i, num = 0; + + for (i = 0; i < LUKS_NUMKEYS; i++) + if(hdr->keyblock[i].active == LUKS_KEY_ENABLED) + num++; + + return num; +} + +int LUKS_keyslot_set(struct luks_phdr *hdr, int keyslot, int enable, struct crypt_device *ctx) +{ + crypt_keyslot_info ki = LUKS_keyslot_info(hdr, keyslot); + + if (ki == CRYPT_SLOT_INVALID) + return -EINVAL; + + hdr->keyblock[keyslot].active = enable ? LUKS_KEY_ENABLED : LUKS_KEY_DISABLED; + log_dbg(ctx, "Key slot %d was %s in LUKS header.", keyslot, enable ? "enabled" : "disabled"); + return 0; +} + +int LUKS1_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint32_t flags) +{ + int r; + struct crypt_dm_active_device dmd = { + .flags = flags, + .uuid = crypt_get_uuid(cd), + }; + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), + vk, crypt_get_cipher_spec(cd), crypt_get_iv_offset(cd), + crypt_get_data_offset(cd), crypt_get_integrity(cd), + crypt_get_integrity_tag_size(cd), crypt_get_sector_size(cd)); + if (!r) + r = create_or_reload_device(cd, name, CRYPT_LUKS1, &dmd); + + dm_targets_free(cd, &dmd); + + return r; +} + +int LUKS_wipe_header_areas(struct luks_phdr *hdr, + struct crypt_device *ctx) +{ + int i, r; + uint64_t offset, length; + size_t wipe_block; + + /* Wipe complete header, keyslots and padding areas with zeroes. */ + offset = 0; + length = (uint64_t)hdr->payloadOffset * SECTOR_SIZE; + wipe_block = 1024 * 1024; + + /* On detached header or bogus header, wipe at least the first 4k */ + if (length == 0 || length > (LUKS_MAX_KEYSLOT_SIZE * LUKS_NUMKEYS)) { + length = 4096; + wipe_block = 4096; + } + + log_dbg(ctx, "Wiping LUKS areas (0x%06" PRIx64 " - 0x%06" PRIx64") with zeroes.", + offset, length + offset); + + r = crypt_wipe_device(ctx, crypt_metadata_device(ctx), CRYPT_WIPE_ZERO, + offset, length, wipe_block, NULL, NULL); + if (r < 0) + return r; + + /* Wipe keyslots areas */ + wipe_block = 1024 * 1024; + for (i = 0; i < LUKS_NUMKEYS; i++) { + r = LUKS_keyslot_area(hdr, i, &offset, &length); + if (r < 0) + return r; + + /* Ignore too big LUKS1 keyslots here */ + if (length > LUKS_MAX_KEYSLOT_SIZE || + offset > (LUKS_MAX_KEYSLOT_SIZE - length)) + continue; + + if (length == 0 || offset < 4096) + return -EINVAL; + + log_dbg(ctx, "Wiping keyslot %i area (0x%06" PRIx64 " - 0x%06" PRIx64") with random data.", + i, offset, length + offset); + + r = crypt_wipe_device(ctx, crypt_metadata_device(ctx), CRYPT_WIPE_RANDOM, + offset, length, wipe_block, NULL, NULL); + if (r < 0) + return r; + } + + return r; +} + +int LUKS_keyslot_pbkdf(struct luks_phdr *hdr, int keyslot, struct crypt_pbkdf_type *pbkdf) +{ + if (LUKS_keyslot_info(hdr, keyslot) < CRYPT_SLOT_ACTIVE) + return -EINVAL; + + pbkdf->type = CRYPT_KDF_PBKDF2; + pbkdf->hash = hdr->hashSpec; + pbkdf->iterations = hdr->keyblock[keyslot].passwordIterations; + pbkdf->max_memory_kb = 0; + pbkdf->parallel_threads = 0; + pbkdf->time_ms = 0; + pbkdf->flags = 0; + return 0; +} diff --git a/lib/luks1/luks.h b/lib/luks1/luks.h new file mode 100644 index 0000000..2b5132a --- /dev/null +++ b/lib/luks1/luks.h @@ -0,0 +1,194 @@ +/* + * LUKS - Linux Unified Key Setup + * + * Copyright (C) 2004-2006 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef INCLUDED_CRYPTSETUP_LUKS_LUKS_H +#define INCLUDED_CRYPTSETUP_LUKS_LUKS_H + +/* + * LUKS partition header + */ + +#include "libcryptsetup.h" + +#define LUKS_CIPHERNAME_L 32 +#define LUKS_CIPHERMODE_L 32 +#define LUKS_HASHSPEC_L 32 +#define LUKS_DIGESTSIZE 20 // since SHA1 +#define LUKS_HMACSIZE 32 +#define LUKS_SALTSIZE 32 +#define LUKS_NUMKEYS 8 + +// Minimal number of iterations +#define LUKS_MKD_ITERATIONS_MIN 1000 +#define LUKS_SLOT_ITERATIONS_MIN 1000 + +// Iteration time for digest in ms +#define LUKS_MKD_ITERATIONS_MS 125 + +#define LUKS_KEY_DISABLED_OLD 0 +#define LUKS_KEY_ENABLED_OLD 0xCAFE + +#define LUKS_KEY_DISABLED 0x0000DEAD +#define LUKS_KEY_ENABLED 0x00AC71F3 + +#define LUKS_STRIPES 4000 + +// partition header starts with magic +#define LUKS_MAGIC {'L','U','K','S', 0xba, 0xbe}; +#define LUKS_MAGIC_L 6 + +/* Actually we need only 37, but we don't want struct autoaligning to kick in */ +#define UUID_STRING_L 40 + +/* Offset to keyslot area [in bytes] */ +#define LUKS_ALIGN_KEYSLOTS 4096 + +/* Maximal LUKS header size, for wipe [in bytes] */ +#define LUKS_MAX_KEYSLOT_SIZE 0x1000000 /* 16 MB, up to 32768 bits key */ + +/* Any integer values are stored in network byte order on disk and must be +converted */ + +struct volume_key; +struct device_backend; + +struct luks_phdr { + char magic[LUKS_MAGIC_L]; + uint16_t version; + char cipherName[LUKS_CIPHERNAME_L]; + char cipherMode[LUKS_CIPHERMODE_L]; + char hashSpec[LUKS_HASHSPEC_L]; + uint32_t payloadOffset; + uint32_t keyBytes; + char mkDigest[LUKS_DIGESTSIZE]; + char mkDigestSalt[LUKS_SALTSIZE]; + uint32_t mkDigestIterations; + char uuid[UUID_STRING_L]; + + struct { + uint32_t active; + + /* parameters used for password processing */ + uint32_t passwordIterations; + char passwordSalt[LUKS_SALTSIZE]; + + /* parameters used for AF store/load */ + uint32_t keyMaterialOffset; + uint32_t stripes; + } keyblock[LUKS_NUMKEYS]; + + /* Align it to 512 sector size */ + char _padding[432]; +}; + +int LUKS_verify_volume_key(const struct luks_phdr *hdr, + const struct volume_key *vk); + +int LUKS_check_cipher(struct crypt_device *ctx, + size_t keylength, + const char *cipher, + const char *cipher_mode); + +int LUKS_generate_phdr(struct luks_phdr *header, + const struct volume_key *vk, + const char *cipherName, + const char *cipherMode, + const char *hashSpec, + const char *uuid, + uint64_t data_offset, + uint64_t align_offset, + uint64_t required_alignment, + struct crypt_device *ctx); + +int LUKS_read_phdr( + struct luks_phdr *hdr, + int require_luks_device, + int repair, + struct crypt_device *ctx); + +int LUKS_read_phdr_backup( + const char *backup_file, + struct luks_phdr *hdr, + int require_luks_device, + struct crypt_device *ctx); + +int LUKS_hdr_uuid_set( + struct luks_phdr *hdr, + const char *uuid, + struct crypt_device *ctx); + +int LUKS_hdr_backup( + const char *backup_file, + struct crypt_device *ctx); + +int LUKS_hdr_restore( + const char *backup_file, + struct luks_phdr *hdr, + struct crypt_device *ctx); + +int LUKS_write_phdr( + struct luks_phdr *hdr, + struct crypt_device *ctx); + +int LUKS_set_key( + unsigned int keyIndex, + const char *password, + size_t passwordLen, + struct luks_phdr *hdr, + struct volume_key *vk, + struct crypt_device *ctx); + +int LUKS_open_key_with_hdr( + int keyIndex, + const char *password, + size_t passwordLen, + struct luks_phdr *hdr, + struct volume_key **vk, + struct crypt_device *ctx); + +int LUKS_del_key( + unsigned int keyIndex, + struct luks_phdr *hdr, + struct crypt_device *ctx); + +int LUKS_wipe_header_areas(struct luks_phdr *hdr, + struct crypt_device *ctx); + +crypt_keyslot_info LUKS_keyslot_info(struct luks_phdr *hdr, int keyslot); +int LUKS_keyslot_find_empty(struct luks_phdr *hdr); +int LUKS_keyslot_active_count(struct luks_phdr *hdr); +int LUKS_keyslot_set(struct luks_phdr *hdr, int keyslot, int enable, + struct crypt_device *ctx); +int LUKS_keyslot_area(const struct luks_phdr *hdr, + int keyslot, + uint64_t *offset, + uint64_t *length); +size_t LUKS_device_sectors(const struct luks_phdr *hdr); +size_t LUKS_keyslots_offset(const struct luks_phdr *hdr); +int LUKS_keyslot_pbkdf(struct luks_phdr *hdr, int keyslot, + struct crypt_pbkdf_type *pbkdf); + +int LUKS1_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint32_t flags); + +#endif diff --git a/lib/luks2/luks2.h b/lib/luks2/luks2.h new file mode 100644 index 0000000..158c023 --- /dev/null +++ b/lib/luks2/luks2.h @@ -0,0 +1,459 @@ +/* + * LUKS - Linux Unified Key Setup v2 + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_LUKS2_ONDISK_H +#define _CRYPTSETUP_LUKS2_ONDISK_H + +#include +#include +#include + +#include "libcryptsetup.h" + +#define LUKS2_MAGIC_1ST "LUKS\xba\xbe" +#define LUKS2_MAGIC_2ND "SKUL\xba\xbe" +#define LUKS2_MAGIC_L 6 +#define LUKS2_UUID_L 40 +#define LUKS2_LABEL_L 48 +#define LUKS2_SALT_L 64 +#define LUKS2_CHECKSUM_ALG_L 32 +#define LUKS2_CHECKSUM_L 64 + +#define LUKS2_KEYSLOTS_MAX 32 +#define LUKS2_TOKENS_MAX 32 +#define LUKS2_SEGMENT_MAX 32 + +#define LUKS2_BUILTIN_TOKEN_PREFIX "luks2-" +#define LUKS2_BUILTIN_TOKEN_PREFIX_LEN 6 + +#define LUKS2_TOKEN_KEYRING LUKS2_BUILTIN_TOKEN_PREFIX "keyring" + +#define LUKS2_DIGEST_MAX 8 + +#define CRYPT_ANY_SEGMENT -1 +#define CRYPT_DEFAULT_SEGMENT -2 +#define CRYPT_ONE_SEGMENT -3 + +#define CRYPT_ANY_DIGEST -1 + +/* 20 MiBs */ +#define LUKS2_DEFAULT_NONE_REENCRYPTION_LENGTH 0x1400000 + +/* 1 GiB */ +#define LUKS2_REENCRYPT_MAX_HOTZONE_LENGTH 0x40000000 + +struct device; +struct luks2_reencrypt; +struct crypt_lock_handle; +struct crypt_dm_active_device; +struct luks_phdr; /* LUKS1 for conversion */ + +/* + * LUKS2 header on-disk. + * + * Binary header is followed by JSON area. + * JSON area is followed by keyslot area and data area, + * these are described in JSON metadata. + * + * Note: uuid, csum_alg are intentionally on the same offset as LUKS1 + * (checksum alg replaces hash in LUKS1) + * + * String (char) should be zero terminated. + * Padding should be wiped. + * Checksum is calculated with csum zeroed (+ full JSON area). + */ +struct luks2_hdr_disk { + char magic[LUKS2_MAGIC_L]; + uint16_t version; /* Version 2 */ + uint64_t hdr_size; /* in bytes, including JSON area */ + uint64_t seqid; /* increased on every update */ + char label[LUKS2_LABEL_L]; + char checksum_alg[LUKS2_CHECKSUM_ALG_L]; + uint8_t salt[LUKS2_SALT_L]; /* unique for every header/offset */ + char uuid[LUKS2_UUID_L]; + char subsystem[LUKS2_LABEL_L]; /* owner subsystem label */ + uint64_t hdr_offset; /* offset from device start in bytes */ + char _padding[184]; + uint8_t csum[LUKS2_CHECKSUM_L]; + char _padding4096[7*512]; + /* JSON area starts here */ +} __attribute__ ((packed)); + +/* + * LUKS2 header in-memory. + */ +struct luks2_hdr { + size_t hdr_size; + uint64_t seqid; + unsigned int version; + char label[LUKS2_LABEL_L]; + char subsystem[LUKS2_LABEL_L]; + char checksum_alg[LUKS2_CHECKSUM_ALG_L]; + uint8_t salt1[LUKS2_SALT_L]; + uint8_t salt2[LUKS2_SALT_L]; + char uuid[LUKS2_UUID_L]; + void *jobj; +}; + +struct luks2_keyslot_params { + enum { LUKS2_KEYSLOT_AF_LUKS1 = 0 } af_type; + enum { LUKS2_KEYSLOT_AREA_RAW = 0 } area_type; + + union { + struct { + char hash[LUKS2_CHECKSUM_ALG_L]; // or include luks.h + unsigned int stripes; + } luks1; + } af; + + union { + struct { + char encryption[65]; // or include utils_crypt.h + size_t key_size; + } raw; + } area; +}; + +/* + * Supportable header sizes (hdr_disk + JSON area) + * Also used as offset for the 2nd header. + */ +#define LUKS2_HDR_16K_LEN 0x4000 + +#define LUKS2_HDR_BIN_LEN sizeof(struct luks2_hdr_disk) + +//#define LUKS2_DEFAULT_HDR_SIZE 0x400000 /* 4 MiB */ +#define LUKS2_DEFAULT_HDR_SIZE 0x1000000 /* 16 MiB */ + +#define LUKS2_MAX_KEYSLOTS_SIZE 0x8000000 /* 128 MiB */ + +#define LUKS2_HDR_OFFSET_MAX 0x400000 /* 4 MiB */ + +/* Offsets for secondary header (for scan if primary header is corrupted). */ +#define LUKS2_HDR2_OFFSETS { 0x04000, 0x008000, 0x010000, 0x020000, \ + 0x40000, 0x080000, 0x100000, 0x200000, LUKS2_HDR_OFFSET_MAX } + +int LUKS2_hdr_version_unlocked(struct crypt_device *cd, + const char *backup_file); + +int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, int repair); +int LUKS2_hdr_write(struct crypt_device *cd, struct luks2_hdr *hdr); +int LUKS2_hdr_write_force(struct crypt_device *cd, struct luks2_hdr *hdr); +int LUKS2_hdr_dump(struct crypt_device *cd, struct luks2_hdr *hdr); + +int LUKS2_hdr_uuid(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *uuid); + +int LUKS2_hdr_labels(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *label, + const char *subsystem, + int commit); + +void LUKS2_hdr_free(struct crypt_device *cd, struct luks2_hdr *hdr); + +int LUKS2_hdr_backup(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *backup_file); +int LUKS2_hdr_restore(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *backup_file); + +uint64_t LUKS2_hdr_and_areas_size(struct luks2_hdr *hdr); +uint64_t LUKS2_keyslots_size(struct luks2_hdr *hdr); +uint64_t LUKS2_metadata_size(struct luks2_hdr *hdr); + +int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd, const char *cipher_spec); + +/* + * Generic LUKS2 keyslot + */ +int LUKS2_keyslot_open(struct crypt_device *cd, + int keyslot, + int segment, + const char *password, + size_t password_len, + struct volume_key **vk); + +int LUKS2_keyslot_open_all_segments(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *password, + size_t password_len, + struct volume_key **vks); + +int LUKS2_keyslot_store(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const char *password, + size_t password_len, + const struct volume_key *vk, + const struct luks2_keyslot_params *params); + +int LUKS2_keyslot_wipe(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int wipe_area_only); + +crypt_keyslot_priority LUKS2_keyslot_priority_get(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot); + +int LUKS2_keyslot_priority_set(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + crypt_keyslot_priority priority, + int commit); + +/* + * Generic LUKS2 token + */ +int LUKS2_token_json_get(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char **json); + +int LUKS2_token_assign(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int token, + int assign, + int commit); + +int LUKS2_token_is_assigned(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int token); + +int LUKS2_token_assignment_copy(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot_from, + int keyslot_to, + int commit); + +int LUKS2_token_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *json, + int commit); + +crypt_token_info LUKS2_token_status(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char **type); + +int LUKS2_builtin_token_get(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *type, + void *params); + +int LUKS2_builtin_token_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *type, + const void *params, + int commit); + +int LUKS2_token_open_and_activate(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *name, + uint32_t flags, + void *usrptr); + +int LUKS2_token_open_and_activate_any(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *name, + uint32_t flags); + +/* + * Generic LUKS2 digest + */ +int LUKS2_digest_any_matching(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk); + +int LUKS2_digest_verify_by_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, + int segment, + const struct volume_key *vk); + +int LUKS2_digest_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk, + int keyslot); + +int LUKS2_digest_assign(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int digest, + int assign, + int commit); + +int LUKS2_digest_segment_assign(struct crypt_device *cd, + struct luks2_hdr *hdr, + int segment, + int digest, + int assign, + int commit); + +int LUKS2_digest_by_keyslot(struct luks2_hdr *hdr, int keyslot); + +int LUKS2_digest_by_segment(struct luks2_hdr *hdr, int segment); + +int LUKS2_digest_create(struct crypt_device *cd, + const char *type, + struct luks2_hdr *hdr, + const struct volume_key *vk); + +/* + * LUKS2 generic + */ +int LUKS2_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint32_t flags); + +int LUKS2_activate_multi(struct crypt_device *cd, + const char *name, + struct volume_key *vks, + uint64_t device_size, + uint32_t flags); + +int LUKS2_deactivate(struct crypt_device *cd, + const char *name, + struct luks2_hdr *hdr, + struct crypt_dm_active_device *dmd, + uint32_t flags); + +int LUKS2_generate_hdr( + struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk, + const char *cipherName, + const char *cipherMode, + const char *integrity, + const char *uuid, + unsigned int sector_size, + uint64_t data_offset, + uint64_t align_offset, + uint64_t required_alignment, + uint64_t metadata_size, + uint64_t keyslots_size); + +int LUKS2_check_metadata_area_size(uint64_t metadata_size); +int LUKS2_check_keyslots_area_size(uint64_t keyslots_size); + +int LUKS2_wipe_header_areas(struct crypt_device *cd, + struct luks2_hdr *hdr, bool detached_header); + +uint64_t LUKS2_get_data_offset(struct luks2_hdr *hdr); +int LUKS2_get_data_size(struct luks2_hdr *hdr, uint64_t *size, bool *dynamic); +int LUKS2_get_sector_size(struct luks2_hdr *hdr); +const char *LUKS2_get_cipher(struct luks2_hdr *hdr, int segment); +const char *LUKS2_get_integrity(struct luks2_hdr *hdr, int segment); +int LUKS2_keyslot_params_default(struct crypt_device *cd, struct luks2_hdr *hdr, + struct luks2_keyslot_params *params); +int LUKS2_get_volume_key_size(struct luks2_hdr *hdr, int segment); +int LUKS2_get_keyslot_stored_key_size(struct luks2_hdr *hdr, int keyslot); +const char *LUKS2_get_keyslot_cipher(struct luks2_hdr *hdr, int keyslot, size_t *key_size); +int LUKS2_keyslot_find_empty(struct luks2_hdr *hdr); +int LUKS2_keyslot_active_count(struct luks2_hdr *hdr, int segment); +crypt_keyslot_info LUKS2_keyslot_info(struct luks2_hdr *hdr, int keyslot); +int LUKS2_keyslot_area(struct luks2_hdr *hdr, + int keyslot, + uint64_t *offset, + uint64_t *length); +int LUKS2_keyslot_pbkdf(struct luks2_hdr *hdr, int keyslot, struct crypt_pbkdf_type *pbkdf); + +/* + * Permanent activation flags stored in header + */ +int LUKS2_config_get_flags(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t *flags); +int LUKS2_config_set_flags(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t flags); + +/* + * Requirements for device activation or header modification + */ +int LUKS2_config_get_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t *reqs); +int LUKS2_config_set_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t reqs, bool commit); + +int LUKS2_config_get_reencrypt_version(struct luks2_hdr *hdr, uint32_t *version); + +int LUKS2_unmet_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t reqs_mask, int quiet); + +int LUKS2_key_description_by_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int segment); +int LUKS2_volume_key_load_in_keyring_by_keyslot(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int keyslot); +int LUKS2_volume_key_load_in_keyring_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int digest); + +int LUKS2_luks1_to_luks2(struct crypt_device *cd, + struct luks_phdr *hdr1, + struct luks2_hdr *hdr2); +int LUKS2_luks2_to_luks1(struct crypt_device *cd, + struct luks2_hdr *hdr2, + struct luks_phdr *hdr1); + +/* + * LUKS2 reencryption + */ +int LUKS2_reencrypt_locked_recovery_by_passphrase(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size, + uint32_t flags, + struct volume_key **vks); + +void LUKS2_reencrypt_free(struct crypt_device *cd, + struct luks2_reencrypt *rh); + +crypt_reencrypt_info LUKS2_reencrypt_status(struct luks2_hdr *hdr); + +crypt_reencrypt_info LUKS2_reencrypt_get_params(struct luks2_hdr *hdr, + struct crypt_params_reencrypt *params); + +int LUKS2_reencrypt_lock(struct crypt_device *cd, + struct crypt_lock_handle **reencrypt_lock); + +int LUKS2_reencrypt_lock_by_dm_uuid(struct crypt_device *cd, + const char *dm_uuid, + struct crypt_lock_handle **reencrypt_lock); + +void LUKS2_reencrypt_unlock(struct crypt_device *cd, + struct crypt_lock_handle *reencrypt_lock); + +int LUKS2_reencrypt_check_device_size(struct crypt_device *cd, + struct luks2_hdr *hdr, + uint64_t check_size, + uint64_t *dev_size, + bool activation, + bool dynamic); + +int LUKS2_reencrypt_digest_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks); + +#endif diff --git a/lib/luks2/luks2_digest.c b/lib/luks2/luks2_digest.c new file mode 100644 index 0000000..6845a6b --- /dev/null +++ b/lib/luks2/luks2_digest.c @@ -0,0 +1,459 @@ +/* + * LUKS - Linux Unified Key Setup v2, digest handling + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +extern const digest_handler PBKDF2_digest; + +static const digest_handler *digest_handlers[LUKS2_DIGEST_MAX] = { + &PBKDF2_digest, + NULL +}; + +static const digest_handler *LUKS2_digest_handler_type(struct crypt_device *cd, const char *type) +{ + int i; + + for (i = 0; i < LUKS2_DIGEST_MAX && digest_handlers[i]; i++) { + if (!strcmp(digest_handlers[i]->name, type)) + return digest_handlers[i]; + } + + return NULL; +} + +static const digest_handler *LUKS2_digest_handler(struct crypt_device *cd, int digest) +{ + struct luks2_hdr *hdr; + json_object *jobj1, *jobj2; + + if (digest < 0) + return NULL; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return NULL; + + if (!(jobj1 = LUKS2_get_digest_jobj(hdr, digest))) + return NULL; + + if (!json_object_object_get_ex(jobj1, "type", &jobj2)) + return NULL; + + return LUKS2_digest_handler_type(cd, json_object_get_string(jobj2)); +} + +static int LUKS2_digest_find_free(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + int digest = 0; + + while (LUKS2_get_digest_jobj(hdr, digest) && digest < LUKS2_DIGEST_MAX) + digest++; + + return digest < LUKS2_DIGEST_MAX ? digest : -1; +} + +int LUKS2_digest_create(struct crypt_device *cd, + const char *type, + struct luks2_hdr *hdr, + const struct volume_key *vk) +{ + int digest; + const digest_handler *dh; + + dh = LUKS2_digest_handler_type(cd, type); + if (!dh) + return -EINVAL; + + digest = LUKS2_digest_find_free(cd, hdr); + if (digest < 0) + return -EINVAL; + + log_dbg(cd, "Creating new digest %d (%s).", digest, type); + + return dh->store(cd, digest, vk->key, vk->keylength) ?: digest; +} + +int LUKS2_digest_by_keyslot(struct luks2_hdr *hdr, int keyslot) +{ + char keyslot_name[16]; + json_object *jobj_digests, *jobj_digest_keyslots; + + if (snprintf(keyslot_name, sizeof(keyslot_name), "%u", keyslot) < 1) + return -ENOMEM; + + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + + json_object_object_foreach(jobj_digests, key, val) { + json_object_object_get_ex(val, "keyslots", &jobj_digest_keyslots); + if (LUKS2_array_jobj(jobj_digest_keyslots, keyslot_name)) + return atoi(key); + } + + return -ENOENT; +} + +int LUKS2_digest_verify_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, + int digest, + const struct volume_key *vk) +{ + const digest_handler *h; + int r; + + h = LUKS2_digest_handler(cd, digest); + if (!h) + return -EINVAL; + + r = h->verify(cd, digest, vk->key, vk->keylength); + if (r < 0) { + log_dbg(cd, "Digest %d (%s) verify failed with %d.", digest, h->name, r); + return r; + } + + return digest; +} + +int LUKS2_digest_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk, + int keyslot) +{ + int digest; + + digest = LUKS2_digest_by_keyslot(hdr, keyslot); + if (digest < 0) + return digest; + + log_dbg(cd, "Verifying key from keyslot %d, digest %d.", keyslot, digest); + + return LUKS2_digest_verify_by_digest(cd, hdr, digest, vk); +} + +int LUKS2_digest_dump(struct crypt_device *cd, int digest) +{ + const digest_handler *h; + + if (!(h = LUKS2_digest_handler(cd, digest))) + return -EINVAL; + + return h->dump(cd, digest); +} + +int LUKS2_digest_any_matching(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk) +{ + int digest; + + for (digest = 0; digest < LUKS2_DIGEST_MAX; digest++) + if (LUKS2_digest_verify_by_digest(cd, hdr, digest, vk) == digest) + return digest; + + return -ENOENT; +} + +int LUKS2_digest_verify_by_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, + int segment, + const struct volume_key *vk) +{ + return LUKS2_digest_verify_by_digest(cd, hdr, LUKS2_digest_by_segment(hdr, segment), vk); +} + +/* FIXME: segment can have more digests */ +int LUKS2_digest_by_segment(struct luks2_hdr *hdr, int segment) +{ + char segment_name[16]; + json_object *jobj_digests, *jobj_digest_segments; + + if (segment == CRYPT_DEFAULT_SEGMENT) + segment = LUKS2_get_default_segment(hdr); + + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + + if (snprintf(segment_name, sizeof(segment_name), "%u", segment) < 1) + return -EINVAL; + + json_object_object_foreach(jobj_digests, key, val) { + json_object_object_get_ex(val, "segments", &jobj_digest_segments); + if (!LUKS2_array_jobj(jobj_digest_segments, segment_name)) + continue; + + return atoi(key); + } + + return -ENOENT; +} + +static int assign_one_digest(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, int digest, int assign) +{ + json_object *jobj1, *jobj_digest, *jobj_digest_keyslots; + char num[16]; + + log_dbg(cd, "Keyslot %i %s digest %i.", keyslot, assign ? "assigned to" : "unassigned from", digest); + + jobj_digest = LUKS2_get_digest_jobj(hdr, digest); + if (!jobj_digest) + return -EINVAL; + + json_object_object_get_ex(jobj_digest, "keyslots", &jobj_digest_keyslots); + if (!jobj_digest_keyslots) + return -EINVAL; + + if (snprintf(num, sizeof(num), "%d", keyslot) < 0) + return -EINVAL; + + if (assign) { + jobj1 = LUKS2_array_jobj(jobj_digest_keyslots, num); + if (!jobj1) + json_object_array_add(jobj_digest_keyslots, json_object_new_string(num)); + } else { + jobj1 = LUKS2_array_remove(jobj_digest_keyslots, num); + if (jobj1) + json_object_object_add(jobj_digest, "keyslots", jobj1); + } + + return 0; +} + +int LUKS2_digest_assign(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, int digest, int assign, int commit) +{ + json_object *jobj_digests; + int r = 0; + + if (digest == CRYPT_ANY_DIGEST) { + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + + json_object_object_foreach(jobj_digests, key, val) { + UNUSED(val); + r = assign_one_digest(cd, hdr, keyslot, atoi(key), assign); + if (r < 0) + break; + } + } else + r = assign_one_digest(cd, hdr, keyslot, digest, assign); + + if (r < 0) + return r; + + // FIXME: do not write header in nothing changed + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +static int assign_all_segments(struct crypt_device *cd, struct luks2_hdr *hdr, + int digest, int assign) +{ + json_object *jobj1, *jobj_digest, *jobj_digest_segments; + + jobj_digest = LUKS2_get_digest_jobj(hdr, digest); + if (!jobj_digest) + return -EINVAL; + + json_object_object_get_ex(jobj_digest, "segments", &jobj_digest_segments); + if (!jobj_digest_segments) + return -EINVAL; + + if (assign) { + json_object_object_foreach(LUKS2_get_segments_jobj(hdr), key, value) { + UNUSED(value); + jobj1 = LUKS2_array_jobj(jobj_digest_segments, key); + if (!jobj1) + json_object_array_add(jobj_digest_segments, json_object_new_string(key)); + } + } else { + jobj1 = json_object_new_array(); + if (!jobj1) + return -ENOMEM; + json_object_object_add(jobj_digest, "segments", jobj1); + } + + return 0; +} + +static int assign_one_segment(struct crypt_device *cd, struct luks2_hdr *hdr, + int segment, int digest, int assign) +{ + json_object *jobj1, *jobj_digest, *jobj_digest_segments; + char num[16]; + + log_dbg(cd, "Segment %i %s digest %i.", segment, assign ? "assigned to" : "unassigned from", digest); + + jobj_digest = LUKS2_get_digest_jobj(hdr, digest); + if (!jobj_digest) + return -EINVAL; + + json_object_object_get_ex(jobj_digest, "segments", &jobj_digest_segments); + if (!jobj_digest_segments) + return -EINVAL; + + if (snprintf(num, sizeof(num), "%d", segment) < 0) + return -EINVAL; + + if (assign) { + jobj1 = LUKS2_array_jobj(jobj_digest_segments, num); + if (!jobj1) + json_object_array_add(jobj_digest_segments, json_object_new_string(num)); + } else { + jobj1 = LUKS2_array_remove(jobj_digest_segments, num); + if (jobj1) + json_object_object_add(jobj_digest, "segments", jobj1); + } + + return 0; +} + +int LUKS2_digest_segment_assign(struct crypt_device *cd, struct luks2_hdr *hdr, + int segment, int digest, int assign, int commit) +{ + json_object *jobj_digests; + int r = 0; + + if (segment == CRYPT_DEFAULT_SEGMENT) + segment = LUKS2_get_default_segment(hdr); + + if (digest == CRYPT_ANY_DIGEST) { + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + + json_object_object_foreach(jobj_digests, key, val) { + UNUSED(val); + if (segment == CRYPT_ANY_SEGMENT) + r = assign_all_segments(cd, hdr, atoi(key), assign); + else + r = assign_one_segment(cd, hdr, segment, atoi(key), assign); + if (r < 0) + break; + } + } else { + if (segment == CRYPT_ANY_SEGMENT) + r = assign_all_segments(cd, hdr, digest, assign); + else + r = assign_one_segment(cd, hdr, segment, digest, assign); + } + + if (r < 0) + return r; + + // FIXME: do not write header in nothing changed + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +static int digest_unused(json_object *jobj_digest) +{ + json_object *jobj; + + json_object_object_get_ex(jobj_digest, "segments", &jobj); + if (!jobj || !json_object_is_type(jobj, json_type_array) || json_object_array_length(jobj) > 0) + return 0; + + json_object_object_get_ex(jobj_digest, "keyslots", &jobj); + if (!jobj || !json_object_is_type(jobj, json_type_array)) + return 0; + + return json_object_array_length(jobj) > 0 ? 0 : 1; +} + +void LUKS2_digests_erase_unused(struct crypt_device *cd, + struct luks2_hdr *hdr) +{ + json_object *jobj_digests; + + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + if (!jobj_digests || !json_object_is_type(jobj_digests, json_type_object)) + return; + + json_object_object_foreach(jobj_digests, key, val) { + if (digest_unused(val)) { + log_dbg(cd, "Erasing unused digest %d.", atoi(key)); + json_object_object_del(jobj_digests, key); + } + } +} + +/* Key description helpers */ +static char *get_key_description_by_digest(struct crypt_device *cd, int digest) +{ + char *desc, digest_str[3]; + int r; + size_t len; + + if (!crypt_get_uuid(cd)) + return NULL; + + r = snprintf(digest_str, sizeof(digest_str), "d%u", digest); + if (r < 0 || (size_t)r >= sizeof(digest_str)) + return NULL; + + /* "cryptsetup:-" + \0 */ + len = strlen(crypt_get_uuid(cd)) + strlen(digest_str) + 13; + + desc = malloc(len); + if (!desc) + return NULL; + + r = snprintf(desc, len, "%s:%s-%s", "cryptsetup", crypt_get_uuid(cd), digest_str); + if (r < 0 || (size_t)r >= len) { + free(desc); + return NULL; + } + + return desc; +} + +int LUKS2_key_description_by_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int segment) +{ + char *desc = get_key_description_by_digest(cd, LUKS2_digest_by_segment(hdr, segment)); + int r; + + r = crypt_volume_key_set_description(vk, desc); + free(desc); + return r; +} + +int LUKS2_volume_key_load_in_keyring_by_keyslot(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int keyslot) +{ + char *desc = get_key_description_by_digest(cd, LUKS2_digest_by_keyslot(hdr, keyslot)); + int r; + + r = crypt_volume_key_set_description(vk, desc); + if (!r) + r = crypt_volume_key_load_in_keyring(cd, vk); + + free(desc); + return r; +} + +int LUKS2_volume_key_load_in_keyring_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, struct volume_key *vk, int digest) +{ + char *desc = get_key_description_by_digest(cd, digest); + int r; + + r = crypt_volume_key_set_description(vk, desc); + if (!r) + r = crypt_volume_key_load_in_keyring(cd, vk); + + free(desc); + return r; +} diff --git a/lib/luks2/luks2_digest_pbkdf2.c b/lib/luks2/luks2_digest_pbkdf2.c new file mode 100644 index 0000000..03c6f49 --- /dev/null +++ b/lib/luks2/luks2_digest_pbkdf2.c @@ -0,0 +1,211 @@ +/* + * LUKS - Linux Unified Key Setup v2, PBKDF2 digest handler (LUKS1 compatible) + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +#define LUKS_DIGESTSIZE 20 // since SHA1 +#define LUKS_SALTSIZE 32 +#define LUKS_MKD_ITERATIONS_MS 125 + +static int PBKDF2_digest_verify(struct crypt_device *cd, + int digest, + const char *volume_key, + size_t volume_key_len) +{ + char checkHashBuf[64]; + json_object *jobj_digest, *jobj1; + const char *hashSpec; + char *mkDigest = NULL, mkDigestSalt[LUKS_SALTSIZE]; + unsigned int mkDigestIterations; + size_t len; + int r; + + /* This can be done only for internally linked digests */ + jobj_digest = LUKS2_get_digest_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), digest); + if (!jobj_digest) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_digest, "hash", &jobj1)) + return -EINVAL; + hashSpec = json_object_get_string(jobj1); + + if (!json_object_object_get_ex(jobj_digest, "iterations", &jobj1)) + return -EINVAL; + mkDigestIterations = json_object_get_int64(jobj1); + + if (!json_object_object_get_ex(jobj_digest, "salt", &jobj1)) + return -EINVAL; + len = sizeof(mkDigestSalt); + if (!base64_decode(json_object_get_string(jobj1), + json_object_get_string_len(jobj1), mkDigestSalt, &len)) + return -EINVAL; + if (len != LUKS_SALTSIZE) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_digest, "digest", &jobj1)) + return -EINVAL; + len = 0; + if (!base64_decode_alloc(json_object_get_string(jobj1), + json_object_get_string_len(jobj1), &mkDigest, &len)) + return -EINVAL; + if (len < LUKS_DIGESTSIZE || + len > sizeof(checkHashBuf) || + (len != LUKS_DIGESTSIZE && len != (size_t)crypt_hash_size(hashSpec))) { + free(mkDigest); + return -EINVAL; + } + + r = -EPERM; + if (crypt_pbkdf(CRYPT_KDF_PBKDF2, hashSpec, volume_key, volume_key_len, + mkDigestSalt, LUKS_SALTSIZE, + checkHashBuf, len, + mkDigestIterations, 0, 0) < 0) { + r = -EINVAL; + } else { + if (memcmp(checkHashBuf, mkDigest, len) == 0) + r = 0; + } + + free(mkDigest); + return r; +} + +static int PBKDF2_digest_store(struct crypt_device *cd, + int digest, + const char *volume_key, + size_t volume_key_len) +{ + json_object *jobj_digest, *jobj_digests; + char salt[LUKS_SALTSIZE], digest_raw[128]; + int hmac_size, r; + char *base64_str; + struct luks2_hdr *hdr; + struct crypt_pbkdf_limits pbkdf_limits; + const struct crypt_pbkdf_type *pbkdf_cd; + struct crypt_pbkdf_type pbkdf = { + .type = CRYPT_KDF_PBKDF2, + .time_ms = LUKS_MKD_ITERATIONS_MS, + }; + + /* Inherit hash from PBKDF setting */ + pbkdf_cd = crypt_get_pbkdf_type(cd); + if (pbkdf_cd) + pbkdf.hash = pbkdf_cd->hash; + if (!pbkdf.hash) + pbkdf.hash = DEFAULT_LUKS1_HASH; + + log_dbg(cd, "Setting PBKDF2 type key digest %d.", digest); + + r = crypt_random_get(cd, salt, LUKS_SALTSIZE, CRYPT_RND_SALT); + if (r < 0) + return r; + + r = crypt_pbkdf_get_limits(CRYPT_KDF_PBKDF2, &pbkdf_limits); + if (r < 0) + return r; + + if (crypt_get_pbkdf(cd)->flags & CRYPT_PBKDF_NO_BENCHMARK) + pbkdf.iterations = pbkdf_limits.min_iterations; + else { + r = crypt_benchmark_pbkdf_internal(cd, &pbkdf, volume_key_len); + if (r < 0) + return r; + } + + hmac_size = crypt_hmac_size(pbkdf.hash); + if (hmac_size < 0 || hmac_size > (int)sizeof(digest_raw)) + return -EINVAL; + + r = crypt_pbkdf(CRYPT_KDF_PBKDF2, pbkdf.hash, volume_key, volume_key_len, + salt, LUKS_SALTSIZE, digest_raw, hmac_size, + pbkdf.iterations, 0, 0); + if (r < 0) + return r; + + jobj_digest = LUKS2_get_digest_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), digest); + jobj_digests = NULL; + if (!jobj_digest) { + hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + jobj_digest = json_object_new_object(); + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + } + + json_object_object_add(jobj_digest, "type", json_object_new_string("pbkdf2")); + json_object_object_add(jobj_digest, "keyslots", json_object_new_array()); + json_object_object_add(jobj_digest, "segments", json_object_new_array()); + json_object_object_add(jobj_digest, "hash", json_object_new_string(pbkdf.hash)); + json_object_object_add(jobj_digest, "iterations", json_object_new_int(pbkdf.iterations)); + + base64_encode_alloc(salt, LUKS_SALTSIZE, &base64_str); + if (!base64_str) { + json_object_put(jobj_digest); + return -ENOMEM; + } + json_object_object_add(jobj_digest, "salt", json_object_new_string(base64_str)); + free(base64_str); + + base64_encode_alloc(digest_raw, hmac_size, &base64_str); + if (!base64_str) { + json_object_put(jobj_digest); + return -ENOMEM; + } + json_object_object_add(jobj_digest, "digest", json_object_new_string(base64_str)); + free(base64_str); + + if (jobj_digests) + json_object_object_add_by_uint(jobj_digests, digest, jobj_digest); + + JSON_DBG(cd, jobj_digest, "Digest JSON:"); + return 0; +} + +static int PBKDF2_digest_dump(struct crypt_device *cd, int digest) +{ + json_object *jobj_digest, *jobj1; + + /* This can be done only for internally linked digests */ + jobj_digest = LUKS2_get_digest_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), digest); + if (!jobj_digest) + return -EINVAL; + + json_object_object_get_ex(jobj_digest, "hash", &jobj1); + log_std(cd, "\tHash: %s\n", json_object_get_string(jobj1)); + + json_object_object_get_ex(jobj_digest, "iterations", &jobj1); + log_std(cd, "\tIterations: %" PRIu64 "\n", json_object_get_int64(jobj1)); + + json_object_object_get_ex(jobj_digest, "salt", &jobj1); + log_std(cd, "\tSalt: "); + hexprint_base64(cd, jobj1, " ", " "); + + json_object_object_get_ex(jobj_digest, "digest", &jobj1); + log_std(cd, "\tDigest: "); + hexprint_base64(cd, jobj1, " ", " "); + + return 0; +} + +const digest_handler PBKDF2_digest = { + .name = "pbkdf2", + .verify = PBKDF2_digest_verify, + .store = PBKDF2_digest_store, + .dump = PBKDF2_digest_dump, +}; diff --git a/lib/luks2/luks2_disk_metadata.c b/lib/luks2/luks2_disk_metadata.c new file mode 100644 index 0000000..3f6b3ae --- /dev/null +++ b/lib/luks2/luks2_disk_metadata.c @@ -0,0 +1,806 @@ +/* + * LUKS - Linux Unified Key Setup v2 + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include + +#include "luks2_internal.h" + +/* + * Helper functions + */ +static json_object *parse_json_len(struct crypt_device *cd, const char *json_area, + uint64_t max_length, int *json_len) +{ + json_object *jobj; + struct json_tokener *jtok; + + /* INT32_MAX is internal (json-c) json_tokener_parse_ex() limit */ + if (!json_area || max_length > INT32_MAX) + return NULL; + + jtok = json_tokener_new(); + if (!jtok) { + log_dbg(cd, "ERROR: Failed to init json tokener"); + return NULL; + } + + jobj = json_tokener_parse_ex(jtok, json_area, max_length); + if (!jobj) + log_dbg(cd, "ERROR: Failed to parse json data (%d): %s", + json_tokener_get_error(jtok), + json_tokener_error_desc(json_tokener_get_error(jtok))); + else + *json_len = jtok->char_offset; + + json_tokener_free(jtok); + + return jobj; +} + +static void log_dbg_checksum(struct crypt_device *cd, + const uint8_t *csum, const char *csum_alg, const char *info) +{ + char csum_txt[2*LUKS2_CHECKSUM_L+1]; + int i; + + for (i = 0; i < crypt_hash_size(csum_alg); i++) + snprintf(&csum_txt[i*2], 3, "%02hhx", (const char)csum[i]); + csum_txt[i*2+1] = '\0'; /* Just to be safe, sprintf should write \0 there. */ + + log_dbg(cd, "Checksum:%s (%s)", &csum_txt[0], info); +} + +/* + * Calculate hash (checksum) of |LUKS2_bin|LUKS2_JSON_area| from in-memory structs. + * LUKS2 on-disk header contains uniques salt both for primary and secondary header. + * Checksum is always calculated with zeroed checksum field in binary header. + */ +static int hdr_checksum_calculate(const char *alg, struct luks2_hdr_disk *hdr_disk, + const char *json_area, size_t json_len) +{ + struct crypt_hash *hd = NULL; + int hash_size, r; + + hash_size = crypt_hash_size(alg); + if (hash_size <= 0 || crypt_hash_init(&hd, alg)) + return -EINVAL; + + /* Binary header, csum zeroed. */ + r = crypt_hash_write(hd, (char*)hdr_disk, LUKS2_HDR_BIN_LEN); + + /* JSON area (including unused space) */ + if (!r) + r = crypt_hash_write(hd, json_area, json_len); + + if (!r) + r = crypt_hash_final(hd, (char*)hdr_disk->csum, (size_t)hash_size); + + crypt_hash_destroy(hd); + return r; +} + +/* + * Compare hash (checksum) of on-disk and in-memory header. + */ +static int hdr_checksum_check(struct crypt_device *cd, + const char *alg, struct luks2_hdr_disk *hdr_disk, + const char *json_area, size_t json_len) +{ + struct luks2_hdr_disk hdr_tmp; + int hash_size, r; + + hash_size = crypt_hash_size(alg); + if (hash_size <= 0) + return -EINVAL; + + /* Copy header and zero checksum. */ + memcpy(&hdr_tmp, hdr_disk, LUKS2_HDR_BIN_LEN); + memset(&hdr_tmp.csum, 0, sizeof(hdr_tmp.csum)); + + r = hdr_checksum_calculate(alg, &hdr_tmp, json_area, json_len); + if (r < 0) + return r; + + log_dbg_checksum(cd, hdr_disk->csum, alg, "on-disk"); + log_dbg_checksum(cd, hdr_tmp.csum, alg, "in-memory"); + + if (memcmp(hdr_tmp.csum, hdr_disk->csum, (size_t)hash_size)) + return -EINVAL; + + return 0; +} + +/* + * Convert header from on-disk format to in-memory struct + */ +static void hdr_from_disk(struct luks2_hdr_disk *hdr_disk1, + struct luks2_hdr_disk *hdr_disk2, + struct luks2_hdr *hdr, + int secondary) +{ + hdr->version = be16_to_cpu(hdr_disk1->version); + hdr->hdr_size = be64_to_cpu(hdr_disk1->hdr_size); + hdr->seqid = be64_to_cpu(hdr_disk1->seqid); + + memcpy(hdr->label, hdr_disk1->label, LUKS2_LABEL_L); + hdr->label[LUKS2_LABEL_L - 1] = '\0'; + memcpy(hdr->subsystem, hdr_disk1->subsystem, LUKS2_LABEL_L); + hdr->subsystem[LUKS2_LABEL_L - 1] = '\0'; + memcpy(hdr->checksum_alg, hdr_disk1->checksum_alg, LUKS2_CHECKSUM_ALG_L); + hdr->checksum_alg[LUKS2_CHECKSUM_ALG_L - 1] = '\0'; + memcpy(hdr->uuid, hdr_disk1->uuid, LUKS2_UUID_L); + hdr->uuid[LUKS2_UUID_L - 1] = '\0'; + + if (secondary) { + memcpy(hdr->salt1, hdr_disk2->salt, LUKS2_SALT_L); + memcpy(hdr->salt2, hdr_disk1->salt, LUKS2_SALT_L); + } else { + memcpy(hdr->salt1, hdr_disk1->salt, LUKS2_SALT_L); + memcpy(hdr->salt2, hdr_disk2->salt, LUKS2_SALT_L); + } +} + +/* + * Convert header from in-memory struct to on-disk format + */ +static void hdr_to_disk(struct luks2_hdr *hdr, + struct luks2_hdr_disk *hdr_disk, + int secondary, uint64_t offset) +{ + assert(((char*)&(hdr_disk->_padding4096) - (char*)&(hdr_disk->magic)) == 512); + + memset(hdr_disk, 0, LUKS2_HDR_BIN_LEN); + + memcpy(&hdr_disk->magic, secondary ? LUKS2_MAGIC_2ND : LUKS2_MAGIC_1ST, LUKS2_MAGIC_L); + hdr_disk->version = cpu_to_be16(hdr->version); + hdr_disk->hdr_size = cpu_to_be64(hdr->hdr_size); + hdr_disk->hdr_offset = cpu_to_be64(offset); + hdr_disk->seqid = cpu_to_be64(hdr->seqid); + + memcpy(hdr_disk->label, hdr->label, MIN(strlen(hdr->label), LUKS2_LABEL_L)); + hdr_disk->label[LUKS2_LABEL_L - 1] = '\0'; + memcpy(hdr_disk->subsystem, hdr->subsystem, MIN(strlen(hdr->subsystem), LUKS2_LABEL_L)); + hdr_disk->subsystem[LUKS2_LABEL_L - 1] = '\0'; + memcpy(hdr_disk->checksum_alg, hdr->checksum_alg, MIN(strlen(hdr->checksum_alg), LUKS2_CHECKSUM_ALG_L)); + hdr_disk->checksum_alg[LUKS2_CHECKSUM_ALG_L - 1] = '\0'; + memcpy(hdr_disk->uuid, hdr->uuid, MIN(strlen(hdr->uuid), LUKS2_UUID_L)); + hdr_disk->uuid[LUKS2_UUID_L - 1] = '\0'; + + memcpy(hdr_disk->salt, secondary ? hdr->salt2 : hdr->salt1, LUKS2_SALT_L); +} + +/* + * Sanity checks before checksum is validated + */ +static int hdr_disk_sanity_check_pre(struct crypt_device *cd, + struct luks2_hdr_disk *hdr, + size_t *hdr_json_size, int secondary, + uint64_t offset) +{ + if (memcmp(hdr->magic, secondary ? LUKS2_MAGIC_2ND : LUKS2_MAGIC_1ST, LUKS2_MAGIC_L)) + return -EINVAL; + + if (be16_to_cpu(hdr->version) != 2) { + log_dbg(cd, "Unsupported LUKS2 header version %u.", be16_to_cpu(hdr->version)); + return -EINVAL; + } + + if (offset != be64_to_cpu(hdr->hdr_offset)) { + log_dbg(cd, "LUKS2 offset 0x%04x on device differs to expected offset 0x%04x.", + (unsigned)be64_to_cpu(hdr->hdr_offset), (unsigned)offset); + return -EINVAL; + } + + if (secondary && (offset != be64_to_cpu(hdr->hdr_size))) { + log_dbg(cd, "LUKS2 offset 0x%04x in secondary header does not match size 0x%04x.", + (unsigned)offset, (unsigned)be64_to_cpu(hdr->hdr_size)); + return -EINVAL; + } + + /* FIXME: sanity check checksum alg. */ + + log_dbg(cd, "LUKS2 header version %u of size %u bytes, checksum %s.", + (unsigned)be16_to_cpu(hdr->version), (unsigned)be64_to_cpu(hdr->hdr_size), + hdr->checksum_alg); + + *hdr_json_size = be64_to_cpu(hdr->hdr_size) - LUKS2_HDR_BIN_LEN; + return 0; +} + +/* + * Read LUKS2 header from disk at specific offset. + */ +static int hdr_read_disk(struct crypt_device *cd, + struct device *device, struct luks2_hdr_disk *hdr_disk, + char **json_area, uint64_t offset, int secondary) +{ + size_t hdr_json_size = 0; + int devfd, r; + + log_dbg(cd, "Trying to read %s LUKS2 header at offset 0x%" PRIx64 ".", + secondary ? "secondary" : "primary", offset); + + devfd = device_open_locked(cd, device, O_RDONLY); + if (devfd < 0) + return devfd == -1 ? -EIO : devfd; + + /* + * Read binary header and run sanity check before reading + * JSON area and validating checksum. + */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr_disk, + LUKS2_HDR_BIN_LEN, offset) != LUKS2_HDR_BIN_LEN) { + return -EIO; + } + + r = hdr_disk_sanity_check_pre(cd, hdr_disk, &hdr_json_size, secondary, offset); + if (r < 0) { + return r; + } + + /* + * Allocate and read JSON area. Always the whole area must be read. + */ + *json_area = malloc(hdr_json_size); + if (!*json_area) { + return -ENOMEM; + } + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), *json_area, hdr_json_size, + offset + LUKS2_HDR_BIN_LEN) != (ssize_t)hdr_json_size) { + free(*json_area); + *json_area = NULL; + return -EIO; + } + + /* + * Calculate and validate checksum and zero it afterwards. + */ + if (hdr_checksum_check(cd, hdr_disk->checksum_alg, hdr_disk, + *json_area, hdr_json_size)) { + log_dbg(cd, "LUKS2 header checksum error (offset %" PRIu64 ").", offset); + r = -EINVAL; + } + memset(hdr_disk->csum, 0, LUKS2_CHECKSUM_L); + + return r; +} + +/* + * Write LUKS2 header to disk at specific offset. + */ +static int hdr_write_disk(struct crypt_device *cd, + struct device *device, struct luks2_hdr *hdr, + const char *json_area, int secondary) +{ + struct luks2_hdr_disk hdr_disk; + uint64_t offset = secondary ? hdr->hdr_size : 0; + size_t hdr_json_len; + int devfd, r; + + log_dbg(cd, "Trying to write LUKS2 header (%zu bytes) at offset %" PRIu64 ".", + hdr->hdr_size, offset); + + /* FIXME: read-only device silent fail? */ + + devfd = device_open_locked(cd, device, O_RDWR); + if (devfd < 0) + return devfd == -1 ? -EINVAL : devfd; + + hdr_json_len = hdr->hdr_size - LUKS2_HDR_BIN_LEN; + + hdr_to_disk(hdr, &hdr_disk, secondary, offset); + + /* + * Write header without checksum but with proper seqid. + */ + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), (char *)&hdr_disk, + LUKS2_HDR_BIN_LEN, offset) < (ssize_t)LUKS2_HDR_BIN_LEN) { + return -EIO; + } + + /* + * Write json area. + */ + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), + CONST_CAST(char*)json_area, hdr_json_len, + LUKS2_HDR_BIN_LEN + offset) < (ssize_t)hdr_json_len) { + return -EIO; + } + + /* + * Calculate checksum and write header with checksum. + */ + r = hdr_checksum_calculate(hdr_disk.checksum_alg, &hdr_disk, + json_area, hdr_json_len); + if (r < 0) { + return r; + } + log_dbg_checksum(cd, hdr_disk.csum, hdr_disk.checksum_alg, "in-memory"); + + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), (char *)&hdr_disk, + LUKS2_HDR_BIN_LEN, offset) < (ssize_t)LUKS2_HDR_BIN_LEN) + r = -EIO; + + device_sync(cd, device); + return r; +} + +static int LUKS2_check_sequence_id(struct crypt_device *cd, struct luks2_hdr *hdr, struct device *device) +{ + int devfd; + struct luks2_hdr_disk dhdr; + + if (!hdr) + return -EINVAL; + + devfd = device_open_locked(cd, device, O_RDONLY); + if (devfd < 0) + return devfd == -1 ? -EINVAL : devfd; + + /* we need only first 512 bytes, see luks2_hdr_disk structure */ + if ((read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &dhdr, 512, 0) != 512)) + return -EIO; + + /* there's nothing to check if there's no LUKS2 header */ + if ((be16_to_cpu(dhdr.version) != 2) || + memcmp(dhdr.magic, LUKS2_MAGIC_1ST, LUKS2_MAGIC_L) || + strcmp(dhdr.uuid, hdr->uuid)) + return 0; + + return hdr->seqid != be64_to_cpu(dhdr.seqid); +} + +int LUKS2_device_write_lock(struct crypt_device *cd, struct luks2_hdr *hdr, struct device *device) +{ + int r = device_write_lock(cd, device); + + if (r < 0) { + log_err(cd, _("Failed to acquire write lock on device %s."), device_path(device)); + return r; + } + + /* run sequence id check only on first write lock (r == 1) and w/o LUKS2 reencryption in-progress */ + if (r == 1 && !crypt_get_luks2_reencrypt(cd)) { + log_dbg(cd, "Checking context sequence id matches value stored on disk."); + if (LUKS2_check_sequence_id(cd, hdr, device)) { + device_write_unlock(cd, device); + log_err(cd, _("Detected attempt for concurrent LUKS2 metadata update. Aborting operation.")); + return -EINVAL; + } + } + + return 0; +} + +/* + * Convert in-memory LUKS2 header and write it to disk. + * This will increase sequence id, write both header copies and calculate checksum. + */ +int LUKS2_disk_hdr_write(struct crypt_device *cd, struct luks2_hdr *hdr, struct device *device, bool seqid_check) +{ + char *json_area; + const char *json_text; + size_t json_area_len; + int r; + + if (hdr->version != 2) { + log_dbg(cd, "Unsupported LUKS2 header version (%u).", hdr->version); + return -EINVAL; + } + + r = device_check_size(cd, crypt_metadata_device(cd), LUKS2_hdr_and_areas_size(hdr), 1); + if (r) + return r; + + /* + * Allocate and zero JSON area (of proper header size). + */ + json_area_len = hdr->hdr_size - LUKS2_HDR_BIN_LEN; + json_area = crypt_zalloc(json_area_len); + if (!json_area) + return -ENOMEM; + + /* + * Generate text space-efficient JSON representation to json area. + */ + json_text = json_object_to_json_string_ext(hdr->jobj, + JSON_C_TO_STRING_PLAIN | JSON_C_TO_STRING_NOSLASHESCAPE); + if (!json_text || !*json_text) { + log_dbg(cd, "Cannot parse JSON object to text representation."); + free(json_area); + return -ENOMEM; + } + if (strlen(json_text) > (json_area_len - 1)) { + log_dbg(cd, "JSON is too large (%zu > %zu).", strlen(json_text), json_area_len); + free(json_area); + return -EINVAL; + } + strncpy(json_area, json_text, json_area_len); + + if (seqid_check) + r = LUKS2_device_write_lock(cd, hdr, device); + else + r = device_write_lock(cd, device); + if (r < 0) { + free(json_area); + return r; + } + + /* Increase sequence id before writing it to disk. */ + hdr->seqid++; + + /* Write primary and secondary header */ + r = hdr_write_disk(cd, device, hdr, json_area, 0); + if (!r) + r = hdr_write_disk(cd, device, hdr, json_area, 1); + + if (r) + log_dbg(cd, "LUKS2 header write failed (%d).", r); + + device_write_unlock(cd, device); + + free(json_area); + return r; +} +static int validate_json_area(struct crypt_device *cd, const char *json_area, + uint64_t json_len, uint64_t max_length) +{ + char c; + + /* Enforce there are no needless opening bytes */ + if (*json_area != '{') { + log_dbg(cd, "ERROR: Opening character must be left curly bracket: '{'."); + return -EINVAL; + } + + if (json_len >= max_length) { + log_dbg(cd, "ERROR: Missing trailing null byte beyond parsed json data string."); + return -EINVAL; + } + + /* + * TODO: + * validate there are legal json format characters between + * 'json_area' and 'json_area + json_len' + */ + + do { + c = *(json_area + json_len); + if (c != '\0') { + log_dbg(cd, "ERROR: Forbidden ascii code 0x%02hhx found beyond json data string at offset %" PRIu64, + c, json_len); + return -EINVAL; + } + } while (++json_len < max_length); + + return 0; +} + +static int validate_luks2_json_object(struct crypt_device *cd, json_object *jobj_hdr, uint64_t length) +{ + int r; + + /* we require top level object to be of json_type_object */ + r = !json_object_is_type(jobj_hdr, json_type_object); + if (r) { + log_dbg(cd, "ERROR: Resulting object is not a json object type"); + return r; + } + + r = LUKS2_hdr_validate(cd, jobj_hdr, length); + if (r) { + log_dbg(cd, "Repairing JSON metadata."); + /* try to correct known glitches */ + LUKS2_hdr_repair(cd, jobj_hdr); + + /* run validation again */ + r = LUKS2_hdr_validate(cd, jobj_hdr, length); + } + + if (r) + log_dbg(cd, "ERROR: LUKS2 validation failed"); + + return r; +} + +static json_object *parse_and_validate_json(struct crypt_device *cd, + const char *json_area, uint64_t max_length) +{ + int json_len, r; + json_object *jobj = parse_json_len(cd, json_area, max_length, &json_len); + + if (!jobj) + return NULL; + + /* successful parse_json_len must not return offset <= 0 */ + assert(json_len > 0); + + r = validate_json_area(cd, json_area, json_len, max_length); + if (!r) + r = validate_luks2_json_object(cd, jobj, max_length); + + if (r) { + json_object_put(jobj); + jobj = NULL; + } + + return jobj; +} + +static int detect_device_signatures(struct crypt_device *cd, const char *path) +{ + blk_probe_status prb_state; + int r; + struct blkid_handle *h; + + if (!blk_supported()) { + log_dbg(cd, "Blkid probing of device signatures disabled."); + return 0; + } + + if ((r = blk_init_by_path(&h, path))) { + log_dbg(cd, "Failed to initialize blkid_handle by path."); + return -EINVAL; + } + + /* We don't care about details. Be fast. */ + blk_set_chains_for_fast_detection(h); + + /* Filter out crypto_LUKS. we don't care now */ + blk_superblocks_filter_luks(h); + + prb_state = blk_safeprobe(h); + + switch (prb_state) { + case PRB_AMBIGUOUS: + log_dbg(cd, "Blkid probe couldn't decide device type unambiguously."); + /* fall through */ + case PRB_FAIL: + log_dbg(cd, "Blkid probe failed."); + r = -EINVAL; + break; + case PRB_OK: /* crypto_LUKS type is filtered out */ + r = -EINVAL; + + if (blk_is_partition(h)) + log_dbg(cd, "Blkid probe detected partition type '%s'", blk_get_partition_type(h)); + else if (blk_is_superblock(h)) + log_dbg(cd, "blkid probe detected superblock type '%s'", blk_get_superblock_type(h)); + break; + case PRB_EMPTY: + log_dbg(cd, "Blkid probe detected no foreign device signature."); + } + blk_free(h); + return r; +} + +/* + * Read and convert on-disk LUKS2 header to in-memory representation.. + * Try to do recovery if on-disk state is not consistent. + */ +int LUKS2_disk_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, + struct device *device, int do_recovery, int do_blkprobe) +{ + enum { HDR_OK, HDR_OBSOLETE, HDR_FAIL, HDR_FAIL_IO } state_hdr1, state_hdr2; + struct luks2_hdr_disk hdr_disk1, hdr_disk2; + char *json_area1 = NULL, *json_area2 = NULL; + json_object *jobj_hdr1 = NULL, *jobj_hdr2 = NULL; + unsigned int i; + int r; + uint64_t hdr_size; + uint64_t hdr2_offsets[] = LUKS2_HDR2_OFFSETS; + + /* Skip auto-recovery if locks are disabled and we're not doing LUKS2 explicit repair */ + if (do_recovery && do_blkprobe && !crypt_metadata_locking_enabled()) { + do_recovery = 0; + log_dbg(cd, "Disabling header auto-recovery due to locking being disabled."); + } + + /* + * Read primary LUKS2 header (offset 0). + */ + state_hdr1 = HDR_FAIL; + r = hdr_read_disk(cd, device, &hdr_disk1, &json_area1, 0, 0); + if (r == 0) { + jobj_hdr1 = parse_and_validate_json(cd, json_area1, be64_to_cpu(hdr_disk1.hdr_size) - LUKS2_HDR_BIN_LEN); + state_hdr1 = jobj_hdr1 ? HDR_OK : HDR_OBSOLETE; + } else if (r == -EIO) + state_hdr1 = HDR_FAIL_IO; + + /* + * Read secondary LUKS2 header (follows primary). + */ + state_hdr2 = HDR_FAIL; + if (state_hdr1 != HDR_FAIL && state_hdr1 != HDR_FAIL_IO) { + r = hdr_read_disk(cd, device, &hdr_disk2, &json_area2, be64_to_cpu(hdr_disk1.hdr_size), 1); + if (r == 0) { + jobj_hdr2 = parse_and_validate_json(cd, json_area2, be64_to_cpu(hdr_disk2.hdr_size) - LUKS2_HDR_BIN_LEN); + state_hdr2 = jobj_hdr2 ? HDR_OK : HDR_OBSOLETE; + } else if (r == -EIO) + state_hdr2 = HDR_FAIL_IO; + } else { + /* + * No header size, check all known offsets. + */ + for (r = -EINVAL,i = 0; r < 0 && i < ARRAY_SIZE(hdr2_offsets); i++) + r = hdr_read_disk(cd, device, &hdr_disk2, &json_area2, hdr2_offsets[i], 1); + + if (r == 0) { + jobj_hdr2 = parse_and_validate_json(cd, json_area2, be64_to_cpu(hdr_disk2.hdr_size) - LUKS2_HDR_BIN_LEN); + state_hdr2 = jobj_hdr2 ? HDR_OK : HDR_OBSOLETE; + } else if (r == -EIO) + state_hdr2 = HDR_FAIL_IO; + } + + /* + * Check sequence id if both headers are read correctly. + */ + if (state_hdr1 == HDR_OK && state_hdr2 == HDR_OK) { + if (be64_to_cpu(hdr_disk1.seqid) > be64_to_cpu(hdr_disk2.seqid)) + state_hdr2 = HDR_OBSOLETE; + else if (be64_to_cpu(hdr_disk1.seqid) < be64_to_cpu(hdr_disk2.seqid)) + state_hdr1 = HDR_OBSOLETE; + } + + /* check header with keyslots to fit the device */ + if (state_hdr1 == HDR_OK) + hdr_size = LUKS2_hdr_and_areas_size_jobj(jobj_hdr1); + else if (state_hdr2 == HDR_OK) + hdr_size = LUKS2_hdr_and_areas_size_jobj(jobj_hdr2); + else { + r = (state_hdr1 == HDR_FAIL_IO && state_hdr2 == HDR_FAIL_IO) ? -EIO : -EINVAL; + goto err; + } + + r = device_check_size(cd, device, hdr_size, 0); + if (r) + goto err; + + /* + * Try to rewrite (recover) bad header. Always regenerate salt for bad header. + */ + if (state_hdr1 == HDR_OK && state_hdr2 != HDR_OK) { + log_dbg(cd, "Secondary LUKS2 header requires recovery."); + + if (do_blkprobe && (r = detect_device_signatures(cd, device_path(device)))) { + log_err(cd, _("Device contains ambiguous signatures, cannot auto-recover LUKS2.\n" + "Please run \"cryptsetup repair\" for recovery.")); + goto err; + } + + if (do_recovery) { + memcpy(&hdr_disk2, &hdr_disk1, LUKS2_HDR_BIN_LEN); + r = crypt_random_get(cd, (char*)hdr_disk2.salt, sizeof(hdr_disk2.salt), CRYPT_RND_SALT); + if (r) + log_dbg(cd, "Cannot generate master salt."); + else { + hdr_from_disk(&hdr_disk1, &hdr_disk2, hdr, 0); + r = hdr_write_disk(cd, device, hdr, json_area1, 1); + } + if (r) + log_dbg(cd, "Secondary LUKS2 header recovery failed."); + } + } else if (state_hdr1 != HDR_OK && state_hdr2 == HDR_OK) { + log_dbg(cd, "Primary LUKS2 header requires recovery."); + + if (do_blkprobe && (r = detect_device_signatures(cd, device_path(device)))) { + log_err(cd, _("Device contains ambiguous signatures, cannot auto-recover LUKS2.\n" + "Please run \"cryptsetup repair\" for recovery.")); + goto err; + } + + if (do_recovery) { + memcpy(&hdr_disk1, &hdr_disk2, LUKS2_HDR_BIN_LEN); + r = crypt_random_get(cd, (char*)hdr_disk1.salt, sizeof(hdr_disk1.salt), CRYPT_RND_SALT); + if (r) + log_dbg(cd, "Cannot generate master salt."); + else { + hdr_from_disk(&hdr_disk2, &hdr_disk1, hdr, 1); + r = hdr_write_disk(cd, device, hdr, json_area2, 0); + } + if (r) + log_dbg(cd, "Primary LUKS2 header recovery failed."); + } + } + + free(json_area1); + json_area1 = NULL; + free(json_area2); + json_area2 = NULL; + + /* wrong lock for write mode during recovery attempt */ + if (r == -EAGAIN) + goto err; + + /* + * Even if status is failed, the second header includes salt. + */ + if (state_hdr1 == HDR_OK) { + hdr_from_disk(&hdr_disk1, &hdr_disk2, hdr, 0); + hdr->jobj = jobj_hdr1; + json_object_put(jobj_hdr2); + } else if (state_hdr2 == HDR_OK) { + hdr_from_disk(&hdr_disk2, &hdr_disk1, hdr, 1); + hdr->jobj = jobj_hdr2; + json_object_put(jobj_hdr1); + } + + /* + * FIXME: should this fail? At least one header was read correctly. + * r = (state_hdr1 == HDR_FAIL_IO || state_hdr2 == HDR_FAIL_IO) ? -EIO : -EINVAL; + */ + return 0; +err: + log_dbg(cd, "LUKS2 header read failed (%d).", r); + + free(json_area1); + free(json_area2); + json_object_put(jobj_hdr1); + json_object_put(jobj_hdr2); + hdr->jobj = NULL; + return r; +} + +int LUKS2_hdr_version_unlocked(struct crypt_device *cd, const char *backup_file) +{ + struct { + char magic[LUKS2_MAGIC_L]; + uint16_t version; + } __attribute__ ((packed)) hdr; + struct device *device = NULL; + int r = 0, devfd = -1, flags; + + if (!backup_file) + device = crypt_metadata_device(cd); + else if (device_alloc(cd, &device, backup_file) < 0) + return 0; + + if (!device) + return 0; + + flags = O_RDONLY; + if (device_direct_io(device)) + flags |= O_DIRECT; + + devfd = open(device_path(device), flags); + if (devfd < 0) + goto err; + + if ((read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &hdr, sizeof(hdr), 0) == sizeof(hdr)) && + !memcmp(hdr.magic, LUKS2_MAGIC_1ST, LUKS2_MAGIC_L)) + r = (int)be16_to_cpu(hdr.version); +err: + if (devfd != -1) + close(devfd); + + if (backup_file) + device_free(cd, device); + + return r; +} diff --git a/lib/luks2/luks2_internal.h b/lib/luks2/luks2_internal.h new file mode 100644 index 0000000..7527c19 --- /dev/null +++ b/lib/luks2/luks2_internal.h @@ -0,0 +1,330 @@ +/* + * LUKS - Linux Unified Key Setup v2 + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_LUKS2_INTERNAL_H +#define _CRYPTSETUP_LUKS2_INTERNAL_H + +#include +#include +#include + +#include "internal.h" +#include "base64.h" +#include "luks2.h" + +#define UNUSED(x) (void)(x) + +/* override useless forward slash escape when supported by json-c */ +#ifndef JSON_C_TO_STRING_NOSLASHESCAPE +#define JSON_C_TO_STRING_NOSLASHESCAPE 0 +#endif + +/* + * On-disk access function prototypes + */ +int LUKS2_disk_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, + struct device *device, int do_recovery, int do_blkprobe); +int LUKS2_disk_hdr_write(struct crypt_device *cd, struct luks2_hdr *hdr, + struct device *device, bool seqid_check); +int LUKS2_device_write_lock(struct crypt_device *cd, + struct luks2_hdr *hdr, struct device *device); + +/* + * JSON struct access helpers + */ +json_object *LUKS2_get_keyslot_jobj(struct luks2_hdr *hdr, int keyslot); +json_object *LUKS2_get_token_jobj(struct luks2_hdr *hdr, int token); +json_object *LUKS2_get_digest_jobj(struct luks2_hdr *hdr, int digest); +json_object *LUKS2_get_segment_jobj(struct luks2_hdr *hdr, int segment); +json_object *LUKS2_get_tokens_jobj(struct luks2_hdr *hdr); +json_object *LUKS2_get_segments_jobj(struct luks2_hdr *hdr); + +void hexprint_base64(struct crypt_device *cd, json_object *jobj, + const char *sep, const char *line_sep); + +uint64_t crypt_jobj_get_uint64(json_object *jobj); +uint32_t crypt_jobj_get_uint32(json_object *jobj); +json_object *crypt_jobj_new_uint64(uint64_t value); + +int json_object_object_add_by_uint(json_object *jobj, unsigned key, json_object *jobj_val); +void json_object_object_del_by_uint(json_object *jobj, unsigned key); +int json_object_copy(json_object *jobj_src, json_object **jobj_dst); + +void JSON_DBG(struct crypt_device *cd, json_object *jobj, const char *desc); + +/* + * LUKS2 JSON validation + */ + +/* validation helper */ +json_bool validate_json_uint32(json_object *jobj); +json_object *json_contains(struct crypt_device *cd, json_object *jobj, const char *name, + const char *section, const char *key, json_type type); + +int LUKS2_hdr_validate(struct crypt_device *cd, json_object *hdr_jobj, uint64_t json_size); +int LUKS2_check_json_size(struct crypt_device *cd, const struct luks2_hdr *hdr); +int LUKS2_token_validate(struct crypt_device *cd, json_object *hdr_jobj, + json_object *jobj_token, const char *key); +void LUKS2_token_dump(struct crypt_device *cd, int token); + +/* + * LUKS2 JSON repair for known glitches + */ +void LUKS2_hdr_repair(struct crypt_device *cd, json_object *jobj_hdr); +void LUKS2_keyslots_repair(struct crypt_device *cd, json_object *jobj_hdr); + +/* + * JSON array helpers + */ +json_object *LUKS2_array_jobj(json_object *array, const char *num); +json_object *LUKS2_array_remove(json_object *array, const char *num); + +/* + * Plugins API + */ + +/** + * LUKS2 keyslots handlers (EXPERIMENTAL) + */ +typedef int (*keyslot_alloc_func)(struct crypt_device *cd, int keyslot, + size_t volume_key_len, + const struct luks2_keyslot_params *params); +typedef int (*keyslot_update_func)(struct crypt_device *cd, int keyslot, + const struct luks2_keyslot_params *params); +typedef int (*keyslot_open_func) (struct crypt_device *cd, int keyslot, + const char *password, size_t password_len, + char *volume_key, size_t volume_key_len); +typedef int (*keyslot_store_func)(struct crypt_device *cd, int keyslot, + const char *password, size_t password_len, + const char *volume_key, size_t volume_key_len); +typedef int (*keyslot_wipe_func) (struct crypt_device *cd, int keyslot); +typedef int (*keyslot_dump_func) (struct crypt_device *cd, int keyslot); +typedef int (*keyslot_validate_func) (struct crypt_device *cd, json_object *jobj_keyslot); +typedef void(*keyslot_repair_func) (struct crypt_device *cd, json_object *jobj_keyslot); + +/* see LUKS2_luks2_to_luks1 */ +int placeholder_keyslot_alloc(struct crypt_device *cd, + int keyslot, + uint64_t area_offset, + uint64_t area_length, + size_t volume_key_len); + +/* validate all keyslot implementations in hdr json */ +int LUKS2_keyslots_validate(struct crypt_device *cd, json_object *hdr_jobj); + +typedef struct { + const char *name; + keyslot_alloc_func alloc; + keyslot_update_func update; + keyslot_open_func open; + keyslot_store_func store; + keyslot_wipe_func wipe; + keyslot_dump_func dump; + keyslot_validate_func validate; + keyslot_repair_func repair; +} keyslot_handler; + +/* can not fit prototype alloc function */ +int reenc_keyslot_alloc(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const struct crypt_params_reencrypt *params); + +/** + * LUKS2 digest handlers (EXPERIMENTAL) + */ +typedef int (*digest_verify_func)(struct crypt_device *cd, int digest, + const char *volume_key, size_t volume_key_len); +typedef int (*digest_store_func) (struct crypt_device *cd, int digest, + const char *volume_key, size_t volume_key_len); +typedef int (*digest_dump_func) (struct crypt_device *cd, int digest); + +typedef struct { + const char *name; + digest_verify_func verify; + digest_store_func store; + digest_dump_func dump; +} digest_handler; + +/** + * LUKS2 token handlers (internal use only) + */ +typedef int (*builtin_token_get_func) (json_object *jobj_token, void *params); +typedef int (*builtin_token_set_func) (json_object **jobj_token, const void *params); + +typedef struct { + /* internal only section used by builtin tokens */ + builtin_token_get_func get; + builtin_token_set_func set; + /* public token handler */ + const crypt_token_handler *h; +} token_handler; + +int token_keyring_set(json_object **, const void *); +int token_keyring_get(json_object *, void *); + +int LUKS2_find_area_gap(struct crypt_device *cd, struct luks2_hdr *hdr, + size_t keylength, uint64_t *area_offset, uint64_t *area_length); +int LUKS2_find_area_max_gap(struct crypt_device *cd, struct luks2_hdr *hdr, + uint64_t *area_offset, uint64_t *area_length); + +uint64_t LUKS2_hdr_and_areas_size_jobj(json_object *jobj); + +int LUKS2_check_cipher(struct crypt_device *cd, + size_t keylength, + const char *cipher, + const char *cipher_mode); + +static inline const char *crypt_reencrypt_mode_to_str(crypt_reencrypt_mode_info mi) +{ + if (mi == CRYPT_REENCRYPT_REENCRYPT) + return "reencrypt"; + if (mi == CRYPT_REENCRYPT_ENCRYPT) + return "encrypt"; + if (mi == CRYPT_REENCRYPT_DECRYPT) + return "decrypt"; + return ""; +} + +/* + * Generic LUKS2 keyslot + */ +int LUKS2_keyslot_reencrypt_store(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const void *buffer, + size_t buffer_length); + +int LUKS2_keyslot_reencrypt_allocate(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const struct crypt_params_reencrypt *params); + +int LUKS2_keyslot_reencrypt_digest_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks); + +int LUKS2_keyslot_dump(struct crypt_device *cd, + int keyslot); + +int LUKS2_keyslot_jobj_area(json_object *jobj_keyslot, uint64_t *offset, uint64_t *length); + +/* JSON helpers */ +uint64_t json_segment_get_offset(json_object *jobj_segment, unsigned blockwise); +const char *json_segment_type(json_object *jobj_segment); +uint64_t json_segment_get_iv_offset(json_object *jobj_segment); +uint64_t json_segment_get_size(json_object *jobj_segment, unsigned blockwise); +const char *json_segment_get_cipher(json_object *jobj_segment); +int json_segment_get_sector_size(json_object *jobj_segment); +bool json_segment_is_backup(json_object *jobj_segment); +json_object *json_segments_get_segment(json_object *jobj_segments, int segment); +unsigned json_segments_count(json_object *jobj_segments); +void json_segment_remove_flag(json_object *jobj_segment, const char *flag); +uint64_t json_segments_get_minimal_offset(json_object *jobj_segments, unsigned blockwise); +json_object *json_segment_create_linear(uint64_t offset, const uint64_t *length, unsigned reencryption); +json_object *json_segment_create_crypt(uint64_t offset, uint64_t iv_offset, const uint64_t *length, const char *cipher, uint32_t sector_size, unsigned reencryption); +int json_segments_segment_in_reencrypt(json_object *jobj_segments); +bool json_segment_cmp(json_object *jobj_segment_1, json_object *jobj_segment_2); +bool json_segment_contains_flag(json_object *jobj_segment, const char *flag_str, size_t len); + +int LUKS2_assembly_multisegment_dmd(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks, + json_object *jobj_segments, + struct crypt_dm_active_device *dmd); + +/* + * Generic LUKS2 segment + */ +int LUKS2_segments_count(struct luks2_hdr *hdr); + +int LUKS2_segment_first_unused_id(struct luks2_hdr *hdr); + +int LUKS2_segment_set_flag(json_object *jobj_segment, const char *flag); + +json_object *LUKS2_get_segment_by_flag(struct luks2_hdr *hdr, const char *flag); + +int LUKS2_get_segment_id_by_flag(struct luks2_hdr *hdr, const char *flag); + +int LUKS2_segments_set(struct crypt_device *cd, + struct luks2_hdr *hdr, + json_object *jobj_segments, + int commit); + +uint64_t LUKS2_segment_offset(struct luks2_hdr *hdr, + int segment, + unsigned blockwise); + +uint64_t LUKS2_segment_size(struct luks2_hdr *hdr, + int segment, + unsigned blockwise); + +int LUKS2_segment_is_type(struct luks2_hdr *hdr, + int segment, + const char *type); + +int LUKS2_segment_by_type(struct luks2_hdr *hdr, + const char *type); + +int LUKS2_last_segment_by_type(struct luks2_hdr *hdr, + const char *type); + +int LUKS2_get_default_segment(struct luks2_hdr *hdr); + +int LUKS2_reencrypt_digest_new(struct luks2_hdr *hdr); +int LUKS2_reencrypt_digest_old(struct luks2_hdr *hdr); +int LUKS2_reencrypt_data_offset(struct luks2_hdr *hdr, bool blockwise); + +/* + * Generic LUKS2 digest + */ +int LUKS2_digest_verify_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, + int digest, + const struct volume_key *vk); + +void LUKS2_digests_erase_unused(struct crypt_device *cd, + struct luks2_hdr *hdr); + +int LUKS2_digest_dump(struct crypt_device *cd, + int digest); + +/* + * Generic LUKS2 token + */ +int LUKS2_tokens_count(struct luks2_hdr *hdr); + +/* + * LUKS2 generic + */ +int LUKS2_reload(struct crypt_device *cd, + const char *name, + struct volume_key *vks, + uint64_t device_size, + uint32_t flags); + +int LUKS2_keyslot_for_segment(struct luks2_hdr *hdr, int keyslot, int segment); +int LUKS2_find_keyslot(struct luks2_hdr *hdr, const char *type); +int LUKS2_set_keyslots_size(struct crypt_device *cd, + struct luks2_hdr *hdr, + uint64_t data_offset); + +#endif diff --git a/lib/luks2/luks2_json_format.c b/lib/luks2/luks2_json_format.c new file mode 100644 index 0000000..1540910 --- /dev/null +++ b/lib/luks2/luks2_json_format.c @@ -0,0 +1,408 @@ +/* + * LUKS - Linux Unified Key Setup v2, LUKS2 header format code + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" +#include +#include + +struct area { + uint64_t offset; + uint64_t length; +}; + +static size_t get_area_size(size_t keylength) +{ + //FIXME: calculate this properly, for now it is AF_split_sectors + return size_round_up(keylength * 4000, 4096); +} + +static size_t get_min_offset(struct luks2_hdr *hdr) +{ + return 2 * hdr->hdr_size; +} + +static size_t get_max_offset(struct luks2_hdr *hdr) +{ + return LUKS2_hdr_and_areas_size(hdr); +} + +int LUKS2_find_area_max_gap(struct crypt_device *cd, struct luks2_hdr *hdr, + uint64_t *area_offset, uint64_t *area_length) +{ + struct area areas[LUKS2_KEYSLOTS_MAX], sorted_areas[LUKS2_KEYSLOTS_MAX+1] = {}; + int i, j, k, area_i; + size_t valid_offset, offset, length; + + /* fill area offset + length table */ + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + if (!LUKS2_keyslot_area(hdr, i, &areas[i].offset, &areas[i].length)) + continue; + areas[i].length = 0; + areas[i].offset = 0; + } + + /* sort table */ + k = 0; /* index in sorted table */ + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + offset = get_max_offset(hdr) ?: UINT64_MAX; + area_i = -1; + /* search for the smallest offset in table */ + for (j = 0; j < LUKS2_KEYSLOTS_MAX; j++) + if (areas[j].offset && areas[j].offset <= offset) { + area_i = j; + offset = areas[j].offset; + } + + if (area_i >= 0) { + sorted_areas[k].length = areas[area_i].length; + sorted_areas[k].offset = areas[area_i].offset; + areas[area_i].length = 0; + areas[area_i].offset = 0; + k++; + } + } + + sorted_areas[LUKS2_KEYSLOTS_MAX].offset = get_max_offset(hdr); + sorted_areas[LUKS2_KEYSLOTS_MAX].length = 1; + + /* search for the gap we can use */ + length = valid_offset = 0; + offset = get_min_offset(hdr); + for (i = 0; i < LUKS2_KEYSLOTS_MAX+1; i++) { + /* skip empty */ + if (sorted_areas[i].offset == 0 || sorted_areas[i].length == 0) + continue; + + /* found bigger gap than the last one */ + if ((offset < sorted_areas[i].offset) && (sorted_areas[i].offset - offset) > length) { + length = sorted_areas[i].offset - offset; + valid_offset = offset; + } + + /* move beyond allocated area */ + offset = sorted_areas[i].offset + sorted_areas[i].length; + } + + /* this search 'algorithm' does not work with unaligned areas */ + assert(length == size_round_up(length, 4096)); + assert(valid_offset == size_round_up(valid_offset, 4096)); + + if (!length) { + log_dbg(cd, "Not enough space in header keyslot area."); + return -EINVAL; + } + + log_dbg(cd, "Found largest free area %zu -> %zu", valid_offset, length + valid_offset); + + *area_offset = valid_offset; + *area_length = length; + + return 0; +} + +int LUKS2_find_area_gap(struct crypt_device *cd, struct luks2_hdr *hdr, + size_t keylength, uint64_t *area_offset, uint64_t *area_length) +{ + struct area areas[LUKS2_KEYSLOTS_MAX], sorted_areas[LUKS2_KEYSLOTS_MAX] = {}; + int i, j, k, area_i; + size_t offset, length; + + /* fill area offset + length table */ + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + if (!LUKS2_keyslot_area(hdr, i, &areas[i].offset, &areas[i].length)) + continue; + areas[i].length = 0; + areas[i].offset = 0; + } + + /* sort table */ + k = 0; /* index in sorted table */ + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + offset = get_max_offset(hdr) ?: UINT64_MAX; + area_i = -1; + /* search for the smallest offset in table */ + for (j = 0; j < LUKS2_KEYSLOTS_MAX; j++) + if (areas[j].offset && areas[j].offset <= offset) { + area_i = j; + offset = areas[j].offset; + } + + if (area_i >= 0) { + sorted_areas[k].length = areas[area_i].length; + sorted_areas[k].offset = areas[area_i].offset; + areas[area_i].length = 0; + areas[area_i].offset = 0; + k++; + } + } + + /* search for the gap we can use */ + offset = get_min_offset(hdr); + length = get_area_size(keylength); + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + /* skip empty */ + if (sorted_areas[i].offset == 0 || sorted_areas[i].length == 0) + continue; + + /* enough space before the used area */ + if ((offset < sorted_areas[i].offset) && ((offset + length) <= sorted_areas[i].offset)) + break; + + /* both offset and length are already aligned to 4096 bytes */ + offset = sorted_areas[i].offset + sorted_areas[i].length; + } + + if ((offset + length) > get_max_offset(hdr)) { + log_dbg(cd, "Not enough space in header keyslot area."); + return -EINVAL; + } + + log_dbg(cd, "Found area %zu -> %zu", offset, length + offset); + + *area_offset = offset; + *area_length = length; + return 0; +} + +int LUKS2_check_metadata_area_size(uint64_t metadata_size) +{ + /* see LUKS2_HDR2_OFFSETS */ + return (metadata_size != 0x004000 && + metadata_size != 0x008000 && metadata_size != 0x010000 && + metadata_size != 0x020000 && metadata_size != 0x040000 && + metadata_size != 0x080000 && metadata_size != 0x100000 && + metadata_size != 0x200000 && metadata_size != 0x400000); +} + +int LUKS2_check_keyslots_area_size(uint64_t keyslots_size) +{ + return (MISALIGNED_4K(keyslots_size) || + keyslots_size > LUKS2_MAX_KEYSLOTS_SIZE); +} + +int LUKS2_generate_hdr( + struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct volume_key *vk, + const char *cipherName, + const char *cipherMode, + const char *integrity, + const char *uuid, + unsigned int sector_size, /* in bytes */ + uint64_t data_offset, /* in bytes */ + uint64_t align_offset, /* in bytes */ + uint64_t required_alignment, + uint64_t metadata_size, + uint64_t keyslots_size) +{ + struct json_object *jobj_segment, *jobj_integrity, *jobj_keyslots, *jobj_segments, *jobj_config; + char cipher[128]; + uuid_t partitionUuid; + int r, digest; + uint64_t mdev_size; + + if (!metadata_size) + metadata_size = LUKS2_HDR_16K_LEN; + hdr->hdr_size = metadata_size; + + if (data_offset && data_offset < get_min_offset(hdr)) { + log_err(cd, _("Requested data offset is too small.")); + return -EINVAL; + } + + /* Increase keyslot size according to data offset */ + if (!keyslots_size && data_offset) + keyslots_size = data_offset - get_min_offset(hdr); + + /* keyslots size has to be 4 KiB aligned */ + keyslots_size -= (keyslots_size % 4096); + + if (keyslots_size > LUKS2_MAX_KEYSLOTS_SIZE) + keyslots_size = LUKS2_MAX_KEYSLOTS_SIZE; + + if (!keyslots_size) { + assert(LUKS2_DEFAULT_HDR_SIZE > 2 * LUKS2_HDR_OFFSET_MAX); + keyslots_size = LUKS2_DEFAULT_HDR_SIZE - get_min_offset(hdr); + /* Decrease keyslots_size due to metadata device being too small */ + if (!device_size(crypt_metadata_device(cd), &mdev_size) && + ((keyslots_size + get_min_offset(hdr)) > mdev_size) && + device_fallocate(crypt_metadata_device(cd), keyslots_size + get_min_offset(hdr)) && + (get_min_offset(hdr) <= mdev_size)) + keyslots_size = mdev_size - get_min_offset(hdr); + } + + /* Decrease keyslots_size if we have smaller data_offset */ + if (data_offset && (keyslots_size + get_min_offset(hdr)) > data_offset) { + keyslots_size = data_offset - get_min_offset(hdr); + log_dbg(cd, "Decreasing keyslot area size to %" PRIu64 + " bytes due to the requested data offset %" + PRIu64 " bytes.", keyslots_size, data_offset); + } + + /* Data offset has priority */ + if (!data_offset && required_alignment) { + data_offset = size_round_up(get_min_offset(hdr) + keyslots_size, + (size_t)required_alignment); + data_offset += align_offset; + } + + log_dbg(cd, "Formatting LUKS2 with JSON metadata area %" PRIu64 + " bytes and keyslots area %" PRIu64 " bytes.", + metadata_size - LUKS2_HDR_BIN_LEN, keyslots_size); + + if (keyslots_size < (LUKS2_HDR_OFFSET_MAX - 2*LUKS2_HDR_16K_LEN)) + log_std(cd, _("WARNING: keyslots area (%" PRIu64 " bytes) is very small," + " available LUKS2 keyslot count is very limited.\n"), + keyslots_size); + + hdr->seqid = 1; + hdr->version = 2; + memset(hdr->label, 0, LUKS2_LABEL_L); + strcpy(hdr->checksum_alg, "sha256"); + crypt_random_get(cd, (char*)hdr->salt1, LUKS2_SALT_L, CRYPT_RND_SALT); + crypt_random_get(cd, (char*)hdr->salt2, LUKS2_SALT_L, CRYPT_RND_SALT); + + if (uuid && uuid_parse(uuid, partitionUuid) == -1) { + log_err(cd, _("Wrong LUKS UUID format provided.")); + return -EINVAL; + } + if (!uuid) + uuid_generate(partitionUuid); + + uuid_unparse(partitionUuid, hdr->uuid); + + if (*cipherMode != '\0') + r = snprintf(cipher, sizeof(cipher), "%s-%s", cipherName, cipherMode); + else + r = snprintf(cipher, sizeof(cipher), "%s", cipherName); + if (r < 0 || (size_t)r >= sizeof(cipher)) + return -EINVAL; + + hdr->jobj = json_object_new_object(); + + jobj_keyslots = json_object_new_object(); + json_object_object_add(hdr->jobj, "keyslots", jobj_keyslots); + json_object_object_add(hdr->jobj, "tokens", json_object_new_object()); + jobj_segments = json_object_new_object(); + json_object_object_add(hdr->jobj, "segments", jobj_segments); + json_object_object_add(hdr->jobj, "digests", json_object_new_object()); + jobj_config = json_object_new_object(); + json_object_object_add(hdr->jobj, "config", jobj_config); + + digest = LUKS2_digest_create(cd, "pbkdf2", hdr, vk); + if (digest < 0) + goto err; + + if (LUKS2_digest_segment_assign(cd, hdr, 0, digest, 1, 0) < 0) + goto err; + + jobj_segment = json_segment_create_crypt(data_offset, 0, NULL, cipher, sector_size, 0); + if (!jobj_segment) + goto err; + + if (integrity) { + jobj_integrity = json_object_new_object(); + json_object_object_add(jobj_integrity, "type", json_object_new_string(integrity)); + json_object_object_add(jobj_integrity, "journal_encryption", json_object_new_string("none")); + json_object_object_add(jobj_integrity, "journal_integrity", json_object_new_string("none")); + json_object_object_add(jobj_segment, "integrity", jobj_integrity); + } + + json_object_object_add_by_uint(jobj_segments, 0, jobj_segment); + + json_object_object_add(jobj_config, "json_size", crypt_jobj_new_uint64(metadata_size - LUKS2_HDR_BIN_LEN)); + json_object_object_add(jobj_config, "keyslots_size", crypt_jobj_new_uint64(keyslots_size)); + + JSON_DBG(cd, hdr->jobj, "Header JSON:"); + return 0; +err: + json_object_put(hdr->jobj); + hdr->jobj = NULL; + return -EINVAL; +} + +int LUKS2_wipe_header_areas(struct crypt_device *cd, + struct luks2_hdr *hdr, bool detached_header) +{ + int r; + uint64_t offset, length; + size_t wipe_block; + + /* Wipe complete header, keyslots and padding areas with zeroes. */ + offset = 0; + length = LUKS2_get_data_offset(hdr) * SECTOR_SIZE; + wipe_block = 1024 * 1024; + + if (LUKS2_hdr_validate(cd, hdr->jobj, hdr->hdr_size - LUKS2_HDR_BIN_LEN)) + return -EINVAL; + + /* On detached header wipe at least the first 4k */ + if (detached_header) { + length = 4096; + wipe_block = 4096; + } + + log_dbg(cd, "Wiping LUKS areas (0x%06" PRIx64 " - 0x%06" PRIx64") with zeroes.", + offset, length + offset); + + r = crypt_wipe_device(cd, crypt_metadata_device(cd), CRYPT_WIPE_ZERO, + offset, length, wipe_block, NULL, NULL); + if (r < 0) + return r; + + /* Wipe keyslot area */ + wipe_block = 1024 * 1024; + offset = get_min_offset(hdr); + length = LUKS2_keyslots_size(hdr); + + log_dbg(cd, "Wiping keyslots area (0x%06" PRIx64 " - 0x%06" PRIx64") with random data.", + offset, length + offset); + + return crypt_wipe_device(cd, crypt_metadata_device(cd), CRYPT_WIPE_RANDOM, + offset, length, wipe_block, NULL, NULL); +} + +/* FIXME: what if user wanted to keep original keyslots size? */ +int LUKS2_set_keyslots_size(struct crypt_device *cd, + struct luks2_hdr *hdr, + uint64_t data_offset) +{ + json_object *jobj_config; + uint64_t keyslots_size; + + if (data_offset < get_min_offset(hdr)) + return 1; + + keyslots_size = data_offset - get_min_offset(hdr); + + /* keep keyslots_size reasonable for custom data alignments */ + if (keyslots_size > LUKS2_MAX_KEYSLOTS_SIZE) + keyslots_size = LUKS2_MAX_KEYSLOTS_SIZE; + + /* keyslots size has to be 4 KiB aligned */ + keyslots_size -= (keyslots_size % 4096); + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return 1; + + json_object_object_add(jobj_config, "keyslots_size", crypt_jobj_new_uint64(keyslots_size)); + return 0; +} diff --git a/lib/luks2/luks2_json_metadata.c b/lib/luks2/luks2_json_metadata.c new file mode 100644 index 0000000..8469257 --- /dev/null +++ b/lib/luks2/luks2_json_metadata.c @@ -0,0 +1,2601 @@ +/* + * LUKS - Linux Unified Key Setup v2 + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * Copyright (C) 2015-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" +#include "../integrity/integrity.h" +#include +#include +#include + +#define LUKS_STRIPES 4000 + +struct interval { + uint64_t offset; + uint64_t length; +}; + +void hexprint_base64(struct crypt_device *cd, json_object *jobj, + const char *sep, const char *line_sep) +{ + char *buf = NULL; + size_t buf_len; + unsigned int i; + + if (!base64_decode_alloc(json_object_get_string(jobj), + json_object_get_string_len(jobj), + &buf, &buf_len)) + return; + + for (i = 0; i < buf_len; i++) { + if (i && !(i % 16)) + log_std(cd, "\n\t%s", line_sep); + log_std(cd, "%02hhx%s", buf[i], sep); + } + log_std(cd, "\n"); + free(buf); +} + +void JSON_DBG(struct crypt_device *cd, json_object *jobj, const char *desc) +{ + if (desc) + crypt_log(cd, CRYPT_LOG_DEBUG_JSON, desc); + crypt_log(cd, CRYPT_LOG_DEBUG_JSON, json_object_to_json_string_ext(jobj, + JSON_C_TO_STRING_PRETTY | JSON_C_TO_STRING_NOSLASHESCAPE)); +} + +/* + * JSON array helpers + */ +struct json_object *LUKS2_array_jobj(struct json_object *array, const char *num) +{ + struct json_object *jobj1; + int i; + + for (i = 0; i < (int) json_object_array_length(array); i++) { + jobj1 = json_object_array_get_idx(array, i); + if (!strcmp(num, json_object_get_string(jobj1))) + return jobj1; + } + + return NULL; +} + +struct json_object *LUKS2_array_remove(struct json_object *array, const char *num) +{ + struct json_object *jobj1, *jobj_removing = NULL, *array_new; + int i; + + jobj_removing = LUKS2_array_jobj(array, num); + if (!jobj_removing) + return NULL; + + /* Create new array without jobj_removing. */ + array_new = json_object_new_array(); + for (i = 0; i < (int) json_object_array_length(array); i++) { + jobj1 = json_object_array_get_idx(array, i); + if (jobj1 != jobj_removing) + json_object_array_add(array_new, json_object_get(jobj1)); + } + + return array_new; +} + +/* + * JSON struct access helpers + */ +json_object *LUKS2_get_keyslot_jobj(struct luks2_hdr *hdr, int keyslot) +{ + json_object *jobj1, *jobj2; + char keyslot_name[16]; + + if (!hdr || keyslot < 0) + return NULL; + + if (snprintf(keyslot_name, sizeof(keyslot_name), "%u", keyslot) < 1) + return NULL; + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj1)) + return NULL; + + if (!json_object_object_get_ex(jobj1, keyslot_name, &jobj2)) + return NULL; + + return jobj2; +} + +json_object *LUKS2_get_tokens_jobj(struct luks2_hdr *hdr) +{ + json_object *jobj_tokens; + + if (!hdr || !json_object_object_get_ex(hdr->jobj, "tokens", &jobj_tokens)) + return NULL; + + return jobj_tokens; +} + +json_object *LUKS2_get_token_jobj(struct luks2_hdr *hdr, int token) +{ + json_object *jobj1, *jobj2; + char token_name[16]; + + if (!hdr || token < 0) + return NULL; + + jobj1 = LUKS2_get_tokens_jobj(hdr); + if (!jobj1) + return NULL; + + if (snprintf(token_name, sizeof(token_name), "%u", token) < 1) + return NULL; + + json_object_object_get_ex(jobj1, token_name, &jobj2); + return jobj2; +} + +json_object *LUKS2_get_digest_jobj(struct luks2_hdr *hdr, int digest) +{ + json_object *jobj1, *jobj2; + char digest_name[16]; + + if (!hdr || digest < 0) + return NULL; + + if (snprintf(digest_name, sizeof(digest_name), "%u", digest) < 1) + return NULL; + + if (!json_object_object_get_ex(hdr->jobj, "digests", &jobj1)) + return NULL; + + json_object_object_get_ex(jobj1, digest_name, &jobj2); + return jobj2; +} + +static json_object *json_get_segments_jobj(json_object *hdr_jobj) +{ + json_object *jobj_segments; + + if (!hdr_jobj || !json_object_object_get_ex(hdr_jobj, "segments", &jobj_segments)) + return NULL; + + return jobj_segments; +} + +json_object *LUKS2_get_segment_jobj(struct luks2_hdr *hdr, int segment) +{ + if (!hdr) + return NULL; + + if (segment == CRYPT_DEFAULT_SEGMENT) + segment = LUKS2_get_default_segment(hdr); + + return json_segments_get_segment(json_get_segments_jobj(hdr->jobj), segment); +} + +json_object *LUKS2_get_segments_jobj(struct luks2_hdr *hdr) +{ + return hdr ? json_get_segments_jobj(hdr->jobj) : NULL; +} + +int LUKS2_segments_count(struct luks2_hdr *hdr) +{ + if (!hdr) + return -EINVAL; + + return json_segments_count(LUKS2_get_segments_jobj(hdr)); +} + +int LUKS2_get_default_segment(struct luks2_hdr *hdr) +{ + int s = LUKS2_get_segment_id_by_flag(hdr, "backup-final"); + if (s >= 0) + return s; + + if (LUKS2_segments_count(hdr) == 1) + return 0; + + return -EINVAL; +} + +/* + * json_type_int needs to be validated first. + * See validate_json_uint32() + */ +uint32_t crypt_jobj_get_uint32(json_object *jobj) +{ + return json_object_get_int64(jobj); +} + +/* jobj has to be json_type_string and numbered */ +static json_bool json_str_to_uint64(json_object *jobj, uint64_t *value) +{ + char *endptr; + unsigned long long tmp; + + errno = 0; + tmp = strtoull(json_object_get_string(jobj), &endptr, 10); + if (*endptr || errno) { + *value = 0; + return 0; + } + + *value = tmp; + return 1; +} + +uint64_t crypt_jobj_get_uint64(json_object *jobj) +{ + uint64_t r; + json_str_to_uint64(jobj, &r); + return r; +} + +json_object *crypt_jobj_new_uint64(uint64_t value) +{ + /* 18446744073709551615 */ + char num[21]; + int r; + json_object *jobj; + + r = snprintf(num, sizeof(num), "%" PRIu64, value); + if (r < 0 || (size_t)r >= sizeof(num)) + return NULL; + + jobj = json_object_new_string(num); + return jobj; +} + +/* + * Validate helpers + */ +static json_bool numbered(struct crypt_device *cd, const char *name, const char *key) +{ + int i; + + for (i = 0; key[i]; i++) + if (!isdigit(key[i])) { + log_dbg(cd, "%s \"%s\" is not in numbered form.", name, key); + return 0; + } + return 1; +} + +json_object *json_contains(struct crypt_device *cd, json_object *jobj, const char *name, + const char *section, const char *key, json_type type) +{ + json_object *sobj; + + if (!json_object_object_get_ex(jobj, key, &sobj) || + !json_object_is_type(sobj, type)) { + log_dbg(cd, "%s \"%s\" is missing \"%s\" (%s) specification.", + section, name, key, json_type_to_name(type)); + return NULL; + } + + return sobj; +} + +json_bool validate_json_uint32(json_object *jobj) +{ + int64_t tmp; + + errno = 0; + tmp = json_object_get_int64(jobj); + + return (errno || tmp < 0 || tmp > UINT32_MAX) ? 0 : 1; +} + +static json_bool validate_keyslots_array(struct crypt_device *cd, + json_object *jarr, json_object *jobj_keys) +{ + json_object *jobj; + int i = 0, length = (int) json_object_array_length(jarr); + + while (i < length) { + jobj = json_object_array_get_idx(jarr, i); + if (!json_object_is_type(jobj, json_type_string)) { + log_dbg(cd, "Illegal value type in keyslots array at index %d.", i); + return 0; + } + + if (!json_contains(cd, jobj_keys, "", "Keyslots section", + json_object_get_string(jobj), json_type_object)) + return 0; + + i++; + } + + return 1; +} + +static json_bool validate_segments_array(struct crypt_device *cd, + json_object *jarr, json_object *jobj_segments) +{ + json_object *jobj; + int i = 0, length = (int) json_object_array_length(jarr); + + while (i < length) { + jobj = json_object_array_get_idx(jarr, i); + if (!json_object_is_type(jobj, json_type_string)) { + log_dbg(cd, "Illegal value type in segments array at index %d.", i); + return 0; + } + + if (!json_contains(cd, jobj_segments, "", "Segments section", + json_object_get_string(jobj), json_type_object)) + return 0; + + i++; + } + + return 1; +} + +static json_bool segment_has_digest(const char *segment_name, json_object *jobj_digests) +{ + json_object *jobj_segments; + + json_object_object_foreach(jobj_digests, key, val) { + UNUSED(key); + json_object_object_get_ex(val, "segments", &jobj_segments); + if (LUKS2_array_jobj(jobj_segments, segment_name)) + return 1; + } + + return 0; +} + +static json_bool validate_intervals(struct crypt_device *cd, + int length, const struct interval *ix, + uint64_t metadata_size, uint64_t keyslots_area_end) +{ + int j, i = 0; + + while (i < length) { + if (ix[i].offset < 2 * metadata_size) { + log_dbg(cd, "Illegal area offset: %" PRIu64 ".", ix[i].offset); + return 0; + } + + if (!ix[i].length) { + log_dbg(cd, "Area length must be greater than zero."); + return 0; + } + + if ((ix[i].offset + ix[i].length) > keyslots_area_end) { + log_dbg(cd, "Area [%" PRIu64 ", %" PRIu64 "] overflows binary keyslots area (ends at offset: %" PRIu64 ").", + ix[i].offset, ix[i].offset + ix[i].length, keyslots_area_end); + return 0; + } + + for (j = 0; j < length; j++) { + if (i == j) + continue; + if ((ix[i].offset >= ix[j].offset) && (ix[i].offset < (ix[j].offset + ix[j].length))) { + log_dbg(cd, "Overlapping areas [%" PRIu64 ",%" PRIu64 "] and [%" PRIu64 ",%" PRIu64 "].", + ix[i].offset, ix[i].offset + ix[i].length, + ix[j].offset, ix[j].offset + ix[j].length); + return 0; + } + } + + i++; + } + + return 1; +} + +static int LUKS2_keyslot_validate(struct crypt_device *cd, json_object *hdr_jobj, json_object *hdr_keyslot, const char *key) +{ + json_object *jobj_key_size; + + if (!json_contains(cd, hdr_keyslot, key, "Keyslot", "type", json_type_string)) + return 1; + if (!(jobj_key_size = json_contains(cd, hdr_keyslot, key, "Keyslot", "key_size", json_type_int))) + return 1; + + /* enforce uint32_t type */ + if (!validate_json_uint32(jobj_key_size)) { + log_dbg(cd, "Illegal field \"key_size\":%s.", + json_object_get_string(jobj_key_size)); + return 1; + } + + return 0; +} + +int LUKS2_token_validate(struct crypt_device *cd, + json_object *hdr_jobj, json_object *jobj_token, const char *key) +{ + json_object *jarr, *jobj_keyslots; + + /* keyslots are not yet validated, but we need to know token doesn't reference missing keyslot */ + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) + return 1; + + if (!json_contains(cd, jobj_token, key, "Token", "type", json_type_string)) + return 1; + + jarr = json_contains(cd, jobj_token, key, "Token", "keyslots", json_type_array); + if (!jarr) + return 1; + + if (!validate_keyslots_array(cd, jarr, jobj_keyslots)) + return 1; + + return 0; +} + +static int hdr_validate_json_size(struct crypt_device *cd, json_object *hdr_jobj, uint64_t hdr_json_size) +{ + json_object *jobj, *jobj1; + const char *json; + uint64_t json_area_size, json_size; + + json_object_object_get_ex(hdr_jobj, "config", &jobj); + json_object_object_get_ex(jobj, "json_size", &jobj1); + + json = json_object_to_json_string_ext(hdr_jobj, + JSON_C_TO_STRING_PLAIN | JSON_C_TO_STRING_NOSLASHESCAPE); + json_area_size = crypt_jobj_get_uint64(jobj1); + json_size = (uint64_t)strlen(json); + + if (hdr_json_size != json_area_size) { + log_dbg(cd, "JSON area size does not match value in binary header."); + return 1; + } + + if (json_size > json_area_size) { + log_dbg(cd, "JSON does not fit in the designated area."); + return 1; + } + + return 0; +} + +int LUKS2_check_json_size(struct crypt_device *cd, const struct luks2_hdr *hdr) +{ + return hdr_validate_json_size(cd, hdr->jobj, hdr->hdr_size - LUKS2_HDR_BIN_LEN); +} + +static int hdr_validate_keyslots(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jobj; + + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj)) { + log_dbg(cd, "Missing keyslots section."); + return 1; + } + + json_object_object_foreach(jobj, key, val) { + if (!numbered(cd, "Keyslot", key)) + return 1; + if (LUKS2_keyslot_validate(cd, hdr_jobj, val, key)) + return 1; + } + + return 0; +} + +static int hdr_validate_tokens(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jobj; + + if (!json_object_object_get_ex(hdr_jobj, "tokens", &jobj)) { + log_dbg(cd, "Missing tokens section."); + return 1; + } + + json_object_object_foreach(jobj, key, val) { + if (!numbered(cd, "Token", key)) + return 1; + if (LUKS2_token_validate(cd, hdr_jobj, val, key)) + return 1; + } + + return 0; +} + +static int hdr_validate_crypt_segment(struct crypt_device *cd, + json_object *jobj, const char *key, json_object *jobj_digests, + uint64_t offset, uint64_t size) +{ + json_object *jobj_ivoffset, *jobj_sector_size, *jobj_integrity; + uint32_t sector_size; + uint64_t ivoffset; + + if (!(jobj_ivoffset = json_contains(cd, jobj, key, "Segment", "iv_tweak", json_type_string)) || + !json_contains(cd, jobj, key, "Segment", "encryption", json_type_string) || + !(jobj_sector_size = json_contains(cd, jobj, key, "Segment", "sector_size", json_type_int))) + return 1; + + /* integrity */ + if (json_object_object_get_ex(jobj, "integrity", &jobj_integrity)) { + if (!json_contains(cd, jobj, key, "Segment", "integrity", json_type_object) || + !json_contains(cd, jobj_integrity, key, "Segment integrity", "type", json_type_string) || + !json_contains(cd, jobj_integrity, key, "Segment integrity", "journal_encryption", json_type_string) || + !json_contains(cd, jobj_integrity, key, "Segment integrity", "journal_integrity", json_type_string)) + return 1; + } + + /* enforce uint32_t type */ + if (!validate_json_uint32(jobj_sector_size)) { + log_dbg(cd, "Illegal field \"sector_size\":%s.", + json_object_get_string(jobj_sector_size)); + return 1; + } + + sector_size = crypt_jobj_get_uint32(jobj_sector_size); + if (!sector_size || MISALIGNED_512(sector_size)) { + log_dbg(cd, "Illegal sector size: %" PRIu32, sector_size); + return 1; + } + + if (!numbered(cd, "iv_tweak", json_object_get_string(jobj_ivoffset)) || + !json_str_to_uint64(jobj_ivoffset, &ivoffset)) { + log_dbg(cd, "Illegal iv_tweak value."); + return 1; + } + + if (size % sector_size) { + log_dbg(cd, "Size field has to be aligned to sector size: %" PRIu32, sector_size); + return 1; + } + + return !segment_has_digest(key, jobj_digests); +} + +static bool validate_segment_intervals(struct crypt_device *cd, + int length, const struct interval *ix) +{ + int j, i = 0; + + while (i < length) { + if (ix[i].length == UINT64_MAX && (i != (length - 1))) { + log_dbg(cd, "Only last regular segment is allowed to have 'dynamic' size."); + return false; + } + + for (j = 0; j < length; j++) { + if (i == j) + continue; + if ((ix[i].offset >= ix[j].offset) && (ix[j].length == UINT64_MAX || (ix[i].offset < (ix[j].offset + ix[j].length)))) { + log_dbg(cd, "Overlapping segments [%" PRIu64 ",%" PRIu64 "]%s and [%" PRIu64 ",%" PRIu64 "]%s.", + ix[i].offset, ix[i].offset + ix[i].length, ix[i].length == UINT64_MAX ? "(dynamic)" : "", + ix[j].offset, ix[j].offset + ix[j].length, ix[j].length == UINT64_MAX ? "(dynamic)" : ""); + return false; + } + } + + i++; + } + + return true; +} + +static int reqs_unknown(uint32_t reqs) +{ + return reqs & CRYPT_REQUIREMENT_UNKNOWN; +} + +static int reqs_reencrypt(uint32_t reqs) +{ + return reqs & CRYPT_REQUIREMENT_OFFLINE_REENCRYPT; +} + +static int reqs_reencrypt_online(uint32_t reqs) +{ + return reqs & CRYPT_REQUIREMENT_ONLINE_REENCRYPT; +} + +/* + * Config section requirements object must be valid. + * Also general segments section must be validated first. + */ +static int validate_reencrypt_segments(struct crypt_device *cd, json_object *hdr_jobj, json_object *jobj_segments, int first_backup, int segments_count) +{ + json_object *jobj, *jobj_backup_previous = NULL, *jobj_backup_final = NULL; + uint32_t reqs; + int i, r; + struct luks2_hdr dummy = { + .jobj = hdr_jobj + }; + + r = LUKS2_config_get_requirements(cd, &dummy, &reqs); + if (r) + return 1; + + if (reqs_reencrypt_online(reqs)) { + for (i = first_backup; i < segments_count; i++) { + jobj = json_segments_get_segment(jobj_segments, i); + if (!jobj) + return 1; + if (json_segment_contains_flag(jobj, "backup-final", 0)) + jobj_backup_final = jobj; + else if (json_segment_contains_flag(jobj, "backup-previous", 0)) + jobj_backup_previous = jobj; + } + + if (!jobj_backup_final || !jobj_backup_previous) { + log_dbg(cd, "Backup segment is missing."); + return 1; + } + + for (i = 0; i < first_backup; i++) { + jobj = json_segments_get_segment(jobj_segments, i); + if (!jobj) + return 1; + + if (json_segment_contains_flag(jobj, "in-reencryption", 0)) { + if (!json_segment_cmp(jobj, jobj_backup_final)) { + log_dbg(cd, "Segment in reencryption does not match backup final segment."); + return 1; + } + continue; + } + + if (!json_segment_cmp(jobj, jobj_backup_final) && + !json_segment_cmp(jobj, jobj_backup_previous)) { + log_dbg(cd, "Segment does not match neither backup final or backup previous segment."); + return 1; + } + } + } + + return 0; +} + +static int hdr_validate_segments(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jobj_segments, *jobj_digests, *jobj_offset, *jobj_size, *jobj_type, *jobj_flags, *jobj; + uint64_t offset, size; + int i, r, count, first_backup = -1; + struct interval *intervals = NULL; + + if (!json_object_object_get_ex(hdr_jobj, "segments", &jobj_segments)) { + log_dbg(cd, "Missing segments section."); + return 1; + } + + count = json_object_object_length(jobj_segments); + if (count < 1) { + log_dbg(cd, "Empty segments section."); + return 1; + } + + /* digests should already be validated */ + if (!json_object_object_get_ex(hdr_jobj, "digests", &jobj_digests)) + return 1; + + json_object_object_foreach(jobj_segments, key, val) { + if (!numbered(cd, "Segment", key)) + return 1; + + /* those fields are mandatory for all segment types */ + if (!(jobj_type = json_contains(cd, val, key, "Segment", "type", json_type_string)) || + !(jobj_offset = json_contains(cd, val, key, "Segment", "offset", json_type_string)) || + !(jobj_size = json_contains(cd, val, key, "Segment", "size", json_type_string))) + return 1; + + if (!numbered(cd, "offset", json_object_get_string(jobj_offset)) || + !json_str_to_uint64(jobj_offset, &offset)) + return 1; + + /* size "dynamic" means whole device starting at 'offset' */ + if (strcmp(json_object_get_string(jobj_size), "dynamic")) { + if (!numbered(cd, "size", json_object_get_string(jobj_size)) || + !json_str_to_uint64(jobj_size, &size) || !size) + return 1; + } else + size = 0; + + /* all device-mapper devices are aligned to 512 sector size */ + if (MISALIGNED_512(offset)) { + log_dbg(cd, "Offset field has to be aligned to sector size: %" PRIu32, SECTOR_SIZE); + return 1; + } + if (MISALIGNED_512(size)) { + log_dbg(cd, "Size field has to be aligned to sector size: %" PRIu32, SECTOR_SIZE); + return 1; + } + + /* flags array is optional and must contain strings */ + if (json_object_object_get_ex(val, "flags", NULL)) { + if (!(jobj_flags = json_contains(cd, val, key, "Segment", "flags", json_type_array))) + return 1; + for (i = 0; i < (int) json_object_array_length(jobj_flags); i++) + if (!json_object_is_type(json_object_array_get_idx(jobj_flags, i), json_type_string)) + return 1; + } + + i = atoi(key); + if (json_segment_is_backup(val)) { + if (first_backup < 0 || i < first_backup) + first_backup = i; + } else { + if ((first_backup >= 0) && i >= first_backup) { + log_dbg(cd, "Regular segment at %d is behind backup segment at %d", i, first_backup); + return 1; + } + } + + /* crypt */ + if (!strcmp(json_object_get_string(jobj_type), "crypt") && + hdr_validate_crypt_segment(cd, val, key, jobj_digests, offset, size)) + return 1; + } + + if (first_backup == 0) { + log_dbg(cd, "No regular segment."); + return 1; + } + + /* avoid needlessly large allocation when first backup segment is invalid */ + if (first_backup >= count) { + log_dbg(cd, "Gap between last regular segment and backup segment at key %d.", first_backup); + return 1; + } + + if (first_backup < 0) + first_backup = count; + + if ((size_t)first_backup < SIZE_MAX / sizeof(*intervals)) + intervals = malloc(first_backup * sizeof(*intervals)); + + if (!intervals) { + log_dbg(cd, "Not enough memory."); + return 1; + } + + for (i = 0; i < first_backup; i++) { + jobj = json_segments_get_segment(jobj_segments, i); + if (!jobj) { + log_dbg(cd, "Gap at key %d in segments object.", i); + free(intervals); + return 1; + } + intervals[i].offset = json_segment_get_offset(jobj, 0); + intervals[i].length = json_segment_get_size(jobj, 0) ?: UINT64_MAX; + } + + r = !validate_segment_intervals(cd, first_backup, intervals); + free(intervals); + + if (r) + return 1; + + for (; i < count; i++) { + if (!json_segments_get_segment(jobj_segments, i)) { + log_dbg(cd, "Gap at key %d in segments object.", i); + return 1; + } + } + + return validate_reencrypt_segments(cd, hdr_jobj, jobj_segments, first_backup, count); +} + +static uint64_t LUKS2_metadata_size_jobj(json_object *jobj) +{ + json_object *jobj1, *jobj2; + uint64_t json_size; + + json_object_object_get_ex(jobj, "config", &jobj1); + json_object_object_get_ex(jobj1, "json_size", &jobj2); + json_str_to_uint64(jobj2, &json_size); + + return json_size + LUKS2_HDR_BIN_LEN; +} + +uint64_t LUKS2_metadata_size(struct luks2_hdr *hdr) +{ + return LUKS2_metadata_size_jobj(hdr->jobj); +} + +static int hdr_validate_areas(struct crypt_device *cd, json_object *hdr_jobj) +{ + struct interval *intervals; + json_object *jobj_keyslots, *jobj_offset, *jobj_length, *jobj_segments, *jobj_area; + int length, ret, i = 0; + uint64_t metadata_size; + + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) + return 1; + + /* segments are already validated */ + if (!json_object_object_get_ex(hdr_jobj, "segments", &jobj_segments)) + return 1; + + /* config is already validated */ + metadata_size = LUKS2_metadata_size_jobj(hdr_jobj); + + length = json_object_object_length(jobj_keyslots); + + /* Empty section */ + if (length == 0) + return 0; + + if (length < 0) { + log_dbg(cd, "Invalid keyslot areas specification."); + return 1; + } + + intervals = malloc(length * sizeof(*intervals)); + if (!intervals) { + log_dbg(cd, "Not enough memory."); + return -ENOMEM; + } + + json_object_object_foreach(jobj_keyslots, key, val) { + + if (!(jobj_area = json_contains(cd, val, key, "Keyslot", "area", json_type_object)) || + !json_contains(cd, jobj_area, key, "Keyslot area", "type", json_type_string) || + !(jobj_offset = json_contains(cd, jobj_area, key, "Keyslot", "offset", json_type_string)) || + !(jobj_length = json_contains(cd, jobj_area, key, "Keyslot", "size", json_type_string)) || + !numbered(cd, "offset", json_object_get_string(jobj_offset)) || + !numbered(cd, "size", json_object_get_string(jobj_length))) { + free(intervals); + return 1; + } + + /* rule out values > UINT64_MAX */ + if (!json_str_to_uint64(jobj_offset, &intervals[i].offset) || + !json_str_to_uint64(jobj_length, &intervals[i].length)) { + free(intervals); + return 1; + } + + i++; + } + + if (length != i) { + free(intervals); + return 1; + } + + ret = validate_intervals(cd, length, intervals, metadata_size, LUKS2_hdr_and_areas_size_jobj(hdr_jobj)) ? 0 : 1; + + free(intervals); + + return ret; +} + +static int hdr_validate_digests(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jarr_keys, *jarr_segs, *jobj, *jobj_keyslots, *jobj_segments; + + if (!json_object_object_get_ex(hdr_jobj, "digests", &jobj)) { + log_dbg(cd, "Missing digests section."); + return 1; + } + + /* keyslots are not yet validated, but we need to know digest doesn't reference missing keyslot */ + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) + return 1; + + /* segments are not yet validated, but we need to know digest doesn't reference missing segment */ + if (!json_object_object_get_ex(hdr_jobj, "segments", &jobj_segments)) + return 1; + + json_object_object_foreach(jobj, key, val) { + if (!numbered(cd, "Digest", key)) + return 1; + + if (!json_contains(cd, val, key, "Digest", "type", json_type_string) || + !(jarr_keys = json_contains(cd, val, key, "Digest", "keyslots", json_type_array)) || + !(jarr_segs = json_contains(cd, val, key, "Digest", "segments", json_type_array))) + return 1; + + if (!validate_keyslots_array(cd, jarr_keys, jobj_keyslots)) + return 1; + if (!validate_segments_array(cd, jarr_segs, jobj_segments)) + return 1; + } + + return 0; +} + +/* requirements being validated in stand-alone routine */ +static int hdr_validate_config(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jobj_config, *jobj; + int i; + uint64_t keyslots_size, metadata_size, segment_offset; + + if (!json_object_object_get_ex(hdr_jobj, "config", &jobj_config)) { + log_dbg(cd, "Missing config section."); + return 1; + } + + if (!(jobj = json_contains(cd, jobj_config, "section", "Config", "json_size", json_type_string)) || + !json_str_to_uint64(jobj, &metadata_size)) + return 1; + + /* single metadata instance is assembled from json area size plus + * binary header size */ + metadata_size += LUKS2_HDR_BIN_LEN; + + if (!(jobj = json_contains(cd, jobj_config, "section", "Config", "keyslots_size", json_type_string)) || + !json_str_to_uint64(jobj, &keyslots_size)) + return 1; + + if (LUKS2_check_metadata_area_size(metadata_size)) { + log_dbg(cd, "Unsupported LUKS2 header size (%" PRIu64 ").", metadata_size); + return 1; + } + + if (LUKS2_check_keyslots_area_size(keyslots_size)) { + log_dbg(cd, "Unsupported LUKS2 keyslots size (%" PRIu64 ").", keyslots_size); + return 1; + } + + /* + * validate keyslots_size fits in between (2 * metadata_size) and first + * segment_offset (except detached header) + */ + segment_offset = json_segments_get_minimal_offset(json_get_segments_jobj(hdr_jobj), 0); + if (segment_offset && + (segment_offset < keyslots_size || + (segment_offset - keyslots_size) < (2 * metadata_size))) { + log_dbg(cd, "keyslots_size is too large %" PRIu64 " (bytes). Data offset: %" PRIu64 + ", keyslots offset: %" PRIu64, keyslots_size, segment_offset, 2 * metadata_size); + return 1; + } + + /* Flags array is optional */ + if (json_object_object_get_ex(jobj_config, "flags", &jobj)) { + if (!json_contains(cd, jobj_config, "section", "Config", "flags", json_type_array)) + return 1; + + /* All array members must be strings */ + for (i = 0; i < (int) json_object_array_length(jobj); i++) + if (!json_object_is_type(json_object_array_get_idx(jobj, i), json_type_string)) + return 1; + } + + return 0; +} + +static int hdr_validate_requirements(struct crypt_device *cd, json_object *hdr_jobj) +{ + int i; + json_object *jobj_config, *jobj, *jobj1; + + if (!json_object_object_get_ex(hdr_jobj, "config", &jobj_config)) { + log_dbg(cd, "Missing config section."); + return 1; + } + + /* Requirements object is optional */ + if (json_object_object_get_ex(jobj_config, "requirements", &jobj)) { + if (!json_contains(cd, jobj_config, "section", "Config", "requirements", json_type_object)) + return 1; + + /* Mandatory array is optional */ + if (json_object_object_get_ex(jobj, "mandatory", &jobj1)) { + if (!json_contains(cd, jobj, "section", "Requirements", "mandatory", json_type_array)) + return 1; + + /* All array members must be strings */ + for (i = 0; i < (int) json_object_array_length(jobj1); i++) + if (!json_object_is_type(json_object_array_get_idx(jobj1, i), json_type_string)) + return 1; + } + } + + return 0; +} + +int LUKS2_hdr_validate(struct crypt_device *cd, json_object *hdr_jobj, uint64_t json_size) +{ + struct { + int (*validate)(struct crypt_device *, json_object *); + } checks[] = { + { hdr_validate_requirements }, + { hdr_validate_tokens }, + { hdr_validate_digests }, + { hdr_validate_segments }, + { hdr_validate_keyslots }, + { hdr_validate_config }, + { hdr_validate_areas }, + { NULL } + }; + int i; + + if (!hdr_jobj) + return 1; + + for (i = 0; checks[i].validate; i++) + if (checks[i].validate && checks[i].validate(cd, hdr_jobj)) + return 1; + + if (hdr_validate_json_size(cd, hdr_jobj, json_size)) + return 1; + + /* validate keyslot implementations */ + if (LUKS2_keyslots_validate(cd, hdr_jobj)) + return 1; + + return 0; +} + +/* FIXME: should we expose do_recovery parameter explicitly? */ +int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, int repair) +{ + int r; + + r = device_read_lock(cd, crypt_metadata_device(cd)); + if (r) { + log_err(cd, _("Failed to acquire read lock on device %s."), + device_path(crypt_metadata_device(cd))); + return r; + } + + r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, !repair); + if (r == -EAGAIN) { + /* unlikely: auto-recovery is required and failed due to read lock being held */ + device_read_unlock(cd, crypt_metadata_device(cd)); + + /* Do not use LUKS2_device_write lock. Recovery. */ + r = device_write_lock(cd, crypt_metadata_device(cd)); + if (r < 0) { + log_err(cd, _("Failed to acquire write lock on device %s."), + device_path(crypt_metadata_device(cd))); + return r; + } + + r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, !repair); + + device_write_unlock(cd, crypt_metadata_device(cd)); + } else + device_read_unlock(cd, crypt_metadata_device(cd)); + + return r; +} + +static int hdr_cleanup_and_validate(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + LUKS2_digests_erase_unused(cd, hdr); + + return LUKS2_hdr_validate(cd, hdr->jobj, hdr->hdr_size - LUKS2_HDR_BIN_LEN); +} + +int LUKS2_hdr_write_force(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + if (hdr_cleanup_and_validate(cd, hdr)) + return -EINVAL; + + return LUKS2_disk_hdr_write(cd, hdr, crypt_metadata_device(cd), false); +} + +int LUKS2_hdr_write(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + if (hdr_cleanup_and_validate(cd, hdr)) + return -EINVAL; + + return LUKS2_disk_hdr_write(cd, hdr, crypt_metadata_device(cd), true); +} + +int LUKS2_hdr_uuid(struct crypt_device *cd, struct luks2_hdr *hdr, const char *uuid) +{ + uuid_t partitionUuid; + + if (uuid && uuid_parse(uuid, partitionUuid) == -1) { + log_err(cd, _("Wrong LUKS UUID format provided.")); + return -EINVAL; + } + if (!uuid) + uuid_generate(partitionUuid); + + uuid_unparse(partitionUuid, hdr->uuid); + + return LUKS2_hdr_write(cd, hdr); +} + +int LUKS2_hdr_labels(struct crypt_device *cd, struct luks2_hdr *hdr, + const char *label, const char *subsystem, int commit) +{ + //FIXME: check if the labels are the same and skip this. + + memset(hdr->label, 0, LUKS2_LABEL_L); + if (label) + strncpy(hdr->label, label, LUKS2_LABEL_L-1); + + memset(hdr->subsystem, 0, LUKS2_LABEL_L); + if (subsystem) + strncpy(hdr->subsystem, subsystem, LUKS2_LABEL_L-1); + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +void LUKS2_hdr_free(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + if (json_object_put(hdr->jobj)) + hdr->jobj = NULL; + else if (hdr->jobj) + log_dbg(cd, "LUKS2 header still in use"); +} + +static uint64_t LUKS2_keyslots_size_jobj(json_object *jobj) +{ + json_object *jobj1, *jobj2; + uint64_t keyslots_size; + + json_object_object_get_ex(jobj, "config", &jobj1); + json_object_object_get_ex(jobj1, "keyslots_size", &jobj2); + json_str_to_uint64(jobj2, &keyslots_size); + + return keyslots_size; +} + +uint64_t LUKS2_keyslots_size(struct luks2_hdr *hdr) +{ + return LUKS2_keyslots_size_jobj(hdr->jobj); +} + +uint64_t LUKS2_hdr_and_areas_size_jobj(json_object *jobj) +{ + return 2 * LUKS2_metadata_size_jobj(jobj) + LUKS2_keyslots_size_jobj(jobj); +} + +uint64_t LUKS2_hdr_and_areas_size(struct luks2_hdr *hdr) +{ + return LUKS2_hdr_and_areas_size_jobj(hdr->jobj); +} + +int LUKS2_hdr_backup(struct crypt_device *cd, struct luks2_hdr *hdr, + const char *backup_file) +{ + struct device *device = crypt_metadata_device(cd); + int fd, devfd, r = 0; + ssize_t hdr_size; + ssize_t ret, buffer_size; + char *buffer = NULL; + + hdr_size = LUKS2_hdr_and_areas_size(hdr); + buffer_size = size_round_up(hdr_size, crypt_getpagesize()); + + buffer = crypt_safe_alloc(buffer_size); + if (!buffer) + return -ENOMEM; + + log_dbg(cd, "Storing backup of header (%zu bytes).", hdr_size); + log_dbg(cd, "Output backup file size: %zu bytes.", buffer_size); + + r = device_read_lock(cd, device); + if (r) { + log_err(cd, _("Failed to acquire read lock on device %s."), + device_path(crypt_metadata_device(cd))); + crypt_safe_free(buffer); + return r; + } + + devfd = device_open_locked(cd, device, O_RDONLY); + if (devfd < 0) { + device_read_unlock(cd, device); + log_err(cd, _("Device %s is not a valid LUKS device."), device_path(device)); + crypt_safe_free(buffer); + return devfd == -1 ? -EINVAL : devfd; + } + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), buffer, hdr_size, 0) < hdr_size) { + device_read_unlock(cd, device); + crypt_safe_free(buffer); + return -EIO; + } + + device_read_unlock(cd, device); + + fd = open(backup_file, O_CREAT|O_EXCL|O_WRONLY, S_IRUSR); + if (fd == -1) { + if (errno == EEXIST) + log_err(cd, _("Requested header backup file %s already exists."), backup_file); + else + log_err(cd, _("Cannot create header backup file %s."), backup_file); + crypt_safe_free(buffer); + return -EINVAL; + } + ret = write_buffer(fd, buffer, buffer_size); + close(fd); + if (ret < buffer_size) { + log_err(cd, _("Cannot write header backup file %s."), backup_file); + r = -EIO; + } else + r = 0; + + crypt_safe_free(buffer); + return r; +} + +int LUKS2_hdr_restore(struct crypt_device *cd, struct luks2_hdr *hdr, + const char *backup_file) +{ + struct device *backup_device, *device = crypt_metadata_device(cd); + int r, fd, devfd = -1, diff_uuid = 0; + ssize_t ret, buffer_size = 0; + char *buffer = NULL, msg[1024]; + struct luks2_hdr hdr_file; + struct luks2_hdr tmp_hdr = {}; + uint32_t reqs = 0; + + r = device_alloc(cd, &backup_device, backup_file); + if (r < 0) + return r; + + r = device_read_lock(cd, backup_device); + if (r) { + log_err(cd, _("Failed to acquire read lock on device %s."), + device_path(backup_device)); + device_free(cd, backup_device); + return r; + } + + r = LUKS2_disk_hdr_read(cd, &hdr_file, backup_device, 0, 0); + device_read_unlock(cd, backup_device); + device_free(cd, backup_device); + + if (r < 0) { + log_err(cd, _("Backup file does not contain valid LUKS header.")); + goto out; + } + + /* do not allow header restore from backup with unmet requirements */ + if (LUKS2_unmet_requirements(cd, &hdr_file, CRYPT_REQUIREMENT_ONLINE_REENCRYPT, 1)) { + log_err(cd, _("Forbidden LUKS2 requirements detected in backup %s."), + backup_file); + r = -ETXTBSY; + goto out; + } + + buffer_size = LUKS2_hdr_and_areas_size(&hdr_file); + buffer = crypt_safe_alloc(buffer_size); + if (!buffer) { + r = -ENOMEM; + goto out; + } + + fd = open(backup_file, O_RDONLY); + if (fd == -1) { + log_err(cd, _("Cannot open header backup file %s."), backup_file); + r = -EINVAL; + goto out; + } + + ret = read_buffer(fd, buffer, buffer_size); + close(fd); + if (ret < buffer_size) { + log_err(cd, _("Cannot read header backup file %s."), backup_file); + r = -EIO; + goto out; + } + + r = LUKS2_hdr_read(cd, &tmp_hdr, 0); + if (r == 0) { + log_dbg(cd, "Device %s already contains LUKS2 header, checking UUID and requirements.", device_path(device)); + r = LUKS2_config_get_requirements(cd, &tmp_hdr, &reqs); + if (r) + goto out; + + if (memcmp(tmp_hdr.uuid, hdr_file.uuid, LUKS2_UUID_L)) + diff_uuid = 1; + + if (!reqs_reencrypt(reqs)) { + log_dbg(cd, "Checking LUKS2 header size and offsets."); + if (LUKS2_get_data_offset(&tmp_hdr) != LUKS2_get_data_offset(&hdr_file)) { + log_err(cd, _("Data offset differ on device and backup, restore failed.")); + r = -EINVAL; + goto out; + } + /* FIXME: what could go wrong? Erase if we're fine with consequences */ + if (buffer_size != (ssize_t) LUKS2_hdr_and_areas_size(&tmp_hdr)) { + log_err(cd, _("Binary header with keyslot areas size differ on device and backup, restore failed.")); + r = -EINVAL; + goto out; + } + } + } + + r = snprintf(msg, sizeof(msg), _("Device %s %s%s%s%s"), device_path(device), + r ? _("does not contain LUKS2 header. Replacing header can destroy data on that device.") : + _("already contains LUKS2 header. Replacing header will destroy existing keyslots."), + diff_uuid ? _("\nWARNING: real device header has different UUID than backup!") : "", + reqs_unknown(reqs) ? _("\nWARNING: unknown LUKS2 requirements detected in real device header!" + "\nReplacing header with backup may corrupt the data on that device!") : "", + reqs_reencrypt(reqs) ? _("\nWARNING: Unfinished offline reencryption detected on the device!" + "\nReplacing header with backup may corrupt data.") : ""); + if (r < 0 || (size_t) r >= sizeof(msg)) { + r = -ENOMEM; + goto out; + } + + if (!crypt_confirm(cd, msg)) { + r = -EINVAL; + goto out; + } + + log_dbg(cd, "Storing backup of header (%zu bytes) to device %s.", buffer_size, device_path(device)); + + /* Do not use LUKS2_device_write lock for checking sequence id on restore */ + r = device_write_lock(cd, device); + if (r < 0) { + log_err(cd, _("Failed to acquire write lock on device %s."), + device_path(device)); + goto out; + } + + devfd = device_open_locked(cd, device, O_RDWR); + if (devfd < 0) { + if (errno == EACCES) + log_err(cd, _("Cannot write to device %s, permission denied."), + device_path(device)); + else + log_err(cd, _("Cannot open device %s."), device_path(device)); + device_write_unlock(cd, device); + r = -EINVAL; + goto out; + } + + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), buffer, buffer_size, 0) < buffer_size) + r = -EIO; + else + r = 0; + + device_write_unlock(cd, device); +out: + LUKS2_hdr_free(cd, hdr); + LUKS2_hdr_free(cd, &hdr_file); + LUKS2_hdr_free(cd, &tmp_hdr); + crypt_safe_memzero(&hdr_file, sizeof(hdr_file)); + crypt_safe_memzero(&tmp_hdr, sizeof(tmp_hdr)); + crypt_safe_free(buffer); + + device_sync(cd, device); + + return r; +} + +/* + * Persistent config flags + */ +static const struct { + uint32_t flag; + const char *description; +} persistent_flags[] = { + { CRYPT_ACTIVATE_ALLOW_DISCARDS, "allow-discards" }, + { CRYPT_ACTIVATE_SAME_CPU_CRYPT, "same-cpu-crypt" }, + { CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS, "submit-from-crypt-cpus" }, + { CRYPT_ACTIVATE_NO_JOURNAL, "no-journal" }, + { CRYPT_ACTIVATE_NO_READ_WORKQUEUE, "no-read-workqueue" }, + { CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE, "no-write-workqueue" }, + { 0, NULL } +}; + +int LUKS2_config_get_flags(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t *flags) +{ + json_object *jobj1, *jobj_config, *jobj_flags; + int i, j, found; + + if (!hdr || !flags) + return -EINVAL; + + *flags = 0; + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return 0; + + if (!json_object_object_get_ex(jobj_config, "flags", &jobj_flags)) + return 0; + + for (i = 0; i < (int) json_object_array_length(jobj_flags); i++) { + jobj1 = json_object_array_get_idx(jobj_flags, i); + found = 0; + for (j = 0; persistent_flags[j].description && !found; j++) + if (!strcmp(persistent_flags[j].description, + json_object_get_string(jobj1))) { + *flags |= persistent_flags[j].flag; + log_dbg(cd, "Using persistent flag %s.", + json_object_get_string(jobj1)); + found = 1; + } + if (!found) + log_verbose(cd, _("Ignored unknown flag %s."), + json_object_get_string(jobj1)); + } + + return 0; +} + +int LUKS2_config_set_flags(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t flags) +{ + json_object *jobj_config, *jobj_flags; + int i; + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return 0; + + jobj_flags = json_object_new_array(); + + for (i = 0; persistent_flags[i].description; i++) { + if (flags & persistent_flags[i].flag) { + log_dbg(cd, "Setting persistent flag: %s.", persistent_flags[i].description); + json_object_array_add(jobj_flags, + json_object_new_string(persistent_flags[i].description)); + } + } + + /* Replace or add new flags array */ + json_object_object_add(jobj_config, "flags", jobj_flags); + + return LUKS2_hdr_write(cd, hdr); +} + +/* + * json format example (mandatory array must not be ignored, + * all other future fields may be added later) + * + * "requirements": { + * mandatory : [], + * optional0 : [], + * optional1 : "lala" + * } + */ + +/* LUKS2 library requirements */ +struct requirement_flag { + uint32_t flag; + uint32_t version; + const char *description; +}; + +static const struct requirement_flag unknown_requirement_flag = { CRYPT_REQUIREMENT_UNKNOWN, 0, NULL }; + +static const struct requirement_flag requirements_flags[] = { + { CRYPT_REQUIREMENT_OFFLINE_REENCRYPT,1, "offline-reencrypt" }, + { CRYPT_REQUIREMENT_ONLINE_REENCRYPT, 2, "online-reencrypt-v2" }, + { CRYPT_REQUIREMENT_ONLINE_REENCRYPT, 1, "online-reencrypt" }, + { 0, 0, NULL } +}; + +static const struct requirement_flag *get_requirement_by_name(const char *requirement) +{ + int i; + + for (i = 0; requirements_flags[i].description; i++) + if (!strcmp(requirement, requirements_flags[i].description)) + return requirements_flags + i; + + return &unknown_requirement_flag; +} + +int LUKS2_config_get_reencrypt_version(struct luks2_hdr *hdr, uint32_t *version) +{ + json_object *jobj_config, *jobj_requirements, *jobj_mandatory, *jobj; + int i, len; + const struct requirement_flag *req; + + assert(hdr && version); + if (!hdr || !version) + return -EINVAL; + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_config, "requirements", &jobj_requirements)) + return -ENOENT; + + if (!json_object_object_get_ex(jobj_requirements, "mandatory", &jobj_mandatory)) + return -ENOENT; + + len = (int) json_object_array_length(jobj_mandatory); + if (len <= 0) + return -ENOENT; + + for (i = 0; i < len; i++) { + jobj = json_object_array_get_idx(jobj_mandatory, i); + + /* search for requirements prefixed with "online-reencrypt" */ + if (strncmp(json_object_get_string(jobj), "online-reencrypt", 16)) + continue; + + /* check current library is aware of the requirement */ + req = get_requirement_by_name(json_object_get_string(jobj)); + if (req->flag == (uint32_t)CRYPT_REQUIREMENT_UNKNOWN) + continue; + + *version = req->version; + + return 0; + } + + return -ENOENT; +} + +static const struct requirement_flag *stored_requirement_name_by_id(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t req_id) +{ + json_object *jobj_config, *jobj_requirements, *jobj_mandatory, *jobj; + int i, len; + const struct requirement_flag *req; + + assert(hdr); + if (!hdr) + return NULL; + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return NULL; + + if (!json_object_object_get_ex(jobj_config, "requirements", &jobj_requirements)) + return NULL; + + if (!json_object_object_get_ex(jobj_requirements, "mandatory", &jobj_mandatory)) + return NULL; + + len = (int) json_object_array_length(jobj_mandatory); + if (len <= 0) + return 0; + + for (i = 0; i < len; i++) { + jobj = json_object_array_get_idx(jobj_mandatory, i); + req = get_requirement_by_name(json_object_get_string(jobj)); + if (req->flag == req_id) + return req; + } + + return NULL; +} + +/* + * returns count of requirements (past cryptsetup 2.0 release) + */ +int LUKS2_config_get_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t *reqs) +{ + json_object *jobj_config, *jobj_requirements, *jobj_mandatory, *jobj; + int i, len; + const struct requirement_flag *req; + + assert(hdr); + if (!hdr || !reqs) + return -EINVAL; + + *reqs = 0; + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + return 0; + + if (!json_object_object_get_ex(jobj_config, "requirements", &jobj_requirements)) + return 0; + + if (!json_object_object_get_ex(jobj_requirements, "mandatory", &jobj_mandatory)) + return 0; + + len = (int) json_object_array_length(jobj_mandatory); + if (len <= 0) + return 0; + + log_dbg(cd, "LUKS2 requirements detected:"); + + for (i = 0; i < len; i++) { + jobj = json_object_array_get_idx(jobj_mandatory, i); + req = get_requirement_by_name(json_object_get_string(jobj)); + log_dbg(cd, "%s - %sknown", json_object_get_string(jobj), + reqs_unknown(req->flag) ? "un" : ""); + *reqs |= req->flag; + } + + return 0; +} + +int LUKS2_config_set_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t reqs, bool commit) +{ + json_object *jobj_config, *jobj_requirements, *jobj_mandatory, *jobj; + int i, r = -EINVAL; + const struct requirement_flag *req; + uint32_t req_id; + + if (!hdr) + return -EINVAL; + + jobj_mandatory = json_object_new_array(); + if (!jobj_mandatory) + return -ENOMEM; + + for (i = 0; requirements_flags[i].description; i++) { + req_id = reqs & requirements_flags[i].flag; + if (req_id) { + /* retain already stored version of requirement flag */ + req = stored_requirement_name_by_id(cd, hdr, req_id); + if (req) + jobj = json_object_new_string(req->description); + else + jobj = json_object_new_string(requirements_flags[i].description); + if (!jobj) { + r = -ENOMEM; + goto err; + } + json_object_array_add(jobj_mandatory, jobj); + /* erase processed flag from input set */ + reqs &= ~(requirements_flags[i].flag); + } + } + + /* any remaining bit in requirements is unknown therefore illegal */ + if (reqs) { + log_dbg(cd, "Illegal requirement flag(s) requested"); + goto err; + } + + if (!json_object_object_get_ex(hdr->jobj, "config", &jobj_config)) + goto err; + + if (!json_object_object_get_ex(jobj_config, "requirements", &jobj_requirements)) { + jobj_requirements = json_object_new_object(); + if (!jobj_requirements) { + r = -ENOMEM; + goto err; + } + json_object_object_add(jobj_config, "requirements", jobj_requirements); + } + + if (json_object_array_length(jobj_mandatory) > 0) { + /* replace mandatory field with new values */ + json_object_object_add(jobj_requirements, "mandatory", jobj_mandatory); + } else { + /* new mandatory field was empty, delete old one */ + json_object_object_del(jobj_requirements, "mandatory"); + json_object_put(jobj_mandatory); + } + + /* remove empty requirements object */ + if (!json_object_object_length(jobj_requirements)) + json_object_object_del(jobj_config, "requirements"); + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +err: + json_object_put(jobj_mandatory); + return r; +} + +/* + * Header dump + */ +static void hdr_dump_config(struct crypt_device *cd, json_object *hdr_jobj) +{ + + json_object *jobj1, *jobj_config, *jobj_flags, *jobj_requirements, *jobj_mandatory; + int i = 0, flags = 0, reqs = 0; + + log_std(cd, "Flags: \t"); + + if (json_object_object_get_ex(hdr_jobj, "config", &jobj_config)) { + if (json_object_object_get_ex(jobj_config, "flags", &jobj_flags)) + flags = (int) json_object_array_length(jobj_flags); + if (json_object_object_get_ex(jobj_config, "requirements", &jobj_requirements) && + json_object_object_get_ex(jobj_requirements, "mandatory", &jobj_mandatory)) + reqs = (int) json_object_array_length(jobj_mandatory); + } + + for (i = 0; i < flags; i++) { + jobj1 = json_object_array_get_idx(jobj_flags, i); + log_std(cd, "%s ", json_object_get_string(jobj1)); + } + + log_std(cd, "%s\n%s", flags > 0 ? "" : "(no flags)", reqs > 0 ? "" : "\n"); + + if (reqs > 0) { + log_std(cd, "Requirements:\t"); + for (i = 0; i < reqs; i++) { + jobj1 = json_object_array_get_idx(jobj_mandatory, i); + log_std(cd, "%s ", json_object_get_string(jobj1)); + } + log_std(cd, "\n\n"); + } +} + +static const char *get_priority_desc(json_object *jobj) +{ + crypt_keyslot_priority priority; + json_object *jobj_priority; + const char *text; + + if (json_object_object_get_ex(jobj, "priority", &jobj_priority)) + priority = (crypt_keyslot_priority)(int)json_object_get_int(jobj_priority); + else + priority = CRYPT_SLOT_PRIORITY_NORMAL; + + switch (priority) { + case CRYPT_SLOT_PRIORITY_IGNORE: text = "ignored"; break; + case CRYPT_SLOT_PRIORITY_PREFER: text = "preferred"; break; + case CRYPT_SLOT_PRIORITY_NORMAL: text = "normal"; break; + default: text = "invalid"; + } + + return text; +} + +static void hdr_dump_keyslots(struct crypt_device *cd, json_object *hdr_jobj) +{ + char slot[16]; + json_object *keyslots_jobj, *digests_jobj, *jobj2, *jobj3, *val; + const char *tmps; + int i, j, r; + + log_std(cd, "Keyslots:\n"); + json_object_object_get_ex(hdr_jobj, "keyslots", &keyslots_jobj); + + for (j = 0; j < LUKS2_KEYSLOTS_MAX; j++) { + (void) snprintf(slot, sizeof(slot), "%i", j); + json_object_object_get_ex(keyslots_jobj, slot, &val); + if (!val) + continue; + + json_object_object_get_ex(val, "type", &jobj2); + tmps = json_object_get_string(jobj2); + + r = LUKS2_keyslot_for_segment(crypt_get_hdr(cd, CRYPT_LUKS2), j, CRYPT_ONE_SEGMENT); + log_std(cd, " %s: %s%s\n", slot, tmps, r == -ENOENT ? " (unbound)" : ""); + + if (json_object_object_get_ex(val, "key_size", &jobj2)) + log_std(cd, "\tKey: %u bits\n", crypt_jobj_get_uint32(jobj2) * 8); + + log_std(cd, "\tPriority: %s\n", get_priority_desc(val)); + + LUKS2_keyslot_dump(cd, j); + + json_object_object_get_ex(hdr_jobj, "digests", &digests_jobj); + json_object_object_foreach(digests_jobj, key2, val2) { + json_object_object_get_ex(val2, "keyslots", &jobj2); + for (i = 0; i < (int) json_object_array_length(jobj2); i++) { + jobj3 = json_object_array_get_idx(jobj2, i); + if (!strcmp(slot, json_object_get_string(jobj3))) { + log_std(cd, "\tDigest ID: %s\n", key2); + } + } + } + } +} + +static void hdr_dump_tokens(struct crypt_device *cd, json_object *hdr_jobj) +{ + char token[16]; + json_object *tokens_jobj, *jobj2, *jobj3, *val; + const char *tmps; + int i, j; + + log_std(cd, "Tokens:\n"); + json_object_object_get_ex(hdr_jobj, "tokens", &tokens_jobj); + + for (j = 0; j < LUKS2_TOKENS_MAX; j++) { + (void) snprintf(token, sizeof(token), "%i", j); + json_object_object_get_ex(tokens_jobj, token, &val); + if (!val) + continue; + + json_object_object_get_ex(val, "type", &jobj2); + tmps = json_object_get_string(jobj2); + log_std(cd, " %s: %s\n", token, tmps); + + LUKS2_token_dump(cd, j); + + json_object_object_get_ex(val, "keyslots", &jobj2); + for (i = 0; i < (int) json_object_array_length(jobj2); i++) { + jobj3 = json_object_array_get_idx(jobj2, i); + log_std(cd, "\tKeyslot: %s\n", json_object_get_string(jobj3)); + } + } +} + +static void hdr_dump_segments(struct crypt_device *cd, json_object *hdr_jobj) +{ + char segment[16]; + json_object *jobj_segments, *jobj_segment, *jobj1, *jobj2; + int i, j, flags; + uint64_t value; + + log_std(cd, "Data segments:\n"); + json_object_object_get_ex(hdr_jobj, "segments", &jobj_segments); + + for (i = 0; i < LUKS2_SEGMENT_MAX; i++) { + (void) snprintf(segment, sizeof(segment), "%i", i); + if (!json_object_object_get_ex(jobj_segments, segment, &jobj_segment)) + continue; + + json_object_object_get_ex(jobj_segment, "type", &jobj1); + log_std(cd, " %s: %s\n", segment, json_object_get_string(jobj1)); + + json_object_object_get_ex(jobj_segment, "offset", &jobj1); + json_str_to_uint64(jobj1, &value); + log_std(cd, "\toffset: %" PRIu64 " [bytes]\n", value); + + json_object_object_get_ex(jobj_segment, "size", &jobj1); + if (!(strcmp(json_object_get_string(jobj1), "dynamic"))) + log_std(cd, "\tlength: (whole device)\n"); + else { + json_str_to_uint64(jobj1, &value); + log_std(cd, "\tlength: %" PRIu64 " [bytes]\n", value); + } + + if (json_object_object_get_ex(jobj_segment, "encryption", &jobj1)) + log_std(cd, "\tcipher: %s\n", json_object_get_string(jobj1)); + + if (json_object_object_get_ex(jobj_segment, "sector_size", &jobj1)) + log_std(cd, "\tsector: %" PRIu32 " [bytes]\n", crypt_jobj_get_uint32(jobj1)); + + if (json_object_object_get_ex(jobj_segment, "integrity", &jobj1) && + json_object_object_get_ex(jobj1, "type", &jobj2)) + log_std(cd, "\tintegrity: %s\n", json_object_get_string(jobj2)); + + if (json_object_object_get_ex(jobj_segment, "flags", &jobj1) && + (flags = (int)json_object_array_length(jobj1)) > 0) { + jobj2 = json_object_array_get_idx(jobj1, 0); + log_std(cd, "\tflags : %s", json_object_get_string(jobj2)); + for (j = 1; j < flags; j++) { + jobj2 = json_object_array_get_idx(jobj1, j); + log_std(cd, ", %s", json_object_get_string(jobj2)); + } + log_std(cd, "\n"); + } + + log_std(cd, "\n"); + } +} + +static void hdr_dump_digests(struct crypt_device *cd, json_object *hdr_jobj) +{ + char key[16]; + json_object *jobj1, *jobj2, *val; + const char *tmps; + int i; + + log_std(cd, "Digests:\n"); + json_object_object_get_ex(hdr_jobj, "digests", &jobj1); + + for (i = 0; i < LUKS2_DIGEST_MAX; i++) { + (void) snprintf(key, sizeof(key), "%i", i); + json_object_object_get_ex(jobj1, key, &val); + if (!val) + continue; + + json_object_object_get_ex(val, "type", &jobj2); + tmps = json_object_get_string(jobj2); + log_std(cd, " %s: %s\n", key, tmps); + + LUKS2_digest_dump(cd, i); + } +} + +int LUKS2_hdr_dump(struct crypt_device *cd, struct luks2_hdr *hdr) +{ + if (!hdr->jobj) + return -EINVAL; + + JSON_DBG(cd, hdr->jobj, NULL); + + log_std(cd, "LUKS header information\n"); + log_std(cd, "Version: \t%u\n", hdr->version); + log_std(cd, "Epoch: \t%" PRIu64 "\n", hdr->seqid); + log_std(cd, "Metadata area: \t%" PRIu64 " [bytes]\n", LUKS2_metadata_size(hdr)); + log_std(cd, "Keyslots area: \t%" PRIu64 " [bytes]\n", LUKS2_keyslots_size(hdr)); + log_std(cd, "UUID: \t%s\n", *hdr->uuid ? hdr->uuid : "(no UUID)"); + log_std(cd, "Label: \t%s\n", *hdr->label ? hdr->label : "(no label)"); + log_std(cd, "Subsystem: \t%s\n", *hdr->subsystem ? hdr->subsystem : "(no subsystem)"); + + hdr_dump_config(cd, hdr->jobj); + hdr_dump_segments(cd, hdr->jobj); + hdr_dump_keyslots(cd, hdr->jobj); + hdr_dump_tokens(cd, hdr->jobj); + hdr_dump_digests(cd, hdr->jobj); + + return 0; +} + +int LUKS2_get_data_size(struct luks2_hdr *hdr, uint64_t *size, bool *dynamic) +{ + int sector_size; + json_object *jobj_segments, *jobj_size; + uint64_t tmp = 0; + + if (!size || !json_object_object_get_ex(hdr->jobj, "segments", &jobj_segments)) + return -EINVAL; + + json_object_object_foreach(jobj_segments, key, val) { + UNUSED(key); + if (json_segment_is_backup(val)) + continue; + + json_object_object_get_ex(val, "size", &jobj_size); + if (!strcmp(json_object_get_string(jobj_size), "dynamic")) { + sector_size = json_segment_get_sector_size(val); + /* last dynamic segment must have at least one sector in size */ + if (tmp) + *size = tmp + (sector_size > 0 ? sector_size : SECTOR_SIZE); + else + *size = 0; + if (dynamic) + *dynamic = true; + return 0; + } + + tmp += crypt_jobj_get_uint64(jobj_size); + } + + /* impossible, real device size must not be zero */ + if (!tmp) + return -EINVAL; + + *size = tmp; + if (dynamic) + *dynamic = false; + return 0; +} + +uint64_t LUKS2_get_data_offset(struct luks2_hdr *hdr) +{ + crypt_reencrypt_info ri; + json_object *jobj; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_CLEAN || ri == CRYPT_REENCRYPT_CRASH) { + jobj = LUKS2_get_segment_by_flag(hdr, "backup-final"); + if (jobj) + return json_segment_get_offset(jobj, 1); + } + + return json_segments_get_minimal_offset(LUKS2_get_segments_jobj(hdr), 1); +} + +const char *LUKS2_get_cipher(struct luks2_hdr *hdr, int segment) +{ + json_object *jobj_segment; + + if (!hdr) + return NULL; + + if (segment == CRYPT_DEFAULT_SEGMENT) + segment = LUKS2_get_default_segment(hdr); + + jobj_segment = json_segments_get_segment(json_get_segments_jobj(hdr->jobj), segment); + if (!jobj_segment) + return NULL; + + /* FIXME: default encryption (for other segment types) must be string here. */ + return json_segment_get_cipher(jobj_segment) ?: "null"; +} + +crypt_reencrypt_info LUKS2_reencrypt_status(struct luks2_hdr *hdr) +{ + uint32_t reqs; + + /* + * Any unknown requirement or offline reencryption should abort + * anything related to online-reencryption handling + */ + if (LUKS2_config_get_requirements(NULL, hdr, &reqs)) + return CRYPT_REENCRYPT_INVALID; + + if (!reqs_reencrypt_online(reqs)) + return CRYPT_REENCRYPT_NONE; + + if (json_segments_segment_in_reencrypt(LUKS2_get_segments_jobj(hdr)) < 0) + return CRYPT_REENCRYPT_CLEAN; + + return CRYPT_REENCRYPT_CRASH; +} + +const char *LUKS2_get_keyslot_cipher(struct luks2_hdr *hdr, int keyslot, size_t *key_size) +{ + json_object *jobj_keyslot, *jobj_area, *jobj1; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return NULL; + + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return NULL; + + /* currently we only support raw length preserving area encryption */ + json_object_object_get_ex(jobj_area, "type", &jobj1); + if (strcmp(json_object_get_string(jobj1), "raw")) + return NULL; + + if (!json_object_object_get_ex(jobj_area, "key_size", &jobj1)) + return NULL; + *key_size = json_object_get_int(jobj1); + + if (!json_object_object_get_ex(jobj_area, "encryption", &jobj1)) + return NULL; + + return json_object_get_string(jobj1); +} + +const char *LUKS2_get_integrity(struct luks2_hdr *hdr, int segment) +{ + json_object *jobj1, *jobj2, *jobj3; + + jobj1 = LUKS2_get_segment_jobj(hdr, segment); + if (!jobj1) + return NULL; + + if (!json_object_object_get_ex(jobj1, "integrity", &jobj2)) + return NULL; + + if (!json_object_object_get_ex(jobj2, "type", &jobj3)) + return NULL; + + return json_object_get_string(jobj3); +} + +/* FIXME: this only ensures that once we have journal encryption, it is not ignored. */ +/* implement segment count and type restrictions (crypt and only single crypt) */ +static int LUKS2_integrity_compatible(struct luks2_hdr *hdr) +{ + json_object *jobj1, *jobj2, *jobj3, *jobj4; + const char *str; + + if (!json_object_object_get_ex(hdr->jobj, "segments", &jobj1)) + return 0; + + if (!(jobj2 = LUKS2_get_segment_jobj(hdr, CRYPT_DEFAULT_SEGMENT))) + return 0; + + if (!json_object_object_get_ex(jobj2, "integrity", &jobj3)) + return 0; + + if (!json_object_object_get_ex(jobj3, "journal_encryption", &jobj4) || + !(str = json_object_get_string(jobj4)) || + strcmp(str, "none")) + return 0; + + if (!json_object_object_get_ex(jobj3, "journal_integrity", &jobj4) || + !(str = json_object_get_string(jobj4)) || + strcmp(str, "none")) + return 0; + + return 1; +} + +static int LUKS2_keyslot_get_volume_key_size(struct luks2_hdr *hdr, const char *keyslot) +{ + json_object *jobj1, *jobj2, *jobj3; + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj1)) + return -1; + + if (!json_object_object_get_ex(jobj1, keyslot, &jobj2)) + return -1; + + if (!json_object_object_get_ex(jobj2, "key_size", &jobj3)) + return -1; + + return json_object_get_int(jobj3); +} + +/* Key size used for encryption of keyslot */ +int LUKS2_get_keyslot_stored_key_size(struct luks2_hdr *hdr, int keyslot) +{ + char keyslot_name[16]; + + if (snprintf(keyslot_name, sizeof(keyslot_name), "%u", keyslot) < 1) + return -1; + + return LUKS2_keyslot_get_volume_key_size(hdr, keyslot_name); +} + +int LUKS2_get_volume_key_size(struct luks2_hdr *hdr, int segment) +{ + json_object *jobj_digests, *jobj_digest_segments, *jobj_digest_keyslots, *jobj1; + char buf[16]; + + if (segment == CRYPT_DEFAULT_SEGMENT) + segment = LUKS2_get_default_segment(hdr); + + if (snprintf(buf, sizeof(buf), "%u", segment) < 1) + return -1; + + json_object_object_get_ex(hdr->jobj, "digests", &jobj_digests); + + json_object_object_foreach(jobj_digests, key, val) { + UNUSED(key); + json_object_object_get_ex(val, "segments", &jobj_digest_segments); + json_object_object_get_ex(val, "keyslots", &jobj_digest_keyslots); + + if (!LUKS2_array_jobj(jobj_digest_segments, buf)) + continue; + if (json_object_array_length(jobj_digest_keyslots) <= 0) + continue; + + jobj1 = json_object_array_get_idx(jobj_digest_keyslots, 0); + + return LUKS2_keyslot_get_volume_key_size(hdr, json_object_get_string(jobj1)); + } + + return -1; +} + +int LUKS2_get_sector_size(struct luks2_hdr *hdr) +{ + json_object *jobj_segment; + + jobj_segment = LUKS2_get_segment_jobj(hdr, CRYPT_DEFAULT_SEGMENT); + if (!jobj_segment) + return SECTOR_SIZE; + + return json_segment_get_sector_size(jobj_segment) ?: SECTOR_SIZE; +} + +int LUKS2_assembly_multisegment_dmd(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks, + json_object *jobj_segments, + struct crypt_dm_active_device *dmd) +{ + struct volume_key *vk; + json_object *jobj; + enum devcheck device_check; + int r; + unsigned s = 0; + uint64_t data_offset, segment_size, segment_offset, segment_start = 0; + struct dm_target *t = &dmd->segment; + + if (dmd->flags & CRYPT_ACTIVATE_SHARED) + device_check = DEV_OK; + else + device_check = DEV_EXCL; + + data_offset = LUKS2_reencrypt_data_offset(hdr, true); + + r = device_block_adjust(cd, crypt_data_device(cd), device_check, + data_offset, &dmd->size, &dmd->flags); + if (r) + return r; + + r = dm_targets_allocate(&dmd->segment, json_segments_count(jobj_segments)); + if (r) + goto err; + + r = -EINVAL; + + while (t) { + jobj = json_segments_get_segment(jobj_segments, s); + if (!jobj) { + log_dbg(cd, "Internal error. Segment %u is null.", s); + r = -EINVAL; + goto err; + } + + segment_offset = json_segment_get_offset(jobj, 1); + segment_size = json_segment_get_size(jobj, 1); + /* 'dynamic' length allowed in last segment only */ + if (!segment_size && !t->next) + segment_size = dmd->size - segment_start; + if (!segment_size) { + log_dbg(cd, "Internal error. Wrong segment size %u", s); + r = -EINVAL; + goto err; + } + + if (!strcmp(json_segment_type(jobj), "crypt")) { + vk = crypt_volume_key_by_id(vks, LUKS2_digest_by_segment(hdr, s)); + if (!vk) { + log_err(cd, _("Missing key for dm-crypt segment %u"), s); + r = -EINVAL; + goto err; + } + + r = dm_crypt_target_set(t, segment_start, segment_size, + crypt_data_device(cd), vk, + json_segment_get_cipher(jobj), + json_segment_get_iv_offset(jobj), + segment_offset, "none", 0, + json_segment_get_sector_size(jobj)); + if (r) { + log_err(cd, _("Failed to set dm-crypt segment.")); + goto err; + } + } else if (!strcmp(json_segment_type(jobj), "linear")) { + r = dm_linear_target_set(t, segment_start, segment_size, crypt_data_device(cd), segment_offset); + if (r) { + log_err(cd, _("Failed to set dm-linear segment.")); + goto err; + } + } else { + r = -EINVAL; + goto err; + } + + segment_start += segment_size; + t = t->next; + s++; + } + + return r; +err: + dm_targets_free(cd, dmd); + return r; +} + +/* FIXME: This shares almost all code with activate_multi_custom */ +static int _reload_custom_multi(struct crypt_device *cd, + const char *name, + struct volume_key *vks, + json_object *jobj_segments, + uint64_t device_size, + uint32_t flags) +{ + int r; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + struct crypt_dm_active_device dmd = { + .uuid = crypt_get_uuid(cd), + .size = device_size >> SECTOR_SHIFT + }; + + /* do not allow activation when particular requirements detected */ + if ((r = LUKS2_unmet_requirements(cd, hdr, CRYPT_REQUIREMENT_ONLINE_REENCRYPT, 0))) + return r; + + /* Add persistent activation flags */ + if (!(flags & CRYPT_ACTIVATE_IGNORE_PERSISTENT)) + LUKS2_config_get_flags(cd, hdr, &dmd.flags); + + dmd.flags |= (flags | CRYPT_ACTIVATE_SHARED); + + r = LUKS2_assembly_multisegment_dmd(cd, hdr, vks, jobj_segments, &dmd); + if (!r) + r = dm_reload_device(cd, name, &dmd, 0, 0); + + dm_targets_free(cd, &dmd); + return r; +} + +int LUKS2_reload(struct crypt_device *cd, + const char *name, + struct volume_key *vks, + uint64_t device_size, + uint32_t flags) +{ + if (crypt_get_integrity_tag_size(cd)) + return -ENOTSUP; + + return _reload_custom_multi(cd, name, vks, + LUKS2_get_segments_jobj(crypt_get_hdr(cd, CRYPT_LUKS2)), device_size, flags); +} + +int LUKS2_activate_multi(struct crypt_device *cd, + const char *name, + struct volume_key *vks, + uint64_t device_size, + uint32_t flags) +{ + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + json_object *jobj_segments = LUKS2_get_segments_jobj(hdr); + int r; + struct crypt_dm_active_device dmd = { + .size = device_size, + .uuid = crypt_get_uuid(cd) + }; + + /* do not allow activation when particular requirements detected */ + if ((r = LUKS2_unmet_requirements(cd, hdr, CRYPT_REQUIREMENT_ONLINE_REENCRYPT, 0))) + return r; + + /* Add persistent activation flags */ + if (!(flags & CRYPT_ACTIVATE_IGNORE_PERSISTENT)) + LUKS2_config_get_flags(cd, hdr, &dmd.flags); + + dmd.flags |= flags; + + r = LUKS2_assembly_multisegment_dmd(cd, hdr, vks, jobj_segments, &dmd); + if (!r) + r = dm_create_device(cd, name, CRYPT_LUKS2, &dmd); + + dm_targets_free(cd, &dmd); + return r; +} + +int LUKS2_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint32_t flags) +{ + int r; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + struct crypt_dm_active_device dmdi = {}, dmd = { + .uuid = crypt_get_uuid(cd) + }; + + /* do not allow activation when particular requirements detected */ + if ((r = LUKS2_unmet_requirements(cd, hdr, 0, 0))) + return r; + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), + vk, crypt_get_cipher_spec(cd), crypt_get_iv_offset(cd), + crypt_get_data_offset(cd), crypt_get_integrity(cd) ?: "none", + crypt_get_integrity_tag_size(cd), crypt_get_sector_size(cd)); + if (r < 0) + return r; + + /* Add persistent activation flags */ + if (!(flags & CRYPT_ACTIVATE_IGNORE_PERSISTENT)) + LUKS2_config_get_flags(cd, hdr, &dmd.flags); + + dmd.flags |= flags; + + if (crypt_get_integrity_tag_size(cd)) { + if (!LUKS2_integrity_compatible(hdr)) { + log_err(cd, _("Unsupported device integrity configuration.")); + return -EINVAL; + } + + if (dmd.flags & CRYPT_ACTIVATE_ALLOW_DISCARDS) { + log_err(cd, _("Discard/TRIM is not supported.")); + return -EINVAL; + } + + r = INTEGRITY_create_dmd_device(cd, NULL, NULL, NULL, NULL, &dmdi, dmd.flags, 0); + if (r) + return r; + + dmdi.flags |= CRYPT_ACTIVATE_PRIVATE; + dmdi.uuid = dmd.uuid; + dmd.segment.u.crypt.offset = 0; + dmd.segment.size = dmdi.segment.size; + + r = create_or_reload_device_with_integrity(cd, name, CRYPT_LUKS2, &dmd, &dmdi); + } else + r = create_or_reload_device(cd, name, CRYPT_LUKS2, &dmd); + + dm_targets_free(cd, &dmd); + dm_targets_free(cd, &dmdi); + + return r; +} + +static bool is_reencryption_helper(const char *name) +{ + size_t len; + + if (!name) + return false; + + len = strlen(name); + return (len >= 9 && (!strncmp(name + len - 8, "-hotzone-", 9) || + !strcmp(name + len - 8, "-overlay"))); + +} + +static bool contains_reencryption_helper(char **names) +{ + while (*names) { + if (is_reencryption_helper(*names++)) + return true; + } + + return false; +} + +int LUKS2_deactivate(struct crypt_device *cd, const char *name, struct luks2_hdr *hdr, struct crypt_dm_active_device *dmd, uint32_t flags) +{ + int r, ret; + struct dm_target *tgt; + crypt_status_info ci; + struct crypt_dm_active_device dmdc; + char **dep, deps_uuid_prefix[40], *deps[MAX_DM_DEPS+1] = { 0 }; + const char *namei = NULL; + struct crypt_lock_handle *reencrypt_lock = NULL; + + if (!dmd || !dmd->uuid || strncmp(CRYPT_LUKS2, dmd->uuid, sizeof(CRYPT_LUKS2)-1)) + return -EINVAL; + + /* uuid mismatch with metadata (if available) */ + if (hdr && crypt_uuid_cmp(dmd->uuid, hdr->uuid)) + return -EINVAL; + + r = snprintf(deps_uuid_prefix, sizeof(deps_uuid_prefix), CRYPT_SUBDEV "-%.32s", dmd->uuid + 6); + if (r < 0 || (size_t)r != (sizeof(deps_uuid_prefix) - 1)) + return -EINVAL; + + tgt = &dmd->segment; + + /* TODO: We have LUKS2 dependencies now */ + if (hdr && single_segment(dmd) && tgt->type == DM_CRYPT && crypt_get_integrity_tag_size(cd)) + namei = device_dm_name(tgt->data_device); + + r = dm_device_deps(cd, name, deps_uuid_prefix, deps, ARRAY_SIZE(deps)); + if (r < 0) + goto out; + + if (contains_reencryption_helper(deps)) { + r = LUKS2_reencrypt_lock_by_dm_uuid(cd, dmd->uuid, &reencrypt_lock); + if (r) { + if (r == -EBUSY) + log_err(cd, _("Reencryption in-progress. Cannot deactivate device.")); + else + log_err(cd, _("Failed to get reencryption lock.")); + goto out; + } + } + + dep = deps; + while (*dep) { + if (is_reencryption_helper(*dep) && (dm_status_suspended(cd, *dep) > 0)) { + if (dm_error_device(cd, *dep)) + log_err(cd, _("Failed to replace suspended device %s with dm-error target."), *dep); + } + dep++; + } + + r = dm_query_device(cd, name, DM_ACTIVE_CRYPT_KEY | DM_ACTIVE_CRYPT_KEYSIZE, &dmdc); + if (r < 0) { + memset(&dmdc, 0, sizeof(dmdc)); + dmdc.segment.type = DM_UNKNOWN; + } + + /* Remove top level device first */ + r = dm_remove_device(cd, name, flags); + if (!r) { + tgt = &dmdc.segment; + while (tgt) { + if (tgt->type == DM_CRYPT) + crypt_drop_keyring_key_by_description(cd, tgt->u.crypt.vk->key_description, LOGON_KEY); + tgt = tgt->next; + } + } + dm_targets_free(cd, &dmdc); + + /* TODO: We have LUKS2 dependencies now */ + if (r >= 0 && namei) { + log_dbg(cd, "Deactivating integrity device %s.", namei); + r = dm_remove_device(cd, namei, 0); + } + + if (!r) { + ret = 0; + dep = deps; + while (*dep) { + log_dbg(cd, "Deactivating LUKS2 dependent device %s.", *dep); + r = dm_query_device(cd, *dep, DM_ACTIVE_CRYPT_KEY | DM_ACTIVE_CRYPT_KEYSIZE, &dmdc); + if (r < 0) { + memset(&dmdc, 0, sizeof(dmdc)); + dmdc.segment.type = DM_UNKNOWN; + } + + r = dm_remove_device(cd, *dep, flags); + if (r < 0) { + ci = crypt_status(cd, *dep); + if (ci == CRYPT_BUSY) + log_err(cd, _("Device %s is still in use."), *dep); + if (ci == CRYPT_INACTIVE) + r = 0; + } + if (!r) { + tgt = &dmdc.segment; + while (tgt) { + if (tgt->type == DM_CRYPT) + crypt_drop_keyring_key_by_description(cd, tgt->u.crypt.vk->key_description, LOGON_KEY); + tgt = tgt->next; + } + } + dm_targets_free(cd, &dmdc); + if (r && !ret) + ret = r; + dep++; + } + r = ret; + } + +out: + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + dep = deps; + while (*dep) + free(*dep++); + + return r; +} + +int LUKS2_unmet_requirements(struct crypt_device *cd, struct luks2_hdr *hdr, uint32_t reqs_mask, int quiet) +{ + uint32_t reqs; + int r = LUKS2_config_get_requirements(cd, hdr, &reqs); + + if (r) { + if (!quiet) + log_err(cd, _("Failed to read LUKS2 requirements.")); + return r; + } + + /* do not mask unknown requirements check */ + if (reqs_unknown(reqs)) { + if (!quiet) + log_err(cd, _("Unmet LUKS2 requirements detected.")); + return -ETXTBSY; + } + + /* mask out permitted requirements */ + reqs &= ~reqs_mask; + + if (reqs_reencrypt(reqs) && !quiet) + log_err(cd, _("Operation incompatible with device marked for legacy reencryption. Aborting.")); + if (reqs_reencrypt_online(reqs) && !quiet) + log_err(cd, _("Operation incompatible with device marked for LUKS2 reencryption. Aborting.")); + + /* any remaining unmasked requirement fails the check */ + return reqs ? -EINVAL : 0; +} + +/* + * NOTE: this routine is called on json object that failed validation. + * Proceed with caution :) + * + * known glitches so far: + * + * any version < 2.0.3: + * - luks2 keyslot pbkdf params change via crypt_keyslot_change_by_passphrase() + * could leave previous type parameters behind. Correct this by purging + * all params not needed by current type. + */ +void LUKS2_hdr_repair(struct crypt_device *cd, json_object *hdr_jobj) +{ + json_object *jobj_keyslots; + + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) + return; + if (!json_object_is_type(jobj_keyslots, json_type_object)) + return; + + LUKS2_keyslots_repair(cd, jobj_keyslots); +} + +void json_object_object_del_by_uint(json_object *jobj, unsigned key) +{ + char key_name[16]; + + if (snprintf(key_name, sizeof(key_name), "%u", key) < 1) + return; + json_object_object_del(jobj, key_name); +} + +int json_object_object_add_by_uint(json_object *jobj, unsigned key, json_object *jobj_val) +{ + char key_name[16]; + + if (snprintf(key_name, sizeof(key_name), "%u", key) < 1) + return -EINVAL; + +#if HAVE_DECL_JSON_OBJECT_OBJECT_ADD_EX + return json_object_object_add_ex(jobj, key_name, jobj_val, 0) ? -ENOMEM : 0; +#else + json_object_object_add(jobj, key_name, jobj_val); + return 0; +#endif +} + +/* jobj_dst must contain pointer initialized to NULL (see json-c json_object_deep_copy API) */ +int json_object_copy(json_object *jobj_src, json_object **jobj_dst) +{ + if (!jobj_src || !jobj_dst || *jobj_dst) + return -1; + +#if HAVE_DECL_JSON_OBJECT_DEEP_COPY + return json_object_deep_copy(jobj_src, jobj_dst, NULL); +#else + *jobj_dst = json_tokener_parse(json_object_get_string(jobj_src)); + return *jobj_dst ? 0 : -1; +#endif +} diff --git a/lib/luks2/luks2_keyslot.c b/lib/luks2/luks2_keyslot.c new file mode 100644 index 0000000..d93f2dd --- /dev/null +++ b/lib/luks2/luks2_keyslot.c @@ -0,0 +1,968 @@ +/* + * LUKS - Linux Unified Key Setup v2, keyslot handling + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +/* Internal implementations */ +extern const keyslot_handler luks2_keyslot; +extern const keyslot_handler reenc_keyslot; + +static const keyslot_handler *keyslot_handlers[LUKS2_KEYSLOTS_MAX] = { + &luks2_keyslot, +#if USE_LUKS2_REENCRYPTION + &reenc_keyslot, +#endif + NULL +}; + +static const keyslot_handler +*LUKS2_keyslot_handler_type(struct crypt_device *cd, const char *type) +{ + int i; + + for (i = 0; i < LUKS2_KEYSLOTS_MAX && keyslot_handlers[i]; i++) { + if (!strcmp(keyslot_handlers[i]->name, type)) + return keyslot_handlers[i]; + } + + return NULL; +} + +static const keyslot_handler +*LUKS2_keyslot_handler(struct crypt_device *cd, int keyslot) +{ + struct luks2_hdr *hdr; + json_object *jobj1, *jobj2; + + if (keyslot < 0) + return NULL; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return NULL; + + if (!(jobj1 = LUKS2_get_keyslot_jobj(hdr, keyslot))) + return NULL; + + if (!json_object_object_get_ex(jobj1, "type", &jobj2)) + return NULL; + + return LUKS2_keyslot_handler_type(cd, json_object_get_string(jobj2)); +} + +int LUKS2_keyslot_find_empty(struct luks2_hdr *hdr) +{ + int i; + + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) + if (!LUKS2_get_keyslot_jobj(hdr, i)) + return i; + + return -EINVAL; +} + +/* Check if a keyslot is assigned to specific segment */ +static int _keyslot_for_segment(struct luks2_hdr *hdr, int keyslot, int segment) +{ + int keyslot_digest, count = 0; + unsigned s; + + keyslot_digest = LUKS2_digest_by_keyslot(hdr, keyslot); + if (keyslot_digest < 0) + return keyslot_digest; + + if (segment >= 0) + return keyslot_digest == LUKS2_digest_by_segment(hdr, segment); + + for (s = 0; s < json_segments_count(LUKS2_get_segments_jobj(hdr)); s++) { + if (keyslot_digest == LUKS2_digest_by_segment(hdr, s)) + count++; + } + + return count; +} + +static int _keyslot_for_digest(struct luks2_hdr *hdr, int keyslot, int digest) +{ + int r = -EINVAL; + + r = LUKS2_digest_by_keyslot(hdr, keyslot); + if (r < 0) + return r; + return r == digest ? 0 : -ENOENT; +} + +int LUKS2_keyslot_for_segment(struct luks2_hdr *hdr, int keyslot, int segment) +{ + int r = -EINVAL; + + /* no need to check anything */ + if (segment == CRYPT_ANY_SEGMENT) + return 0; /* ok */ + if (segment == CRYPT_DEFAULT_SEGMENT) { + segment = LUKS2_get_default_segment(hdr); + if (segment < 0) + return segment; + } + + r = _keyslot_for_segment(hdr, keyslot, segment); + if (r < 0) + return r; + + return r >= 1 ? 0 : -ENOENT; +} + +/* Number of keyslots assigned to a segment or all keyslots for CRYPT_ANY_SEGMENT */ +int LUKS2_keyslot_active_count(struct luks2_hdr *hdr, int segment) +{ + int num = 0; + json_object *jobj_keyslots; + + json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots); + + json_object_object_foreach(jobj_keyslots, slot, val) { + UNUSED(val); + if (!LUKS2_keyslot_for_segment(hdr, atoi(slot), segment)) + num++; + } + + return num; +} + +int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd, const char *cipher_spec) +{ + char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN]; + + if (!cipher_spec || crypt_is_cipher_null(cipher_spec)) + return 1; + + if (crypt_parse_name_and_mode(cipher_spec, cipher, NULL, cipher_mode) < 0) + return 1; + + /* Keyslot is already authenticated; we cannot use integrity tags here */ + if (crypt_get_integrity_tag_size(cd)) + return 1; + + /* Wrapped key schemes cannot be used for keyslot encryption */ + if (crypt_cipher_wrapped_key(cipher, cipher_mode)) + return 1; + + /* Check if crypto backend can use the cipher */ + if (crypt_cipher_ivsize(cipher, cipher_mode) < 0) + return 1; + + return 0; +} + +int LUKS2_keyslot_params_default(struct crypt_device *cd, struct luks2_hdr *hdr, + struct luks2_keyslot_params *params) +{ + const struct crypt_pbkdf_type *pbkdf = crypt_get_pbkdf_type(cd); + const char *cipher_spec; + size_t key_size; + int r; + + if (!hdr || !pbkdf || !params) + return -EINVAL; + + /* + * set keyslot area encryption parameters + */ + params->area_type = LUKS2_KEYSLOT_AREA_RAW; + cipher_spec = crypt_keyslot_get_encryption(cd, CRYPT_ANY_SLOT, &key_size); + if (!cipher_spec || !key_size) + return -EINVAL; + + params->area.raw.key_size = key_size; + r = snprintf(params->area.raw.encryption, sizeof(params->area.raw.encryption), "%s", cipher_spec); + if (r < 0 || (size_t)r >= sizeof(params->area.raw.encryption)) + return -EINVAL; + + /* + * set keyslot AF parameters + */ + params->af_type = LUKS2_KEYSLOT_AF_LUKS1; + /* currently we use hash for AF from pbkdf settings */ + r = snprintf(params->af.luks1.hash, sizeof(params->af.luks1.hash), "%s", pbkdf->hash ?: DEFAULT_LUKS1_HASH); + if (r < 0 || (size_t)r >= sizeof(params->af.luks1.hash)) + return -EINVAL; + params->af.luks1.stripes = 4000; + + return 0; +} + +int LUKS2_keyslot_pbkdf(struct luks2_hdr *hdr, int keyslot, struct crypt_pbkdf_type *pbkdf) +{ + json_object *jobj_keyslot, *jobj_kdf, *jobj; + + if (!hdr || !pbkdf) + return -EINVAL; + + if (LUKS2_keyslot_info(hdr, keyslot) == CRYPT_SLOT_INVALID) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -ENOENT; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf)) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_kdf, "type", &jobj)) + return -EINVAL; + + memset(pbkdf, 0, sizeof(*pbkdf)); + + pbkdf->type = json_object_get_string(jobj); + if (json_object_object_get_ex(jobj_kdf, "hash", &jobj)) + pbkdf->hash = json_object_get_string(jobj); + if (json_object_object_get_ex(jobj_kdf, "iterations", &jobj)) + pbkdf->iterations = json_object_get_int(jobj); + if (json_object_object_get_ex(jobj_kdf, "time", &jobj)) + pbkdf->iterations = json_object_get_int(jobj); + if (json_object_object_get_ex(jobj_kdf, "memory", &jobj)) + pbkdf->max_memory_kb = json_object_get_int(jobj); + if (json_object_object_get_ex(jobj_kdf, "cpus", &jobj)) + pbkdf->parallel_threads = json_object_get_int(jobj); + + return 0; +} + +static int LUKS2_keyslot_unbound(struct luks2_hdr *hdr, int keyslot) +{ + json_object *jobj_digest, *jobj_segments; + int digest = LUKS2_digest_by_keyslot(hdr, keyslot); + + if (digest < 0) + return 0; + + if (!(jobj_digest = LUKS2_get_digest_jobj(hdr, digest))) + return 0; + + json_object_object_get_ex(jobj_digest, "segments", &jobj_segments); + if (!jobj_segments || !json_object_is_type(jobj_segments, json_type_array) || + json_object_array_length(jobj_segments) == 0) + return 1; + + return 0; +} + +crypt_keyslot_info LUKS2_keyslot_info(struct luks2_hdr *hdr, int keyslot) +{ + if(keyslot >= LUKS2_KEYSLOTS_MAX || keyslot < 0) + return CRYPT_SLOT_INVALID; + + if (!LUKS2_get_keyslot_jobj(hdr, keyslot)) + return CRYPT_SLOT_INACTIVE; + + if (LUKS2_digest_by_keyslot(hdr, keyslot) < 0 || + LUKS2_keyslot_unbound(hdr, keyslot)) + return CRYPT_SLOT_UNBOUND; + + if (LUKS2_keyslot_active_count(hdr, CRYPT_DEFAULT_SEGMENT) == 1 && + !LUKS2_keyslot_for_segment(hdr, keyslot, CRYPT_DEFAULT_SEGMENT)) + return CRYPT_SLOT_ACTIVE_LAST; + + return CRYPT_SLOT_ACTIVE; +} + +int LUKS2_keyslot_jobj_area(json_object *jobj_keyslot, uint64_t *offset, uint64_t *length) +{ + json_object *jobj_area, *jobj; + + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_area, "offset", &jobj)) + return -EINVAL; + *offset = crypt_jobj_get_uint64(jobj); + + if (!json_object_object_get_ex(jobj_area, "size", &jobj)) + return -EINVAL; + *length = crypt_jobj_get_uint64(jobj); + + return 0; +} + +int LUKS2_keyslot_area(struct luks2_hdr *hdr, + int keyslot, + uint64_t *offset, + uint64_t *length) +{ + json_object *jobj_keyslot; + + if (LUKS2_keyslot_info(hdr, keyslot) == CRYPT_SLOT_INVALID) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -ENOENT; + + return LUKS2_keyslot_jobj_area(jobj_keyslot, offset, length); +} + +static int _open_and_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + const keyslot_handler *h, + int keyslot, + const char *password, + size_t password_len, + struct volume_key **vk) +{ + int r, key_size = LUKS2_get_keyslot_stored_key_size(hdr, keyslot); + + if (key_size < 0) + return -EINVAL; + + *vk = crypt_alloc_volume_key(key_size, NULL); + if (!*vk) + return -ENOMEM; + + r = h->open(cd, keyslot, password, password_len, (*vk)->key, (*vk)->keylength); + if (r < 0) + log_dbg(cd, "Keyslot %d (%s) open failed with %d.", keyslot, h->name, r); + else + r = LUKS2_digest_verify(cd, hdr, *vk, keyslot); + + if (r < 0) { + crypt_free_volume_key(*vk); + *vk = NULL; + } + + crypt_volume_key_set_id(*vk, r); + + return r < 0 ? r : keyslot; +} + +static int LUKS2_open_and_verify_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int digest, + const char *password, + size_t password_len, + struct volume_key **vk) +{ + const keyslot_handler *h; + int r; + + if (!(h = LUKS2_keyslot_handler(cd, keyslot))) + return -ENOENT; + + r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); + if (r) { + log_dbg(cd, "Keyslot %d validation failed.", keyslot); + return r; + } + + r = _keyslot_for_digest(hdr, keyslot, digest); + if (r) { + if (r == -ENOENT) + log_dbg(cd, "Keyslot %d unusable for digest %d.", keyslot, digest); + return r; + } + + return _open_and_verify(cd, hdr, h, keyslot, password, password_len, vk); +} + +static int LUKS2_open_and_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int segment, + const char *password, + size_t password_len, + struct volume_key **vk) +{ + const keyslot_handler *h; + int r; + + if (!(h = LUKS2_keyslot_handler(cd, keyslot))) + return -ENOENT; + + r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); + if (r) { + log_dbg(cd, "Keyslot %d validation failed.", keyslot); + return r; + } + + r = LUKS2_keyslot_for_segment(hdr, keyslot, segment); + if (r) { + if (r == -ENOENT) + log_dbg(cd, "Keyslot %d unusable for segment %d.", keyslot, segment); + return r; + } + + return _open_and_verify(cd, hdr, h, keyslot, password, password_len, vk); +} + +static int LUKS2_keyslot_open_priority_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, + crypt_keyslot_priority priority, + const char *password, + size_t password_len, + int digest, + struct volume_key **vk) +{ + json_object *jobj_keyslots, *jobj; + crypt_keyslot_priority slot_priority; + int keyslot, r = -ENOENT; + + json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots); + + json_object_object_foreach(jobj_keyslots, slot, val) { + if (!json_object_object_get_ex(val, "priority", &jobj)) + slot_priority = CRYPT_SLOT_PRIORITY_NORMAL; + else + slot_priority = json_object_get_int(jobj); + + keyslot = atoi(slot); + if (slot_priority != priority) { + log_dbg(cd, "Keyslot %d priority %d != %d (required), skipped.", + keyslot, slot_priority, priority); + continue; + } + + r = LUKS2_open_and_verify_by_digest(cd, hdr, keyslot, digest, password, password_len, vk); + + /* Do not retry for errors that are no -EPERM or -ENOENT, + former meaning password wrong, latter key slot unusable for segment */ + if ((r != -EPERM) && (r != -ENOENT)) + break; + } + + return r; +} + +static int LUKS2_keyslot_open_priority(struct crypt_device *cd, + struct luks2_hdr *hdr, + crypt_keyslot_priority priority, + const char *password, + size_t password_len, + int segment, + struct volume_key **vk) +{ + json_object *jobj_keyslots, *jobj; + crypt_keyslot_priority slot_priority; + int keyslot, r = -ENOENT; + + json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots); + + json_object_object_foreach(jobj_keyslots, slot, val) { + if (!json_object_object_get_ex(val, "priority", &jobj)) + slot_priority = CRYPT_SLOT_PRIORITY_NORMAL; + else + slot_priority = json_object_get_int(jobj); + + keyslot = atoi(slot); + if (slot_priority != priority) { + log_dbg(cd, "Keyslot %d priority %d != %d (required), skipped.", + keyslot, slot_priority, priority); + continue; + } + + r = LUKS2_open_and_verify(cd, hdr, keyslot, segment, password, password_len, vk); + + /* Do not retry for errors that are no -EPERM or -ENOENT, + former meaning password wrong, latter key slot unusable for segment */ + if ((r != -EPERM) && (r != -ENOENT)) + break; + } + + return r; +} + +static int LUKS2_keyslot_open_by_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int digest, + const char *password, + size_t password_len, + struct volume_key **vk) +{ + int r_prio, r = -EINVAL; + + if (digest < 0) + return r; + + if (keyslot == CRYPT_ANY_SLOT) { + r_prio = LUKS2_keyslot_open_priority_digest(cd, hdr, CRYPT_SLOT_PRIORITY_PREFER, + password, password_len, digest, vk); + if (r_prio >= 0) + r = r_prio; + else if (r_prio != -EPERM && r_prio != -ENOENT) + r = r_prio; + else + r = LUKS2_keyslot_open_priority_digest(cd, hdr, CRYPT_SLOT_PRIORITY_NORMAL, + password, password_len, digest, vk); + /* Prefer password wrong to no entry from priority slot */ + if (r_prio == -EPERM && r == -ENOENT) + r = r_prio; + } else + r = LUKS2_open_and_verify_by_digest(cd, hdr, keyslot, digest, password, password_len, vk); + + return r; +} + +int LUKS2_keyslot_open_all_segments(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *password, + size_t password_len, + struct volume_key **vks) +{ + struct volume_key *vk = NULL; + int digest_old, digest_new, r = -EINVAL; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + digest_old = LUKS2_reencrypt_digest_old(hdr); + if (digest_old >= 0) { + log_dbg(cd, "Trying to unlock volume key (digest: %d) using keyslot %d.", digest_old, keyslot_old); + r = LUKS2_keyslot_open_by_digest(cd, hdr, keyslot_old, digest_old, password, password_len, &vk); + if (r < 0) + goto out; + crypt_volume_key_add_next(vks, vk); + } + + digest_new = LUKS2_reencrypt_digest_new(hdr); + if (digest_new >= 0 && digest_old != digest_new) { + log_dbg(cd, "Trying to unlock volume key (digest: %d) using keyslot %d.", digest_new, keyslot_new); + r = LUKS2_keyslot_open_by_digest(cd, hdr, keyslot_new, digest_new, password, password_len, &vk); + if (r < 0) + goto out; + crypt_volume_key_add_next(vks, vk); + } +out: + if (r < 0) { + crypt_free_volume_key(*vks); + *vks = NULL; + + if (r == -ENOMEM) + log_err(cd, _("Not enough available memory to open a keyslot.")); + else if (r != -EPERM) + log_err(cd, _("Keyslot open failed.")); + } + return r; +} + +int LUKS2_keyslot_open(struct crypt_device *cd, + int keyslot, + int segment, + const char *password, + size_t password_len, + struct volume_key **vk) +{ + struct luks2_hdr *hdr; + int r_prio, r = -EINVAL; + + hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + if (keyslot == CRYPT_ANY_SLOT) { + r_prio = LUKS2_keyslot_open_priority(cd, hdr, CRYPT_SLOT_PRIORITY_PREFER, + password, password_len, segment, vk); + if (r_prio >= 0) + r = r_prio; + else if (r_prio != -EPERM && r_prio != -ENOENT) + r = r_prio; + else + r = LUKS2_keyslot_open_priority(cd, hdr, CRYPT_SLOT_PRIORITY_NORMAL, + password, password_len, segment, vk); + /* Prefer password wrong to no entry from priority slot */ + if (r_prio == -EPERM && r == -ENOENT) + r = r_prio; + } else + r = LUKS2_open_and_verify(cd, hdr, keyslot, segment, password, password_len, vk); + + if (r < 0) { + if (r == -ENOMEM) + log_err(cd, _("Not enough available memory to open a keyslot.")); + else if (r != -EPERM) + log_err(cd, _("Keyslot open failed.")); + } + + return r; +} + +int LUKS2_keyslot_reencrypt_allocate(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const struct crypt_params_reencrypt *params) +{ + const keyslot_handler *h; + int r; + + if (keyslot == CRYPT_ANY_SLOT) + return -EINVAL; + + /* FIXME: find keyslot by type */ + h = LUKS2_keyslot_handler_type(cd, "reencrypt"); + if (!h) + return -EINVAL; + + r = reenc_keyslot_alloc(cd, hdr, keyslot, params); + if (r < 0) + return r; + + r = LUKS2_keyslot_priority_set(cd, hdr, keyslot, CRYPT_SLOT_PRIORITY_IGNORE, 0); + if (r < 0) + return r; + + r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); + if (r) { + log_dbg(cd, "Keyslot validation failed."); + return r; + } + + return 0; +} + +int LUKS2_keyslot_reencrypt_store(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const void *buffer, + size_t buffer_length) +{ + const keyslot_handler *h; + int r; + + if (!(h = LUKS2_keyslot_handler(cd, keyslot)) || strcmp(h->name, "reencrypt")) + return -EINVAL; + + r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); + if (r) { + log_dbg(cd, "Keyslot validation failed."); + return r; + } + + return h->store(cd, keyslot, NULL, 0, + buffer, buffer_length); +} + +int LUKS2_keyslot_store(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const char *password, + size_t password_len, + const struct volume_key *vk, + const struct luks2_keyslot_params *params) +{ + const keyslot_handler *h; + int r; + + if (keyslot == CRYPT_ANY_SLOT) + return -EINVAL; + + if (!LUKS2_get_keyslot_jobj(hdr, keyslot)) { + /* Try to allocate default and empty keyslot type */ + h = LUKS2_keyslot_handler_type(cd, "luks2"); + if (!h) + return -EINVAL; + + r = h->alloc(cd, keyslot, vk->keylength, params); + if (r) + return r; + } else { + if (!(h = LUKS2_keyslot_handler(cd, keyslot))) + return -EINVAL; + + r = h->update(cd, keyslot, params); + if (r) { + log_dbg(cd, "Failed to update keyslot %d json.", keyslot); + return r; + } + } + + r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); + if (r) { + log_dbg(cd, "Keyslot validation failed."); + return r; + } + + if (LUKS2_hdr_validate(cd, hdr->jobj, hdr->hdr_size - LUKS2_HDR_BIN_LEN)) + return -EINVAL; + + return h->store(cd, keyslot, password, password_len, + vk->key, vk->keylength); +} + +int LUKS2_keyslot_wipe(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + int wipe_area_only) +{ + struct device *device = crypt_metadata_device(cd); + uint64_t area_offset, area_length; + int r; + json_object *jobj_keyslot, *jobj_keyslots; + const keyslot_handler *h; + + h = LUKS2_keyslot_handler(cd, keyslot); + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots)) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -ENOENT; + + if (wipe_area_only) + log_dbg(cd, "Wiping keyslot %d area only.", keyslot); + + r = LUKS2_device_write_lock(cd, hdr, device); + if (r) + return r; + + /* secure deletion of possible key material in keyslot area */ + r = crypt_keyslot_area(cd, keyslot, &area_offset, &area_length); + if (r && r != -ENOENT) + goto out; + + if (!r) { + r = crypt_wipe_device(cd, device, CRYPT_WIPE_SPECIAL, area_offset, + area_length, area_length, NULL, NULL); + if (r) { + if (r == -EACCES) { + log_err(cd, _("Cannot write to device %s, permission denied."), + device_path(device)); + r = -EINVAL; + } else + log_err(cd, _("Cannot wipe device %s."), device_path(device)); + goto out; + } + } + + if (wipe_area_only) + goto out; + + /* Slot specific wipe */ + if (h) { + r = h->wipe(cd, keyslot); + if (r < 0) + goto out; + } else + log_dbg(cd, "Wiping keyslot %d without specific-slot handler loaded.", keyslot); + + json_object_object_del_by_uint(jobj_keyslots, keyslot); + + r = LUKS2_hdr_write(cd, hdr); +out: + device_write_unlock(cd, crypt_metadata_device(cd)); + return r; +} + +int LUKS2_keyslot_dump(struct crypt_device *cd, int keyslot) +{ + const keyslot_handler *h; + + if (!(h = LUKS2_keyslot_handler(cd, keyslot))) + return -EINVAL; + + return h->dump(cd, keyslot); +} + +crypt_keyslot_priority LUKS2_keyslot_priority_get(struct crypt_device *cd, + struct luks2_hdr *hdr, int keyslot) +{ + json_object *jobj_keyslot, *jobj_priority; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return CRYPT_SLOT_PRIORITY_INVALID; + + if (!json_object_object_get_ex(jobj_keyslot, "priority", &jobj_priority)) + return CRYPT_SLOT_PRIORITY_NORMAL; + + return json_object_get_int(jobj_priority); +} + +int LUKS2_keyslot_priority_set(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, crypt_keyslot_priority priority, int commit) +{ + json_object *jobj_keyslot; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -EINVAL; + + if (priority == CRYPT_SLOT_PRIORITY_NORMAL) + json_object_object_del(jobj_keyslot, "priority"); + else + json_object_object_add(jobj_keyslot, "priority", json_object_new_int(priority)); + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +int placeholder_keyslot_alloc(struct crypt_device *cd, + int keyslot, + uint64_t area_offset, + uint64_t area_length, + size_t volume_key_len) +{ + struct luks2_hdr *hdr; + json_object *jobj_keyslots, *jobj_keyslot, *jobj_area; + + log_dbg(cd, "Allocating placeholder keyslot %d for LUKS1 down conversion.", keyslot); + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX) + return -EINVAL; + + if (LUKS2_get_keyslot_jobj(hdr, keyslot)) + return -EINVAL; + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots)) + return -EINVAL; + + jobj_keyslot = json_object_new_object(); + json_object_object_add(jobj_keyslot, "type", json_object_new_string("placeholder")); + /* + * key_size = -1 makes placeholder keyslot impossible to pass validation. + * It's a safeguard against accidentally storing temporary conversion + * LUKS2 header. + */ + json_object_object_add(jobj_keyslot, "key_size", json_object_new_int(-1)); + + /* Area object */ + jobj_area = json_object_new_object(); + json_object_object_add(jobj_area, "offset", crypt_jobj_new_uint64(area_offset)); + json_object_object_add(jobj_area, "size", crypt_jobj_new_uint64(area_length)); + json_object_object_add(jobj_keyslot, "area", jobj_area); + + json_object_object_add_by_uint(jobj_keyslots, keyslot, jobj_keyslot); + + return 0; +} + +static unsigned LUKS2_get_keyslot_digests_count(json_object *hdr_jobj, int keyslot) +{ + char num[16]; + json_object *jobj_digests, *jobj_keyslots; + unsigned count = 0; + + if (!json_object_object_get_ex(hdr_jobj, "digests", &jobj_digests)) + return 0; + + if (snprintf(num, sizeof(num), "%u", keyslot) < 0) + return 0; + + json_object_object_foreach(jobj_digests, key, val) { + UNUSED(key); + json_object_object_get_ex(val, "keyslots", &jobj_keyslots); + if (LUKS2_array_jobj(jobj_keyslots, num)) + count++; + } + + return count; +} + +/* run only on header that passed basic format validation */ +int LUKS2_keyslots_validate(struct crypt_device *cd, json_object *hdr_jobj) +{ + const keyslot_handler *h; + int keyslot; + json_object *jobj_keyslots, *jobj_type; + uint32_t reqs, reencrypt_count = 0; + struct luks2_hdr dummy = { + .jobj = hdr_jobj + }; + + if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) + return -EINVAL; + + if (LUKS2_config_get_requirements(cd, &dummy, &reqs)) + return -EINVAL; + + json_object_object_foreach(jobj_keyslots, slot, val) { + keyslot = atoi(slot); + json_object_object_get_ex(val, "type", &jobj_type); + h = LUKS2_keyslot_handler_type(cd, json_object_get_string(jobj_type)); + if (!h) + continue; + if (h->validate && h->validate(cd, val)) { + log_dbg(cd, "Keyslot type %s validation failed on keyslot %d.", h->name, keyslot); + return -EINVAL; + } + + if (!strcmp(h->name, "luks2") && LUKS2_get_keyslot_digests_count(hdr_jobj, keyslot) != 1) { + log_dbg(cd, "Keyslot %d is not assigned to exactly 1 digest.", keyslot); + return -EINVAL; + } + + if (!strcmp(h->name, "reencrypt")) + reencrypt_count++; + } + + if ((reqs & CRYPT_REQUIREMENT_ONLINE_REENCRYPT) && reencrypt_count == 0) { + log_dbg(cd, "Missing reencryption keyslot."); + return -EINVAL; + } + + if (!(reqs & CRYPT_REQUIREMENT_ONLINE_REENCRYPT) && reencrypt_count) { + log_dbg(cd, "Missing reencryption requirement flag."); + return -EINVAL; + } + + if (reencrypt_count > 1) { + log_dbg(cd, "Too many reencryption keyslots."); + return -EINVAL; + } + + return 0; +} + +void LUKS2_keyslots_repair(struct crypt_device *cd, json_object *jobj_keyslots) +{ + const keyslot_handler *h; + json_object *jobj_type; + + json_object_object_foreach(jobj_keyslots, slot, val) { + UNUSED(slot); + if (!json_object_is_type(val, json_type_object) || + !json_object_object_get_ex(val, "type", &jobj_type) || + !json_object_is_type(jobj_type, json_type_string)) + continue; + + h = LUKS2_keyslot_handler_type(cd, json_object_get_string(jobj_type)); + if (h && h->repair) + h->repair(cd, val); + } +} + +/* assumes valid header */ +int LUKS2_find_keyslot(struct luks2_hdr *hdr, const char *type) +{ + int i; + json_object *jobj_keyslot, *jobj_type; + + if (!type) + return -EINVAL; + + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, i); + if (!jobj_keyslot) + continue; + + json_object_object_get_ex(jobj_keyslot, "type", &jobj_type); + if (!strcmp(json_object_get_string(jobj_type), type)) + return i; + } + + return -ENOENT; +} diff --git a/lib/luks2/luks2_keyslot_luks2.c b/lib/luks2/luks2_keyslot_luks2.c new file mode 100644 index 0000000..189a3cb --- /dev/null +++ b/lib/luks2/luks2_keyslot_luks2.c @@ -0,0 +1,785 @@ +/* + * LUKS - Linux Unified Key Setup v2, LUKS2 type keyslot handler + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +/* FIXME: move keyslot encryption to crypto backend */ +#include "../luks1/af.h" + +#define LUKS_SALTSIZE 32 +#define LUKS_SLOT_ITERATIONS_MIN 1000 +#define LUKS_STRIPES 4000 + +/* Serialize memory-hard keyslot access: optional workaround for parallel processing */ +#define MIN_MEMORY_FOR_SERIALIZE_LOCK_KB 32*1024 /* 32MB */ + +static int luks2_encrypt_to_storage(char *src, size_t srcLength, + const char *cipher, const char *cipher_mode, + struct volume_key *vk, unsigned int sector, + struct crypt_device *cd) +{ +#ifndef ENABLE_AF_ALG /* Support for old kernel without Crypto API */ + return LUKS_encrypt_to_storage(src, srcLength, cipher, cipher_mode, vk, sector, cd); +#else + struct crypt_storage *s; + int devfd, r; + struct device *device = crypt_metadata_device(cd); + + /* Only whole sector writes supported */ + if (MISALIGNED_512(srcLength)) + return -EINVAL; + + /* Encrypt buffer */ + r = crypt_storage_init(&s, SECTOR_SIZE, cipher, cipher_mode, vk->key, vk->keylength, false); + if (r) { + log_err(cd, _("Cannot use %s-%s cipher for keyslot encryption."), cipher, cipher_mode); + return r; + } + + r = crypt_storage_encrypt(s, 0, srcLength, src); + crypt_storage_destroy(s); + if (r) { + log_err(cd, _("IO error while encrypting keyslot.")); + return r; + } + + devfd = device_open_locked(cd, device, O_RDWR); + if (devfd >= 0) { + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), src, + srcLength, sector * SECTOR_SIZE) < 0) + r = -EIO; + else + r = 0; + + device_sync(cd, device); + } else + r = -EIO; + + if (r) + log_err(cd, _("IO error while encrypting keyslot.")); + + return r; +#endif +} + +static int luks2_decrypt_from_storage(char *dst, size_t dstLength, + const char *cipher, const char *cipher_mode, struct volume_key *vk, + unsigned int sector, struct crypt_device *cd) +{ + struct device *device = crypt_metadata_device(cd); +#ifndef ENABLE_AF_ALG /* Support for old kernel without Crypto API */ + int r = device_read_lock(cd, device); + if (r) { + log_err(cd, _("Failed to acquire read lock on device %s."), device_path(device)); + return r; + } + r = LUKS_decrypt_from_storage(dst, dstLength, cipher, cipher_mode, vk, sector, cd); + device_read_unlock(cd, crypt_metadata_device(cd)); + return r; +#else + struct crypt_storage *s; + int devfd, r; + + /* Only whole sector writes supported */ + if (MISALIGNED_512(dstLength)) + return -EINVAL; + + r = crypt_storage_init(&s, SECTOR_SIZE, cipher, cipher_mode, vk->key, vk->keylength, false); + if (r) { + log_err(cd, _("Cannot use %s-%s cipher for keyslot encryption."), cipher, cipher_mode); + return r; + } + + r = device_read_lock(cd, device); + if (r) { + log_err(cd, _("Failed to acquire read lock on device %s."), + device_path(device)); + crypt_storage_destroy(s); + return r; + } + + devfd = device_open_locked(cd, device, O_RDONLY); + if (devfd >= 0) { + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), dst, + dstLength, sector * SECTOR_SIZE) < 0) + r = -EIO; + else + r = 0; + } else + r = -EIO; + + device_read_unlock(cd, device); + + /* Decrypt buffer */ + if (!r) + r = crypt_storage_decrypt(s, 0, dstLength, dst); + else + log_err(cd, _("IO error while decrypting keyslot.")); + + crypt_storage_destroy(s); + return r; +#endif +} + +static int luks2_keyslot_get_pbkdf_params(json_object *jobj_keyslot, + struct crypt_pbkdf_type *pbkdf, char *salt) +{ + json_object *jobj_kdf, *jobj1, *jobj2; + size_t salt_len; + + if (!jobj_keyslot || !pbkdf) + return -EINVAL; + + memset(pbkdf, 0, sizeof(*pbkdf)); + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf)) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_kdf, "type", &jobj1)) + return -EINVAL; + pbkdf->type = json_object_get_string(jobj1); + if (!strcmp(pbkdf->type, CRYPT_KDF_PBKDF2)) { + if (!json_object_object_get_ex(jobj_kdf, "hash", &jobj2)) + return -EINVAL; + pbkdf->hash = json_object_get_string(jobj2); + if (!json_object_object_get_ex(jobj_kdf, "iterations", &jobj2)) + return -EINVAL; + pbkdf->iterations = json_object_get_int(jobj2); + pbkdf->max_memory_kb = 0; + pbkdf->parallel_threads = 0; + } else { + if (!json_object_object_get_ex(jobj_kdf, "time", &jobj2)) + return -EINVAL; + pbkdf->iterations = json_object_get_int(jobj2); + if (!json_object_object_get_ex(jobj_kdf, "memory", &jobj2)) + return -EINVAL; + pbkdf->max_memory_kb = json_object_get_int(jobj2); + if (!json_object_object_get_ex(jobj_kdf, "cpus", &jobj2)) + return -EINVAL; + pbkdf->parallel_threads = json_object_get_int(jobj2); + } + + if (!json_object_object_get_ex(jobj_kdf, "salt", &jobj2)) + return -EINVAL; + salt_len = LUKS_SALTSIZE; + if (!base64_decode(json_object_get_string(jobj2), + json_object_get_string_len(jobj2), + salt, &salt_len)) + return -EINVAL; + if (salt_len != LUKS_SALTSIZE) + return -EINVAL; + + return 0; +} + +static int luks2_keyslot_set_key(struct crypt_device *cd, + json_object *jobj_keyslot, + const char *password, size_t passwordLen, + const char *volume_key, size_t volume_key_len) +{ + struct volume_key *derived_key; + char salt[LUKS_SALTSIZE], cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN]; + char *AfKey = NULL; + const char *af_hash = NULL; + size_t AFEKSize, keyslot_key_len; + json_object *jobj2, *jobj_kdf, *jobj_af, *jobj_area; + uint64_t area_offset; + struct crypt_pbkdf_type pbkdf; + int r; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf) || + !json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + /* prevent accidental volume key size change after allocation */ + if (!json_object_object_get_ex(jobj_keyslot, "key_size", &jobj2)) + return -EINVAL; + if (json_object_get_int(jobj2) != (int)volume_key_len) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_area, "offset", &jobj2)) + return -EINVAL; + area_offset = crypt_jobj_get_uint64(jobj2); + + if (!json_object_object_get_ex(jobj_area, "encryption", &jobj2)) + return -EINVAL; + r = crypt_parse_name_and_mode(json_object_get_string(jobj2), cipher, NULL, cipher_mode); + if (r < 0) + return r; + + if (!json_object_object_get_ex(jobj_area, "key_size", &jobj2)) + return -EINVAL; + keyslot_key_len = json_object_get_int(jobj2); + + if (!json_object_object_get_ex(jobj_af, "hash", &jobj2)) + return -EINVAL; + af_hash = json_object_get_string(jobj2); + + if (luks2_keyslot_get_pbkdf_params(jobj_keyslot, &pbkdf, salt)) + return -EINVAL; + + /* + * Allocate derived key storage. + */ + derived_key = crypt_alloc_volume_key(keyslot_key_len, NULL); + if (!derived_key) + return -ENOMEM; + /* + * Calculate keyslot content, split and store it to keyslot area. + */ + r = crypt_pbkdf(pbkdf.type, pbkdf.hash, password, passwordLen, + salt, LUKS_SALTSIZE, + derived_key->key, derived_key->keylength, + pbkdf.iterations, pbkdf.max_memory_kb, + pbkdf.parallel_threads); + if (r < 0) { + crypt_free_volume_key(derived_key); + return r; + } + + // FIXME: verity key_size to AFEKSize + AFEKSize = AF_split_sectors(volume_key_len, LUKS_STRIPES) * SECTOR_SIZE; + AfKey = crypt_safe_alloc(AFEKSize); + if (!AfKey) { + crypt_free_volume_key(derived_key); + return -ENOMEM; + } + + r = AF_split(cd, volume_key, AfKey, volume_key_len, LUKS_STRIPES, af_hash); + + if (r == 0) { + log_dbg(cd, "Updating keyslot area [0x%04x].", (unsigned)area_offset); + /* FIXME: sector_offset should be size_t, fix LUKS_encrypt... accordingly */ + r = luks2_encrypt_to_storage(AfKey, AFEKSize, cipher, cipher_mode, + derived_key, (unsigned)(area_offset / SECTOR_SIZE), cd); + } + + crypt_safe_free(AfKey); + crypt_free_volume_key(derived_key); + if (r < 0) + return r; + + return 0; +} + +static int luks2_keyslot_get_key(struct crypt_device *cd, + json_object *jobj_keyslot, + const char *password, size_t passwordLen, + char *volume_key, size_t volume_key_len) +{ + struct volume_key *derived_key; + struct crypt_pbkdf_type pbkdf; + char *AfKey; + size_t AFEKSize; + const char *af_hash = NULL; + char salt[LUKS_SALTSIZE], cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN]; + json_object *jobj2, *jobj_af, *jobj_area; + uint64_t area_offset; + size_t keyslot_key_len; + bool try_serialize_lock = false; + int r; + + if (!json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + if (luks2_keyslot_get_pbkdf_params(jobj_keyslot, &pbkdf, salt)) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_af, "hash", &jobj2)) + return -EINVAL; + af_hash = json_object_get_string(jobj2); + + if (!json_object_object_get_ex(jobj_area, "offset", &jobj2)) + return -EINVAL; + area_offset = crypt_jobj_get_uint64(jobj2); + + if (!json_object_object_get_ex(jobj_area, "encryption", &jobj2)) + return -EINVAL; + r = crypt_parse_name_and_mode(json_object_get_string(jobj2), cipher, NULL, cipher_mode); + if (r < 0) + return r; + + if (!json_object_object_get_ex(jobj_area, "key_size", &jobj2)) + return -EINVAL; + keyslot_key_len = json_object_get_int(jobj2); + + /* + * If requested, serialize unlocking for memory-hard KDF. Usually NOOP. + */ + if (pbkdf.max_memory_kb > MIN_MEMORY_FOR_SERIALIZE_LOCK_KB) + try_serialize_lock = true; + if (try_serialize_lock && crypt_serialize_lock(cd)) + return -EINVAL; + /* + * Allocate derived key storage space. + */ + derived_key = crypt_alloc_volume_key(keyslot_key_len, NULL); + if (!derived_key) + return -ENOMEM; + + AFEKSize = AF_split_sectors(volume_key_len, LUKS_STRIPES) * SECTOR_SIZE; + AfKey = crypt_safe_alloc(AFEKSize); + if (!AfKey) { + crypt_free_volume_key(derived_key); + return -ENOMEM; + } + /* + * Calculate derived key, decrypt keyslot content and merge it. + */ + r = crypt_pbkdf(pbkdf.type, pbkdf.hash, password, passwordLen, + salt, LUKS_SALTSIZE, + derived_key->key, derived_key->keylength, + pbkdf.iterations, pbkdf.max_memory_kb, + pbkdf.parallel_threads); + + if (try_serialize_lock) + crypt_serialize_unlock(cd); + + if (r == 0) { + log_dbg(cd, "Reading keyslot area [0x%04x].", (unsigned)area_offset); + /* FIXME: sector_offset should be size_t, fix LUKS_decrypt... accordingly */ + r = luks2_decrypt_from_storage(AfKey, AFEKSize, cipher, cipher_mode, + derived_key, (unsigned)(area_offset / SECTOR_SIZE), cd); + } + + if (r == 0) + r = AF_merge(cd, AfKey, volume_key, volume_key_len, LUKS_STRIPES, af_hash); + + crypt_free_volume_key(derived_key); + crypt_safe_free(AfKey); + + return r; +} + +/* + * currently we support update of only: + * + * - af hash function + * - kdf params + */ +static int luks2_keyslot_update_json(struct crypt_device *cd, + json_object *jobj_keyslot, + const struct luks2_keyslot_params *params) +{ + const struct crypt_pbkdf_type *pbkdf; + json_object *jobj_af, *jobj_area, *jobj_kdf; + char salt[LUKS_SALTSIZE], *salt_base64 = NULL; + int r; + + /* jobj_keyslot is not yet validated */ + + if (!json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + /* update area encryption parameters */ + json_object_object_add(jobj_area, "encryption", json_object_new_string(params->area.raw.encryption)); + json_object_object_add(jobj_area, "key_size", json_object_new_int(params->area.raw.key_size)); + + pbkdf = crypt_get_pbkdf_type(cd); + if (!pbkdf) + return -EINVAL; + + r = crypt_benchmark_pbkdf_internal(cd, CONST_CAST(struct crypt_pbkdf_type *)pbkdf, params->area.raw.key_size); + if (r < 0) + return r; + + /* refresh whole 'kdf' object */ + jobj_kdf = json_object_new_object(); + if (!jobj_kdf) + return -ENOMEM; + json_object_object_add(jobj_kdf, "type", json_object_new_string(pbkdf->type)); + if (!strcmp(pbkdf->type, CRYPT_KDF_PBKDF2)) { + json_object_object_add(jobj_kdf, "hash", json_object_new_string(pbkdf->hash)); + json_object_object_add(jobj_kdf, "iterations", json_object_new_int(pbkdf->iterations)); + } else { + json_object_object_add(jobj_kdf, "time", json_object_new_int(pbkdf->iterations)); + json_object_object_add(jobj_kdf, "memory", json_object_new_int(pbkdf->max_memory_kb)); + json_object_object_add(jobj_kdf, "cpus", json_object_new_int(pbkdf->parallel_threads)); + } + json_object_object_add(jobj_keyslot, "kdf", jobj_kdf); + + /* + * Regenerate salt and add it in 'kdf' object + */ + r = crypt_random_get(cd, salt, LUKS_SALTSIZE, CRYPT_RND_SALT); + if (r < 0) + return r; + base64_encode_alloc(salt, LUKS_SALTSIZE, &salt_base64); + if (!salt_base64) + return -ENOMEM; + json_object_object_add(jobj_kdf, "salt", json_object_new_string(salt_base64)); + free(salt_base64); + + /* update 'af' hash */ + json_object_object_add(jobj_af, "hash", json_object_new_string(params->af.luks1.hash)); + + JSON_DBG(cd, jobj_keyslot, "Keyslot JSON:"); + return 0; +} + +static int luks2_keyslot_alloc(struct crypt_device *cd, + int keyslot, + size_t volume_key_len, + const struct luks2_keyslot_params *params) +{ + struct luks2_hdr *hdr; + uint64_t area_offset, area_length; + json_object *jobj_keyslots, *jobj_keyslot, *jobj_af, *jobj_area; + int r; + + log_dbg(cd, "Trying to allocate LUKS2 keyslot %d.", keyslot); + + if (!params || params->area_type != LUKS2_KEYSLOT_AREA_RAW || + params->af_type != LUKS2_KEYSLOT_AF_LUKS1) { + log_dbg(cd, "Invalid LUKS2 keyslot parameters."); + return -EINVAL; + } + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + if (keyslot == CRYPT_ANY_SLOT) + keyslot = LUKS2_keyslot_find_empty(hdr); + + if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX) + return -ENOMEM; + + if (LUKS2_get_keyslot_jobj(hdr, keyslot)) { + log_dbg(cd, "Cannot modify already active keyslot %d.", keyslot); + return -EINVAL; + } + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots)) + return -EINVAL; + + r = LUKS2_find_area_gap(cd, hdr, volume_key_len, &area_offset, &area_length); + if (r < 0) { + log_err(cd, _("No space for new keyslot.")); + return r; + } + + jobj_keyslot = json_object_new_object(); + json_object_object_add(jobj_keyslot, "type", json_object_new_string("luks2")); + json_object_object_add(jobj_keyslot, "key_size", json_object_new_int(volume_key_len)); + + /* AF object */ + jobj_af = json_object_new_object(); + json_object_object_add(jobj_af, "type", json_object_new_string("luks1")); + json_object_object_add(jobj_af, "stripes", json_object_new_int(params->af.luks1.stripes)); + json_object_object_add(jobj_keyslot, "af", jobj_af); + + /* Area object */ + jobj_area = json_object_new_object(); + json_object_object_add(jobj_area, "type", json_object_new_string("raw")); + json_object_object_add(jobj_area, "offset", crypt_jobj_new_uint64(area_offset)); + json_object_object_add(jobj_area, "size", crypt_jobj_new_uint64(area_length)); + json_object_object_add(jobj_keyslot, "area", jobj_area); + + json_object_object_add_by_uint(jobj_keyslots, keyslot, jobj_keyslot); + + r = luks2_keyslot_update_json(cd, jobj_keyslot, params); + + if (!r && LUKS2_check_json_size(cd, hdr)) { + log_dbg(cd, "Not enough space in header json area for new keyslot."); + r = -ENOSPC; + } + + if (r) + json_object_object_del_by_uint(jobj_keyslots, keyslot); + + return r; +} + +static int luks2_keyslot_open(struct crypt_device *cd, + int keyslot, + const char *password, + size_t password_len, + char *volume_key, + size_t volume_key_len) +{ + struct luks2_hdr *hdr; + json_object *jobj_keyslot; + + log_dbg(cd, "Trying to open LUKS2 keyslot %d.", keyslot); + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -EINVAL; + + return luks2_keyslot_get_key(cd, jobj_keyslot, + password, password_len, + volume_key, volume_key_len); +} + +/* + * This function must not modify json. + * It's called after luks2 keyslot validation. + */ +static int luks2_keyslot_store(struct crypt_device *cd, + int keyslot, + const char *password, + size_t password_len, + const char *volume_key, + size_t volume_key_len) +{ + struct luks2_hdr *hdr; + json_object *jobj_keyslot; + int r; + + log_dbg(cd, "Calculating attributes for LUKS2 keyslot %d.", keyslot); + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -EINVAL; + + r = LUKS2_device_write_lock(cd, hdr, crypt_metadata_device(cd)); + if(r) + return r; + + r = luks2_keyslot_set_key(cd, jobj_keyslot, + password, password_len, + volume_key, volume_key_len); + if (!r) + r = LUKS2_hdr_write(cd, hdr); + + device_write_unlock(cd, crypt_metadata_device(cd)); + + return r < 0 ? r : keyslot; +} + +static int luks2_keyslot_wipe(struct crypt_device *cd, int keyslot) +{ + struct luks2_hdr *hdr; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + /* Remove any reference of deleted keyslot from digests and tokens */ + LUKS2_digest_assign(cd, hdr, keyslot, CRYPT_ANY_DIGEST, 0, 0); + LUKS2_token_assign(cd, hdr, keyslot, CRYPT_ANY_TOKEN, 0, 0); + + return 0; +} + +static int luks2_keyslot_dump(struct crypt_device *cd, int keyslot) +{ + json_object *jobj_keyslot, *jobj1, *jobj_kdf, *jobj_af, *jobj_area; + + jobj_keyslot = LUKS2_get_keyslot_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), keyslot); + if (!jobj_keyslot) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf) || + !json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + json_object_object_get_ex(jobj_area, "encryption", &jobj1); + log_std(cd, "\tCipher: %s\n", json_object_get_string(jobj1)); + + json_object_object_get_ex(jobj_area, "key_size", &jobj1); + log_std(cd, "\tCipher key: %u bits\n", crypt_jobj_get_uint32(jobj1) * 8); + + json_object_object_get_ex(jobj_kdf, "type", &jobj1); + log_std(cd, "\tPBKDF: %s\n", json_object_get_string(jobj1)); + + if (!strcmp(json_object_get_string(jobj1), CRYPT_KDF_PBKDF2)) { + json_object_object_get_ex(jobj_kdf, "hash", &jobj1); + log_std(cd, "\tHash: %s\n", json_object_get_string(jobj1)); + + json_object_object_get_ex(jobj_kdf, "iterations", &jobj1); + log_std(cd, "\tIterations: %" PRIu64 "\n", crypt_jobj_get_uint64(jobj1)); + } else { + json_object_object_get_ex(jobj_kdf, "time", &jobj1); + log_std(cd, "\tTime cost: %" PRIu64 "\n", json_object_get_int64(jobj1)); + + json_object_object_get_ex(jobj_kdf, "memory", &jobj1); + log_std(cd, "\tMemory: %" PRIu64 "\n", json_object_get_int64(jobj1)); + + json_object_object_get_ex(jobj_kdf, "cpus", &jobj1); + log_std(cd, "\tThreads: %" PRIu64 "\n", json_object_get_int64(jobj1)); + } + json_object_object_get_ex(jobj_kdf, "salt", &jobj1); + log_std(cd, "\tSalt: "); + hexprint_base64(cd, jobj1, " ", " "); + + + json_object_object_get_ex(jobj_af, "stripes", &jobj1); + log_std(cd, "\tAF stripes: %u\n", json_object_get_int(jobj1)); + + json_object_object_get_ex(jobj_af, "hash", &jobj1); + log_std(cd, "\tAF hash: %s\n", json_object_get_string(jobj1)); + + json_object_object_get_ex(jobj_area, "offset", &jobj1); + log_std(cd, "\tArea offset:%" PRIu64 " [bytes]\n", crypt_jobj_get_uint64(jobj1)); + + json_object_object_get_ex(jobj_area, "size", &jobj1); + log_std(cd, "\tArea length:%" PRIu64 " [bytes]\n", crypt_jobj_get_uint64(jobj1)); + + return 0; +} + +static int luks2_keyslot_validate(struct crypt_device *cd, json_object *jobj_keyslot) +{ + json_object *jobj_kdf, *jobj_af, *jobj_area, *jobj1; + const char *type; + int count; + + if (!jobj_keyslot) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf) || + !json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + + count = json_object_object_length(jobj_kdf); + + jobj1 = json_contains(cd, jobj_kdf, "", "kdf section", "type", json_type_string); + if (!jobj1) + return -EINVAL; + type = json_object_get_string(jobj1); + + if (!strcmp(type, CRYPT_KDF_PBKDF2)) { + if (count != 4 || /* type, salt, hash, iterations only */ + !json_contains(cd, jobj_kdf, "kdf type", type, "hash", json_type_string) || + !json_contains(cd, jobj_kdf, "kdf type", type, "iterations", json_type_int) || + !json_contains(cd, jobj_kdf, "kdf type", type, "salt", json_type_string)) + return -EINVAL; + } else if (!strcmp(type, CRYPT_KDF_ARGON2I) || !strcmp(type, CRYPT_KDF_ARGON2ID)) { + if (count != 5 || /* type, salt, time, memory, cpus only */ + !json_contains(cd, jobj_kdf, "kdf type", type, "time", json_type_int) || + !json_contains(cd, jobj_kdf, "kdf type", type, "memory", json_type_int) || + !json_contains(cd, jobj_kdf, "kdf type", type, "cpus", json_type_int) || + !json_contains(cd, jobj_kdf, "kdf type", type, "salt", json_type_string)) + return -EINVAL; + } + + if (!json_object_object_get_ex(jobj_af, "type", &jobj1)) + return -EINVAL; + if (!strcmp(json_object_get_string(jobj1), "luks1")) { + if (!json_contains(cd, jobj_af, "", "luks1 af", "hash", json_type_string) || + !json_contains(cd, jobj_af, "", "luks1 af", "stripes", json_type_int)) + return -EINVAL; + } else + return -EINVAL; + + // FIXME check numbered + if (!json_object_object_get_ex(jobj_area, "type", &jobj1)) + return -EINVAL; + if (!strcmp(json_object_get_string(jobj1), "raw")) { + if (!json_contains(cd, jobj_area, "area", "raw type", "encryption", json_type_string) || + !json_contains(cd, jobj_area, "area", "raw type", "key_size", json_type_int) || + !json_contains(cd, jobj_area, "area", "raw type", "offset", json_type_string) || + !json_contains(cd, jobj_area, "area", "raw type", "size", json_type_string)) + return -EINVAL; + } else + return -EINVAL; + + return 0; +} + +static int luks2_keyslot_update(struct crypt_device *cd, + int keyslot, + const struct luks2_keyslot_params *params) +{ + struct luks2_hdr *hdr; + json_object *jobj_keyslot; + int r; + + log_dbg(cd, "Updating LUKS2 keyslot %d.", keyslot); + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -EINVAL; + + r = luks2_keyslot_update_json(cd, jobj_keyslot, params); + + if (!r && LUKS2_check_json_size(cd, hdr)) { + log_dbg(cd, "Not enough space in header json area for updated keyslot %d.", keyslot); + r = -ENOSPC; + } + + return r; +} + +static void luks2_keyslot_repair(struct crypt_device *cd, json_object *jobj_keyslot) +{ + const char *type; + json_object *jobj_kdf, *jobj_type; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf) || + !json_object_is_type(jobj_kdf, json_type_object)) + return; + + if (!json_object_object_get_ex(jobj_kdf, "type", &jobj_type) || + !json_object_is_type(jobj_type, json_type_string)) + return; + + type = json_object_get_string(jobj_type); + + if (!strcmp(type, CRYPT_KDF_PBKDF2)) { + /* type, salt, hash, iterations only */ + json_object_object_foreach(jobj_kdf, key, val) { + UNUSED(val); + if (!strcmp(key, "type") || !strcmp(key, "salt") || + !strcmp(key, "hash") || !strcmp(key, "iterations")) + continue; + json_object_object_del(jobj_kdf, key); + } + } else if (!strcmp(type, CRYPT_KDF_ARGON2I) || !strcmp(type, CRYPT_KDF_ARGON2ID)) { + /* type, salt, time, memory, cpus only */ + json_object_object_foreach(jobj_kdf, key, val) { + UNUSED(val); + if (!strcmp(key, "type") || !strcmp(key, "salt") || + !strcmp(key, "time") || !strcmp(key, "memory") || + !strcmp(key, "cpus")) + continue; + json_object_object_del(jobj_kdf, key); + } + } +} + +const keyslot_handler luks2_keyslot = { + .name = "luks2", + .alloc = luks2_keyslot_alloc, + .update = luks2_keyslot_update, + .open = luks2_keyslot_open, + .store = luks2_keyslot_store, + .wipe = luks2_keyslot_wipe, + .dump = luks2_keyslot_dump, + .validate = luks2_keyslot_validate, + .repair = luks2_keyslot_repair +}; diff --git a/lib/luks2/luks2_keyslot_reenc.c b/lib/luks2/luks2_keyslot_reenc.c new file mode 100644 index 0000000..9da7007 --- /dev/null +++ b/lib/luks2/luks2_keyslot_reenc.c @@ -0,0 +1,316 @@ +/* + * LUKS - Linux Unified Key Setup v2, reencryption keyslot handler + * + * Copyright (C) 2016-2021, Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021, Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +static int reenc_keyslot_open(struct crypt_device *cd, + int keyslot, + const char *password, + size_t password_len, + char *volume_key, + size_t volume_key_len) +{ + return -ENOENT; +} + +int reenc_keyslot_alloc(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const struct crypt_params_reencrypt *params) +{ + int r; + json_object *jobj_keyslots, *jobj_keyslot, *jobj_area; + uint64_t area_offset, area_length; + + log_dbg(cd, "Allocating reencrypt keyslot %d.", keyslot); + + if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX) + return -ENOMEM; + + if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots)) + return -EINVAL; + + /* encryption doesn't require area (we shift data and backup will be available) */ + if (!params->data_shift) { + r = LUKS2_find_area_max_gap(cd, hdr, &area_offset, &area_length); + if (r < 0) + return r; + } else { /* we can't have keyslot w/o area...bug? */ + r = LUKS2_find_area_gap(cd, hdr, 1, &area_offset, &area_length); + if (r < 0) + return r; + } + + jobj_keyslot = json_object_new_object(); + if (!jobj_keyslot) + return -ENOMEM; + + jobj_area = json_object_new_object(); + + if (params->data_shift) { + json_object_object_add(jobj_area, "type", json_object_new_string("datashift")); + json_object_object_add(jobj_area, "shift_size", crypt_jobj_new_uint64(params->data_shift << SECTOR_SHIFT)); + } else + /* except data shift protection, initial setting is irrelevant. Type can be changed during reencryption */ + json_object_object_add(jobj_area, "type", json_object_new_string("none")); + + json_object_object_add(jobj_area, "offset", crypt_jobj_new_uint64(area_offset)); + json_object_object_add(jobj_area, "size", crypt_jobj_new_uint64(area_length)); + + json_object_object_add(jobj_keyslot, "type", json_object_new_string("reencrypt")); + json_object_object_add(jobj_keyslot, "key_size", json_object_new_int(1)); /* useless but mandatory */ + json_object_object_add(jobj_keyslot, "mode", json_object_new_string(crypt_reencrypt_mode_to_str(params->mode))); + if (params->direction == CRYPT_REENCRYPT_FORWARD) + json_object_object_add(jobj_keyslot, "direction", json_object_new_string("forward")); + else if (params->direction == CRYPT_REENCRYPT_BACKWARD) + json_object_object_add(jobj_keyslot, "direction", json_object_new_string("backward")); + else + return -EINVAL; + + json_object_object_add(jobj_keyslot, "area", jobj_area); + + json_object_object_add_by_uint(jobj_keyslots, keyslot, jobj_keyslot); + if (LUKS2_check_json_size(cd, hdr)) { + log_dbg(cd, "New keyslot too large to fit in free metadata space."); + json_object_object_del_by_uint(jobj_keyslots, keyslot); + return -ENOSPC; + } + + JSON_DBG(cd, hdr->jobj, "JSON:"); + + return 0; +} + +static int reenc_keyslot_store_data(struct crypt_device *cd, + json_object *jobj_keyslot, + const void *buffer, size_t buffer_len) +{ + int devfd, r; + json_object *jobj_area, *jobj_offset, *jobj_length; + uint64_t area_offset, area_length; + struct device *device = crypt_metadata_device(cd); + + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area) || + !json_object_object_get_ex(jobj_area, "offset", &jobj_offset) || + !json_object_object_get_ex(jobj_area, "size", &jobj_length)) + return -EINVAL; + + area_offset = crypt_jobj_get_uint64(jobj_offset); + area_length = crypt_jobj_get_uint64(jobj_length); + + if (!area_offset || !area_length || ((uint64_t)buffer_len > area_length)) + return -EINVAL; + + devfd = device_open_locked(cd, device, O_RDWR); + if (devfd >= 0) { + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), CONST_CAST(void *)buffer, + buffer_len, area_offset) < 0) + r = -EIO; + else + r = 0; + } else + r = -EINVAL; + + if (r) + log_err(cd, _("IO error while encrypting keyslot.")); + + return r; +} + +static int reenc_keyslot_store(struct crypt_device *cd, + int keyslot, + const char *password __attribute__((unused)), + size_t password_len __attribute__((unused)), + const char *buffer, + size_t buffer_len) +{ + struct luks2_hdr *hdr; + json_object *jobj_keyslot; + int r = 0; + + if (!cd || !buffer || !buffer_len) + return -EINVAL; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + log_dbg(cd, "Reencrypt keyslot %d store.", keyslot); + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return -EINVAL; + + r = LUKS2_device_write_lock(cd, hdr, crypt_metadata_device(cd)); + if (r) + return r; + + r = reenc_keyslot_store_data(cd, jobj_keyslot, buffer, buffer_len); + if (r < 0) { + device_write_unlock(cd, crypt_metadata_device(cd)); + return r; + } + + r = LUKS2_hdr_write(cd, hdr); + + device_write_unlock(cd, crypt_metadata_device(cd)); + + return r < 0 ? r : keyslot; +} + +static int reenc_keyslot_wipe(struct crypt_device *cd, + int keyslot) +{ + struct luks2_hdr *hdr; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + /* remove reencryption verification data */ + LUKS2_digest_assign(cd, hdr, keyslot, CRYPT_ANY_DIGEST, 0, 0); + + return 0; +} + +static int reenc_keyslot_dump(struct crypt_device *cd, int keyslot) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_direction, *jobj_mode, *jobj_resilience, + *jobj1; + + jobj_keyslot = LUKS2_get_keyslot_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), keyslot); + if (!jobj_keyslot) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_keyslot, "direction", &jobj_direction) || + !json_object_object_get_ex(jobj_keyslot, "mode", &jobj_mode) || + !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area) || + !json_object_object_get_ex(jobj_area, "type", &jobj_resilience)) + return -EINVAL; + + log_std(cd, "\t%-12s%s\n", "Mode:", json_object_get_string(jobj_mode)); + log_std(cd, "\t%-12s%s\n", "Direction:", json_object_get_string(jobj_direction)); + log_std(cd, "\t%-12s%s\n", "Resilience:", json_object_get_string(jobj_resilience)); + + if (!strcmp(json_object_get_string(jobj_resilience), "checksum")) { + json_object_object_get_ex(jobj_area, "hash", &jobj1); + log_std(cd, "\t%-12s%s\n", "Hash:", json_object_get_string(jobj1)); + json_object_object_get_ex(jobj_area, "sector_size", &jobj1); + log_std(cd, "\t%-12s%d [bytes]\n", "Hash data:", json_object_get_int(jobj1)); + } else if (!strcmp(json_object_get_string(jobj_resilience), "datashift")) { + json_object_object_get_ex(jobj_area, "shift_size", &jobj1); + log_std(cd, "\t%-12s%" PRIu64 "[bytes]\n", "Shift size:", crypt_jobj_get_uint64(jobj1)); + } + + json_object_object_get_ex(jobj_area, "offset", &jobj1); + log_std(cd, "\tArea offset:%" PRIu64 " [bytes]\n", crypt_jobj_get_uint64(jobj1)); + + json_object_object_get_ex(jobj_area, "size", &jobj1); + log_std(cd, "\tArea length:%" PRIu64 " [bytes]\n", crypt_jobj_get_uint64(jobj1)); + + return 0; +} + +static int reenc_keyslot_validate(struct crypt_device *cd, json_object *jobj_keyslot) +{ + json_object *jobj_mode, *jobj_area, *jobj_type, *jobj_shift_size, *jobj_hash, *jobj_sector_size, *jobj_direction, *jobj_key_size; + const char *mode, *type, *direction; + uint32_t sector_size; + uint64_t shift_size; + + /* mode (string: encrypt,reencrypt,decrypt) + * direction (string:) + * area { + * type: (string: datashift, journal, checksum, none) + * hash: (string: checksum only) + * sector_size (uint32: checksum only) + * shift_size (uint64: datashift only) + * } + */ + + /* area and area type are validated in general validation code */ + if (!jobj_keyslot || !json_object_object_get_ex(jobj_keyslot, "area", &jobj_area) || + !json_object_object_get_ex(jobj_area, "type", &jobj_type)) + return -EINVAL; + + jobj_key_size = json_contains(cd, jobj_keyslot, "", "reencrypt keyslot", "key_size", json_type_int); + jobj_mode = json_contains(cd, jobj_keyslot, "", "reencrypt keyslot", "mode", json_type_string); + jobj_direction = json_contains(cd, jobj_keyslot, "", "reencrypt keyslot", "direction", json_type_string); + + if (!jobj_mode || !jobj_direction || !jobj_key_size) + return -EINVAL; + + if (!validate_json_uint32(jobj_key_size) || crypt_jobj_get_uint32(jobj_key_size) != 1) { + log_dbg(cd, "Illegal reencrypt key size."); + return -EINVAL; + } + + mode = json_object_get_string(jobj_mode); + type = json_object_get_string(jobj_type); + direction = json_object_get_string(jobj_direction); + + if (strcmp(mode, "reencrypt") && strcmp(mode, "encrypt") && + strcmp(mode, "decrypt")) { + log_dbg(cd, "Illegal reencrypt mode %s.", mode); + return -EINVAL; + } + + if (strcmp(direction, "forward") && strcmp(direction, "backward")) { + log_dbg(cd, "Illegal reencrypt direction %s.", direction); + return -EINVAL; + } + + if (!strcmp(type, "checksum")) { + jobj_hash = json_contains(cd, jobj_area, "type:checksum", "Keyslot area", "hash", json_type_string); + jobj_sector_size = json_contains(cd, jobj_area, "type:checksum", "Keyslot area", "sector_size", json_type_int); + if (!jobj_hash || !jobj_sector_size) + return -EINVAL; + if (!validate_json_uint32(jobj_sector_size)) + return -EINVAL; + sector_size = crypt_jobj_get_uint32(jobj_sector_size); + if (sector_size < SECTOR_SIZE || NOTPOW2(sector_size)) { + log_dbg(cd, "Invalid sector_size (%" PRIu32 ") for checksum resilience mode.", sector_size); + return -EINVAL; + } + } else if (!strcmp(type, "datashift")) { + if (!(jobj_shift_size = json_contains(cd, jobj_area, "type:datashift", "Keyslot area", "shift_size", json_type_string))) + return -EINVAL; + + shift_size = crypt_jobj_get_uint64(jobj_shift_size); + if (!shift_size) + return -EINVAL; + + if (MISALIGNED_512(shift_size)) { + log_dbg(cd, "Shift size field has to be aligned to sector size: %" PRIu32, SECTOR_SIZE); + return -EINVAL; + } + } + + return 0; +} + +const keyslot_handler reenc_keyslot = { + .name = "reencrypt", + .open = reenc_keyslot_open, + .store = reenc_keyslot_store, /* initialization only or also per every chunk write */ + .wipe = reenc_keyslot_wipe, + .dump = reenc_keyslot_dump, + .validate = reenc_keyslot_validate +}; diff --git a/lib/luks2/luks2_luks1_convert.c b/lib/luks2/luks2_luks1_convert.c new file mode 100644 index 0000000..84fd44f --- /dev/null +++ b/lib/luks2/luks2_luks1_convert.c @@ -0,0 +1,898 @@ +/* + * LUKS - Linux Unified Key Setup v2, LUKS1 conversion code + * + * Copyright (C) 2015-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021 Ondrej Kozina + * Copyright (C) 2015-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" +#include "../luks1/luks.h" +#include "../luks1/af.h" + +int LUKS2_check_cipher(struct crypt_device *cd, + size_t keylength, + const char *cipher, + const char *cipher_mode) +{ + return LUKS_check_cipher(cd, keylength, cipher, cipher_mode); +} + +static int json_luks1_keyslot(const struct luks_phdr *hdr_v1, int keyslot, struct json_object **keyslot_object) +{ + char *base64_str, cipher[LUKS_CIPHERNAME_L+LUKS_CIPHERMODE_L]; + size_t base64_len; + struct json_object *keyslot_obj, *field, *jobj_kdf, *jobj_af, *jobj_area; + uint64_t offset, area_size, offs_a, offs_b, length; + + keyslot_obj = json_object_new_object(); + json_object_object_add(keyslot_obj, "type", json_object_new_string("luks2")); + json_object_object_add(keyslot_obj, "key_size", json_object_new_int64(hdr_v1->keyBytes)); + + /* KDF */ + jobj_kdf = json_object_new_object(); + json_object_object_add(jobj_kdf, "type", json_object_new_string(CRYPT_KDF_PBKDF2)); + json_object_object_add(jobj_kdf, "hash", json_object_new_string(hdr_v1->hashSpec)); + json_object_object_add(jobj_kdf, "iterations", json_object_new_int64(hdr_v1->keyblock[keyslot].passwordIterations)); + /* salt field */ + base64_len = base64_encode_alloc(hdr_v1->keyblock[keyslot].passwordSalt, LUKS_SALTSIZE, &base64_str); + if (!base64_str) { + json_object_put(keyslot_obj); + json_object_put(jobj_kdf); + if (!base64_len) + return -EINVAL; + return -ENOMEM; + } + field = json_object_new_string_len(base64_str, base64_len); + free(base64_str); + json_object_object_add(jobj_kdf, "salt", field); + json_object_object_add(keyslot_obj, "kdf", jobj_kdf); + + /* AF */ + jobj_af = json_object_new_object(); + json_object_object_add(jobj_af, "type", json_object_new_string("luks1")); + json_object_object_add(jobj_af, "hash", json_object_new_string(hdr_v1->hashSpec)); + /* stripes field ignored, fixed to LUKS_STRIPES (4000) */ + json_object_object_add(jobj_af, "stripes", json_object_new_int(4000)); + json_object_object_add(keyslot_obj, "af", jobj_af); + + /* Area */ + jobj_area = json_object_new_object(); + json_object_object_add(jobj_area, "type", json_object_new_string("raw")); + + /* encryption algorithm field */ + if (*hdr_v1->cipherMode != '\0') { + (void) snprintf(cipher, sizeof(cipher), "%s-%s", hdr_v1->cipherName, hdr_v1->cipherMode); + json_object_object_add(jobj_area, "encryption", json_object_new_string(cipher)); + } else + json_object_object_add(jobj_area, "encryption", json_object_new_string(hdr_v1->cipherName)); + + /* area */ + if (LUKS_keyslot_area(hdr_v1, 0, &offs_a, &length) || + LUKS_keyslot_area(hdr_v1, 1, &offs_b, &length) || + LUKS_keyslot_area(hdr_v1, keyslot, &offset, &length)) { + json_object_put(keyslot_obj); + json_object_put(jobj_area); + return -EINVAL; + } + area_size = offs_b - offs_a; + json_object_object_add(jobj_area, "key_size", json_object_new_int(hdr_v1->keyBytes)); + json_object_object_add(jobj_area, "offset", crypt_jobj_new_uint64(offset)); + json_object_object_add(jobj_area, "size", crypt_jobj_new_uint64(area_size)); + json_object_object_add(keyslot_obj, "area", jobj_area); + + *keyslot_object = keyslot_obj; + return 0; +} + +static int json_luks1_keyslots(const struct luks_phdr *hdr_v1, struct json_object **keyslots_object) +{ + int keyslot, r; + struct json_object *keyslot_obj, *field; + + keyslot_obj = json_object_new_object(); + if (!keyslot_obj) + return -ENOMEM; + + for (keyslot = 0; keyslot < LUKS_NUMKEYS; keyslot++) { + if (hdr_v1->keyblock[keyslot].active != LUKS_KEY_ENABLED) + continue; + r = json_luks1_keyslot(hdr_v1, keyslot, &field); + if (r) { + json_object_put(keyslot_obj); + return r; + } + json_object_object_add_by_uint(keyslot_obj, keyslot, field); + } + + *keyslots_object = keyslot_obj; + return 0; +} + +static int json_luks1_segment(const struct luks_phdr *hdr_v1, struct json_object **segment_object) +{ + const char *c; + char cipher[LUKS_CIPHERNAME_L+LUKS_CIPHERMODE_L]; + struct json_object *segment_obj, *field; + uint64_t number; + + segment_obj = json_object_new_object(); + if (!segment_obj) + return -ENOMEM; + + /* type field */ + field = json_object_new_string("crypt"); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "type", field); + + /* offset field */ + number = (uint64_t)hdr_v1->payloadOffset * SECTOR_SIZE; + + field = crypt_jobj_new_uint64(number); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "offset", field); + + /* iv_tweak field */ + field = json_object_new_string("0"); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "iv_tweak", field); + + /* length field */ + field = json_object_new_string("dynamic"); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "size", field); + + /* cipher field */ + if (*hdr_v1->cipherMode != '\0') { + (void) snprintf(cipher, sizeof(cipher), "%s-%s", hdr_v1->cipherName, hdr_v1->cipherMode); + c = cipher; + } else + c = hdr_v1->cipherName; + + field = json_object_new_string(c); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "encryption", field); + + /* block field */ + field = json_object_new_int(SECTOR_SIZE); + if (!field) { + json_object_put(segment_obj); + return -ENOMEM; + } + json_object_object_add(segment_obj, "sector_size", field); + + *segment_object = segment_obj; + return 0; +} + +static int json_luks1_segments(const struct luks_phdr *hdr_v1, struct json_object **segments_object) +{ + int r; + struct json_object *segments_obj, *field; + + segments_obj = json_object_new_object(); + if (!segments_obj) + return -ENOMEM; + + r = json_luks1_segment(hdr_v1, &field); + if (r) { + json_object_put(segments_obj); + return r; + } + json_object_object_add_by_uint(segments_obj, 0, field); + + *segments_object = segments_obj; + return 0; +} + +static int json_luks1_digest(const struct luks_phdr *hdr_v1, struct json_object **digest_object) +{ + char keyslot_str[2], *base64_str; + int ks; + size_t base64_len; + struct json_object *digest_obj, *array, *field; + + digest_obj = json_object_new_object(); + if (!digest_obj) + return -ENOMEM; + + /* type field */ + field = json_object_new_string("pbkdf2"); + if (!field) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "type", field); + + /* keyslots array */ + array = json_object_new_array(); + if (!array) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "keyslots", json_object_get(array)); + + for (ks = 0; ks < LUKS_NUMKEYS; ks++) { + if (hdr_v1->keyblock[ks].active != LUKS_KEY_ENABLED) + continue; + (void) snprintf(keyslot_str, sizeof(keyslot_str), "%d", ks); + + field = json_object_new_string(keyslot_str); + if (!field || json_object_array_add(array, field) < 0) { + json_object_put(field); + json_object_put(array); + json_object_put(digest_obj); + return -ENOMEM; + } + } + + json_object_put(array); + + /* segments array */ + array = json_object_new_array(); + if (!array) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "segments", json_object_get(array)); + + field = json_object_new_string("0"); + if (!field || json_object_array_add(array, field) < 0) { + json_object_put(field); + json_object_put(array); + json_object_put(digest_obj); + return -ENOMEM; + } + + json_object_put(array); + + /* hash field */ + field = json_object_new_string(hdr_v1->hashSpec); + if (!field) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "hash", field); + + /* salt field */ + base64_len = base64_encode_alloc(hdr_v1->mkDigestSalt, LUKS_SALTSIZE, &base64_str); + if (!base64_str) { + json_object_put(digest_obj); + if (!base64_len) + return -EINVAL; + return -ENOMEM; + } + + field = json_object_new_string_len(base64_str, base64_len); + free(base64_str); + if (!field) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "salt", field); + + /* digest field */ + base64_len = base64_encode_alloc(hdr_v1->mkDigest, LUKS_DIGESTSIZE, &base64_str); + if (!base64_str) { + json_object_put(digest_obj); + if (!base64_len) + return -EINVAL; + return -ENOMEM; + } + + field = json_object_new_string_len(base64_str, base64_len); + free(base64_str); + if (!field) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "digest", field); + + /* iterations field */ + field = json_object_new_int64(hdr_v1->mkDigestIterations); + if (!field) { + json_object_put(digest_obj); + return -ENOMEM; + } + json_object_object_add(digest_obj, "iterations", field); + + *digest_object = digest_obj; + return 0; +} + +static int json_luks1_digests(const struct luks_phdr *hdr_v1, struct json_object **digests_object) +{ + int r; + struct json_object *digests_obj, *field; + + digests_obj = json_object_new_object(); + if (!digests_obj) + return -ENOMEM; + + r = json_luks1_digest(hdr_v1, &field); + if (r) { + json_object_put(digests_obj); + return r; + } + json_object_object_add(digests_obj, "0", field); + + *digests_object = digests_obj; + return 0; +} + +static int json_luks1_object(struct luks_phdr *hdr_v1, struct json_object **luks1_object, uint64_t keyslots_size) +{ + int r; + struct json_object *luks1_obj, *field; + uint64_t json_size; + + luks1_obj = json_object_new_object(); + if (!luks1_obj) + return -ENOMEM; + + /* keyslots field */ + r = json_luks1_keyslots(hdr_v1, &field); + if (r) { + json_object_put(luks1_obj); + return r; + } + json_object_object_add(luks1_obj, "keyslots", field); + + /* tokens field */ + field = json_object_new_object(); + if (!field) { + json_object_put(luks1_obj); + return -ENOMEM; + } + json_object_object_add(luks1_obj, "tokens", field); + + /* segments field */ + r = json_luks1_segments(hdr_v1, &field); + if (r) { + json_object_put(luks1_obj); + return r; + } + json_object_object_add(luks1_obj, "segments", field); + + /* digests field */ + r = json_luks1_digests(hdr_v1, &field); + if (r) { + json_object_put(luks1_obj); + return r; + } + json_object_object_add(luks1_obj, "digests", field); + + /* config field */ + /* anything else? */ + field = json_object_new_object(); + if (!field) { + json_object_put(luks1_obj); + return -ENOMEM; + } + json_object_object_add(luks1_obj, "config", field); + + json_size = LUKS2_HDR_16K_LEN - LUKS2_HDR_BIN_LEN; + json_object_object_add(field, "json_size", crypt_jobj_new_uint64(json_size)); + keyslots_size -= (keyslots_size % 4096); + json_object_object_add(field, "keyslots_size", crypt_jobj_new_uint64(keyslots_size)); + + *luks1_object = luks1_obj; + return 0; +} + +static void move_keyslot_offset(json_object *jobj, int offset_add) +{ + json_object *jobj1, *jobj2, *jobj_area; + uint64_t offset = 0; + + json_object_object_get_ex(jobj, "keyslots", &jobj1); + json_object_object_foreach(jobj1, key, val) { + UNUSED(key); + json_object_object_get_ex(val, "area", &jobj_area); + json_object_object_get_ex(jobj_area, "offset", &jobj2); + offset = crypt_jobj_get_uint64(jobj2) + offset_add; + json_object_object_add(jobj_area, "offset", crypt_jobj_new_uint64(offset)); + } +} + +/* FIXME: return specific error code for partial write error (aka keyslots are gone) */ +static int move_keyslot_areas(struct crypt_device *cd, off_t offset_from, + off_t offset_to, size_t buf_size) +{ + int devfd, r = -EIO; + struct device *device = crypt_metadata_device(cd); + void *buf = NULL; + + log_dbg(cd, "Moving keyslot areas of size %zu from %jd to %jd.", + buf_size, (intmax_t)offset_from, (intmax_t)offset_to); + + if (posix_memalign(&buf, crypt_getpagesize(), buf_size)) + return -ENOMEM; + + devfd = device_open(cd, device, O_RDWR); + if (devfd < 0) { + free(buf); + return -EIO; + } + + /* This can safely fail (for block devices). It only allocates space if it is possible. */ + if (posix_fallocate(devfd, offset_to, buf_size)) + log_dbg(cd, "Preallocation (fallocate) of new keyslot area not available."); + + /* Try to read *new* area to check that area is there (trimmed backup). */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), buf, buf_size, + offset_to)!= (ssize_t)buf_size) + goto out; + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), buf, buf_size, + offset_from)!= (ssize_t)buf_size) + goto out; + + if (write_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), buf, buf_size, + offset_to) != (ssize_t)buf_size) + goto out; + + r = 0; +out: + device_sync(cd, device); + crypt_safe_memzero(buf, buf_size); + free(buf); + + return r; +} + +static int luks_header_in_use(struct crypt_device *cd) +{ + int r; + + r = lookup_dm_dev_by_uuid(cd, crypt_get_uuid(cd), crypt_get_type(cd)); + if (r < 0) + log_err(cd, _("Cannot check status of device with uuid: %s."), crypt_get_uuid(cd)); + + return r; +} + +/* Check if there is a luksmeta area (foreign metadata created by the luksmeta package) */ +static int luksmeta_header_present(struct crypt_device *cd, off_t luks1_size) +{ + int devfd, r = 0; + static const uint8_t LM_MAGIC[] = { 'L', 'U', 'K', 'S', 'M', 'E', 'T', 'A' }; + struct device *device = crypt_metadata_device(cd); + void *buf = NULL; + + if (posix_memalign(&buf, crypt_getpagesize(), sizeof(LM_MAGIC))) + return -ENOMEM; + + devfd = device_open(cd, device, O_RDONLY); + if (devfd < 0) { + free(buf); + return -EIO; + } + + /* Note: we must not detect failure as problem here, header can be trimmed. */ + if (read_lseek_blockwise(devfd, device_block_size(cd, device), device_alignment(device), + buf, sizeof(LM_MAGIC), luks1_size) == (ssize_t)sizeof(LM_MAGIC) && + !memcmp(LM_MAGIC, buf, sizeof(LM_MAGIC))) { + log_err(cd, _("Unable to convert header with LUKSMETA additional metadata.")); + r = -EBUSY; + } + + free(buf); + return r; +} + +/* Convert LUKS1 -> LUKS2 */ +int LUKS2_luks1_to_luks2(struct crypt_device *cd, struct luks_phdr *hdr1, struct luks2_hdr *hdr2) +{ + int r; + json_object *jobj = NULL; + size_t buf_size, buf_offset, luks1_size, luks1_shift = 2 * LUKS2_HDR_16K_LEN - LUKS_ALIGN_KEYSLOTS; + uint64_t required_size, max_size = crypt_get_data_offset(cd) * SECTOR_SIZE; + + /* for detached headers max size == device size */ + if (!max_size && (r = device_size(crypt_metadata_device(cd), &max_size))) + return r; + + luks1_size = LUKS_device_sectors(hdr1) << SECTOR_SHIFT; + luks1_size = size_round_up(luks1_size, LUKS_ALIGN_KEYSLOTS); + if (!luks1_size) + return -EINVAL; + + if (LUKS_keyslots_offset(hdr1) != (LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE)) { + log_dbg(cd, "Unsupported keyslots material offset: %zu.", LUKS_keyslots_offset(hdr1)); + return -EINVAL; + } + + if (luksmeta_header_present(cd, luks1_size)) + return -EINVAL; + + log_dbg(cd, "Max size: %" PRIu64 ", LUKS1 (full) header size %zu , required shift: %zu", + max_size, luks1_size, luks1_shift); + + required_size = luks1_size + luks1_shift; + + if ((max_size < required_size) && + device_fallocate(crypt_metadata_device(cd), required_size)) { + log_err(cd, _("Unable to move keyslot area. Not enough space.")); + return -EINVAL; + } + + if (max_size < required_size) + max_size = required_size; + + r = json_luks1_object(hdr1, &jobj, max_size - 2 * LUKS2_HDR_16K_LEN); + if (r < 0) + return r; + + move_keyslot_offset(jobj, luks1_shift); + + // fill hdr2 + memset(hdr2, 0, sizeof(*hdr2)); + hdr2->hdr_size = LUKS2_HDR_16K_LEN; + hdr2->seqid = 1; + hdr2->version = 2; + strncpy(hdr2->checksum_alg, "sha256", LUKS2_CHECKSUM_ALG_L); + crypt_random_get(cd, (char*)hdr2->salt1, sizeof(hdr2->salt1), CRYPT_RND_SALT); + crypt_random_get(cd, (char*)hdr2->salt2, sizeof(hdr2->salt2), CRYPT_RND_SALT); + strncpy(hdr2->uuid, crypt_get_uuid(cd), LUKS2_UUID_L-1); /* UUID should be max 36 chars */ + hdr2->jobj = jobj; + + /* + * It duplicates check in LUKS2_hdr_write() but we don't want to move + * keyslot areas in case it would fail later + */ + if (max_size < LUKS2_hdr_and_areas_size(hdr2)) { + r = -EINVAL; + goto out; + } + + /* check future LUKS2 metadata before moving keyslots area */ + if (LUKS2_hdr_validate(cd, hdr2->jobj, hdr2->hdr_size - LUKS2_HDR_BIN_LEN)) { + r = -EINVAL; + goto out; + } + + if ((r = luks_header_in_use(cd))) { + if (r > 0) + r = -EBUSY; + goto out; + } + + // move keyslots 4k -> 32k offset + buf_offset = 2 * LUKS2_HDR_16K_LEN; + buf_size = luks1_size - LUKS_ALIGN_KEYSLOTS; + + /* check future LUKS2 keyslots area is at least as large as LUKS1 keyslots area */ + if (buf_size > LUKS2_keyslots_size(hdr2)) { + log_err(cd, _("Unable to move keyslot area. LUKS2 keyslots area too small.")); + r = -EINVAL; + goto out; + } + + if ((r = move_keyslot_areas(cd, 8 * SECTOR_SIZE, buf_offset, buf_size)) < 0) { + log_err(cd, _("Unable to move keyslot area.")); + goto out; + } + + // Write JSON hdr2 + r = LUKS2_hdr_write(cd, hdr2); +out: + LUKS2_hdr_free(cd, hdr2); + + return r; +} + +static int keyslot_LUKS1_compatible(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, uint32_t key_size, const char *hash) +{ + json_object *jobj_keyslot, *jobj, *jobj_kdf, *jobj_af; + uint64_t l2_offset, l2_length; + size_t ks_key_size; + const char *ks_cipher, *data_cipher; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); + if (!jobj_keyslot) + return 1; + + if (!json_object_object_get_ex(jobj_keyslot, "type", &jobj) || + strcmp(json_object_get_string(jobj), "luks2")) + return 0; + + /* Using PBKDF2, this implies memory and parallel is not used. */ + jobj = NULL; + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf) || + !json_object_object_get_ex(jobj_kdf, "type", &jobj) || + strcmp(json_object_get_string(jobj), CRYPT_KDF_PBKDF2) || + !json_object_object_get_ex(jobj_kdf, "hash", &jobj) || + strcmp(json_object_get_string(jobj), hash)) + return 0; + + jobj = NULL; + if (!json_object_object_get_ex(jobj_keyslot, "af", &jobj_af) || + !json_object_object_get_ex(jobj_af, "stripes", &jobj) || + json_object_get_int(jobj) != LUKS_STRIPES) + return 0; + + jobj = NULL; + if (!json_object_object_get_ex(jobj_af, "hash", &jobj) || + (crypt_hash_size(json_object_get_string(jobj)) < 0) || + strcmp(json_object_get_string(jobj), hash)) + return 0; + + /* FIXME: should this go to validation code instead (aka invalid luks2 header if assigned to segment 0)? */ + /* FIXME: check all keyslots are assigned to segment id 0, and segments count == 1 */ + ks_cipher = LUKS2_get_keyslot_cipher(hdr, keyslot, &ks_key_size); + data_cipher = LUKS2_get_cipher(hdr, CRYPT_DEFAULT_SEGMENT); + if (!ks_cipher || !data_cipher || key_size != ks_key_size || strcmp(ks_cipher, data_cipher)) { + log_dbg(cd, "Cipher in keyslot %d is different from volume key encryption.", keyslot); + return 0; + } + + if (LUKS2_keyslot_area(hdr, keyslot, &l2_offset, &l2_length)) + return 0; + + if (l2_length != (size_round_up(AF_split_sectors(key_size, LUKS_STRIPES) * SECTOR_SIZE, 4096))) { + log_dbg(cd, "Area length in LUKS2 keyslot (%d) is not compatible with LUKS1", keyslot); + return 0; + } + + return 1; +} + +/* Convert LUKS2 -> LUKS1 */ +int LUKS2_luks2_to_luks1(struct crypt_device *cd, struct luks2_hdr *hdr2, struct luks_phdr *hdr1) +{ + size_t buf_size, buf_offset; + char cipher[LUKS_CIPHERNAME_L], cipher_mode[LUKS_CIPHERMODE_L]; + char digest[LUKS_DIGESTSIZE], digest_salt[LUKS_SALTSIZE]; + const char *hash; + size_t len; + json_object *jobj_keyslot, *jobj_digest, *jobj_segment, *jobj_kdf, *jobj_area, *jobj1, *jobj2; + uint32_t key_size; + int i, r, last_active = 0; + uint64_t offset, area_length; + char buf[256], luksMagic[] = LUKS_MAGIC; + + jobj_digest = LUKS2_get_digest_jobj(hdr2, 0); + if (!jobj_digest) + return -EINVAL; + + jobj_segment = LUKS2_get_segment_jobj(hdr2, CRYPT_DEFAULT_SEGMENT); + if (!jobj_segment) + return -EINVAL; + + if (json_segment_get_sector_size(jobj_segment) != SECTOR_SIZE) { + log_err(cd, _("Cannot convert to LUKS1 format - default segment encryption sector size is not 512 bytes.")); + return -EINVAL; + } + + json_object_object_get_ex(hdr2->jobj, "digests", &jobj1); + if (!json_object_object_get_ex(jobj_digest, "type", &jobj2) || + strcmp(json_object_get_string(jobj2), "pbkdf2") || + json_object_object_length(jobj1) != 1) { + log_err(cd, _("Cannot convert to LUKS1 format - key slot digests are not LUKS1 compatible.")); + return -EINVAL; + } + if (!json_object_object_get_ex(jobj_digest, "hash", &jobj2)) + return -EINVAL; + hash = json_object_get_string(jobj2); + + r = crypt_parse_name_and_mode(LUKS2_get_cipher(hdr2, CRYPT_DEFAULT_SEGMENT), cipher, NULL, cipher_mode); + if (r < 0) + return r; + + if (crypt_cipher_wrapped_key(cipher, cipher_mode)) { + log_err(cd, _("Cannot convert to LUKS1 format - device uses wrapped key cipher %s."), cipher); + return -EINVAL; + } + + r = LUKS2_tokens_count(hdr2); + if (r < 0) + return r; + if (r > 0) { + log_err(cd, _("Cannot convert to LUKS1 format - LUKS2 header contains %u token(s)."), r); + return -EINVAL; + } + + r = LUKS2_get_volume_key_size(hdr2, 0); + if (r < 0) + return -EINVAL; + key_size = r; + + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) { + if (LUKS2_keyslot_info(hdr2, i) == CRYPT_SLOT_INACTIVE) + continue; + + if (LUKS2_keyslot_info(hdr2, i) == CRYPT_SLOT_INVALID) { + log_err(cd, _("Cannot convert to LUKS1 format - keyslot %u is in invalid state."), i); + return -EINVAL; + } + + if (i >= LUKS_NUMKEYS) { + log_err(cd, _("Cannot convert to LUKS1 format - slot %u (over maximum slots) is still active."), i); + return -EINVAL; + } + + if (!keyslot_LUKS1_compatible(cd, hdr2, i, key_size, hash)) { + log_err(cd, _("Cannot convert to LUKS1 format - keyslot %u is not LUKS1 compatible."), i); + return -EINVAL; + } + } + + memset(hdr1, 0, sizeof(*hdr1)); + + for (i = 0; i < LUKS_NUMKEYS; i++) { + hdr1->keyblock[i].active = LUKS_KEY_DISABLED; + hdr1->keyblock[i].stripes = LUKS_STRIPES; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr2, i); + + if (jobj_keyslot) { + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + if (!json_object_object_get_ex(jobj_area, "offset", &jobj1)) + return -EINVAL; + offset = crypt_jobj_get_uint64(jobj1); + } else { + if (LUKS2_find_area_gap(cd, hdr2, key_size, &offset, &area_length)) + return -EINVAL; + /* + * We have to create placeholder luks2 keyslots in place of all + * inactive keyslots. Otherwise we would allocate all + * inactive luks1 keyslots over same binary keyslot area. + */ + if (placeholder_keyslot_alloc(cd, i, offset, area_length, key_size)) + return -EINVAL; + } + + offset /= SECTOR_SIZE; + if (offset > UINT32_MAX) + return -EINVAL; + + hdr1->keyblock[i].keyMaterialOffset = offset; + hdr1->keyblock[i].keyMaterialOffset -= + ((2 * LUKS2_HDR_16K_LEN - LUKS_ALIGN_KEYSLOTS) / SECTOR_SIZE); + + if (!jobj_keyslot) + continue; + + hdr1->keyblock[i].active = LUKS_KEY_ENABLED; + last_active = i; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf)) + continue; + + if (!json_object_object_get_ex(jobj_kdf, "iterations", &jobj1)) + continue; + hdr1->keyblock[i].passwordIterations = crypt_jobj_get_uint32(jobj1); + + if (!json_object_object_get_ex(jobj_kdf, "salt", &jobj1)) + continue; + len = sizeof(buf); + memset(buf, 0, len); + if (!base64_decode(json_object_get_string(jobj1), + json_object_get_string_len(jobj1), buf, &len)) + continue; + if (len > 0 && len != LUKS_SALTSIZE) + continue; + memcpy(hdr1->keyblock[i].passwordSalt, buf, LUKS_SALTSIZE); + } + + if (!jobj_keyslot) { + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr2, last_active); + if (!jobj_keyslot) + return -EINVAL; + } + + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return -EINVAL; + if (!json_object_object_get_ex(jobj_area, "encryption", &jobj1)) + return -EINVAL; + r = crypt_parse_name_and_mode(json_object_get_string(jobj1), cipher, NULL, cipher_mode); + if (r < 0) + return r; + + strncpy(hdr1->cipherName, cipher, LUKS_CIPHERNAME_L - 1); + hdr1->cipherName[LUKS_CIPHERNAME_L-1] = '\0'; + strncpy(hdr1->cipherMode, cipher_mode, LUKS_CIPHERMODE_L - 1); + hdr1->cipherMode[LUKS_CIPHERMODE_L-1] = '\0'; + + if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf)) + return -EINVAL; + if (!json_object_object_get_ex(jobj_kdf, "hash", &jobj1)) + return -EINVAL; + strncpy(hdr1->hashSpec, json_object_get_string(jobj1), sizeof(hdr1->hashSpec) - 1); + + hdr1->keyBytes = key_size; + + if (!json_object_object_get_ex(jobj_digest, "iterations", &jobj1)) + return -EINVAL; + hdr1->mkDigestIterations = crypt_jobj_get_uint32(jobj1); + + if (!json_object_object_get_ex(jobj_digest, "digest", &jobj1)) + return -EINVAL; + len = sizeof(digest); + if (!base64_decode(json_object_get_string(jobj1), + json_object_get_string_len(jobj1), digest, &len)) + return -EINVAL; + /* We can store full digest here, not only sha1 length */ + if (len < LUKS_DIGESTSIZE) + return -EINVAL; + memcpy(hdr1->mkDigest, digest, LUKS_DIGESTSIZE); + + if (!json_object_object_get_ex(jobj_digest, "salt", &jobj1)) + return -EINVAL; + len = sizeof(digest_salt); + if (!base64_decode(json_object_get_string(jobj1), + json_object_get_string_len(jobj1), digest_salt, &len)) + return -EINVAL; + if (len != LUKS_SALTSIZE) + return -EINVAL; + memcpy(hdr1->mkDigestSalt, digest_salt, LUKS_SALTSIZE); + + if (!json_object_object_get_ex(jobj_segment, "offset", &jobj1)) + return -EINVAL; + offset = crypt_jobj_get_uint64(jobj1) / SECTOR_SIZE; + if (offset > UINT32_MAX) + return -EINVAL; + /* FIXME: LUKS1 requires offset == 0 || offset >= luks1_hdr_size */ + hdr1->payloadOffset = offset; + + strncpy(hdr1->uuid, hdr2->uuid, UUID_STRING_L); /* max 36 chars */ + hdr1->uuid[UUID_STRING_L-1] = '\0'; + + memcpy(hdr1->magic, luksMagic, LUKS_MAGIC_L); + + hdr1->version = 1; + + r = luks_header_in_use(cd); + if (r) + return r > 0 ? -EBUSY : r; + + // move keyslots 32k -> 4k offset + buf_offset = 2 * LUKS2_HDR_16K_LEN; + buf_size = LUKS2_keyslots_size(hdr2); + r = move_keyslot_areas(cd, buf_offset, 8 * SECTOR_SIZE, buf_size); + if (r < 0) { + log_err(cd, _("Unable to move keyslot area.")); + return r; + } + + crypt_wipe_device(cd, crypt_metadata_device(cd), CRYPT_WIPE_ZERO, 0, + 8 * SECTOR_SIZE, 8 * SECTOR_SIZE, NULL, NULL); + + // Write LUKS1 hdr + return LUKS_write_phdr(hdr1, cd); +} diff --git a/lib/luks2/luks2_reencrypt.c b/lib/luks2/luks2_reencrypt.c new file mode 100644 index 0000000..f01ced0 --- /dev/null +++ b/lib/luks2/luks2_reencrypt.c @@ -0,0 +1,3703 @@ +/* + * LUKS - Linux Unified Key Setup v2, reencryption helpers + * + * Copyright (C) 2015-2021, Red Hat, Inc. All rights reserved. + * Copyright (C) 2015-2021, Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" +#include "utils_device_locking.h" + +struct reenc_protection { + enum { REENC_PROTECTION_NONE = 0, /* none should be 0 always */ + REENC_PROTECTION_CHECKSUM, + REENC_PROTECTION_JOURNAL, + REENC_PROTECTION_DATASHIFT } type; + + union { + struct { + } none; + struct { + char hash[LUKS2_CHECKSUM_ALG_L]; // or include luks.h + struct crypt_hash *ch; + size_t hash_size; + /* buffer for checksums */ + void *checksums; + size_t checksums_len; + } csum; + struct { + } ds; + } p; +}; + +struct luks2_reencrypt { + /* reencryption window attributes */ + uint64_t offset; + uint64_t progress; + uint64_t length; + uint64_t data_shift; + size_t alignment; + uint64_t device_size; + bool online; + bool fixed_length; + crypt_reencrypt_direction_info direction; + crypt_reencrypt_mode_info mode; + + char *device_name; + char *hotzone_name; + char *overlay_name; + uint32_t flags; + + /* reencryption window persistence attributes */ + struct reenc_protection rp; + + int reenc_keyslot; + + /* already running reencryption */ + json_object *jobj_segs_hot; + struct json_object *jobj_segs_post; + + /* backup segments */ + json_object *jobj_segment_new; + int digest_new; + json_object *jobj_segment_old; + int digest_old; + json_object *jobj_segment_moved; + + struct volume_key *vks; + + void *reenc_buffer; + ssize_t read; + + struct crypt_storage_wrapper *cw1; + struct crypt_storage_wrapper *cw2; + + uint32_t wflags1; + uint32_t wflags2; + + struct crypt_lock_handle *reenc_lock; +}; +#if USE_LUKS2_REENCRYPTION +static int reencrypt_keyslot_update(struct crypt_device *cd, + const struct luks2_reencrypt *rh) +{ + int r; + json_object *jobj_keyslot, *jobj_area, *jobj_area_type; + struct luks2_hdr *hdr; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, rh->reenc_keyslot); + if (!jobj_keyslot) + return -EINVAL; + + json_object_object_get_ex(jobj_keyslot, "area", &jobj_area); + json_object_object_get_ex(jobj_area, "type", &jobj_area_type); + + if (rh->rp.type == REENC_PROTECTION_CHECKSUM) { + log_dbg(cd, "Updating reencrypt keyslot for checksum protection."); + json_object_object_add(jobj_area, "type", json_object_new_string("checksum")); + json_object_object_add(jobj_area, "hash", json_object_new_string(rh->rp.p.csum.hash)); + json_object_object_add(jobj_area, "sector_size", json_object_new_int64(rh->alignment)); + } else if (rh->rp.type == REENC_PROTECTION_NONE) { + log_dbg(cd, "Updating reencrypt keyslot for none protection."); + json_object_object_add(jobj_area, "type", json_object_new_string("none")); + json_object_object_del(jobj_area, "hash"); + } else if (rh->rp.type == REENC_PROTECTION_JOURNAL) { + log_dbg(cd, "Updating reencrypt keyslot for journal protection."); + json_object_object_add(jobj_area, "type", json_object_new_string("journal")); + json_object_object_del(jobj_area, "hash"); + } else + log_dbg(cd, "No update of reencrypt keyslot needed."); + + r = LUKS2_keyslot_reencrypt_digest_create(cd, hdr, rh->vks); + if (r < 0) + log_err(cd, "Failed to refresh reencryption verification digest."); + + return r; +} + +static json_object *reencrypt_segment(struct luks2_hdr *hdr, unsigned new) +{ + return LUKS2_get_segment_by_flag(hdr, new ? "backup-final" : "backup-previous"); +} + +static json_object *reencrypt_segment_new(struct luks2_hdr *hdr) +{ + return reencrypt_segment(hdr, 1); +} + +static json_object *reencrypt_segment_old(struct luks2_hdr *hdr) +{ + return reencrypt_segment(hdr, 0); +} + +static const char *reencrypt_segment_cipher_new(struct luks2_hdr *hdr) +{ + return json_segment_get_cipher(reencrypt_segment(hdr, 1)); +} + +static const char *reencrypt_segment_cipher_old(struct luks2_hdr *hdr) +{ + return json_segment_get_cipher(reencrypt_segment(hdr, 0)); +} + +static int reencrypt_get_sector_size_new(struct luks2_hdr *hdr) +{ + return json_segment_get_sector_size(reencrypt_segment(hdr, 1)); +} + +static int reencrypt_get_sector_size_old(struct luks2_hdr *hdr) +{ + return json_segment_get_sector_size(reencrypt_segment(hdr, 0)); +} + +static uint64_t reencrypt_data_offset(struct luks2_hdr *hdr, unsigned new) +{ + json_object *jobj = reencrypt_segment(hdr, new); + if (jobj) + return json_segment_get_offset(jobj, 0); + + return LUKS2_get_data_offset(hdr) << SECTOR_SHIFT; +} + +static uint64_t LUKS2_reencrypt_get_data_offset_moved(struct luks2_hdr *hdr) +{ + json_object *jobj_segment = LUKS2_get_segment_by_flag(hdr, "backup-moved-segment"); + + if (!jobj_segment) + return 0; + + return json_segment_get_offset(jobj_segment, 0); +} + +static uint64_t reencrypt_get_data_offset_new(struct luks2_hdr *hdr) +{ + return reencrypt_data_offset(hdr, 1); +} + +static uint64_t reencrypt_get_data_offset_old(struct luks2_hdr *hdr) +{ + return reencrypt_data_offset(hdr, 0); +} +#endif +static int reencrypt_digest(struct luks2_hdr *hdr, unsigned new) +{ + int segment = LUKS2_get_segment_id_by_flag(hdr, new ? "backup-final" : "backup-previous"); + + if (segment < 0) + return segment; + + return LUKS2_digest_by_segment(hdr, segment); +} + +int LUKS2_reencrypt_digest_new(struct luks2_hdr *hdr) +{ + return reencrypt_digest(hdr, 1); +} + +int LUKS2_reencrypt_digest_old(struct luks2_hdr *hdr) +{ + return reencrypt_digest(hdr, 0); +} + +/* none, checksums, journal or shift */ +static const char *reencrypt_resilience_type(struct luks2_hdr *hdr) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_type; + int ks = LUKS2_find_keyslot(hdr, "reencrypt"); + + if (ks < 0) + return NULL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, ks); + + json_object_object_get_ex(jobj_keyslot, "area", &jobj_area); + if (!json_object_object_get_ex(jobj_area, "type", &jobj_type)) + return NULL; + + return json_object_get_string(jobj_type); +} + +static const char *reencrypt_resilience_hash(struct luks2_hdr *hdr) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_type, *jobj_hash; + int ks = LUKS2_find_keyslot(hdr, "reencrypt"); + + if (ks < 0) + return NULL; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, ks); + + json_object_object_get_ex(jobj_keyslot, "area", &jobj_area); + if (!json_object_object_get_ex(jobj_area, "type", &jobj_type)) + return NULL; + if (strcmp(json_object_get_string(jobj_type), "checksum")) + return NULL; + if (!json_object_object_get_ex(jobj_area, "hash", &jobj_hash)) + return NULL; + + return json_object_get_string(jobj_hash); +} +#if USE_LUKS2_REENCRYPTION +static uint32_t reencrypt_alignment(struct luks2_hdr *hdr) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_type, *jobj_hash, *jobj_sector_size; + int ks = LUKS2_find_keyslot(hdr, "reencrypt"); + + if (ks < 0) + return 0; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, ks); + + json_object_object_get_ex(jobj_keyslot, "area", &jobj_area); + if (!json_object_object_get_ex(jobj_area, "type", &jobj_type)) + return 0; + if (strcmp(json_object_get_string(jobj_type), "checksum")) + return 0; + if (!json_object_object_get_ex(jobj_area, "hash", &jobj_hash)) + return 0; + if (!json_object_object_get_ex(jobj_area, "sector_size", &jobj_sector_size)) + return 0; + + return crypt_jobj_get_uint32(jobj_sector_size); +} + +static json_object *_enc_create_segments_shift_after(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t data_offset) +{ + int reenc_seg, i = 0; + json_object *jobj_copy, *jobj_seg_new = NULL, *jobj_segs_post = json_object_new_object(); + uint64_t tmp; + + if (!rh->jobj_segs_hot || !jobj_segs_post) + goto err; + + if (json_segments_count(rh->jobj_segs_hot) == 0) + return jobj_segs_post; + + reenc_seg = json_segments_segment_in_reencrypt(rh->jobj_segs_hot); + if (reenc_seg < 0) + goto err; + + while (i < reenc_seg) { + jobj_copy = json_segments_get_segment(rh->jobj_segs_hot, i); + if (!jobj_copy) + goto err; + json_object_object_add_by_uint(jobj_segs_post, i++, json_object_get(jobj_copy)); + } + + if (json_object_copy(json_segments_get_segment(rh->jobj_segs_hot, reenc_seg + 1), &jobj_seg_new)) { + if (json_object_copy(json_segments_get_segment(rh->jobj_segs_hot, reenc_seg), &jobj_seg_new)) + goto err; + json_segment_remove_flag(jobj_seg_new, "in-reencryption"); + tmp = rh->length; + } else { + json_object_object_add(jobj_seg_new, "offset", crypt_jobj_new_uint64(rh->offset + data_offset)); + json_object_object_add(jobj_seg_new, "iv_tweak", crypt_jobj_new_uint64(rh->offset >> SECTOR_SHIFT)); + tmp = json_segment_get_size(jobj_seg_new, 0) + rh->length; + } + + /* alter size of new segment, reenc_seg == 0 we're finished */ + json_object_object_add(jobj_seg_new, "size", reenc_seg > 0 ? crypt_jobj_new_uint64(tmp) : json_object_new_string("dynamic")); + json_object_object_add_by_uint(jobj_segs_post, reenc_seg, jobj_seg_new); + + return jobj_segs_post; +err: + json_object_put(jobj_segs_post); + return NULL; +} + +static json_object *reencrypt_make_hot_segments_encrypt_shift(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t data_offset) +{ + int sg, crypt_seg, i = 0; + uint64_t segment_size; + json_object *jobj_seg_shrunk, *jobj_seg_new, *jobj_copy, *jobj_enc_seg = NULL, + *jobj_segs_hot = json_object_new_object(); + + if (!jobj_segs_hot) + return NULL; + + crypt_seg = LUKS2_segment_by_type(hdr, "crypt"); + + /* FIXME: This is hack. Find proper way to fix it. */ + sg = LUKS2_last_segment_by_type(hdr, "linear"); + if (rh->offset && sg < 0) + goto err; + if (sg < 0) + return jobj_segs_hot; + + jobj_enc_seg = json_segment_create_crypt(data_offset + rh->offset, + rh->offset >> SECTOR_SHIFT, + &rh->length, + reencrypt_segment_cipher_new(hdr), + reencrypt_get_sector_size_new(hdr), + 1); + + while (i < sg) { + jobj_copy = LUKS2_get_segment_jobj(hdr, i); + if (!jobj_copy) + goto err; + json_object_object_add_by_uint(jobj_segs_hot, i++, json_object_get(jobj_copy)); + } + + segment_size = LUKS2_segment_size(hdr, sg, 0); + if (segment_size > rh->length) { + jobj_seg_shrunk = NULL; + if (json_object_copy(LUKS2_get_segment_jobj(hdr, sg), &jobj_seg_shrunk)) + goto err; + json_object_object_add(jobj_seg_shrunk, "size", crypt_jobj_new_uint64(segment_size - rh->length)); + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_seg_shrunk); + } + + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_enc_seg); + jobj_enc_seg = NULL; /* see err: label */ + + /* first crypt segment after encryption ? */ + if (crypt_seg >= 0) { + jobj_seg_new = LUKS2_get_segment_jobj(hdr, crypt_seg); + if (!jobj_seg_new) + goto err; + json_object_object_add_by_uint(jobj_segs_hot, sg, json_object_get(jobj_seg_new)); + } + + return jobj_segs_hot; +err: + json_object_put(jobj_enc_seg); + json_object_put(jobj_segs_hot); + + return NULL; +} + +static json_object *reencrypt_make_segment_new(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct luks2_reencrypt *rh, + uint64_t data_offset, + uint64_t segment_offset, + uint64_t iv_offset, + const uint64_t *segment_length) +{ + switch (rh->mode) { + case CRYPT_REENCRYPT_REENCRYPT: + case CRYPT_REENCRYPT_ENCRYPT: + return json_segment_create_crypt(data_offset + segment_offset, + crypt_get_iv_offset(cd) + (iv_offset >> SECTOR_SHIFT), + segment_length, + reencrypt_segment_cipher_new(hdr), + reencrypt_get_sector_size_new(hdr), 0); + case CRYPT_REENCRYPT_DECRYPT: + return json_segment_create_linear(data_offset + segment_offset, segment_length, 0); + } + + return NULL; +} + +static json_object *reencrypt_make_post_segments_forward(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t data_offset) +{ + int reenc_seg; + json_object *jobj_new_seg_after, *jobj_old_seg, *jobj_old_seg_copy = NULL, + *jobj_segs_post = json_object_new_object(); + uint64_t fixed_length = rh->offset + rh->length; + + if (!rh->jobj_segs_hot || !jobj_segs_post) + goto err; + + reenc_seg = json_segments_segment_in_reencrypt(rh->jobj_segs_hot); + if (reenc_seg < 0) + return NULL; + + jobj_old_seg = json_segments_get_segment(rh->jobj_segs_hot, reenc_seg + 1); + + /* + * if there's no old segment after reencryption, we're done. + * Set size to 'dynamic' again. + */ + jobj_new_seg_after = reencrypt_make_segment_new(cd, hdr, rh, data_offset, 0, 0, jobj_old_seg ? &fixed_length : NULL); + if (!jobj_new_seg_after) + goto err; + json_object_object_add_by_uint(jobj_segs_post, 0, jobj_new_seg_after); + + if (jobj_old_seg) { + if (rh->fixed_length) { + if (json_object_copy(jobj_old_seg, &jobj_old_seg_copy)) + goto err; + jobj_old_seg = jobj_old_seg_copy; + fixed_length = rh->device_size - fixed_length; + json_object_object_add(jobj_old_seg, "size", crypt_jobj_new_uint64(fixed_length)); + } else + json_object_get(jobj_old_seg); + json_object_object_add_by_uint(jobj_segs_post, 1, jobj_old_seg); + } + + return jobj_segs_post; +err: + json_object_put(jobj_segs_post); + return NULL; +} + +static json_object *reencrypt_make_post_segments_backward(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t data_offset) +{ + int reenc_seg; + uint64_t fixed_length; + + json_object *jobj_new_seg_after, *jobj_old_seg, + *jobj_segs_post = json_object_new_object(); + + if (!rh->jobj_segs_hot || !jobj_segs_post) + goto err; + + reenc_seg = json_segments_segment_in_reencrypt(rh->jobj_segs_hot); + if (reenc_seg < 0) + return NULL; + + jobj_old_seg = json_segments_get_segment(rh->jobj_segs_hot, reenc_seg - 1); + if (jobj_old_seg) + json_object_object_add_by_uint(jobj_segs_post, reenc_seg - 1, json_object_get(jobj_old_seg)); + if (rh->fixed_length && rh->offset) { + fixed_length = rh->device_size - rh->offset; + jobj_new_seg_after = reencrypt_make_segment_new(cd, hdr, rh, data_offset, rh->offset, rh->offset, &fixed_length); + } else + jobj_new_seg_after = reencrypt_make_segment_new(cd, hdr, rh, data_offset, rh->offset, rh->offset, NULL); + if (!jobj_new_seg_after) + goto err; + json_object_object_add_by_uint(jobj_segs_post, reenc_seg, jobj_new_seg_after); + + return jobj_segs_post; +err: + json_object_put(jobj_segs_post); + return NULL; +} + +static json_object *reencrypt_make_segment_reencrypt(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct luks2_reencrypt *rh, + uint64_t data_offset, + uint64_t segment_offset, + uint64_t iv_offset, + const uint64_t *segment_length) +{ + switch (rh->mode) { + case CRYPT_REENCRYPT_REENCRYPT: + case CRYPT_REENCRYPT_ENCRYPT: + return json_segment_create_crypt(data_offset + segment_offset, + crypt_get_iv_offset(cd) + (iv_offset >> SECTOR_SHIFT), + segment_length, + reencrypt_segment_cipher_new(hdr), + reencrypt_get_sector_size_new(hdr), 1); + case CRYPT_REENCRYPT_DECRYPT: + return json_segment_create_linear(data_offset + segment_offset, segment_length, 1); + } + + return NULL; +} + +static json_object *reencrypt_make_segment_old(struct crypt_device *cd, + struct luks2_hdr *hdr, + const struct luks2_reencrypt *rh, + uint64_t data_offset, + uint64_t segment_offset, + const uint64_t *segment_length) +{ + json_object *jobj_old_seg = NULL; + + switch (rh->mode) { + case CRYPT_REENCRYPT_REENCRYPT: + case CRYPT_REENCRYPT_DECRYPT: + jobj_old_seg = json_segment_create_crypt(data_offset + segment_offset, + crypt_get_iv_offset(cd) + (segment_offset >> SECTOR_SHIFT), + segment_length, + reencrypt_segment_cipher_old(hdr), + reencrypt_get_sector_size_old(hdr), + 0); + break; + case CRYPT_REENCRYPT_ENCRYPT: + jobj_old_seg = json_segment_create_linear(data_offset + segment_offset, segment_length, 0); + } + + return jobj_old_seg; +} + +static json_object *reencrypt_make_hot_segments_forward(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t device_size, + uint64_t data_offset) +{ + json_object *jobj_segs_hot, *jobj_reenc_seg, *jobj_old_seg, *jobj_new_seg; + uint64_t fixed_length, tmp = rh->offset + rh->length; + unsigned int sg = 0; + + jobj_segs_hot = json_object_new_object(); + if (!jobj_segs_hot) + return NULL; + + if (rh->offset) { + jobj_new_seg = reencrypt_make_segment_new(cd, hdr, rh, data_offset, 0, 0, &rh->offset); + if (!jobj_new_seg) + goto err; + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_new_seg); + } + + jobj_reenc_seg = reencrypt_make_segment_reencrypt(cd, hdr, rh, data_offset, rh->offset, rh->offset, &rh->length); + if (!jobj_reenc_seg) + goto err; + + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_reenc_seg); + + if (tmp < device_size) { + fixed_length = device_size - tmp; + jobj_old_seg = reencrypt_make_segment_old(cd, hdr, rh, data_offset + rh->data_shift, rh->offset + rh->length, rh->fixed_length ? &fixed_length : NULL); + if (!jobj_old_seg) + goto err; + json_object_object_add_by_uint(jobj_segs_hot, sg, jobj_old_seg); + } + + return jobj_segs_hot; +err: + json_object_put(jobj_segs_hot); + return NULL; +} + +static json_object *reencrypt_make_hot_segments_backward(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t device_size, + uint64_t data_offset) +{ + json_object *jobj_reenc_seg, *jobj_new_seg, *jobj_old_seg = NULL, + *jobj_segs_hot = json_object_new_object(); + int sg = 0; + uint64_t fixed_length, tmp = rh->offset + rh->length; + + if (!jobj_segs_hot) + return NULL; + + if (rh->offset) { + if (json_object_copy(LUKS2_get_segment_jobj(hdr, 0), &jobj_old_seg)) + goto err; + json_object_object_add(jobj_old_seg, "size", crypt_jobj_new_uint64(rh->offset)); + + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_old_seg); + } + + jobj_reenc_seg = reencrypt_make_segment_reencrypt(cd, hdr, rh, data_offset, rh->offset, rh->offset, &rh->length); + if (!jobj_reenc_seg) + goto err; + + json_object_object_add_by_uint(jobj_segs_hot, sg++, jobj_reenc_seg); + + if (tmp < device_size) { + fixed_length = device_size - tmp; + jobj_new_seg = reencrypt_make_segment_new(cd, hdr, rh, data_offset, rh->offset + rh->length, rh->offset + rh->length, rh->fixed_length ? &fixed_length : NULL); + if (!jobj_new_seg) + goto err; + json_object_object_add_by_uint(jobj_segs_hot, sg, jobj_new_seg); + } + + return jobj_segs_hot; +err: + json_object_put(jobj_segs_hot); + return NULL; +} + +static int reencrypt_make_hot_segments(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t device_size, + uint64_t data_offset) +{ + rh->jobj_segs_hot = NULL; + + if (rh->mode == CRYPT_REENCRYPT_ENCRYPT && rh->direction == CRYPT_REENCRYPT_BACKWARD && + rh->data_shift && rh->jobj_segment_moved) { + log_dbg(cd, "Calculating hot segments for encryption with data move."); + rh->jobj_segs_hot = reencrypt_make_hot_segments_encrypt_shift(cd, hdr, rh, data_offset); + } else if (rh->direction == CRYPT_REENCRYPT_FORWARD) { + log_dbg(cd, "Calculating hot segments (forward direction)."); + rh->jobj_segs_hot = reencrypt_make_hot_segments_forward(cd, hdr, rh, device_size, data_offset); + } else if (rh->direction == CRYPT_REENCRYPT_BACKWARD) { + log_dbg(cd, "Calculating hot segments (backward direction)."); + rh->jobj_segs_hot = reencrypt_make_hot_segments_backward(cd, hdr, rh, device_size, data_offset); + } + + return rh->jobj_segs_hot ? 0 : -EINVAL; +} + +static int reencrypt_make_post_segments(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t data_offset) +{ + rh->jobj_segs_post = NULL; + + if (rh->mode == CRYPT_REENCRYPT_ENCRYPT && rh->direction == CRYPT_REENCRYPT_BACKWARD && + rh->data_shift && rh->jobj_segment_moved) { + log_dbg(cd, "Calculating post segments for encryption with data move."); + rh->jobj_segs_post = _enc_create_segments_shift_after(cd, hdr, rh, data_offset); + } else if (rh->direction == CRYPT_REENCRYPT_FORWARD) { + log_dbg(cd, "Calculating post segments (forward direction)."); + rh->jobj_segs_post = reencrypt_make_post_segments_forward(cd, hdr, rh, data_offset); + } else if (rh->direction == CRYPT_REENCRYPT_BACKWARD) { + log_dbg(cd, "Calculating segments (backward direction)."); + rh->jobj_segs_post = reencrypt_make_post_segments_backward(cd, hdr, rh, data_offset); + } + + return rh->jobj_segs_post ? 0 : -EINVAL; +} +#endif +static uint64_t reencrypt_data_shift(struct luks2_hdr *hdr) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_data_shift; + int ks = LUKS2_find_keyslot(hdr, "reencrypt"); + + if (ks < 0) + return 0; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, ks); + + json_object_object_get_ex(jobj_keyslot, "area", &jobj_area); + if (!json_object_object_get_ex(jobj_area, "shift_size", &jobj_data_shift)) + return 0; + + return crypt_jobj_get_uint64(jobj_data_shift); +} + +static crypt_reencrypt_mode_info reencrypt_mode(struct luks2_hdr *hdr) +{ + const char *mode; + crypt_reencrypt_mode_info mi = CRYPT_REENCRYPT_REENCRYPT; + json_object *jobj_keyslot, *jobj_mode; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, LUKS2_find_keyslot(hdr, "reencrypt")); + if (!jobj_keyslot) + return mi; + + json_object_object_get_ex(jobj_keyslot, "mode", &jobj_mode); + mode = json_object_get_string(jobj_mode); + + /* validation enforces allowed values */ + if (!strcmp(mode, "encrypt")) + mi = CRYPT_REENCRYPT_ENCRYPT; + else if (!strcmp(mode, "decrypt")) + mi = CRYPT_REENCRYPT_DECRYPT; + + return mi; +} + +static crypt_reencrypt_direction_info reencrypt_direction(struct luks2_hdr *hdr) +{ + const char *value; + json_object *jobj_keyslot, *jobj_mode; + crypt_reencrypt_direction_info di = CRYPT_REENCRYPT_FORWARD; + + jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, LUKS2_find_keyslot(hdr, "reencrypt")); + if (!jobj_keyslot) + return di; + + json_object_object_get_ex(jobj_keyslot, "direction", &jobj_mode); + value = json_object_get_string(jobj_mode); + + /* validation enforces allowed values */ + if (strcmp(value, "forward")) + di = CRYPT_REENCRYPT_BACKWARD; + + return di; +} + +typedef enum { REENC_OK = 0, REENC_ERR, REENC_ROLLBACK, REENC_FATAL } reenc_status_t; + +void LUKS2_reencrypt_free(struct crypt_device *cd, struct luks2_reencrypt *rh) +{ + if (!rh) + return; + + if (rh->rp.type == REENC_PROTECTION_CHECKSUM) { + if (rh->rp.p.csum.ch) { + crypt_hash_destroy(rh->rp.p.csum.ch); + rh->rp.p.csum.ch = NULL; + } + if (rh->rp.p.csum.checksums) { + memset(rh->rp.p.csum.checksums, 0, rh->rp.p.csum.checksums_len); + free(rh->rp.p.csum.checksums); + rh->rp.p.csum.checksums = NULL; + } + } + + json_object_put(rh->jobj_segs_hot); + rh->jobj_segs_hot = NULL; + json_object_put(rh->jobj_segs_post); + rh->jobj_segs_post = NULL; + json_object_put(rh->jobj_segment_old); + rh->jobj_segment_old = NULL; + json_object_put(rh->jobj_segment_new); + rh->jobj_segment_new = NULL; + json_object_put(rh->jobj_segment_moved); + rh->jobj_segment_moved = NULL; + + free(rh->reenc_buffer); + rh->reenc_buffer = NULL; + crypt_storage_wrapper_destroy(rh->cw1); + rh->cw1 = NULL; + crypt_storage_wrapper_destroy(rh->cw2); + rh->cw2 = NULL; + + free(rh->device_name); + free(rh->overlay_name); + free(rh->hotzone_name); + crypt_drop_keyring_key(cd, rh->vks); + crypt_free_volume_key(rh->vks); + device_release_excl(cd, crypt_data_device(cd)); + crypt_unlock_internal(cd, rh->reenc_lock); + free(rh); +} +#if USE_LUKS2_REENCRYPTION +static size_t reencrypt_get_alignment(struct crypt_device *cd, + struct luks2_hdr *hdr) +{ + int ss; + size_t alignment = device_block_size(cd, crypt_data_device(cd)); + + ss = reencrypt_get_sector_size_old(hdr); + if (ss > 0 && (size_t)ss > alignment) + alignment = ss; + ss = reencrypt_get_sector_size_new(hdr); + if (ss > 0 && (size_t)ss > alignment) + alignment = (size_t)ss; + + return alignment; +} + +/* returns void because it must not fail on valid LUKS2 header */ +static void _load_backup_segments(struct luks2_hdr *hdr, + struct luks2_reencrypt *rh) +{ + int segment = LUKS2_get_segment_id_by_flag(hdr, "backup-final"); + + if (segment >= 0) { + rh->jobj_segment_new = json_object_get(LUKS2_get_segment_jobj(hdr, segment)); + rh->digest_new = LUKS2_digest_by_segment(hdr, segment); + } else { + rh->jobj_segment_new = NULL; + rh->digest_new = -ENOENT; + } + + segment = LUKS2_get_segment_id_by_flag(hdr, "backup-previous"); + if (segment >= 0) { + rh->jobj_segment_old = json_object_get(LUKS2_get_segment_jobj(hdr, segment)); + rh->digest_old = LUKS2_digest_by_segment(hdr, segment); + } else { + rh->jobj_segment_old = NULL; + rh->digest_old = -ENOENT; + } + + segment = LUKS2_get_segment_id_by_flag(hdr, "backup-moved-segment"); + if (segment >= 0) + rh->jobj_segment_moved = json_object_get(LUKS2_get_segment_jobj(hdr, segment)); + else + rh->jobj_segment_moved = NULL; +} + +static int reencrypt_offset_backward_moved(struct luks2_hdr *hdr, json_object *jobj_segments, uint64_t *reencrypt_length, uint64_t data_shift, uint64_t *offset) +{ + uint64_t tmp, linear_length = 0; + int sg, segs = json_segments_count(jobj_segments); + + /* find reencrypt offset with data shift */ + for (sg = 0; sg < segs; sg++) + if (LUKS2_segment_is_type(hdr, sg, "linear")) + linear_length += LUKS2_segment_size(hdr, sg, 0); + + /* all active linear segments length */ + if (linear_length) { + if (linear_length < data_shift) + return -EINVAL; + tmp = linear_length - data_shift; + if (tmp && tmp < data_shift) { + *offset = data_shift; + *reencrypt_length = tmp; + } else + *offset = tmp; + return 0; + } + + if (segs == 1) { + *offset = 0; + return 0; + } + + /* should be unreachable */ + + return -EINVAL; +} + +static int _offset_forward(struct luks2_hdr *hdr, json_object *jobj_segments, uint64_t *offset) +{ + int segs = json_segments_count(jobj_segments); + + if (segs == 1) + *offset = 0; + else if (segs == 2) { + *offset = json_segment_get_size(json_segments_get_segment(jobj_segments, 0), 0); + if (!*offset) + return -EINVAL; + } else + return -EINVAL; + + return 0; +} + +static int _offset_backward(struct luks2_hdr *hdr, json_object *jobj_segments, uint64_t device_size, uint64_t *length, uint64_t *offset) +{ + int segs = json_segments_count(jobj_segments); + uint64_t tmp; + + if (segs == 1) { + if (device_size < *length) + *length = device_size; + *offset = device_size - *length; + } else if (segs == 2) { + tmp = json_segment_get_size(json_segments_get_segment(jobj_segments, 0), 0); + if (tmp < *length) + *length = tmp; + *offset = tmp - *length; + } else + return -EINVAL; + + return 0; +} + +/* must be always relative to data offset */ +/* the LUKS2 header MUST be valid */ +static int reencrypt_offset(struct luks2_hdr *hdr, + crypt_reencrypt_direction_info di, + uint64_t device_size, + uint64_t *reencrypt_length, + uint64_t *offset) +{ + int sg; + json_object *jobj_segments; + uint64_t data_shift = reencrypt_data_shift(hdr); + + if (!offset) + return -EINVAL; + + /* if there's segment in reencryption return directly offset of it */ + json_object_object_get_ex(hdr->jobj, "segments", &jobj_segments); + sg = json_segments_segment_in_reencrypt(jobj_segments); + if (sg >= 0) { + *offset = LUKS2_segment_offset(hdr, sg, 0) - (reencrypt_get_data_offset_new(hdr)); + return 0; + } + + if (di == CRYPT_REENCRYPT_FORWARD) + return _offset_forward(hdr, jobj_segments, offset); + else if (di == CRYPT_REENCRYPT_BACKWARD) { + if (reencrypt_mode(hdr) == CRYPT_REENCRYPT_ENCRYPT && + LUKS2_get_segment_id_by_flag(hdr, "backup-moved-segment") >= 0) + return reencrypt_offset_backward_moved(hdr, jobj_segments, reencrypt_length, data_shift, offset); + return _offset_backward(hdr, jobj_segments, device_size, reencrypt_length, offset); + } + + return -EINVAL; +} + +static uint64_t reencrypt_length(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t keyslot_area_length, + uint64_t length_max) +{ + unsigned long dummy, optimal_alignment; + uint64_t length, soft_mem_limit; + + if (rh->rp.type == REENC_PROTECTION_NONE) + length = length_max ?: LUKS2_DEFAULT_NONE_REENCRYPTION_LENGTH; + else if (rh->rp.type == REENC_PROTECTION_CHECKSUM) + length = (keyslot_area_length / rh->rp.p.csum.hash_size) * rh->alignment; + else if (rh->rp.type == REENC_PROTECTION_DATASHIFT) + return reencrypt_data_shift(hdr); + else + length = keyslot_area_length; + + /* hard limit */ + if (length > LUKS2_REENCRYPT_MAX_HOTZONE_LENGTH) + length = LUKS2_REENCRYPT_MAX_HOTZONE_LENGTH; + + /* soft limit is 1/4 of system memory */ + soft_mem_limit = crypt_getphysmemory_kb() << 8; /* multiply by (1024/4) */ + + if (soft_mem_limit && length > soft_mem_limit) + length = soft_mem_limit; + + if (length_max && length > length_max) + length = length_max; + + length -= (length % rh->alignment); + + /* Emits error later */ + if (!length) + return length; + + device_topology_alignment(cd, crypt_data_device(cd), &optimal_alignment, &dummy, length); + + /* we have to stick with encryption sector size alignment */ + if (optimal_alignment % rh->alignment) + return length; + + /* align to opt-io size only if remaining size allows it */ + if (length > optimal_alignment) + length -= (length % optimal_alignment); + + return length; +} + +static int reencrypt_context_init(struct crypt_device *cd, struct luks2_hdr *hdr, struct luks2_reencrypt *rh, uint64_t device_size, const struct crypt_params_reencrypt *params) +{ + int r; + uint64_t dummy, area_length; + + rh->reenc_keyslot = LUKS2_find_keyslot(hdr, "reencrypt"); + if (rh->reenc_keyslot < 0) + return -EINVAL; + if (LUKS2_keyslot_area(hdr, rh->reenc_keyslot, &dummy, &area_length) < 0) + return -EINVAL; + + rh->mode = reencrypt_mode(hdr); + + rh->alignment = reencrypt_get_alignment(cd, hdr); + if (!rh->alignment) + return -EINVAL; + + log_dbg(cd, "Hotzone size: %" PRIu64 ", device size: %" PRIu64 ", alignment: %zu.", + params->max_hotzone_size << SECTOR_SHIFT, + params->device_size << SECTOR_SHIFT, rh->alignment); + + if ((params->max_hotzone_size << SECTOR_SHIFT) % rh->alignment) { + log_err(cd, _("Hotzone size must be multiple of calculated zone alignment (%zu bytes)."), rh->alignment); + return -EINVAL; + } + + if ((params->device_size << SECTOR_SHIFT) % rh->alignment) { + log_err(cd, _("Device size must be multiple of calculated zone alignment (%zu bytes)."), rh->alignment); + return -EINVAL; + } + + rh->direction = reencrypt_direction(hdr); + + if (!strcmp(params->resilience, "datashift")) { + log_dbg(cd, "Initializing reencryption context with data_shift resilience."); + rh->rp.type = REENC_PROTECTION_DATASHIFT; + rh->data_shift = reencrypt_data_shift(hdr); + } else if (!strcmp(params->resilience, "journal")) { + log_dbg(cd, "Initializing reencryption context with journal resilience."); + rh->rp.type = REENC_PROTECTION_JOURNAL; + } else if (!strcmp(params->resilience, "checksum")) { + log_dbg(cd, "Initializing reencryption context with checksum resilience."); + rh->rp.type = REENC_PROTECTION_CHECKSUM; + + r = snprintf(rh->rp.p.csum.hash, + sizeof(rh->rp.p.csum.hash), "%s", params->hash); + if (r < 0 || (size_t)r >= sizeof(rh->rp.p.csum.hash)) { + log_dbg(cd, "Invalid hash parameter"); + return -EINVAL; + } + + if (crypt_hash_init(&rh->rp.p.csum.ch, params->hash)) { + log_dbg(cd, "Failed to initialize checksum resilience hash %s", params->hash); + return -EINVAL; + } + + r = crypt_hash_size(params->hash); + if (r < 1) { + log_dbg(cd, "Invalid hash size"); + return -EINVAL; + } + rh->rp.p.csum.hash_size = r; + + rh->rp.p.csum.checksums_len = area_length; + if (posix_memalign(&rh->rp.p.csum.checksums, device_alignment(crypt_metadata_device(cd)), + rh->rp.p.csum.checksums_len)) + return -ENOMEM; + } else if (!strcmp(params->resilience, "none")) { + log_dbg(cd, "Initializing reencryption context with none resilience."); + rh->rp.type = REENC_PROTECTION_NONE; + } else { + log_err(cd, _("Unsupported resilience mode %s"), params->resilience); + return -EINVAL; + } + + if (params->device_size) { + log_dbg(cd, "Switching reencryption to fixed size mode."); + device_size = params->device_size << SECTOR_SHIFT; + rh->fixed_length = true; + } else + rh->fixed_length = false; + + rh->length = reencrypt_length(cd, hdr, rh, area_length, params->max_hotzone_size << SECTOR_SHIFT); + if (!rh->length) { + log_dbg(cd, "Invalid reencryption length."); + return -EINVAL; + } + + if (reencrypt_offset(hdr, rh->direction, device_size, &rh->length, &rh->offset)) { + log_dbg(cd, "Failed to get reencryption offset."); + return -EINVAL; + } + + if (rh->offset > device_size) + return -EINVAL; + if (rh->length > device_size - rh->offset) + rh->length = device_size - rh->offset; + + log_dbg(cd, "reencrypt-direction: %s", rh->direction == CRYPT_REENCRYPT_FORWARD ? "forward" : "backward"); + + _load_backup_segments(hdr, rh); + + if (rh->direction == CRYPT_REENCRYPT_BACKWARD) + rh->progress = device_size - rh->offset - rh->length; + else + rh->progress = rh->offset; + + log_dbg(cd, "backup-previous digest id: %d", rh->digest_old); + log_dbg(cd, "backup-final digest id: %d", rh->digest_new); + log_dbg(cd, "reencrypt length: %" PRIu64, rh->length); + log_dbg(cd, "reencrypt offset: %" PRIu64, rh->offset); + log_dbg(cd, "reencrypt shift: %s%" PRIu64, (rh->data_shift && rh->direction == CRYPT_REENCRYPT_BACKWARD ? "-" : ""), rh->data_shift); + log_dbg(cd, "reencrypt alignment: %zu", rh->alignment); + log_dbg(cd, "reencrypt progress: %" PRIu64, rh->progress); + + rh->device_size = device_size; + + return rh->length < 512 ? -EINVAL : 0; +} + +static size_t reencrypt_buffer_length(struct luks2_reencrypt *rh) +{ + if (rh->data_shift) + return rh->data_shift; + return rh->length; +} + +static int reencrypt_load_clean(struct crypt_device *cd, + struct luks2_hdr *hdr, + uint64_t device_size, + struct luks2_reencrypt **rh, + const struct crypt_params_reencrypt *params) +{ + int r; + const struct crypt_params_reencrypt hdr_reenc_params = { + .resilience = reencrypt_resilience_type(hdr), + .hash = reencrypt_resilience_hash(hdr), + .device_size = params ? params->device_size : 0 + }; + struct luks2_reencrypt *tmp = crypt_zalloc(sizeof (*tmp)); + + if (!tmp) + return -ENOMEM; + + r = -EINVAL; + if (!hdr_reenc_params.resilience) + goto err; + + /* skip context update if data shift is detected in header */ + if (!strcmp(hdr_reenc_params.resilience, "datashift")) + params = NULL; + + log_dbg(cd, "Initializing reencryption context (%s).", params ? "update" : "load"); + + if (!params || !params->resilience) + params = &hdr_reenc_params; + + r = reencrypt_context_init(cd, hdr, tmp, device_size, params); + if (r) + goto err; + + if (posix_memalign(&tmp->reenc_buffer, device_alignment(crypt_data_device(cd)), + reencrypt_buffer_length(tmp))) { + r = -ENOMEM; + goto err; + } + + *rh = tmp; + + return 0; +err: + LUKS2_reencrypt_free(cd, tmp); + + return r; +} + +static int reencrypt_make_segments(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t device_size) +{ + int r; + uint64_t data_offset = reencrypt_get_data_offset_new(hdr); + + log_dbg(cd, "Calculating segments."); + + r = reencrypt_make_hot_segments(cd, hdr, rh, device_size, data_offset); + if (!r) { + r = reencrypt_make_post_segments(cd, hdr, rh, data_offset); + if (r) + json_object_put(rh->jobj_segs_hot); + } + + if (r) + log_dbg(cd, "Failed to make reencryption segments."); + + return r; +} + +static int reencrypt_make_segments_crashed(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh) +{ + int r; + uint64_t data_offset = crypt_get_data_offset(cd) << SECTOR_SHIFT; + + if (!rh) + return -EINVAL; + + rh->jobj_segs_hot = json_object_new_object(); + if (!rh->jobj_segs_hot) + return -ENOMEM; + + json_object_object_foreach(LUKS2_get_segments_jobj(hdr), key, val) { + if (json_segment_is_backup(val)) + continue; + json_object_object_add(rh->jobj_segs_hot, key, json_object_get(val)); + } + + r = reencrypt_make_post_segments(cd, hdr, rh, data_offset); + if (r) { + json_object_put(rh->jobj_segs_hot); + rh->jobj_segs_hot = NULL; + } + + return r; +} + +static int reencrypt_load_crashed(struct crypt_device *cd, + struct luks2_hdr *hdr, uint64_t device_size, struct luks2_reencrypt **rh) +{ + bool dynamic; + uint64_t minimal_size; + int r, reenc_seg; + struct crypt_params_reencrypt params = {}; + + if (LUKS2_get_data_size(hdr, &minimal_size, &dynamic)) + return -EINVAL; + + if (!dynamic) + params.device_size = minimal_size >> SECTOR_SHIFT; + + r = reencrypt_load_clean(cd, hdr, device_size, rh, ¶ms); + + if (!r) { + reenc_seg = json_segments_segment_in_reencrypt(LUKS2_get_segments_jobj(hdr)); + if (reenc_seg < 0) + r = -EINVAL; + else + (*rh)->length = LUKS2_segment_size(hdr, reenc_seg, 0); + } + + if (!r && ((*rh)->rp.type == REENC_PROTECTION_CHECKSUM)) { + /* we have to override calculated alignment with value stored in mda */ + (*rh)->alignment = reencrypt_alignment(hdr); + if (!(*rh)->alignment) { + log_dbg(cd, "Failed to get read resilience sector_size from metadata."); + r = -EINVAL; + } + } + + if (!r) + r = reencrypt_make_segments_crashed(cd, hdr, *rh); + + if (r) { + LUKS2_reencrypt_free(cd, *rh); + *rh = NULL; + } + return r; +} + +static int reencrypt_init_storage_wrappers(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + struct volume_key *vks) +{ + int r; + struct volume_key *vk; + uint32_t wrapper_flags = (getuid() || geteuid()) ? 0 : DISABLE_KCAPI; + + vk = crypt_volume_key_by_id(vks, rh->digest_old); + r = crypt_storage_wrapper_init(cd, &rh->cw1, crypt_data_device(cd), + reencrypt_get_data_offset_old(hdr), + crypt_get_iv_offset(cd), + reencrypt_get_sector_size_old(hdr), + reencrypt_segment_cipher_old(hdr), + vk, wrapper_flags | OPEN_READONLY); + if (r) { + log_err(cd, _("Failed to initialize old segment storage wrapper.")); + return r; + } + rh->wflags1 = wrapper_flags | OPEN_READONLY; + log_dbg(cd, "Old cipher storage wrapper type: %d.", crypt_storage_wrapper_get_type(rh->cw1)); + + vk = crypt_volume_key_by_id(vks, rh->digest_new); + r = crypt_storage_wrapper_init(cd, &rh->cw2, crypt_data_device(cd), + reencrypt_get_data_offset_new(hdr), + crypt_get_iv_offset(cd), + reencrypt_get_sector_size_new(hdr), + reencrypt_segment_cipher_new(hdr), + vk, wrapper_flags); + if (r) { + log_err(cd, _("Failed to initialize new segment storage wrapper.")); + return r; + } + rh->wflags2 = wrapper_flags; + log_dbg(cd, "New cipher storage wrapper type: %d", crypt_storage_wrapper_get_type(rh->cw2)); + + return 0; +} + +static int reencrypt_context_set_names(struct luks2_reencrypt *rh, const char *name) +{ + if (!rh | !name) + return -EINVAL; + + if (*name == '/') { + if (!(rh->device_name = dm_device_name(name))) + return -EINVAL; + } else if (!(rh->device_name = strdup(name))) + return -ENOMEM; + + if (asprintf(&rh->hotzone_name, "%s-hotzone-%s", rh->device_name, + rh->direction == CRYPT_REENCRYPT_FORWARD ? "forward" : "backward") < 0) { + rh->hotzone_name = NULL; + return -ENOMEM; + } + if (asprintf(&rh->overlay_name, "%s-overlay", rh->device_name) < 0) { + rh->overlay_name = NULL; + return -ENOMEM; + } + + rh->online = true; + return 0; +} + +static int modify_offset(uint64_t *offset, uint64_t data_shift, crypt_reencrypt_direction_info di) +{ + int r = -EINVAL; + + if (!offset) + return r; + + if (di == CRYPT_REENCRYPT_FORWARD) { + if (*offset >= data_shift) { + *offset -= data_shift; + r = 0; + } + } else if (di == CRYPT_REENCRYPT_BACKWARD) { + *offset += data_shift; + r = 0; + } + + return r; +} + +static int reencrypt_update_flag(struct crypt_device *cd, int enable, bool commit) +{ + uint32_t reqs; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + if (LUKS2_config_get_requirements(cd, hdr, &reqs)) + return -EINVAL; + + /* nothing to do */ + if (enable && (reqs & CRYPT_REQUIREMENT_ONLINE_REENCRYPT)) + return -EINVAL; + + /* nothing to do */ + if (!enable && !(reqs & CRYPT_REQUIREMENT_ONLINE_REENCRYPT)) + return -EINVAL; + + if (enable) + reqs |= CRYPT_REQUIREMENT_ONLINE_REENCRYPT; + else + reqs &= ~CRYPT_REQUIREMENT_ONLINE_REENCRYPT; + + log_dbg(cd, "Going to %s reencryption requirement flag.", enable ? "store" : "wipe"); + + return LUKS2_config_set_requirements(cd, hdr, reqs, commit); +} + +static int reencrypt_recover_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + struct volume_key *vks) +{ + struct volume_key *vk_old, *vk_new; + size_t count, s; + ssize_t read, w; + unsigned resilience; + uint64_t area_offset, area_length, area_length_read, crash_iv_offset, + data_offset = crypt_get_data_offset(cd) << SECTOR_SHIFT; + int devfd, r, new_sector_size, old_sector_size, rseg = json_segments_segment_in_reencrypt(rh->jobj_segs_hot); + char *checksum_tmp = NULL, *data_buffer = NULL; + struct crypt_storage_wrapper *cw1 = NULL, *cw2 = NULL; + + resilience = rh->rp.type; + + if (rseg < 0 || rh->length < 512) + return -EINVAL; + + vk_new = crypt_volume_key_by_id(vks, rh->digest_new); + if (!vk_new && rh->mode != CRYPT_REENCRYPT_DECRYPT) + return -EINVAL; + vk_old = crypt_volume_key_by_id(vks, rh->digest_old); + if (!vk_old && rh->mode != CRYPT_REENCRYPT_ENCRYPT) + return -EINVAL; + old_sector_size = json_segment_get_sector_size(reencrypt_segment_old(hdr)); + new_sector_size = json_segment_get_sector_size(reencrypt_segment_new(hdr)); + if (rh->mode == CRYPT_REENCRYPT_DECRYPT) + crash_iv_offset = rh->offset >> SECTOR_SHIFT; /* TODO: + old iv_tweak */ + else + crash_iv_offset = json_segment_get_iv_offset(json_segments_get_segment(rh->jobj_segs_hot, rseg)); + + log_dbg(cd, "crash_offset: %" PRIu64 ", crash_length: %" PRIu64 ", crash_iv_offset: %" PRIu64, data_offset + rh->offset, rh->length, crash_iv_offset); + + r = crypt_storage_wrapper_init(cd, &cw2, crypt_data_device(cd), + data_offset + rh->offset, crash_iv_offset, new_sector_size, + reencrypt_segment_cipher_new(hdr), vk_new, 0); + if (r) { + log_err(cd, _("Failed to initialize new segment storage wrapper.")); + return r; + } + + if (LUKS2_keyslot_area(hdr, rh->reenc_keyslot, &area_offset, &area_length)) { + r = -EINVAL; + goto out; + } + + if (posix_memalign((void**)&data_buffer, device_alignment(crypt_data_device(cd)), rh->length)) { + r = -ENOMEM; + goto out; + } + + switch (resilience) { + case REENC_PROTECTION_CHECKSUM: + log_dbg(cd, "Checksums based recovery."); + + r = crypt_storage_wrapper_init(cd, &cw1, crypt_data_device(cd), + data_offset + rh->offset, crash_iv_offset, old_sector_size, + reencrypt_segment_cipher_old(hdr), vk_old, 0); + if (r) { + log_err(cd, _("Failed to initialize old segment storage wrapper.")); + goto out; + } + + count = rh->length / rh->alignment; + area_length_read = count * rh->rp.p.csum.hash_size; + if (area_length_read > area_length) { + log_dbg(cd, "Internal error in calculated area_length."); + r = -EINVAL; + goto out; + } + + checksum_tmp = malloc(rh->rp.p.csum.hash_size); + if (!checksum_tmp) { + r = -ENOMEM; + goto out; + } + + /* TODO: lock for read */ + devfd = device_open(cd, crypt_metadata_device(cd), O_RDONLY); + if (devfd < 0) + goto out; + + /* read old data checksums */ + read = read_lseek_blockwise(devfd, device_block_size(cd, crypt_metadata_device(cd)), + device_alignment(crypt_metadata_device(cd)), rh->rp.p.csum.checksums, area_length_read, area_offset); + if (read < 0 || (size_t)read != area_length_read) { + log_err(cd, _("Failed to read checksums for current hotzone.")); + r = -EINVAL; + goto out; + } + + read = crypt_storage_wrapper_read(cw2, 0, data_buffer, rh->length); + if (read < 0 || (size_t)read != rh->length) { + log_err(cd, _("Failed to read hotzone area starting at %" PRIu64 "."), rh->offset + data_offset); + r = -EINVAL; + goto out; + } + + for (s = 0; s < count; s++) { + if (crypt_hash_write(rh->rp.p.csum.ch, data_buffer + (s * rh->alignment), rh->alignment)) { + log_dbg(cd, "Failed to write hash."); + r = EINVAL; + goto out; + } + if (crypt_hash_final(rh->rp.p.csum.ch, checksum_tmp, rh->rp.p.csum.hash_size)) { + log_dbg(cd, "Failed to finalize hash."); + r = EINVAL; + goto out; + } + if (!memcmp(checksum_tmp, (char *)rh->rp.p.csum.checksums + (s * rh->rp.p.csum.hash_size), rh->rp.p.csum.hash_size)) { + log_dbg(cd, "Sector %zu (size %zu, offset %zu) needs recovery", s, rh->alignment, s * rh->alignment); + if (crypt_storage_wrapper_decrypt(cw1, s * rh->alignment, data_buffer + (s * rh->alignment), rh->alignment)) { + log_err(cd, _("Failed to decrypt sector %zu."), s); + r = -EINVAL; + goto out; + } + w = crypt_storage_wrapper_encrypt_write(cw2, s * rh->alignment, data_buffer + (s * rh->alignment), rh->alignment); + if (w < 0 || (size_t)w != rh->alignment) { + log_err(cd, _("Failed to recover sector %zu."), s); + r = -EINVAL; + goto out; + } + } + } + + r = 0; + break; + case REENC_PROTECTION_JOURNAL: + log_dbg(cd, "Journal based recovery."); + + /* FIXME: validation candidate */ + if (rh->length > area_length) { + r = -EINVAL; + log_dbg(cd, "Invalid journal size."); + goto out; + } + + /* TODO locking */ + r = crypt_storage_wrapper_init(cd, &cw1, crypt_metadata_device(cd), + area_offset, crash_iv_offset, old_sector_size, + reencrypt_segment_cipher_old(hdr), vk_old, 0); + if (r) { + log_err(cd, _("Failed to initialize old segment storage wrapper.")); + goto out; + } + read = crypt_storage_wrapper_read_decrypt(cw1, 0, data_buffer, rh->length); + if (read < 0 || (size_t)read != rh->length) { + log_dbg(cd, "Failed to read journaled data."); + r = -EIO; + /* may content plaintext */ + crypt_safe_memzero(data_buffer, rh->length); + goto out; + } + read = crypt_storage_wrapper_encrypt_write(cw2, 0, data_buffer, rh->length); + /* may content plaintext */ + crypt_safe_memzero(data_buffer, rh->length); + if (read < 0 || (size_t)read != rh->length) { + log_dbg(cd, "recovery write failed."); + r = -EINVAL; + goto out; + } + + r = 0; + break; + case REENC_PROTECTION_DATASHIFT: + log_dbg(cd, "Data shift based recovery."); + + if (rseg == 0) { + r = crypt_storage_wrapper_init(cd, &cw1, crypt_data_device(cd), + json_segment_get_offset(rh->jobj_segment_moved, 0), 0, 0, + reencrypt_segment_cipher_old(hdr), NULL, 0); + } else + r = crypt_storage_wrapper_init(cd, &cw1, crypt_data_device(cd), + data_offset + rh->offset - rh->data_shift, 0, 0, + reencrypt_segment_cipher_old(hdr), NULL, 0); + if (r) { + log_err(cd, _("Failed to initialize old segment storage wrapper.")); + goto out; + } + + read = crypt_storage_wrapper_read_decrypt(cw1, 0, data_buffer, rh->length); + if (read < 0 || (size_t)read != rh->length) { + log_dbg(cd, "Failed to read data."); + r = -EIO; + /* may content plaintext */ + crypt_safe_memzero(data_buffer, rh->length); + goto out; + } + + read = crypt_storage_wrapper_encrypt_write(cw2, 0, data_buffer, rh->length); + /* may content plaintext */ + crypt_safe_memzero(data_buffer, rh->length); + if (read < 0 || (size_t)read != rh->length) { + log_dbg(cd, "recovery write failed."); + r = -EINVAL; + goto out; + } + r = 0; + break; + default: + r = -EINVAL; + } + + if (!r) + rh->read = rh->length; +out: + free(data_buffer); + free(checksum_tmp); + crypt_storage_wrapper_destroy(cw1); + crypt_storage_wrapper_destroy(cw2); + + return r; +} + +static int reencrypt_add_moved_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh) +{ + int s = LUKS2_segment_first_unused_id(hdr); + + if (!rh->jobj_segment_moved) + return 0; + + if (s < 0) + return s; + + if (json_object_object_add_by_uint(LUKS2_get_segments_jobj(hdr), s, json_object_get(rh->jobj_segment_moved))) { + json_object_put(rh->jobj_segment_moved); + return -EINVAL; + } + + return 0; +} + +static int reencrypt_add_backup_segment(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + unsigned final) +{ + int digest, s = LUKS2_segment_first_unused_id(hdr); + json_object *jobj; + + if (s < 0) + return s; + + digest = final ? rh->digest_new : rh->digest_old; + jobj = final ? rh->jobj_segment_new : rh->jobj_segment_old; + + if (json_object_object_add_by_uint(LUKS2_get_segments_jobj(hdr), s, json_object_get(jobj))) { + json_object_put(jobj); + return -EINVAL; + } + + if (strcmp(json_segment_type(jobj), "crypt")) + return 0; + + return LUKS2_digest_segment_assign(cd, hdr, s, digest, 1, 0); +} + +static int reencrypt_assign_segments_simple(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + unsigned hot, + unsigned commit) +{ + int r, sg; + + if (hot && json_segments_count(rh->jobj_segs_hot) > 0) { + log_dbg(cd, "Setting 'hot' segments."); + + r = LUKS2_segments_set(cd, hdr, rh->jobj_segs_hot, 0); + if (!r) + rh->jobj_segs_hot = NULL; + } else if (!hot && json_segments_count(rh->jobj_segs_post) > 0) { + log_dbg(cd, "Setting 'post' segments."); + r = LUKS2_segments_set(cd, hdr, rh->jobj_segs_post, 0); + if (!r) + rh->jobj_segs_post = NULL; + } else { + log_dbg(cd, "No segments to set."); + return -EINVAL; + } + + if (r) { + log_dbg(cd, "Failed to assign new enc segments."); + return r; + } + + r = reencrypt_add_backup_segment(cd, hdr, rh, 0); + if (r) { + log_dbg(cd, "Failed to assign reencryption previous backup segment."); + return r; + } + + r = reencrypt_add_backup_segment(cd, hdr, rh, 1); + if (r) { + log_dbg(cd, "Failed to assign reencryption final backup segment."); + return r; + } + + r = reencrypt_add_moved_segment(cd, hdr, rh); + if (r) { + log_dbg(cd, "Failed to assign reencryption moved backup segment."); + return r; + } + + for (sg = 0; sg < LUKS2_segments_count(hdr); sg++) { + if (LUKS2_segment_is_type(hdr, sg, "crypt") && + LUKS2_digest_segment_assign(cd, hdr, sg, rh->mode == CRYPT_REENCRYPT_ENCRYPT ? rh->digest_new : rh->digest_old, 1, 0)) { + log_dbg(cd, "Failed to assign digest %u to segment %u.", rh->digest_new, sg); + return -EINVAL; + } + } + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +static int reencrypt_assign_segments(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + unsigned hot, + unsigned commit) +{ + bool forward; + int rseg, scount, r = -EINVAL; + + /* FIXME: validate in reencrypt context load */ + if (rh->digest_new < 0 && rh->mode != CRYPT_REENCRYPT_DECRYPT) + return -EINVAL; + + if (LUKS2_digest_segment_assign(cd, hdr, CRYPT_ANY_SEGMENT, CRYPT_ANY_DIGEST, 0, 0)) + return -EINVAL; + + if (rh->mode == CRYPT_REENCRYPT_ENCRYPT || rh->mode == CRYPT_REENCRYPT_DECRYPT) + return reencrypt_assign_segments_simple(cd, hdr, rh, hot, commit); + + if (hot && rh->jobj_segs_hot) { + log_dbg(cd, "Setting 'hot' segments."); + + r = LUKS2_segments_set(cd, hdr, rh->jobj_segs_hot, 0); + if (!r) + rh->jobj_segs_hot = NULL; + } else if (!hot && rh->jobj_segs_post) { + log_dbg(cd, "Setting 'post' segments."); + r = LUKS2_segments_set(cd, hdr, rh->jobj_segs_post, 0); + if (!r) + rh->jobj_segs_post = NULL; + } + + if (r) + return r; + + scount = LUKS2_segments_count(hdr); + + /* segment in reencryption has to hold reference on both digests */ + rseg = json_segments_segment_in_reencrypt(LUKS2_get_segments_jobj(hdr)); + if (rseg < 0 && hot) + return -EINVAL; + + if (rseg >= 0) { + LUKS2_digest_segment_assign(cd, hdr, rseg, rh->digest_new, 1, 0); + LUKS2_digest_segment_assign(cd, hdr, rseg, rh->digest_old, 1, 0); + } + + forward = (rh->direction == CRYPT_REENCRYPT_FORWARD); + if (hot) { + if (rseg > 0) + LUKS2_digest_segment_assign(cd, hdr, 0, forward ? rh->digest_new : rh->digest_old, 1, 0); + if (scount > rseg + 1) + LUKS2_digest_segment_assign(cd, hdr, rseg + 1, forward ? rh->digest_old : rh->digest_new, 1, 0); + } else { + LUKS2_digest_segment_assign(cd, hdr, 0, forward || scount == 1 ? rh->digest_new : rh->digest_old, 1, 0); + if (scount > 1) + LUKS2_digest_segment_assign(cd, hdr, 1, forward ? rh->digest_old : rh->digest_new, 1, 0); + } + + r = reencrypt_add_backup_segment(cd, hdr, rh, 0); + if (r) { + log_dbg(cd, "Failed to assign hot reencryption backup segment."); + return r; + } + r = reencrypt_add_backup_segment(cd, hdr, rh, 1); + if (r) { + log_dbg(cd, "Failed to assign post reencryption backup segment."); + return r; + } + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +static int reencrypt_set_encrypt_segments(struct crypt_device *cd, struct luks2_hdr *hdr, uint64_t dev_size, uint64_t data_shift, bool move_first_segment, crypt_reencrypt_direction_info di) +{ + int r; + uint64_t first_segment_offset, first_segment_length, + second_segment_offset, second_segment_length, + data_offset = LUKS2_get_data_offset(hdr) << SECTOR_SHIFT; + json_object *jobj_segment_first = NULL, *jobj_segment_second = NULL, *jobj_segments; + + if (dev_size < data_shift) + return -EINVAL; + + if (data_shift && (di == CRYPT_REENCRYPT_FORWARD)) + return -ENOTSUP; + + if (move_first_segment) { + /* + * future data_device layout: + * [future LUKS2 header (data shift size)][second data segment][gap (data shift size)][first data segment (data shift size)] + */ + first_segment_offset = dev_size; + first_segment_length = data_shift; + second_segment_offset = data_shift; + second_segment_length = dev_size - 2 * data_shift; + } else if (data_shift) { + first_segment_offset = data_offset; + first_segment_length = dev_size; + } else { + /* future data_device layout with detached header: [first data segment] */ + first_segment_offset = data_offset; + first_segment_length = 0; /* dynamic */ + } + + jobj_segments = json_object_new_object(); + if (!jobj_segments) + return -ENOMEM; + + r = -EINVAL; + if (move_first_segment) { + jobj_segment_first = json_segment_create_linear(first_segment_offset, &first_segment_length, 0); + if (second_segment_length && + !(jobj_segment_second = json_segment_create_linear(second_segment_offset, &second_segment_length, 0))) { + log_dbg(cd, "Failed generate 2nd segment."); + goto err; + } + } else + jobj_segment_first = json_segment_create_linear(first_segment_offset, first_segment_length ? &first_segment_length : NULL, 0); + + if (!jobj_segment_first) { + log_dbg(cd, "Failed generate 1st segment."); + goto err; + } + + json_object_object_add(jobj_segments, "0", jobj_segment_first); + if (jobj_segment_second) + json_object_object_add(jobj_segments, "1", jobj_segment_second); + + r = LUKS2_digest_segment_assign(cd, hdr, CRYPT_ANY_SEGMENT, CRYPT_ANY_DIGEST, 0, 0); + + if (!r) + r = LUKS2_segments_set(cd, hdr, jobj_segments, 0); +err: + return r; +} + +static int reencrypt_make_targets(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct device *hz_device, + struct volume_key *vks, + struct dm_target *result, + uint64_t size) +{ + bool reenc_seg; + struct volume_key *vk; + uint64_t segment_size, segment_offset, segment_start = 0; + int r; + int s = 0; + json_object *jobj, *jobj_segments = LUKS2_get_segments_jobj(hdr); + + while (result) { + jobj = json_segments_get_segment(jobj_segments, s); + if (!jobj) { + log_dbg(cd, "Internal error. Segment %u is null.", s); + r = -EINVAL; + goto out; + } + + reenc_seg = (s == json_segments_segment_in_reencrypt(jobj_segments)); + + segment_offset = json_segment_get_offset(jobj, 1); + segment_size = json_segment_get_size(jobj, 1); + /* 'dynamic' length allowed in last segment only */ + if (!segment_size && !result->next) + segment_size = (size >> SECTOR_SHIFT) - segment_start; + if (!segment_size) { + log_dbg(cd, "Internal error. Wrong segment size %u", s); + r = -EINVAL; + goto out; + } + + if (!strcmp(json_segment_type(jobj), "crypt")) { + vk = crypt_volume_key_by_id(vks, reenc_seg ? LUKS2_reencrypt_digest_new(hdr) : LUKS2_digest_by_segment(hdr, s)); + if (!vk) { + log_err(cd, _("Missing key for dm-crypt segment %u"), s); + r = -EINVAL; + goto out; + } + + if (reenc_seg) + segment_offset -= crypt_get_data_offset(cd); + + r = dm_crypt_target_set(result, segment_start, segment_size, + reenc_seg ? hz_device : crypt_data_device(cd), + vk, + json_segment_get_cipher(jobj), + json_segment_get_iv_offset(jobj), + segment_offset, + "none", + 0, + json_segment_get_sector_size(jobj)); + if (r) { + log_err(cd, _("Failed to set dm-crypt segment.")); + goto out; + } + } else if (!strcmp(json_segment_type(jobj), "linear")) { + r = dm_linear_target_set(result, segment_start, segment_size, reenc_seg ? hz_device : crypt_data_device(cd), segment_offset); + if (r) { + log_err(cd, _("Failed to set dm-linear segment.")); + goto out; + } + } else { + r = -EINVAL; + goto out; + } + + segment_start += segment_size; + s++; + result = result->next; + } + + return s; +out: + return r; +} + +/* GLOBAL FIXME: audit function names and parameters names */ + +/* FIXME: + * 1) audit log routines + * 2) can't we derive hotzone device name from crypt context? (unlocked name, device uuid, etc?) + */ +static int reencrypt_load_overlay_device(struct crypt_device *cd, struct luks2_hdr *hdr, + const char *overlay, const char *hotzone, struct volume_key *vks, uint64_t size, + uint32_t flags) +{ + char hz_path[PATH_MAX]; + int r; + + struct device *hz_dev = NULL; + struct crypt_dm_active_device dmd = { + .flags = flags, + }; + + log_dbg(cd, "Loading new table for overlay device %s.", overlay); + + r = snprintf(hz_path, PATH_MAX, "%s/%s", dm_get_dir(), hotzone); + if (r < 0 || r >= PATH_MAX) { + r = -EINVAL; + goto out; + } + + r = device_alloc(cd, &hz_dev, hz_path); + if (r) + goto out; + + r = dm_targets_allocate(&dmd.segment, LUKS2_segments_count(hdr)); + if (r) + goto out; + + r = reencrypt_make_targets(cd, hdr, hz_dev, vks, &dmd.segment, size); + if (r < 0) + goto out; + + r = dm_reload_device(cd, overlay, &dmd, 0, 0); + + /* what else on error here ? */ +out: + dm_targets_free(cd, &dmd); + device_free(cd, hz_dev); + + return r; +} + +static int reencrypt_replace_device(struct crypt_device *cd, const char *target, const char *source, uint32_t flags) +{ + int r, exists = 1; + struct crypt_dm_active_device dmd_source, dmd_target = {}; + uint32_t dmflags = DM_SUSPEND_SKIP_LOCKFS | DM_SUSPEND_NOFLUSH; + + log_dbg(cd, "Replacing table in device %s with table from device %s.", target, source); + + /* check only whether target device exists */ + r = dm_status_device(cd, target); + if (r < 0) { + if (r == -ENODEV) + exists = 0; + else + return r; + } + + r = dm_query_device(cd, source, DM_ACTIVE_DEVICE | DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_CRYPT_KEYSIZE | DM_ACTIVE_CRYPT_KEY, &dmd_source); + + if (r < 0) + return r; + + if (exists && ((r = dm_query_device(cd, target, 0, &dmd_target)) < 0)) + goto err; + + dmd_source.flags |= flags; + dmd_source.uuid = crypt_get_uuid(cd); + + if (exists) { + if (dmd_target.size != dmd_source.size) { + log_err(cd, _("Source and target device sizes don't match. Source %" PRIu64 ", target: %" PRIu64 "."), + dmd_source.size, dmd_target.size); + r = -EINVAL; + goto err; + } + r = dm_reload_device(cd, target, &dmd_source, 0, 0); + if (!r) { + log_dbg(cd, "Resuming device %s", target); + r = dm_resume_device(cd, target, dmflags | act2dmflags(dmd_source.flags)); + } + } else + r = dm_create_device(cd, target, CRYPT_SUBDEV, &dmd_source); +err: + dm_targets_free(cd, &dmd_source); + dm_targets_free(cd, &dmd_target); + + return r; +} + +static int reencrypt_swap_backing_device(struct crypt_device *cd, const char *name, + const char *new_backend_name) +{ + int r; + struct device *overlay_dev = NULL; + char overlay_path[PATH_MAX] = { 0 }; + struct crypt_dm_active_device dmd = {}; + + log_dbg(cd, "Redirecting %s mapping to new backing device: %s.", name, new_backend_name); + + r = snprintf(overlay_path, PATH_MAX, "%s/%s", dm_get_dir(), new_backend_name); + if (r < 0 || r >= PATH_MAX) { + r = -EINVAL; + goto out; + } + + r = device_alloc(cd, &overlay_dev, overlay_path); + if (r) + goto out; + + r = device_block_adjust(cd, overlay_dev, DEV_OK, + 0, &dmd.size, &dmd.flags); + if (r) + goto out; + + r = dm_linear_target_set(&dmd.segment, 0, dmd.size, overlay_dev, 0); + if (r) + goto out; + + r = dm_reload_device(cd, name, &dmd, 0, 0); + if (!r) { + log_dbg(cd, "Resuming device %s", name); + r = dm_resume_device(cd, name, DM_SUSPEND_SKIP_LOCKFS | DM_SUSPEND_NOFLUSH); + } + +out: + dm_targets_free(cd, &dmd); + device_free(cd, overlay_dev); + + return r; +} + +static int reencrypt_activate_hotzone_device(struct crypt_device *cd, const char *name, uint64_t device_size, uint32_t flags) +{ + int r; + uint64_t new_offset = reencrypt_get_data_offset_new(crypt_get_hdr(cd, CRYPT_LUKS2)) >> SECTOR_SHIFT; + + struct crypt_dm_active_device dmd = { + .flags = flags, + .uuid = crypt_get_uuid(cd), + .size = device_size >> SECTOR_SHIFT + }; + + log_dbg(cd, "Activating hotzone device %s.", name); + + r = device_block_adjust(cd, crypt_data_device(cd), DEV_OK, + new_offset, &dmd.size, &dmd.flags); + if (r) + goto err; + + r = dm_linear_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), new_offset); + if (r) + goto err; + + r = dm_create_device(cd, name, CRYPT_SUBDEV, &dmd); +err: + dm_targets_free(cd, &dmd); + + return r; +} + +static int reencrypt_init_device_stack(struct crypt_device *cd, + const struct luks2_reencrypt *rh) +{ + int r; + + /* Activate hotzone device 1:1 linear mapping to data_device */ + r = reencrypt_activate_hotzone_device(cd, rh->hotzone_name, rh->device_size, CRYPT_ACTIVATE_PRIVATE); + if (r) { + log_err(cd, _("Failed to activate hotzone device %s."), rh->hotzone_name); + return r; + } + + /* + * Activate overlay device with exactly same table as original 'name' mapping. + * Note that within this step the 'name' device may already include a table + * constructed from more than single dm-crypt segment. Therefore transfer + * mapping as is. + * + * If we're about to resume reencryption orig mapping has to be already validated for + * abrupt shutdown and rchunk_offset has to point on next chunk to reencrypt! + * + * TODO: in crypt_activate_by* + */ + r = reencrypt_replace_device(cd, rh->overlay_name, rh->device_name, CRYPT_ACTIVATE_PRIVATE); + if (r) { + log_err(cd, _("Failed to activate overlay device %s with actual origin table."), rh->overlay_name); + goto err; + } + + /* swap origin mapping to overlay device */ + r = reencrypt_swap_backing_device(cd, rh->device_name, rh->overlay_name); + if (r) { + log_err(cd, _("Failed to load new mapping for device %s."), rh->device_name); + goto err; + } + + /* + * Now the 'name' (unlocked luks) device is mapped via dm-linear to an overlay dev. + * The overlay device has a original live table of 'name' device in-before the swap. + */ + + return 0; +err: + /* TODO: force error helper devices on error path */ + dm_remove_device(cd, rh->overlay_name, 0); + dm_remove_device(cd, rh->hotzone_name, 0); + + return r; +} + +/* TODO: + * 1) audit error path. any error in this routine is fatal and should be unlikely. + * usually it would hint some collision with another userspace process touching + * dm devices directly. + */ +static int reenc_refresh_helper_devices(struct crypt_device *cd, const char *overlay, const char *hotzone) +{ + int r; + + /* + * we have to explicitly suspend the overlay device before suspending + * the hotzone one. Resuming overlay device (aka switching tables) only + * after suspending the hotzone may lead to deadlock. + * + * In other words: always suspend the stack from top to bottom! + */ + r = dm_suspend_device(cd, overlay, DM_SUSPEND_SKIP_LOCKFS | DM_SUSPEND_NOFLUSH); + if (r) { + log_err(cd, _("Failed to suspend device %s."), overlay); + return r; + } + + /* suspend HZ device */ + r = dm_suspend_device(cd, hotzone, DM_SUSPEND_SKIP_LOCKFS | DM_SUSPEND_NOFLUSH); + if (r) { + log_err(cd, _("Failed to suspend device %s."), hotzone); + return r; + } + + /* resume overlay device: inactive table (with hotozne) -> live */ + r = dm_resume_device(cd, overlay, DM_RESUME_PRIVATE); + if (r) + log_err(cd, _("Failed to resume device %s."), overlay); + + return r; +} + +static int reencrypt_refresh_overlay_devices(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *overlay, + const char *hotzone, + struct volume_key *vks, + uint64_t device_size, + uint32_t flags) +{ + int r = reencrypt_load_overlay_device(cd, hdr, overlay, hotzone, vks, device_size, flags); + if (r) { + log_err(cd, _("Failed to reload device %s."), overlay); + return REENC_ERR; + } + + r = reenc_refresh_helper_devices(cd, overlay, hotzone); + if (r) { + log_err(cd, _("Failed to refresh reencryption devices stack.")); + return REENC_ROLLBACK; + } + + return REENC_OK; +} + +static int reencrypt_move_data(struct crypt_device *cd, int devfd, uint64_t data_shift) +{ + void *buffer; + int r; + ssize_t ret; + uint64_t buffer_len, offset; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + log_dbg(cd, "Going to move data from head of data device."); + + buffer_len = data_shift; + if (!buffer_len) + return -EINVAL; + + offset = json_segment_get_offset(LUKS2_get_segment_jobj(hdr, 0), 0); + + /* this is nonsense anyway */ + if (buffer_len != json_segment_get_size(LUKS2_get_segment_jobj(hdr, 0), 0)) { + log_dbg(cd, "buffer_len %" PRIu64", segment size %" PRIu64, buffer_len, json_segment_get_size(LUKS2_get_segment_jobj(hdr, 0), 0)); + return -EINVAL; + } + + if (posix_memalign(&buffer, device_alignment(crypt_data_device(cd)), buffer_len)) + return -ENOMEM; + + ret = read_lseek_blockwise(devfd, + device_block_size(cd, crypt_data_device(cd)), + device_alignment(crypt_data_device(cd)), + buffer, buffer_len, 0); + if (ret < 0 || (uint64_t)ret != buffer_len) { + r = -EIO; + goto err; + } + + log_dbg(cd, "Going to write %" PRIu64 " bytes at offset %" PRIu64, buffer_len, offset); + ret = write_lseek_blockwise(devfd, + device_block_size(cd, crypt_data_device(cd)), + device_alignment(crypt_data_device(cd)), + buffer, buffer_len, offset); + if (ret < 0 || (uint64_t)ret != buffer_len) { + r = -EIO; + goto err; + } + + r = 0; +err: + memset(buffer, 0, buffer_len); + free(buffer); + return r; +} + +static int reencrypt_make_backup_segments(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot_new, + const char *cipher, + uint64_t data_offset, + const struct crypt_params_reencrypt *params) +{ + int r, segment, moved_segment = -1, digest_old = -1, digest_new = -1; + json_object *jobj_segment_new = NULL, *jobj_segment_old = NULL, *jobj_segment_bcp = NULL; + uint32_t sector_size = params->luks2 ? params->luks2->sector_size : SECTOR_SIZE; + uint64_t segment_offset, tmp, data_shift = params->data_shift << SECTOR_SHIFT; + + if (params->mode != CRYPT_REENCRYPT_DECRYPT) { + digest_new = LUKS2_digest_by_keyslot(hdr, keyslot_new); + if (digest_new < 0) + return -EINVAL; + } + + if (params->mode != CRYPT_REENCRYPT_ENCRYPT) { + digest_old = LUKS2_digest_by_segment(hdr, CRYPT_DEFAULT_SEGMENT); + if (digest_old < 0) + return -EINVAL; + } + + segment = LUKS2_segment_first_unused_id(hdr); + if (segment < 0) + return -EINVAL; + + if (params->mode == CRYPT_REENCRYPT_ENCRYPT && + (params->flags & CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT)) { + json_object_copy(LUKS2_get_segment_jobj(hdr, 0), &jobj_segment_bcp); + r = LUKS2_segment_set_flag(jobj_segment_bcp, "backup-moved-segment"); + if (r) + goto err; + moved_segment = segment++; + json_object_object_add_by_uint(LUKS2_get_segments_jobj(hdr), moved_segment, jobj_segment_bcp); + } + + /* FIXME: Add detection for case (digest old == digest new && old segment == new segment) */ + if (digest_old >= 0) + json_object_copy(LUKS2_get_segment_jobj(hdr, CRYPT_DEFAULT_SEGMENT), &jobj_segment_old); + else if (params->mode == CRYPT_REENCRYPT_ENCRYPT) { + r = LUKS2_get_data_size(hdr, &tmp, NULL); + if (r) + goto err; + jobj_segment_old = json_segment_create_linear(0, tmp ? &tmp : NULL, 0); + } + + if (!jobj_segment_old) { + r = -EINVAL; + goto err; + } + + r = LUKS2_segment_set_flag(jobj_segment_old, "backup-previous"); + if (r) + goto err; + json_object_object_add_by_uint(LUKS2_get_segments_jobj(hdr), segment, jobj_segment_old); + jobj_segment_old = NULL; + if (digest_old >= 0) + LUKS2_digest_segment_assign(cd, hdr, segment, digest_old, 1, 0); + segment++; + + if (digest_new >= 0) { + segment_offset = data_offset; + if (params->mode != CRYPT_REENCRYPT_ENCRYPT && + modify_offset(&segment_offset, data_shift, params->direction)) { + r = -EINVAL; + goto err; + } + jobj_segment_new = json_segment_create_crypt(segment_offset, + crypt_get_iv_offset(cd), + NULL, cipher, sector_size, 0); + } else if (params->mode == CRYPT_REENCRYPT_DECRYPT) { + segment_offset = data_offset; + if (modify_offset(&segment_offset, data_shift, params->direction)) { + r = -EINVAL; + goto err; + } + jobj_segment_new = json_segment_create_linear(segment_offset, NULL, 0); + } + + if (!jobj_segment_new) { + r = -EINVAL; + goto err; + } + + r = LUKS2_segment_set_flag(jobj_segment_new, "backup-final"); + if (r) + goto err; + json_object_object_add_by_uint(LUKS2_get_segments_jobj(hdr), segment, jobj_segment_new); + jobj_segment_new = NULL; + if (digest_new >= 0) + LUKS2_digest_segment_assign(cd, hdr, segment, digest_new, 1, 0); + + /* FIXME: also check occupied space by keyslot in shrunk area */ + if (params->direction == CRYPT_REENCRYPT_FORWARD && data_shift && + crypt_metadata_device(cd) == crypt_data_device(cd) && + LUKS2_set_keyslots_size(cd, hdr, json_segment_get_offset(reencrypt_segment_new(hdr), 0))) { + log_err(cd, _("Failed to set new keyslots area size.")); + r = -EINVAL; + goto err; + } + + return 0; +err: + json_object_put(jobj_segment_new); + json_object_put(jobj_segment_old); + return r; +} + +static int reencrypt_verify_and_upload_keys(struct crypt_device *cd, struct luks2_hdr *hdr, int digest_old, int digest_new, struct volume_key *vks) +{ + int r; + struct volume_key *vk; + + if (digest_new >= 0) { + vk = crypt_volume_key_by_id(vks, digest_new); + if (!vk) + return -ENOENT; + else { + if (LUKS2_digest_verify_by_digest(cd, hdr, digest_new, vk) != digest_new) + return -EINVAL; + + if (crypt_use_keyring_for_vk(cd) && !crypt_is_cipher_null(reencrypt_segment_cipher_new(hdr)) && + (r = LUKS2_volume_key_load_in_keyring_by_digest(cd, hdr, vk, crypt_volume_key_get_id(vk)))) + return r; + } + } + + if (digest_old >= 0 && digest_old != digest_new) { + vk = crypt_volume_key_by_id(vks, digest_old); + if (!vk) { + r = -ENOENT; + goto err; + } else { + if (LUKS2_digest_verify_by_digest(cd, hdr, digest_old, vk) != digest_old) { + r = -EINVAL; + goto err; + } + if (crypt_use_keyring_for_vk(cd) && !crypt_is_cipher_null(reencrypt_segment_cipher_old(hdr)) && + (r = LUKS2_volume_key_load_in_keyring_by_digest(cd, hdr, vk, crypt_volume_key_get_id(vk)))) + goto err; + } + } + + return 0; +err: + crypt_drop_keyring_key(cd, vks); + return r; +} + +/* This function must be called with metadata lock held */ +static int reencrypt_init(struct crypt_device *cd, + const char *name, + struct luks2_hdr *hdr, + const char *passphrase, + size_t passphrase_size, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params, + struct volume_key **vks) +{ + bool move_first_segment; + char _cipher[128]; + uint32_t sector_size; + int r, reencrypt_keyslot, devfd = -1; + uint64_t data_offset, dev_size = 0; + struct crypt_dm_active_device dmd_target, dmd_source = { + .uuid = crypt_get_uuid(cd), + .flags = CRYPT_ACTIVATE_SHARED /* turn off exclusive open checks */ + }; + + if (!params || params->mode > CRYPT_REENCRYPT_DECRYPT) + return -EINVAL; + + if (params->mode != CRYPT_REENCRYPT_DECRYPT && + (!params->luks2 || !(cipher && cipher_mode) || keyslot_new < 0)) + return -EINVAL; + + log_dbg(cd, "Initializing reencryption (mode: %s) in LUKS2 metadata.", + crypt_reencrypt_mode_to_str(params->mode)); + + move_first_segment = (params->flags & CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT); + + /* implicit sector size 512 for decryption */ + sector_size = params->luks2 ? params->luks2->sector_size : SECTOR_SIZE; + if (sector_size < SECTOR_SIZE || sector_size > MAX_SECTOR_SIZE || + NOTPOW2(sector_size)) { + log_err(cd, _("Unsupported encryption sector size.")); + return -EINVAL; + } + + if (!cipher_mode || *cipher_mode == '\0') + r = snprintf(_cipher, sizeof(_cipher), "%s", cipher); + else + r = snprintf(_cipher, sizeof(_cipher), "%s-%s", cipher, cipher_mode); + if (r < 0 || (size_t)r >= sizeof(_cipher)) + return -EINVAL; + + if (MISALIGNED(params->data_shift, sector_size >> SECTOR_SHIFT)) { + log_err(cd, _("Data shift is not aligned to requested encryption sector size (%" PRIu32 " bytes)."), sector_size); + return -EINVAL; + } + + data_offset = LUKS2_get_data_offset(hdr) << SECTOR_SHIFT; + + r = device_check_access(cd, crypt_data_device(cd), DEV_OK); + if (r) + return r; + + r = device_check_size(cd, crypt_data_device(cd), data_offset, 1); + if (r) + return r; + + r = device_size(crypt_data_device(cd), &dev_size); + if (r) + return r; + + dev_size -= data_offset; + + if (MISALIGNED(dev_size, sector_size)) { + log_err(cd, _("Data device is not aligned to requested encryption sector size (%" PRIu32 " bytes)."), sector_size); + return -EINVAL; + } + + reencrypt_keyslot = LUKS2_keyslot_find_empty(hdr); + if (reencrypt_keyslot < 0) { + log_err(cd, _("All key slots full.")); + return -EINVAL; + } + + /* + * We must perform data move with exclusive open data device + * to exclude another cryptsetup process to colide with + * encryption initialization (or mount) + */ + if (move_first_segment) { + if (dev_size < 2 * (params->data_shift << SECTOR_SHIFT)) { + log_err(cd, _("Device %s is too small."), device_path(crypt_data_device(cd))); + return -EINVAL; + } + if (params->data_shift < LUKS2_get_data_offset(hdr)) { + log_err(cd, _("Data shift (%" PRIu64 " sectors) is less than future data offset (%" PRIu64 " sectors)."), params->data_shift, LUKS2_get_data_offset(hdr)); + return -EINVAL; + } + devfd = device_open_excl(cd, crypt_data_device(cd), O_RDWR); + if (devfd < 0) { + if (devfd == -EBUSY) + log_err(cd,_("Failed to open %s in exclusive mode (already mapped or mounted)."), device_path(crypt_data_device(cd))); + return -EINVAL; + } + } + + if (params->mode == CRYPT_REENCRYPT_ENCRYPT) { + /* in-memory only */ + r = reencrypt_set_encrypt_segments(cd, hdr, dev_size, params->data_shift << SECTOR_SHIFT, move_first_segment, params->direction); + if (r) + goto err; + } + + r = LUKS2_keyslot_reencrypt_allocate(cd, hdr, reencrypt_keyslot, + params); + if (r < 0) + goto err; + + r = reencrypt_make_backup_segments(cd, hdr, keyslot_new, _cipher, data_offset, params); + if (r) { + log_dbg(cd, "Failed to create reencryption backup device segments."); + goto err; + } + + r = LUKS2_keyslot_open_all_segments(cd, keyslot_old, keyslot_new, passphrase, passphrase_size, vks); + if (r < 0) + goto err; + + r = LUKS2_keyslot_reencrypt_digest_create(cd, hdr, *vks); + if (r < 0) + goto err; + + if (name && params->mode != CRYPT_REENCRYPT_ENCRYPT) { + r = reencrypt_verify_and_upload_keys(cd, hdr, LUKS2_reencrypt_digest_old(hdr), LUKS2_reencrypt_digest_new(hdr), *vks); + if (r) + goto err; + + r = dm_query_device(cd, name, DM_ACTIVE_UUID | DM_ACTIVE_DEVICE | + DM_ACTIVE_CRYPT_KEYSIZE | DM_ACTIVE_CRYPT_KEY | + DM_ACTIVE_CRYPT_CIPHER, &dmd_target); + if (r < 0) + goto err; + + r = LUKS2_assembly_multisegment_dmd(cd, hdr, *vks, LUKS2_get_segments_jobj(hdr), &dmd_source); + if (!r) { + r = crypt_compare_dm_devices(cd, &dmd_source, &dmd_target); + if (r) + log_err(cd, _("Mismatching parameters on device %s."), name); + } + + dm_targets_free(cd, &dmd_source); + dm_targets_free(cd, &dmd_target); + free(CONST_CAST(void*)dmd_target.uuid); + + if (r) + goto err; + } + + if (move_first_segment && reencrypt_move_data(cd, devfd, params->data_shift << SECTOR_SHIFT)) { + r = -EIO; + goto err; + } + + /* This must be first and only write in LUKS2 metadata during _reencrypt_init */ + r = reencrypt_update_flag(cd, 1, true); + if (r) { + log_dbg(cd, "Failed to set online-reencryption requirement."); + r = -EINVAL; + } else + r = reencrypt_keyslot; +err: + device_release_excl(cd, crypt_data_device(cd)); + if (r < 0) + crypt_load(cd, CRYPT_LUKS2, NULL); + + return r; +} + +static int reencrypt_hotzone_protect_final(struct crypt_device *cd, + struct luks2_hdr *hdr, struct luks2_reencrypt *rh, + const void *buffer, size_t buffer_len) +{ + const void *pbuffer; + size_t data_offset, len; + int r; + + if (rh->rp.type == REENC_PROTECTION_NONE) + return 0; + + if (rh->rp.type == REENC_PROTECTION_CHECKSUM) { + log_dbg(cd, "Checksums hotzone resilience."); + + for (data_offset = 0, len = 0; data_offset < buffer_len; data_offset += rh->alignment, len += rh->rp.p.csum.hash_size) { + if (crypt_hash_write(rh->rp.p.csum.ch, (const char *)buffer + data_offset, rh->alignment)) { + log_dbg(cd, "Failed to hash sector at offset %zu.", data_offset); + return -EINVAL; + } + if (crypt_hash_final(rh->rp.p.csum.ch, (char *)rh->rp.p.csum.checksums + len, rh->rp.p.csum.hash_size)) { + log_dbg(cd, "Failed to finalize hash."); + return -EINVAL; + } + } + pbuffer = rh->rp.p.csum.checksums; + } else if (rh->rp.type == REENC_PROTECTION_JOURNAL) { + log_dbg(cd, "Journal hotzone resilience."); + len = buffer_len; + pbuffer = buffer; + } else if (rh->rp.type == REENC_PROTECTION_DATASHIFT) { + log_dbg(cd, "Data shift hotzone resilience."); + return LUKS2_hdr_write(cd, hdr); + } else + return -EINVAL; + + log_dbg(cd, "Going to store %zu bytes in reencrypt keyslot.", len); + + r = LUKS2_keyslot_reencrypt_store(cd, hdr, rh->reenc_keyslot, pbuffer, len); + + return r > 0 ? 0 : r; +} + +static int reencrypt_context_update(struct crypt_device *cd, + struct luks2_reencrypt *rh) +{ + if (rh->read < 0) + return -EINVAL; + + if (rh->direction == CRYPT_REENCRYPT_BACKWARD) { + if (rh->data_shift && rh->mode == CRYPT_REENCRYPT_ENCRYPT) { + if (rh->offset) + rh->offset -= rh->data_shift; + if (rh->offset && (rh->offset < rh->data_shift)) { + rh->length = rh->offset; + rh->offset = rh->data_shift; + } + if (!rh->offset) + rh->length = rh->data_shift; + } else { + if (rh->offset < rh->length) + rh->length = rh->offset; + rh->offset -= rh->length; + } + } else if (rh->direction == CRYPT_REENCRYPT_FORWARD) { + rh->offset += (uint64_t)rh->read; + /* it fails in-case of device_size < rh->offset later */ + if (rh->device_size - rh->offset < rh->length) + rh->length = rh->device_size - rh->offset; + } else + return -EINVAL; + + if (rh->device_size < rh->offset) { + log_dbg(cd, "Calculated reencryption offset %" PRIu64 " is beyond device size %" PRIu64 ".", rh->offset, rh->device_size); + return -EINVAL; + } + + rh->progress += (uint64_t)rh->read; + + return 0; +} + +static int reencrypt_load(struct crypt_device *cd, struct luks2_hdr *hdr, + uint64_t device_size, + const struct crypt_params_reencrypt *params, + struct volume_key *vks, + struct luks2_reencrypt **rh) +{ + int r; + struct luks2_reencrypt *tmp = NULL; + crypt_reencrypt_info ri = LUKS2_reencrypt_status(hdr); + + if (ri == CRYPT_REENCRYPT_NONE) { + log_err(cd, _("Device not marked for LUKS2 reencryption.")); + return -EINVAL; + } else if (ri == CRYPT_REENCRYPT_INVALID) + return -EINVAL; + + r = LUKS2_reencrypt_digest_verify(cd, hdr, vks); + if (r < 0) + return r; + + if (ri == CRYPT_REENCRYPT_CLEAN) + r = reencrypt_load_clean(cd, hdr, device_size, &tmp, params); + else if (ri == CRYPT_REENCRYPT_CRASH) + r = reencrypt_load_crashed(cd, hdr, device_size, &tmp); + else + r = -EINVAL; + + if (r < 0 || !tmp) { + log_err(cd, _("Failed to load LUKS2 reencryption context.")); + return r; + } + + *rh = tmp; + + return 0; +} +#endif +static int reencrypt_lock_internal(struct crypt_device *cd, const char *uuid, struct crypt_lock_handle **reencrypt_lock) +{ + int r; + char *lock_resource; + + if (!crypt_metadata_locking_enabled()) { + *reencrypt_lock = NULL; + return 0; + } + + r = asprintf(&lock_resource, "LUKS2-reencryption-%s", uuid); + if (r < 0) + return -ENOMEM; + if (r < 20) { + r = -EINVAL; + goto out; + } + + r = crypt_write_lock(cd, lock_resource, false, reencrypt_lock); +out: + free(lock_resource); + + return r; +} + +/* internal only */ +int LUKS2_reencrypt_lock_by_dm_uuid(struct crypt_device *cd, const char *dm_uuid, + struct crypt_lock_handle **reencrypt_lock) +{ + int r; + char hdr_uuid[37]; + const char *uuid = crypt_get_uuid(cd); + + if (!dm_uuid) + return -EINVAL; + + if (!uuid) { + r = snprintf(hdr_uuid, sizeof(hdr_uuid), "%.8s-%.4s-%.4s-%.4s-%.12s", + dm_uuid + 6, dm_uuid + 14, dm_uuid + 18, dm_uuid + 22, dm_uuid + 26); + if (r < 0 || (size_t)r != (sizeof(hdr_uuid) - 1)) + return -EINVAL; + } else if (crypt_uuid_cmp(dm_uuid, uuid)) + return -EINVAL; + + return reencrypt_lock_internal(cd, uuid, reencrypt_lock); +} + +/* internal only */ +int LUKS2_reencrypt_lock(struct crypt_device *cd, struct crypt_lock_handle **reencrypt_lock) +{ + if (!cd || !crypt_get_type(cd) || strcmp(crypt_get_type(cd), CRYPT_LUKS2)) + return -EINVAL; + + return reencrypt_lock_internal(cd, crypt_get_uuid(cd), reencrypt_lock); +} + +/* internal only */ +void LUKS2_reencrypt_unlock(struct crypt_device *cd, struct crypt_lock_handle *reencrypt_lock) +{ + crypt_unlock_internal(cd, reencrypt_lock); +} +#if USE_LUKS2_REENCRYPTION +static int reencrypt_lock_and_verify(struct crypt_device *cd, struct luks2_hdr *hdr, + struct crypt_lock_handle **reencrypt_lock) +{ + int r; + crypt_reencrypt_info ri; + struct crypt_lock_handle *h; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) { + log_err(cd, _("Failed to get reencryption state.")); + return -EINVAL; + } + if (ri < CRYPT_REENCRYPT_CLEAN) { + log_err(cd, _("Device is not in reencryption.")); + return -EINVAL; + } + + r = LUKS2_reencrypt_lock(cd, &h); + if (r < 0) { + if (r == -EBUSY) + log_err(cd, _("Reencryption process is already running.")); + else + log_err(cd, _("Failed to acquire reencryption lock.")); + return r; + } + + /* With reencryption lock held, reload device context and verify metadata state */ + r = crypt_load(cd, CRYPT_LUKS2, NULL); + if (r) { + LUKS2_reencrypt_unlock(cd, h); + return r; + } + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_CLEAN) { + *reencrypt_lock = h; + return 0; + } + + LUKS2_reencrypt_unlock(cd, h); + log_err(cd, _("Cannot proceed with reencryption. Run reencryption recovery first.")); + return -EINVAL; +} + +static int reencrypt_load_by_passphrase(struct crypt_device *cd, + const char *name, + const char *passphrase, + size_t passphrase_size, + int keyslot_old, + int keyslot_new, + struct volume_key **vks, + const struct crypt_params_reencrypt *params) +{ + int r, old_ss, new_ss; + struct luks2_hdr *hdr; + struct crypt_lock_handle *reencrypt_lock; + struct luks2_reencrypt *rh; + const struct volume_key *vk; + struct crypt_dm_active_device dmd_target, dmd_source = { + .uuid = crypt_get_uuid(cd), + .flags = CRYPT_ACTIVATE_SHARED /* turn off exclusive open checks */ + }; + uint64_t minimal_size, device_size, mapping_size = 0, required_size = 0; + bool dynamic; + struct crypt_params_reencrypt rparams = {}; + uint32_t flags = 0; + + if (params) { + rparams = *params; + required_size = params->device_size; + } + + log_dbg(cd, "Loading LUKS2 reencryption context."); + + rh = crypt_get_luks2_reencrypt(cd); + if (rh) { + LUKS2_reencrypt_free(cd, rh); + crypt_set_luks2_reencrypt(cd, NULL); + rh = NULL; + } + + hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + r = reencrypt_lock_and_verify(cd, hdr, &reencrypt_lock); + if (r) + return r; + + /* From now on we hold reencryption lock */ + + if (LUKS2_get_data_size(hdr, &minimal_size, &dynamic)) + return -EINVAL; + + /* some configurations provides fixed device size */ + r = LUKS2_reencrypt_check_device_size(cd, hdr, minimal_size, &device_size, false, dynamic); + if (r) { + r = -EINVAL; + goto err; + } + + minimal_size >>= SECTOR_SHIFT; + + old_ss = reencrypt_get_sector_size_old(hdr); + new_ss = reencrypt_get_sector_size_new(hdr); + + r = reencrypt_verify_and_upload_keys(cd, hdr, LUKS2_reencrypt_digest_old(hdr), LUKS2_reencrypt_digest_new(hdr), *vks); + if (r == -ENOENT) { + log_dbg(cd, "Keys are not ready. Unlocking all volume keys."); + r = LUKS2_keyslot_open_all_segments(cd, keyslot_old, keyslot_new, passphrase, passphrase_size, vks); + if (r < 0) + goto err; + r = reencrypt_verify_and_upload_keys(cd, hdr, LUKS2_reencrypt_digest_old(hdr), LUKS2_reencrypt_digest_new(hdr), *vks); + } + + if (r < 0) + goto err; + + if (name) { + r = dm_query_device(cd, name, DM_ACTIVE_UUID | DM_ACTIVE_DEVICE | + DM_ACTIVE_CRYPT_KEYSIZE | DM_ACTIVE_CRYPT_KEY | + DM_ACTIVE_CRYPT_CIPHER, &dmd_target); + if (r < 0) + goto err; + flags = dmd_target.flags; + + /* + * By default reencryption code aims to retain flags from existing dm device. + * The keyring activation flag can not be inherited if original cipher is null. + * + * In this case override the flag based on decision made in reencrypt_verify_and_upload_keys + * above. The code checks if new VK is eligible for keyring. + */ + vk = crypt_volume_key_by_id(*vks, LUKS2_reencrypt_digest_new(hdr)); + if (vk && vk->key_description && crypt_is_cipher_null(reencrypt_segment_cipher_old(hdr))) { + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + dmd_source.flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + r = LUKS2_assembly_multisegment_dmd(cd, hdr, *vks, LUKS2_get_segments_jobj(hdr), &dmd_source); + if (!r) { + r = crypt_compare_dm_devices(cd, &dmd_source, &dmd_target); + if (r) + log_err(cd, _("Mismatching parameters on device %s."), name); + } + + dm_targets_free(cd, &dmd_source); + dm_targets_free(cd, &dmd_target); + free(CONST_CAST(void*)dmd_target.uuid); + if (r) + goto err; + mapping_size = dmd_target.size; + } + + r = -EINVAL; + if (required_size && mapping_size && (required_size != mapping_size)) { + log_err(cd, _("Active device size and requested reencryption size don't match.")); + goto err; + } + + if (mapping_size) + required_size = mapping_size; + + if (required_size) { + /* TODO: Add support for changing fixed minimal size in reencryption mda where possible */ + if ((minimal_size && (required_size < minimal_size)) || + (required_size > (device_size >> SECTOR_SHIFT)) || + (!dynamic && (required_size != minimal_size)) || + (old_ss > 0 && MISALIGNED(required_size, old_ss >> SECTOR_SHIFT)) || + (new_ss > 0 && MISALIGNED(required_size, new_ss >> SECTOR_SHIFT))) { + log_err(cd, _("Illegal device size requested in reencryption parameters.")); + goto err; + } + rparams.device_size = required_size; + } + + r = reencrypt_load(cd, hdr, device_size, &rparams, *vks, &rh); + if (r < 0 || !rh) + goto err; + + if (name && (r = reencrypt_context_set_names(rh, name))) + goto err; + + /* Reassure device is not mounted and there's no dm mapping active */ + if (!name && (device_open_excl(cd, crypt_data_device(cd), O_RDONLY) < 0)) { + log_err(cd,_("Failed to open %s in exclusive mode (already mapped or mounted)."), device_path(crypt_data_device(cd))); + r = -EBUSY; + goto err; + } + device_release_excl(cd, crypt_data_device(cd)); + + /* FIXME: There's a race for dm device activation not managed by cryptsetup. + * + * 1) excl close + * 2) rogue dm device activation + * 3) one or more dm-crypt based wrapper activation + * 4) next excl open get's skipped due to 3) device from 2) remains undetected. + */ + r = reencrypt_init_storage_wrappers(cd, hdr, rh, *vks); + if (r) + goto err; + + /* If one of wrappers is based on dmcrypt fallback it already blocked mount */ + if (!name && crypt_storage_wrapper_get_type(rh->cw1) != DMCRYPT && + crypt_storage_wrapper_get_type(rh->cw2) != DMCRYPT) { + if (device_open_excl(cd, crypt_data_device(cd), O_RDONLY) < 0) { + log_err(cd,_("Failed to open %s in exclusive mode (already mapped or mounted)."), device_path(crypt_data_device(cd))); + r = -EBUSY; + goto err; + } + } + + rh->flags = flags; + + MOVE_REF(rh->vks, *vks); + MOVE_REF(rh->reenc_lock, reencrypt_lock); + + crypt_set_luks2_reencrypt(cd, rh); + + return 0; +err: + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + LUKS2_reencrypt_free(cd, rh); + return r; +} + +static int reencrypt_recovery_by_passphrase(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size) +{ + int r; + crypt_reencrypt_info ri; + struct crypt_lock_handle *reencrypt_lock; + + r = LUKS2_reencrypt_lock(cd, &reencrypt_lock); + if (r) { + if (r == -EBUSY) + log_err(cd, _("Reencryption in-progress. Cannot perform recovery.")); + else + log_err(cd, _("Failed to get reencryption lock.")); + return r; + } + + if ((r = crypt_load(cd, CRYPT_LUKS2, NULL))) { + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + return r; + } + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) { + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + return -EINVAL; + } + + if (ri == CRYPT_REENCRYPT_CRASH) { + r = LUKS2_reencrypt_locked_recovery_by_passphrase(cd, keyslot_old, keyslot_new, + passphrase, passphrase_size, 0, NULL); + if (r < 0) + log_err(cd, _("LUKS2 reencryption recovery failed.")); + } else { + log_dbg(cd, "No LUKS2 reencryption recovery needed."); + r = 0; + } + + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + return r; +} + +static int reencrypt_repair_by_passphrase( + struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size) +{ + int r; + struct crypt_lock_handle *reencrypt_lock; + struct luks2_reencrypt *rh; + crypt_reencrypt_info ri; + struct volume_key *vks = NULL; + + log_dbg(cd, "Loading LUKS2 reencryption context for metadata repair."); + + rh = crypt_get_luks2_reencrypt(cd); + if (rh) { + LUKS2_reencrypt_free(cd, rh); + crypt_set_luks2_reencrypt(cd, NULL); + rh = NULL; + } + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) + return -EINVAL; + + if (ri < CRYPT_REENCRYPT_CLEAN) { + log_err(cd, _("Device is not in reencryption.")); + return -EINVAL; + } + + r = LUKS2_reencrypt_lock(cd, &reencrypt_lock); + if (r < 0) { + if (r == -EBUSY) + log_err(cd, _("Reencryption process is already running.")); + else + log_err(cd, _("Failed to acquire reencryption lock.")); + return r; + } + + /* With reencryption lock held, reload device context and verify metadata state */ + r = crypt_load(cd, CRYPT_LUKS2, NULL); + if (r) + goto out; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) { + r = -EINVAL; + goto out; + } + if (ri == CRYPT_REENCRYPT_NONE) { + r = 0; + goto out; + } + + r = LUKS2_keyslot_open_all_segments(cd, keyslot_old, keyslot_new, passphrase, passphrase_size, &vks); + if (r < 0) + goto out; + + r = LUKS2_keyslot_reencrypt_digest_create(cd, hdr, vks); + crypt_free_volume_key(vks); + vks = NULL; + if (r < 0) + goto out; + + /* removes online-reencrypt flag v1 */ + if ((r = reencrypt_update_flag(cd, 0, false))) + goto out; + + /* adds online-reencrypt flag v2 and commits metadata */ + r = reencrypt_update_flag(cd, 1, true); +out: + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + crypt_free_volume_key(vks); + return r; + +} +#endif +static int reencrypt_init_by_passphrase(struct crypt_device *cd, + const char *name, + const char *passphrase, + size_t passphrase_size, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params) +{ +#if USE_LUKS2_REENCRYPTION + int r; + crypt_reencrypt_info ri; + struct volume_key *vks = NULL; + uint32_t flags = params ? params->flags : 0; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + /* short-circuit in reencryption metadata update and finish immediately. */ + if (flags & CRYPT_REENCRYPT_REPAIR_NEEDED) + return reencrypt_repair_by_passphrase(cd, hdr, keyslot_old, keyslot_new, passphrase, passphrase_size); + + /* short-circuit in recovery and finish immediately. */ + if (flags & CRYPT_REENCRYPT_RECOVERY) + return reencrypt_recovery_by_passphrase(cd, hdr, keyslot_old, keyslot_new, passphrase, passphrase_size); + + if (cipher && !crypt_cipher_wrapped_key(cipher, cipher_mode)) { + r = crypt_keyslot_get_key_size(cd, keyslot_new); + if (r < 0) + return r; + r = LUKS2_check_cipher(cd, r, cipher, cipher_mode); + if (r < 0) + return r; + } + + r = LUKS2_device_write_lock(cd, hdr, crypt_metadata_device(cd)); + if (r) + return r; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) { + device_write_unlock(cd, crypt_metadata_device(cd)); + return -EINVAL; + } + + if ((ri > CRYPT_REENCRYPT_NONE) && (flags & CRYPT_REENCRYPT_INITIALIZE_ONLY)) { + device_write_unlock(cd, crypt_metadata_device(cd)); + log_err(cd, _("LUKS2 reencryption already initialized in metadata.")); + return -EBUSY; + } + + if (ri == CRYPT_REENCRYPT_NONE && !(flags & CRYPT_REENCRYPT_RESUME_ONLY)) { + r = reencrypt_init(cd, name, hdr, passphrase, passphrase_size, keyslot_old, keyslot_new, cipher, cipher_mode, params, &vks); + if (r < 0) + log_err(cd, _("Failed to initialize LUKS2 reencryption in metadata.")); + } else if (ri > CRYPT_REENCRYPT_NONE) { + log_dbg(cd, "LUKS2 reencryption already initialized."); + r = 0; + } + + device_write_unlock(cd, crypt_metadata_device(cd)); + + if (r < 0 || (flags & CRYPT_REENCRYPT_INITIALIZE_ONLY)) + goto out; + + r = reencrypt_load_by_passphrase(cd, name, passphrase, passphrase_size, keyslot_old, keyslot_new, &vks, params); +out: + if (r < 0) + crypt_drop_keyring_key(cd, vks); + crypt_free_volume_key(vks); + return r < 0 ? r : LUKS2_find_keyslot(hdr, "reencrypt"); +#else + log_err(cd, _("This operation is not supported for this device type.")); + return -ENOTSUP; +#endif +} + +int crypt_reencrypt_init_by_keyring(struct crypt_device *cd, + const char *name, + const char *passphrase_description, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params) +{ + int r; + char *passphrase; + size_t passphrase_size; + + if (onlyLUKS2mask(cd, CRYPT_REQUIREMENT_ONLINE_REENCRYPT) || !passphrase_description) + return -EINVAL; + if (params && (params->flags & CRYPT_REENCRYPT_INITIALIZE_ONLY) && (params->flags & CRYPT_REENCRYPT_RESUME_ONLY)) + return -EINVAL; + + r = keyring_get_passphrase(passphrase_description, &passphrase, &passphrase_size); + if (r < 0) { + log_err(cd, _("Failed to read passphrase from keyring (error %d)."), r); + return -EINVAL; + } + + r = reencrypt_init_by_passphrase(cd, name, passphrase, passphrase_size, keyslot_old, keyslot_new, cipher, cipher_mode, params); + + crypt_safe_memzero(passphrase, passphrase_size); + free(passphrase); + + return r; +} + +int crypt_reencrypt_init_by_passphrase(struct crypt_device *cd, + const char *name, + const char *passphrase, + size_t passphrase_size, + int keyslot_old, + int keyslot_new, + const char *cipher, + const char *cipher_mode, + const struct crypt_params_reencrypt *params) +{ + if (onlyLUKS2mask(cd, CRYPT_REQUIREMENT_ONLINE_REENCRYPT) || !passphrase) + return -EINVAL; + if (params && (params->flags & CRYPT_REENCRYPT_INITIALIZE_ONLY) && (params->flags & CRYPT_REENCRYPT_RESUME_ONLY)) + return -EINVAL; + + return reencrypt_init_by_passphrase(cd, name, passphrase, passphrase_size, keyslot_old, keyslot_new, cipher, cipher_mode, params); +} + +#if USE_LUKS2_REENCRYPTION +static reenc_status_t reencrypt_step(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, + uint64_t device_size, + bool online) +{ + int r; + + /* in memory only */ + r = reencrypt_make_segments(cd, hdr, rh, device_size); + if (r) + return REENC_ERR; + + r = reencrypt_assign_segments(cd, hdr, rh, 1, 0); + if (r) { + log_err(cd, _("Failed to set device segments for next reencryption hotzone.")); + return REENC_ERR; + } + + if (online) { + r = reencrypt_refresh_overlay_devices(cd, hdr, rh->overlay_name, rh->hotzone_name, rh->vks, rh->device_size, rh->flags); + /* Teardown overlay devices with dm-error. None bio shall pass! */ + if (r != REENC_OK) + return r; + } + + log_dbg(cd, "Reencrypting chunk starting at offset: %" PRIu64 ", size :%" PRIu64 ".", rh->offset, rh->length); + log_dbg(cd, "data_offset: %" PRIu64, crypt_get_data_offset(cd) << SECTOR_SHIFT); + + if (!rh->offset && rh->mode == CRYPT_REENCRYPT_ENCRYPT && rh->data_shift && + rh->jobj_segment_moved) { + crypt_storage_wrapper_destroy(rh->cw1); + log_dbg(cd, "Reinitializing old segment storage wrapper for moved segment."); + r = crypt_storage_wrapper_init(cd, &rh->cw1, crypt_data_device(cd), + LUKS2_reencrypt_get_data_offset_moved(hdr), + crypt_get_iv_offset(cd), + reencrypt_get_sector_size_old(hdr), + reencrypt_segment_cipher_old(hdr), + crypt_volume_key_by_id(rh->vks, rh->digest_old), + rh->wflags1); + if (r) { + log_err(cd, _("Failed to initialize old segment storage wrapper.")); + return REENC_ROLLBACK; + } + } + + rh->read = crypt_storage_wrapper_read(rh->cw1, rh->offset, rh->reenc_buffer, rh->length); + if (rh->read < 0) { + /* severity normal */ + log_err(cd, _("Failed to read hotzone area starting at %" PRIu64 "."), rh->offset); + return REENC_ROLLBACK; + } + + /* metadata commit point */ + r = reencrypt_hotzone_protect_final(cd, hdr, rh, rh->reenc_buffer, rh->read); + if (r < 0) { + /* severity normal */ + log_err(cd, _("Failed to write reencryption resilience metadata.")); + return REENC_ROLLBACK; + } + + r = crypt_storage_wrapper_decrypt(rh->cw1, rh->offset, rh->reenc_buffer, rh->read); + if (r) { + /* severity normal */ + log_err(cd, _("Decryption failed.")); + return REENC_ROLLBACK; + } + if (rh->read != crypt_storage_wrapper_encrypt_write(rh->cw2, rh->offset, rh->reenc_buffer, rh->read)) { + /* severity fatal */ + log_err(cd, _("Failed to write hotzone area starting at %" PRIu64 "."), rh->offset); + return REENC_FATAL; + } + + if (rh->rp.type != REENC_PROTECTION_NONE && crypt_storage_wrapper_datasync(rh->cw2)) { + log_err(cd, _("Failed to sync data.")); + return REENC_FATAL; + } + + /* metadata commit safe point */ + r = reencrypt_assign_segments(cd, hdr, rh, 0, rh->rp.type != REENC_PROTECTION_NONE); + if (r) { + /* severity fatal */ + log_err(cd, _("Failed to update metadata after current reencryption hotzone completed.")); + return REENC_FATAL; + } + + if (online) { + /* severity normal */ + log_dbg(cd, "Resuming device %s", rh->hotzone_name); + r = dm_resume_device(cd, rh->hotzone_name, DM_RESUME_PRIVATE); + if (r) { + log_err(cd, _("Failed to resume device %s."), rh->hotzone_name); + return REENC_ERR; + } + } + + return REENC_OK; +} + +static int reencrypt_erase_backup_segments(struct crypt_device *cd, + struct luks2_hdr *hdr) +{ + int segment = LUKS2_get_segment_id_by_flag(hdr, "backup-previous"); + if (segment >= 0) { + if (LUKS2_digest_segment_assign(cd, hdr, segment, CRYPT_ANY_DIGEST, 0, 0)) + return -EINVAL; + json_object_object_del_by_uint(LUKS2_get_segments_jobj(hdr), segment); + } + segment = LUKS2_get_segment_id_by_flag(hdr, "backup-final"); + if (segment >= 0) { + if (LUKS2_digest_segment_assign(cd, hdr, segment, CRYPT_ANY_DIGEST, 0, 0)) + return -EINVAL; + json_object_object_del_by_uint(LUKS2_get_segments_jobj(hdr), segment); + } + segment = LUKS2_get_segment_id_by_flag(hdr, "backup-moved-segment"); + if (segment >= 0) { + if (LUKS2_digest_segment_assign(cd, hdr, segment, CRYPT_ANY_DIGEST, 0, 0)) + return -EINVAL; + json_object_object_del_by_uint(LUKS2_get_segments_jobj(hdr), segment); + } + + return 0; +} + +static int reencrypt_wipe_moved_segment(struct crypt_device *cd, struct luks2_hdr *hdr, struct luks2_reencrypt *rh) +{ + int r = 0; + uint64_t offset, length; + + if (rh->jobj_segment_moved) { + offset = json_segment_get_offset(rh->jobj_segment_moved, 0); + length = json_segment_get_size(rh->jobj_segment_moved, 0); + log_dbg(cd, "Wiping %" PRIu64 " bytes of backup segment data at offset %" PRIu64, + length, offset); + r = crypt_wipe_device(cd, crypt_data_device(cd), CRYPT_WIPE_RANDOM, + offset, length, 1024 * 1024, NULL, NULL); + } + + return r; +} + +static int reencrypt_teardown_ok(struct crypt_device *cd, struct luks2_hdr *hdr, struct luks2_reencrypt *rh) +{ + int i, r; + uint32_t dmt_flags; + bool finished = !(rh->device_size > rh->progress); + + if (rh->rp.type == REENC_PROTECTION_NONE && + LUKS2_hdr_write(cd, hdr)) { + log_err(cd, _("Failed to write LUKS2 metadata.")); + return -EINVAL; + } + + if (rh->online) { + r = LUKS2_reload(cd, rh->device_name, rh->vks, rh->device_size, rh->flags); + if (r) + log_err(cd, _("Failed to reload device %s."), rh->device_name); + if (!r) { + r = dm_resume_device(cd, rh->device_name, DM_SUSPEND_SKIP_LOCKFS | DM_SUSPEND_NOFLUSH); + if (r) + log_err(cd, _("Failed to resume device %s."), rh->device_name); + } + dm_remove_device(cd, rh->overlay_name, 0); + dm_remove_device(cd, rh->hotzone_name, 0); + + if (!r && finished && rh->mode == CRYPT_REENCRYPT_DECRYPT && + !dm_flags(cd, DM_LINEAR, &dmt_flags) && (dmt_flags & DM_DEFERRED_SUPPORTED)) + dm_remove_device(cd, rh->device_name, CRYPT_DEACTIVATE_DEFERRED); + } + + if (finished) { + if (reencrypt_wipe_moved_segment(cd, hdr, rh)) + log_err(cd, _("Failed to wipe backup segment data.")); + if (reencrypt_get_data_offset_new(hdr) && LUKS2_set_keyslots_size(cd, hdr, reencrypt_get_data_offset_new(hdr))) + log_dbg(cd, "Failed to set new keyslots area size."); + if (rh->digest_old >= 0 && rh->digest_new != rh->digest_old) + for (i = 0; i < LUKS2_KEYSLOTS_MAX; i++) + if (LUKS2_digest_by_keyslot(hdr, i) == rh->digest_old && crypt_keyslot_destroy(cd, i)) + log_err(cd, _("Failed to remove unused (unbound) keyslot %d."), i); + + if (reencrypt_erase_backup_segments(cd, hdr)) + log_dbg(cd, "Failed to erase backup segments"); + + if (reencrypt_update_flag(cd, 0, false)) + log_dbg(cd, "Failed to disable reencryption requirement flag."); + + /* metadata commit point also removing reencryption flag on-disk */ + if (crypt_keyslot_destroy(cd, rh->reenc_keyslot)) { + log_err(cd, _("Failed to remove reencryption keyslot.")); + return -EINVAL; + } + } + + return 0; +} + +static void reencrypt_teardown_fatal(struct crypt_device *cd, struct luks2_hdr *hdr, struct luks2_reencrypt *rh) +{ + log_err(cd, _("Fatal error while reencrypting chunk starting at %" PRIu64 ", %" PRIu64 " sectors long."), + (rh->offset >> SECTOR_SHIFT) + crypt_get_data_offset(cd), rh->length >> SECTOR_SHIFT); + + if (rh->online) { + log_err(cd, "Reencryption was run in online mode."); + if (dm_status_suspended(cd, rh->hotzone_name) > 0) { + log_dbg(cd, "Hotzone device %s suspended, replacing with dm-error.", rh->hotzone_name); + if (dm_error_device(cd, rh->hotzone_name)) { + log_err(cd, _("Failed to replace suspended device %s with dm-error target."), rh->hotzone_name); + log_err(cd, _("Do not resume the device unless replaced with error target manually.")); + } + } + } +} + +static int reencrypt_teardown(struct crypt_device *cd, struct luks2_hdr *hdr, + struct luks2_reencrypt *rh, reenc_status_t rs, bool interrupted, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr)) +{ + int r; + + switch (rs) { + case REENC_OK: + if (progress && !interrupted) + progress(rh->device_size, rh->progress, NULL); + r = reencrypt_teardown_ok(cd, hdr, rh); + break; + case REENC_FATAL: + reencrypt_teardown_fatal(cd, hdr, rh); + /* fall-through */ + default: + r = -EIO; + } + + /* this frees reencryption lock */ + LUKS2_reencrypt_free(cd, rh); + crypt_set_luks2_reencrypt(cd, NULL); + + return r; +} +#endif +int crypt_reencrypt(struct crypt_device *cd, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr)) +{ +#if USE_LUKS2_REENCRYPTION + int r; + crypt_reencrypt_info ri; + struct luks2_hdr *hdr; + struct luks2_reencrypt *rh; + reenc_status_t rs; + bool quit = false; + + if (onlyLUKS2mask(cd, CRYPT_REQUIREMENT_ONLINE_REENCRYPT)) + return -EINVAL; + + hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + + ri = LUKS2_reencrypt_status(hdr); + if (ri > CRYPT_REENCRYPT_CLEAN) { + log_err(cd, _("Cannot proceed with reencryption. Unexpected reencryption status.")); + return -EINVAL; + } + + rh = crypt_get_luks2_reencrypt(cd); + if (!rh || (!rh->reenc_lock && crypt_metadata_locking_enabled())) { + log_err(cd, _("Missing or invalid reencrypt context.")); + return -EINVAL; + } + + log_dbg(cd, "Resuming LUKS2 reencryption."); + + if (rh->online && reencrypt_init_device_stack(cd, rh)) { + log_err(cd, _("Failed to initialize reencryption device stack.")); + return -EINVAL; + } + + log_dbg(cd, "Progress %" PRIu64 ", device_size %" PRIu64, rh->progress, rh->device_size); + + rs = REENC_OK; + + /* update reencrypt keyslot protection parameters in memory only */ + if (!quit && (rh->device_size > rh->progress)) { + r = reencrypt_keyslot_update(cd, rh); + if (r < 0) { + log_dbg(cd, "Keyslot update failed."); + return reencrypt_teardown(cd, hdr, rh, REENC_ERR, quit, progress); + } + } + + while (!quit && (rh->device_size > rh->progress)) { + rs = reencrypt_step(cd, hdr, rh, rh->device_size, rh->online); + if (rs != REENC_OK) + break; + + log_dbg(cd, "Progress %" PRIu64 ", device_size %" PRIu64, rh->progress, rh->device_size); + if (progress && progress(rh->device_size, rh->progress, NULL)) + quit = true; + + r = reencrypt_context_update(cd, rh); + if (r) { + log_err(cd, _("Failed to update reencryption context.")); + rs = REENC_ERR; + break; + } + + log_dbg(cd, "Next reencryption offset will be %" PRIu64 " sectors.", rh->offset); + log_dbg(cd, "Next reencryption chunk size will be %" PRIu64 " sectors).", rh->length); + } + + r = reencrypt_teardown(cd, hdr, rh, rs, quit, progress); + return r; +#else + log_err(cd, _("This operation is not supported for this device type.")); + return -ENOTSUP; +#endif +} + +#if USE_LUKS2_REENCRYPTION +static int reencrypt_recovery(struct crypt_device *cd, + struct luks2_hdr *hdr, + uint64_t device_size, + struct volume_key *vks) +{ + int r; + struct luks2_reencrypt *rh = NULL; + + r = reencrypt_load(cd, hdr, device_size, NULL, vks, &rh); + if (r < 0) { + log_err(cd, _("Failed to load LUKS2 reencryption context.")); + return r; + } + + r = reencrypt_recover_segment(cd, hdr, rh, vks); + if (r < 0) + goto err; + + if ((r = reencrypt_assign_segments(cd, hdr, rh, 0, 0))) + goto err; + + r = reencrypt_context_update(cd, rh); + if (r) { + log_err(cd, _("Failed to update reencryption context.")); + goto err; + } + + r = reencrypt_teardown_ok(cd, hdr, rh); + if (!r) + r = LUKS2_hdr_write(cd, hdr); +err: + LUKS2_reencrypt_free(cd, rh); + + return r; +} +#endif +/* + * use only for calculation of minimal data device size. + * The real data offset is taken directly from segments! + */ +int LUKS2_reencrypt_data_offset(struct luks2_hdr *hdr, bool blockwise) +{ + crypt_reencrypt_info ri = LUKS2_reencrypt_status(hdr); + uint64_t data_offset = LUKS2_get_data_offset(hdr); + + if (ri == CRYPT_REENCRYPT_CLEAN && reencrypt_direction(hdr) == CRYPT_REENCRYPT_FORWARD) + data_offset += reencrypt_data_shift(hdr) >> SECTOR_SHIFT; + + return blockwise ? data_offset : data_offset << SECTOR_SHIFT; +} + +/* internal only */ +int LUKS2_reencrypt_check_device_size(struct crypt_device *cd, struct luks2_hdr *hdr, + uint64_t check_size, uint64_t *dev_size, bool activation, bool dynamic) +{ + int r; + uint64_t data_offset, real_size = 0; + + if (reencrypt_direction(hdr) == CRYPT_REENCRYPT_BACKWARD && + (LUKS2_get_segment_by_flag(hdr, "backup-moved-segment") || dynamic)) + check_size += reencrypt_data_shift(hdr); + + r = device_check_access(cd, crypt_data_device(cd), activation ? DEV_EXCL : DEV_OK); + if (r) + return r; + + data_offset = LUKS2_reencrypt_data_offset(hdr, false); + + r = device_check_size(cd, crypt_data_device(cd), data_offset, 1); + if (r) + return r; + + r = device_size(crypt_data_device(cd), &real_size); + if (r) + return r; + + log_dbg(cd, "Required minimal device size: %" PRIu64 " (%" PRIu64 " sectors)" + ", real device size: %" PRIu64 " (%" PRIu64 " sectors)\n" + "calculated device size: %" PRIu64 " (%" PRIu64 " sectors)", + check_size, check_size >> SECTOR_SHIFT, real_size, real_size >> SECTOR_SHIFT, + real_size - data_offset, (real_size - data_offset) >> SECTOR_SHIFT); + + if (real_size < data_offset || (check_size && (real_size - data_offset) < check_size)) { + log_err(cd, _("Device %s is too small."), device_path(crypt_data_device(cd))); + return -EINVAL; + } + + *dev_size = real_size - data_offset; + + return 0; +} +#if USE_LUKS2_REENCRYPTION +/* returns keyslot number on success (>= 0) or negative errnor otherwise */ +int LUKS2_reencrypt_locked_recovery_by_passphrase(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size, + uint32_t flags, + struct volume_key **vks) +{ + uint64_t minimal_size, device_size; + int keyslot, r = -EINVAL; + struct luks2_hdr *hdr = crypt_get_hdr(cd, CRYPT_LUKS2); + struct volume_key *vk = NULL, *_vks = NULL; + + log_dbg(cd, "Entering reencryption crash recovery."); + + if (LUKS2_get_data_size(hdr, &minimal_size, NULL)) + return r; + + r = LUKS2_keyslot_open_all_segments(cd, keyslot_old, keyslot_new, + passphrase, passphrase_size, &_vks); + if (r < 0) + goto err; + keyslot = r; + + if (crypt_use_keyring_for_vk(cd)) + vk = _vks; + + while (vk) { + r = LUKS2_volume_key_load_in_keyring_by_digest(cd, hdr, vk, crypt_volume_key_get_id(vk)); + if (r < 0) + goto err; + vk = crypt_volume_key_next(vk); + } + + if (LUKS2_reencrypt_check_device_size(cd, hdr, minimal_size, &device_size, true, false)) + goto err; + + r = reencrypt_recovery(cd, hdr, device_size, _vks); + + if (!r && vks) + MOVE_REF(*vks, _vks); +err: + if (r < 0) + crypt_drop_keyring_key(cd, _vks); + crypt_free_volume_key(_vks); + + return r < 0 ? r : keyslot; +} +#endif +crypt_reencrypt_info LUKS2_reencrypt_get_params(struct luks2_hdr *hdr, + struct crypt_params_reencrypt *params) +{ + crypt_reencrypt_info ri; + int digest; + uint32_t version; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_NONE || ri == CRYPT_REENCRYPT_INVALID || !params) + return ri; + + digest = LUKS2_digest_by_keyslot(hdr, LUKS2_find_keyslot(hdr, "reencrypt")); + if (digest < 0 && digest != -ENOENT) + return CRYPT_REENCRYPT_INVALID; + + /* + * In case there's an old "online-reencrypt" requirement or reencryption + * keyslot digest is missing inform caller reencryption metadata requires repair. + */ + if (!LUKS2_config_get_reencrypt_version(hdr, &version) && + (version < 2 || digest == -ENOENT)) { + params->flags |= CRYPT_REENCRYPT_REPAIR_NEEDED; + return ri; + } + + params->mode = reencrypt_mode(hdr); + params->direction = reencrypt_direction(hdr); + params->resilience = reencrypt_resilience_type(hdr); + params->hash = reencrypt_resilience_hash(hdr); + params->data_shift = reencrypt_data_shift(hdr) >> SECTOR_SHIFT; + params->max_hotzone_size = 0; + if (LUKS2_get_segment_id_by_flag(hdr, "backup-moved-segment") >= 0) + params->flags |= CRYPT_REENCRYPT_MOVE_FIRST_SEGMENT; + + return ri; +} diff --git a/lib/luks2/luks2_reencrypt_digest.c b/lib/luks2/luks2_reencrypt_digest.c new file mode 100644 index 0000000..7ee277c --- /dev/null +++ b/lib/luks2/luks2_reencrypt_digest.c @@ -0,0 +1,381 @@ +/* + * LUKS - Linux Unified Key Setup v2, reencryption digest helpers + * + * Copyright (C) 2022, Red Hat, Inc. All rights reserved. + * Copyright (C) 2022, Ondrej Kozina + * Copyright (C) 2022, Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" +#include + +#define MAX_STR 64 + +struct jtype { + enum { JNONE = 0, JSTR, JU64, JX64, JU32 } type; + json_object *jobj; + const char *id; +}; + +static size_t sr(struct jtype *j, uint8_t *ptr) +{ + json_object *jobj; + size_t len = 0; + uint64_t u64; + uint32_t u32; + + if (!json_object_is_type(j->jobj, json_type_object)) + return 0; + + if (!json_object_object_get_ex(j->jobj, j->id, &jobj)) + return 0; + + switch(j->type) { + case JSTR: /* JSON string */ + if (!json_object_is_type(jobj, json_type_string)) + return 0; + len = strlen(json_object_get_string(jobj)); + if (len > MAX_STR) + return 0; + if (ptr) + memcpy(ptr, json_object_get_string(jobj), len); + break; + case JU64: /* Unsigned 64bit integer stored as string */ + if (!json_object_is_type(jobj, json_type_string)) + break; + len = sizeof(u64); + if (ptr) { + u64 = cpu_to_be64(crypt_jobj_get_uint64(jobj)); + memcpy(ptr, &u64, len); + } + break; + case JX64: /* Unsigned 64bit segment size (allows "dynamic") */ + if (!json_object_is_type(jobj, json_type_string)) + break; + if (!strcmp(json_object_get_string(jobj), "dynamic")) { + len = strlen("dynamic"); + if (ptr) + memcpy(ptr, json_object_get_string(jobj), len); + } else { + len = sizeof(u64); + u64 = cpu_to_be64(crypt_jobj_get_uint64(jobj)); + if (ptr) + memcpy(ptr, &u64, len); + } + break; + case JU32: /* Unsigned 32bit integer, stored as JSON int */ + if (!json_object_is_type(jobj, json_type_int)) + return 0; + len = sizeof(u32); + if (ptr) { + u32 = cpu_to_be32(crypt_jobj_get_uint32(jobj)); + memcpy(ptr, &u32, len); + } + break; + case JNONE: + return 0; + }; + + return len; +} + +static size_t srs(struct jtype j[], uint8_t *ptr) +{ + size_t l, len = 0; + + while(j->jobj) { + l = sr(j, ptr); + if (!l) + return 0; + len += l; + if (ptr) + ptr += l; + j++; + } + return len; +} + +static size_t segment_linear_serialize(json_object *jobj_segment, uint8_t *buffer) +{ + struct jtype j[] = { + { JSTR, jobj_segment, "type" }, + { JU64, jobj_segment, "offset" }, + { JX64, jobj_segment, "size" }, + {} + }; + return srs(j, buffer); +} + +static size_t segment_crypt_serialize(json_object *jobj_segment, uint8_t *buffer) +{ + struct jtype j[] = { + { JSTR, jobj_segment, "type" }, + { JU64, jobj_segment, "offset" }, + { JX64, jobj_segment, "size" }, + { JU64, jobj_segment, "iv_tweak" }, + { JSTR, jobj_segment, "encryption" }, + { JU32, jobj_segment, "sector_size" }, + {} + }; + return srs(j, buffer); +} + +static size_t segment_serialize(json_object *jobj_segment, uint8_t *buffer) +{ + json_object *jobj_type; + const char *segment_type; + + if (!json_object_object_get_ex(jobj_segment, "type", &jobj_type)) + return 0; + + if (!(segment_type = json_object_get_string(jobj_type))) + return 0; + + if (!strcmp(segment_type, "crypt")) + return segment_crypt_serialize(jobj_segment, buffer); + else if (!strcmp(segment_type, "linear")) + return segment_linear_serialize(jobj_segment, buffer); + + return 0; +} + +static size_t backup_segments_serialize(struct luks2_hdr *hdr, uint8_t *buffer) +{ + json_object *jobj_segment; + size_t l, len = 0; + + jobj_segment = LUKS2_get_segment_by_flag(hdr, "backup-previous"); + if (!jobj_segment || !(l = segment_serialize(jobj_segment, buffer))) + return 0; + len += l; + if (buffer) + buffer += l; + + jobj_segment = LUKS2_get_segment_by_flag(hdr, "backup-final"); + if (!jobj_segment || !(l = segment_serialize(jobj_segment, buffer))) + return 0; + len += l; + if (buffer) + buffer += l; + + jobj_segment = LUKS2_get_segment_by_flag(hdr, "backup-moved-segment"); + if (jobj_segment) { + if (!(l = segment_serialize(jobj_segment, buffer))) + return 0; + len += l; + } + + return len; +} + +static size_t reenc_keyslot_serialize(struct luks2_hdr *hdr, uint8_t *buffer) +{ + json_object *jobj_keyslot, *jobj_area, *jobj_type; + const char *area_type; + int keyslot_reencrypt; + + keyslot_reencrypt = LUKS2_find_keyslot(hdr, "reencrypt"); + if (keyslot_reencrypt < 0) + return 0; + + if (!(jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot_reencrypt))) + return 0; + + if (!json_object_object_get_ex(jobj_keyslot, "area", &jobj_area)) + return 0; + + if (!json_object_object_get_ex(jobj_area, "type", &jobj_type)) + return 0; + + if (!(area_type = json_object_get_string(jobj_type))) + return 0; + + struct jtype j[] = { + { JSTR, jobj_keyslot, "mode" }, + { JSTR, jobj_keyslot, "direction" }, + { JSTR, jobj_area, "type" }, + { JU64, jobj_area, "offset" }, + { JU64, jobj_area, "size" }, + {} + }; + struct jtype j_datashift[] = { + { JSTR, jobj_keyslot, "mode" }, + { JSTR, jobj_keyslot, "direction" }, + { JSTR, jobj_area, "type" }, + { JU64, jobj_area, "offset" }, + { JU64, jobj_area, "size" }, + { JU64, jobj_area, "shift_size" }, + {} + }; + struct jtype j_checksum[] = { + { JSTR, jobj_keyslot, "mode" }, + { JSTR, jobj_keyslot, "direction" }, + { JSTR, jobj_area, "type" }, + { JU64, jobj_area, "offset" }, + { JU64, jobj_area, "size" }, + { JSTR, jobj_area, "hash" }, + { JU32, jobj_area, "sector_size" }, + {} + }; + + if (!strcmp(area_type, "datashift")) + return srs(j_datashift, buffer); + else if (!strcmp(area_type, "checksum")) + return srs(j_checksum, buffer); + + return srs(j, buffer); +} + +static size_t blob_serialize(void *blob, size_t length, uint8_t *buffer) +{ + if (buffer) + memcpy(buffer, blob, length); + + return length; +} + +static int reencrypt_assembly_verification_data(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks, + struct volume_key **verification_data) +{ + uint8_t *ptr; + int digest_new, digest_old; + struct volume_key *data = NULL, *vk_old = NULL, *vk_new = NULL; + size_t keyslot_data_len, segments_data_len, data_len = 2; + + /* Keys - calculate length */ + digest_new = LUKS2_reencrypt_digest_new(hdr); + digest_old = LUKS2_reencrypt_digest_old(hdr); + + if (digest_old >= 0) { + vk_old = crypt_volume_key_by_id(vks, digest_old); + if (!vk_old) + return -EINVAL; + data_len += blob_serialize(vk_old->key, vk_old->keylength, NULL); + } + + if (digest_new >= 0 && digest_old != digest_new) { + vk_new = crypt_volume_key_by_id(vks, digest_new); + if (!vk_new) + return -EINVAL; + data_len += blob_serialize(vk_new->key, vk_new->keylength, NULL); + } + + if (data_len == 2) + return -EINVAL; + + /* Metadata - calculate length */ + if (!(keyslot_data_len = reenc_keyslot_serialize(hdr, NULL))) + return -EINVAL; + data_len += keyslot_data_len; + + if (!(segments_data_len = backup_segments_serialize(hdr, NULL))) + return -EINVAL; + data_len += segments_data_len; + + /* Alloc and fill serialization data */ + data = crypt_alloc_volume_key(data_len, NULL); + if (!data) + return -ENOMEM; + + ptr = (uint8_t*)data->key; + + /* v2 */ + *ptr++ = 0x76; + *ptr++ = 0x32; + + if (vk_old) + ptr += blob_serialize(vk_old->key, vk_old->keylength, ptr); + + if (vk_new) + ptr += blob_serialize(vk_new->key, vk_new->keylength, ptr); + + if (!reenc_keyslot_serialize(hdr, ptr)) + goto bad; + ptr += keyslot_data_len; + + if (!backup_segments_serialize(hdr, ptr)) + goto bad; + ptr += segments_data_len; + + assert((size_t)(ptr - (uint8_t*)data->key) == data_len); + + *verification_data = data; + + return 0; +bad: + crypt_free_volume_key(data); + return -EINVAL; +} + +int LUKS2_keyslot_reencrypt_digest_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks) +{ + int digest_reencrypt, keyslot_reencrypt, r; + struct volume_key *data; + + keyslot_reencrypt = LUKS2_find_keyslot(hdr, "reencrypt"); + if (keyslot_reencrypt < 0) + return keyslot_reencrypt; + + r = reencrypt_assembly_verification_data(cd, hdr, vks, &data); + if (r < 0) + return r; + + r = LUKS2_digest_create(cd, "pbkdf2", hdr, data); + crypt_free_volume_key(data); + if (r < 0) + return r; + + digest_reencrypt = r; + + r = LUKS2_digest_assign(cd, hdr, keyslot_reencrypt, CRYPT_ANY_DIGEST, 0, 0); + if (r < 0) + return r; + + return LUKS2_digest_assign(cd, hdr, keyslot_reencrypt, digest_reencrypt, 1, 0); +} + +int LUKS2_reencrypt_digest_verify(struct crypt_device *cd, + struct luks2_hdr *hdr, + struct volume_key *vks) +{ + int r, keyslot_reencrypt; + struct volume_key *data; + + keyslot_reencrypt = LUKS2_find_keyslot(hdr, "reencrypt"); + if (keyslot_reencrypt < 0) + return keyslot_reencrypt; + + r = reencrypt_assembly_verification_data(cd, hdr, vks, &data); + if (r < 0) + return r; + + r = LUKS2_digest_verify(cd, hdr, data, keyslot_reencrypt); + crypt_free_volume_key(data); + + if (r < 0) { + if (r == -ENOENT) + log_dbg(cd, "Reencryption digest is missing."); + log_err(cd, _("Reencryption metadata is invalid.")); + } else + log_dbg(cd, "Reencryption metadata verified."); + + return r; +} diff --git a/lib/luks2/luks2_segment.c b/lib/luks2/luks2_segment.c new file mode 100644 index 0000000..46a524d --- /dev/null +++ b/lib/luks2/luks2_segment.c @@ -0,0 +1,432 @@ +/* + * LUKS - Linux Unified Key Setup v2, internal segment handling + * + * Copyright (C) 2018-2021, Red Hat, Inc. All rights reserved. + * Copyright (C) 2018-2021, Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include "luks2_internal.h" + +/* use only on already validated 'segments' object */ +uint64_t json_segments_get_minimal_offset(json_object *jobj_segments, unsigned blockwise) +{ + uint64_t tmp, min = blockwise ? UINT64_MAX >> SECTOR_SHIFT : UINT64_MAX; + + if (!jobj_segments) + return 0; + + json_object_object_foreach(jobj_segments, key, val) { + UNUSED(key); + + if (json_segment_is_backup(val)) + continue; + + tmp = json_segment_get_offset(val, blockwise); + + if (!tmp) + return tmp; + + if (tmp < min) + min = tmp; + } + + return min; +} + +uint64_t json_segment_get_offset(json_object *jobj_segment, unsigned blockwise) +{ + json_object *jobj; + + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "offset", &jobj)) + return 0; + + return blockwise ? crypt_jobj_get_uint64(jobj) >> SECTOR_SHIFT : crypt_jobj_get_uint64(jobj); +} + +const char *json_segment_type(json_object *jobj_segment) +{ + json_object *jobj; + + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "type", &jobj)) + return NULL; + + return json_object_get_string(jobj); +} + +uint64_t json_segment_get_iv_offset(json_object *jobj_segment) +{ + json_object *jobj; + + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "iv_tweak", &jobj)) + return 0; + + return crypt_jobj_get_uint64(jobj); +} + +uint64_t json_segment_get_size(json_object *jobj_segment, unsigned blockwise) +{ + json_object *jobj; + + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "size", &jobj)) + return 0; + + return blockwise ? crypt_jobj_get_uint64(jobj) >> SECTOR_SHIFT : crypt_jobj_get_uint64(jobj); +} + +const char *json_segment_get_cipher(json_object *jobj_segment) +{ + json_object *jobj; + + /* FIXME: Pseudo "null" cipher should be handled elsewhere */ + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "encryption", &jobj)) + return "null"; + + return json_object_get_string(jobj); +} + +int json_segment_get_sector_size(json_object *jobj_segment) +{ + json_object *jobj; + + if (!jobj_segment || + !json_object_object_get_ex(jobj_segment, "sector_size", &jobj)) + return -1; + + return json_object_get_int(jobj); +} + +static json_object *json_segment_get_flags(json_object *jobj_segment) +{ + json_object *jobj; + + if (!jobj_segment || !(json_object_object_get_ex(jobj_segment, "flags", &jobj))) + return NULL; + return jobj; +} + +bool json_segment_contains_flag(json_object *jobj_segment, const char *flag_str, size_t len) +{ + int r, i; + json_object *jobj, *jobj_flags = json_segment_get_flags(jobj_segment); + + if (!jobj_flags) + return false; + + for (i = 0; i < (int)json_object_array_length(jobj_flags); i++) { + jobj = json_object_array_get_idx(jobj_flags, i); + if (len) + r = strncmp(json_object_get_string(jobj), flag_str, len); + else + r = strcmp(json_object_get_string(jobj), flag_str); + if (!r) + return true; + } + + return false; +} + +bool json_segment_is_backup(json_object *jobj_segment) +{ + return json_segment_contains_flag(jobj_segment, "backup-", 7); +} + +json_object *json_segments_get_segment(json_object *jobj_segments, int segment) +{ + json_object *jobj; + char segment_name[16]; + + if (snprintf(segment_name, sizeof(segment_name), "%u", segment) < 1) + return NULL; + + if (!json_object_object_get_ex(jobj_segments, segment_name, &jobj)) + return NULL; + + return jobj; +} + +unsigned json_segments_count(json_object *jobj_segments) +{ + unsigned count = 0; + + if (!jobj_segments) + return 0; + + json_object_object_foreach(jobj_segments, slot, val) { + UNUSED(slot); + if (!json_segment_is_backup(val)) + count++; + } + + return count; +} + +static void _get_segment_or_id_by_flag(json_object *jobj_segments, const char *flag, unsigned id, void *retval) +{ + json_object *jobj_flags, **jobj_ret = (json_object **)retval; + int *ret = (int *)retval; + + if (!flag) + return; + + json_object_object_foreach(jobj_segments, key, value) { + if (!json_object_object_get_ex(value, "flags", &jobj_flags)) + continue; + if (LUKS2_array_jobj(jobj_flags, flag)) { + if (id) + *ret = atoi(key); + else + *jobj_ret = value; + return; + } + } +} + +void json_segment_remove_flag(json_object *jobj_segment, const char *flag) +{ + json_object *jobj_flags, *jobj_flags_new; + + if (!jobj_segment) + return; + + jobj_flags = json_segment_get_flags(jobj_segment); + if (!jobj_flags) + return; + + jobj_flags_new = LUKS2_array_remove(jobj_flags, flag); + if (!jobj_flags_new) + return; + + if (json_object_array_length(jobj_flags_new) <= 0) { + json_object_put(jobj_flags_new); + json_object_object_del(jobj_segment, "flags"); + } else + json_object_object_add(jobj_segment, "flags", jobj_flags_new); +} + +static json_object *_segment_create_generic(const char *type, uint64_t offset, const uint64_t *length) +{ + json_object *jobj = json_object_new_object(); + if (!jobj) + return NULL; + + json_object_object_add(jobj, "type", json_object_new_string(type)); + json_object_object_add(jobj, "offset", crypt_jobj_new_uint64(offset)); + json_object_object_add(jobj, "size", length ? crypt_jobj_new_uint64(*length) : json_object_new_string("dynamic")); + + return jobj; +} + +json_object *json_segment_create_linear(uint64_t offset, const uint64_t *length, unsigned reencryption) +{ + json_object *jobj = _segment_create_generic("linear", offset, length); + if (reencryption) + LUKS2_segment_set_flag(jobj, "in-reencryption"); + return jobj; +} + +json_object *json_segment_create_crypt(uint64_t offset, + uint64_t iv_offset, const uint64_t *length, + const char *cipher, uint32_t sector_size, + unsigned reencryption) +{ + json_object *jobj = _segment_create_generic("crypt", offset, length); + if (!jobj) + return NULL; + + json_object_object_add(jobj, "iv_tweak", crypt_jobj_new_uint64(iv_offset)); + json_object_object_add(jobj, "encryption", json_object_new_string(cipher)); + json_object_object_add(jobj, "sector_size", json_object_new_int(sector_size)); + if (reencryption) + LUKS2_segment_set_flag(jobj, "in-reencryption"); + + return jobj; +} + +uint64_t LUKS2_segment_offset(struct luks2_hdr *hdr, int segment, unsigned blockwise) +{ + return json_segment_get_offset(LUKS2_get_segment_jobj(hdr, segment), blockwise); +} + +int json_segments_segment_in_reencrypt(json_object *jobj_segments) +{ + json_object *jobj_flags; + + json_object_object_foreach(jobj_segments, slot, val) { + if (!json_object_object_get_ex(val, "flags", &jobj_flags) || + !LUKS2_array_jobj(jobj_flags, "in-reencryption")) + continue; + + return atoi(slot); + } + + return -1; +} + +uint64_t LUKS2_segment_size(struct luks2_hdr *hdr, int segment, unsigned blockwise) +{ + return json_segment_get_size(LUKS2_get_segment_jobj(hdr, segment), blockwise); +} + +int LUKS2_segment_is_type(struct luks2_hdr *hdr, int segment, const char *type) +{ + return !strcmp(json_segment_type(LUKS2_get_segment_jobj(hdr, segment)) ?: "", type); +} + +int LUKS2_last_segment_by_type(struct luks2_hdr *hdr, const char *type) +{ + json_object *jobj_segments; + int last_found = -1; + + if (!type) + return -1; + + if (!json_object_object_get_ex(hdr->jobj, "segments", &jobj_segments)) + return -1; + + json_object_object_foreach(jobj_segments, slot, val) { + if (json_segment_is_backup(val)) + continue; + if (strcmp(type, json_segment_type(val) ?: "")) + continue; + + if (atoi(slot) > last_found) + last_found = atoi(slot); + } + + return last_found; +} + +int LUKS2_segment_by_type(struct luks2_hdr *hdr, const char *type) +{ + json_object *jobj_segments; + int first_found = -1; + + if (!type) + return -EINVAL; + + if (!json_object_object_get_ex(hdr->jobj, "segments", &jobj_segments)) + return -EINVAL; + + json_object_object_foreach(jobj_segments, slot, val) { + if (json_segment_is_backup(val)) + continue; + if (strcmp(type, json_segment_type(val) ?: "")) + continue; + + if (first_found < 0) + first_found = atoi(slot); + else if (atoi(slot) < first_found) + first_found = atoi(slot); + } + + return first_found; +} + +int LUKS2_segment_first_unused_id(struct luks2_hdr *hdr) +{ + json_object *jobj_segments; + int id, last_id = -1; + + if (!json_object_object_get_ex(hdr->jobj, "segments", &jobj_segments)) + return -EINVAL; + + json_object_object_foreach(jobj_segments, slot, val) { + UNUSED(val); + id = atoi(slot); + if (id > last_id) + last_id = id; + } + + return last_id + 1; +} + +int LUKS2_segment_set_flag(json_object *jobj_segment, const char *flag) +{ + json_object *jobj_flags; + + if (!jobj_segment || !flag) + return -EINVAL; + + if (!json_object_object_get_ex(jobj_segment, "flags", &jobj_flags)) { + jobj_flags = json_object_new_array(); + if (!jobj_flags) + return -ENOMEM; + json_object_object_add(jobj_segment, "flags", jobj_flags); + } + + if (LUKS2_array_jobj(jobj_flags, flag)) + return 0; + + json_object_array_add(jobj_flags, json_object_new_string(flag)); + + return 0; +} + +int LUKS2_segments_set(struct crypt_device *cd, struct luks2_hdr *hdr, + json_object *jobj_segments, int commit) +{ + json_object_object_add(hdr->jobj, "segments", jobj_segments); + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} + +int LUKS2_get_segment_id_by_flag(struct luks2_hdr *hdr, const char *flag) +{ + int ret = -ENOENT; + json_object *jobj_segments = LUKS2_get_segments_jobj(hdr); + + if (jobj_segments) + _get_segment_or_id_by_flag(jobj_segments, flag, 1, &ret); + + return ret; +} + +json_object *LUKS2_get_segment_by_flag(struct luks2_hdr *hdr, const char *flag) +{ + json_object *jobj_segment = NULL, + *jobj_segments = LUKS2_get_segments_jobj(hdr); + + if (jobj_segments) + _get_segment_or_id_by_flag(jobj_segments, flag, 0, &jobj_segment); + + return jobj_segment; +} + +/* compares key characteristics of both segments */ +bool json_segment_cmp(json_object *jobj_segment_1, json_object *jobj_segment_2) +{ + const char *type = json_segment_type(jobj_segment_1); + const char *type2 = json_segment_type(jobj_segment_2); + + if (!type || !type2) + return false; + + if (strcmp(type, type2)) + return false; + + if (!strcmp(type, "crypt")) + return (json_segment_get_sector_size(jobj_segment_1) == json_segment_get_sector_size(jobj_segment_2) && + !strcmp(json_segment_get_cipher(jobj_segment_1), + json_segment_get_cipher(jobj_segment_2))); + + return true; +} diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c new file mode 100644 index 0000000..9d0a889 --- /dev/null +++ b/lib/luks2/luks2_token.c @@ -0,0 +1,650 @@ +/* + * LUKS - Linux Unified Key Setup v2, token handling + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include + +#include "luks2_internal.h" + +/* Builtin tokens */ +extern const crypt_token_handler keyring_handler; + +static token_handler token_handlers[LUKS2_TOKENS_MAX] = { + /* keyring builtin token */ + { + .get = token_keyring_get, + .set = token_keyring_set, + .h = &keyring_handler + }, +}; + +static int is_builtin_candidate(const char *type) +{ + return !strncmp(type, LUKS2_BUILTIN_TOKEN_PREFIX, LUKS2_BUILTIN_TOKEN_PREFIX_LEN); +} + +int crypt_token_register(const crypt_token_handler *handler) +{ + int i; + + if (is_builtin_candidate(handler->name)) { + log_dbg(NULL, "'" LUKS2_BUILTIN_TOKEN_PREFIX "' is reserved prefix for builtin tokens."); + return -EINVAL; + } + + for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i].h; i++) { + if (!strcmp(token_handlers[i].h->name, handler->name)) { + log_dbg(NULL, "Keyslot handler %s is already registered.", handler->name); + return -EINVAL; + } + } + + if (i == LUKS2_TOKENS_MAX) + return -EINVAL; + + token_handlers[i].h = handler; + return 0; +} + +static const token_handler +*LUKS2_token_handler_type_internal(struct crypt_device *cd, const char *type) +{ + int i; + + for (i = 0; i < LUKS2_TOKENS_MAX && token_handlers[i].h; i++) + if (!strcmp(token_handlers[i].h->name, type)) + return token_handlers + i; + + return NULL; +} + +static const crypt_token_handler +*LUKS2_token_handler_type(struct crypt_device *cd, const char *type) +{ + const token_handler *th = LUKS2_token_handler_type_internal(cd, type); + + return th ? th->h : NULL; +} + +static const token_handler +*LUKS2_token_handler_internal(struct crypt_device *cd, int token) +{ + struct luks2_hdr *hdr; + json_object *jobj1, *jobj2; + + if (token < 0) + return NULL; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return NULL; + + if (!(jobj1 = LUKS2_get_token_jobj(hdr, token))) + return NULL; + + if (!json_object_object_get_ex(jobj1, "type", &jobj2)) + return NULL; + + return LUKS2_token_handler_type_internal(cd, json_object_get_string(jobj2)); +} + +static const crypt_token_handler +*LUKS2_token_handler(struct crypt_device *cd, int token) +{ + const token_handler *th = LUKS2_token_handler_internal(cd, token); + + return th ? th->h : NULL; +} + +static int LUKS2_token_find_free(struct luks2_hdr *hdr) +{ + int i; + + for (i = 0; i < LUKS2_TOKENS_MAX; i++) + if (!LUKS2_get_token_jobj(hdr, i)) + return i; + + return -EINVAL; +} + +int LUKS2_token_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *json, + int commit) +{ + const crypt_token_handler *h; + const token_handler *th; + json_object *jobj_tokens, *jobj_type, *jobj; + enum json_tokener_error jerr; + char num[16]; + + if (token == CRYPT_ANY_TOKEN) { + if (!json) + return -EINVAL; + token = LUKS2_token_find_free(hdr); + } + + if (token < 0 || token >= LUKS2_TOKENS_MAX) + return -EINVAL; + + if (!json_object_object_get_ex(hdr->jobj, "tokens", &jobj_tokens)) + return -EINVAL; + + if (snprintf(num, sizeof(num), "%d", token) < 0) + return -EINVAL; + + /* Remove token */ + if (!json) + json_object_object_del(jobj_tokens, num); + else { + + jobj = json_tokener_parse_verbose(json, &jerr); + if (!jobj) { + log_dbg(cd, "Token JSON parse failed."); + return -EINVAL; + } + + if (LUKS2_token_validate(cd, hdr->jobj, jobj, num)) { + json_object_put(jobj); + return -EINVAL; + } + + json_object_object_get_ex(jobj, "type", &jobj_type); + if (is_builtin_candidate(json_object_get_string(jobj_type))) { + th = LUKS2_token_handler_type_internal(cd, json_object_get_string(jobj_type)); + if (!th || !th->set) { + log_dbg(cd, "%s is builtin token candidate with missing handler", json_object_get_string(jobj_type)); + json_object_put(jobj); + return -EINVAL; + } + h = th->h; + } else + h = LUKS2_token_handler_type(cd, json_object_get_string(jobj_type)); + + if (h && h->validate && h->validate(cd, json)) { + json_object_put(jobj); + log_dbg(cd, "Token type %s validation failed.", h->name); + return -EINVAL; + } + + json_object_object_add(jobj_tokens, num, jobj); + if (LUKS2_check_json_size(cd, hdr)) { + log_dbg(cd, "Not enough space in header json area for new token."); + json_object_object_del(jobj_tokens, num); + return -ENOSPC; + } + } + + if (commit) + return LUKS2_hdr_write(cd, hdr) ?: token; + + return token; +} + +crypt_token_info LUKS2_token_status(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char **type) +{ + const char *tmp; + const token_handler *th; + json_object *jobj_type, *jobj_token; + + if (token < 0 || token >= LUKS2_TOKENS_MAX) + return CRYPT_TOKEN_INVALID; + + if (!(jobj_token = LUKS2_get_token_jobj(hdr, token))) + return CRYPT_TOKEN_INACTIVE; + + json_object_object_get_ex(jobj_token, "type", &jobj_type); + tmp = json_object_get_string(jobj_type); + + if ((th = LUKS2_token_handler_type_internal(cd, tmp))) { + if (type) + *type = th->h->name; + return th->set ? CRYPT_TOKEN_INTERNAL : CRYPT_TOKEN_EXTERNAL; + } + + if (type) + *type = tmp; + + return is_builtin_candidate(tmp) ? CRYPT_TOKEN_INTERNAL_UNKNOWN : CRYPT_TOKEN_EXTERNAL_UNKNOWN; +} + +int LUKS2_builtin_token_get(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *type, + void *params) +{ + const token_handler *th = LUKS2_token_handler_type_internal(cd, type); + + // internal error + assert(th && th->get); + + return th->get(LUKS2_get_token_jobj(hdr, token), params) ?: token; +} + +int LUKS2_builtin_token_create(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *type, + const void *params, + int commit) +{ + const token_handler *th; + int r; + json_object *jobj_token, *jobj_tokens; + + th = LUKS2_token_handler_type_internal(cd, type); + + // at this point all builtin handlers must exist and have validate fn defined + assert(th && th->set && th->h->validate); + + if (token == CRYPT_ANY_TOKEN) { + if ((token = LUKS2_token_find_free(hdr)) < 0) + log_err(cd, _("No free token slot.")); + } + if (token < 0 || token >= LUKS2_TOKENS_MAX) + return -EINVAL; + + r = th->set(&jobj_token, params); + if (r) { + log_err(cd, _("Failed to create builtin token %s."), type); + return r; + } + + // builtin tokens must produce valid json + r = LUKS2_token_validate(cd, hdr->jobj, jobj_token, "new"); + assert(!r); + r = th->h->validate(cd, json_object_to_json_string_ext(jobj_token, + JSON_C_TO_STRING_PLAIN | JSON_C_TO_STRING_NOSLASHESCAPE)); + assert(!r); + + json_object_object_get_ex(hdr->jobj, "tokens", &jobj_tokens); + json_object_object_add_by_uint(jobj_tokens, token, jobj_token); + if (LUKS2_check_json_size(cd, hdr)) { + log_dbg(cd, "Not enough space in header json area for new %s token.", type); + json_object_object_del_by_uint(jobj_tokens, token); + return -ENOSPC; + } + + if (commit) + return LUKS2_hdr_write(cd, hdr) ?: token; + + return token; +} + +static int LUKS2_token_open(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + char **buffer, + size_t *buffer_len, + void *usrptr) +{ + const char *json; + const crypt_token_handler *h; + int r; + + if (!(h = LUKS2_token_handler(cd, token))) + return -ENOENT; + + if (h->validate) { + if (LUKS2_token_json_get(cd, hdr, token, &json)) + return -EINVAL; + + if (h->validate(cd, json)) { + log_dbg(cd, "Token %d (%s) validation failed.", token, h->name); + return -EINVAL; + } + } + + r = h->open(cd, token, buffer, buffer_len, usrptr); + if (r < 0) + log_dbg(cd, "Token %d (%s) open failed with %d.", token, h->name, r); + + return r; +} + +static void LUKS2_token_buffer_free(struct crypt_device *cd, + int token, + void *buffer, + size_t buffer_len) +{ + const crypt_token_handler *h = LUKS2_token_handler(cd, token); + + if (h && h->buffer_free) + h->buffer_free(buffer, buffer_len); + else { + crypt_safe_memzero(buffer, buffer_len); + free(buffer); + } +} + +static int LUKS2_keyslot_open_by_token(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + int segment, + const char *buffer, + size_t buffer_len, + struct volume_key **vk) +{ + const crypt_token_handler *h; + json_object *jobj_token, *jobj_token_keyslots, *jobj; + unsigned int num = 0; + int i, r; + + if (!(h = LUKS2_token_handler(cd, token))) + return -ENOENT; + + jobj_token = LUKS2_get_token_jobj(hdr, token); + if (!jobj_token) + return -EINVAL; + + json_object_object_get_ex(jobj_token, "keyslots", &jobj_token_keyslots); + if (!jobj_token_keyslots) + return -EINVAL; + + /* Try to open keyslot referenced in token */ + r = -EINVAL; + for (i = 0; i < (int) json_object_array_length(jobj_token_keyslots) && r < 0; i++) { + jobj = json_object_array_get_idx(jobj_token_keyslots, i); + num = atoi(json_object_get_string(jobj)); + log_dbg(cd, "Trying to open keyslot %u with token %d (type %s).", num, token, h->name); + r = LUKS2_keyslot_open(cd, num, segment, buffer, buffer_len, vk); + } + + if (r < 0) + return r; + + return num; +} + +int LUKS2_token_open_and_activate(struct crypt_device *cd, + struct luks2_hdr *hdr, + int token, + const char *name, + uint32_t flags, + void *usrptr) +{ + bool use_keyring; + int keyslot, r; + char *buffer; + size_t buffer_len; + struct volume_key *vk = NULL; + + r = LUKS2_token_open(cd, hdr, token, &buffer, &buffer_len, usrptr); + if (r < 0) + return r; + + r = LUKS2_keyslot_open_by_token(cd, hdr, token, + (flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) ? + CRYPT_ANY_SEGMENT : CRYPT_DEFAULT_SEGMENT, + buffer, buffer_len, &vk); + + LUKS2_token_buffer_free(cd, token, buffer, buffer_len); + + if (r < 0) + return r; + + keyslot = r; + + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = ((name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || + (flags & CRYPT_ACTIVATE_KEYRING_KEY)); + + if (use_keyring) { + if (!(r = LUKS2_volume_key_load_in_keyring_by_keyslot(cd, hdr, vk, keyslot))) + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + if (r >= 0 && name) + r = LUKS2_activate(cd, name, vk, flags); + + if (r < 0) + crypt_drop_keyring_key(cd, vk); + crypt_free_volume_key(vk); + + return r < 0 ? r : keyslot; +} + +int LUKS2_token_open_and_activate_any(struct crypt_device *cd, + struct luks2_hdr *hdr, + const char *name, + uint32_t flags) +{ + char *buffer; + json_object *tokens_jobj; + size_t buffer_len; + int keyslot, token, r = -EINVAL; + struct volume_key *vk = NULL; + + json_object_object_get_ex(hdr->jobj, "tokens", &tokens_jobj); + + json_object_object_foreach(tokens_jobj, slot, val) { + UNUSED(val); + token = atoi(slot); + + r = LUKS2_token_open(cd, hdr, token, &buffer, &buffer_len, NULL); + if (r < 0) + continue; + + r = LUKS2_keyslot_open_by_token(cd, hdr, token, + (flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) ? + CRYPT_ANY_SEGMENT : CRYPT_DEFAULT_SEGMENT, + buffer, buffer_len, &vk); + LUKS2_token_buffer_free(cd, token, buffer, buffer_len); + if (r >= 0) + break; + } + + keyslot = r; + + if (r >= 0 && (name || (flags & CRYPT_ACTIVATE_KEYRING_KEY)) && crypt_use_keyring_for_vk(cd)) { + if (!(r = LUKS2_volume_key_load_in_keyring_by_keyslot(cd, hdr, vk, keyslot))) + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + if (r >= 0 && name) + r = LUKS2_activate(cd, name, vk, flags); + + if (r < 0) + crypt_drop_keyring_key(cd, vk); + crypt_free_volume_key(vk); + + return r < 0 ? r : keyslot; +} + +void LUKS2_token_dump(struct crypt_device *cd, int token) +{ + const crypt_token_handler *h; + json_object *jobj_token; + + h = LUKS2_token_handler(cd, token); + if (h && h->dump) { + jobj_token = LUKS2_get_token_jobj(crypt_get_hdr(cd, CRYPT_LUKS2), token); + if (jobj_token) + h->dump(cd, json_object_to_json_string_ext(jobj_token, + JSON_C_TO_STRING_PLAIN | JSON_C_TO_STRING_NOSLASHESCAPE)); + } +} + +int LUKS2_token_json_get(struct crypt_device *cd, struct luks2_hdr *hdr, + int token, const char **json) +{ + json_object *jobj_token; + + jobj_token = LUKS2_get_token_jobj(hdr, token); + if (!jobj_token) + return -EINVAL; + + *json = json_object_to_json_string_ext(jobj_token, + JSON_C_TO_STRING_PLAIN | JSON_C_TO_STRING_NOSLASHESCAPE); + return 0; +} + +static int assign_one_keyslot(struct crypt_device *cd, struct luks2_hdr *hdr, + int token, int keyslot, int assign) +{ + json_object *jobj1, *jobj_token, *jobj_token_keyslots; + char num[16]; + + log_dbg(cd, "Keyslot %i %s token %i.", keyslot, assign ? "assigned to" : "unassigned from", token); + + jobj_token = LUKS2_get_token_jobj(hdr, token); + if (!jobj_token) + return -EINVAL; + + json_object_object_get_ex(jobj_token, "keyslots", &jobj_token_keyslots); + if (!jobj_token_keyslots) + return -EINVAL; + + if (snprintf(num, sizeof(num), "%d", keyslot) < 0) + return -EINVAL; + + if (assign) { + jobj1 = LUKS2_array_jobj(jobj_token_keyslots, num); + if (!jobj1) + json_object_array_add(jobj_token_keyslots, json_object_new_string(num)); + } else { + jobj1 = LUKS2_array_remove(jobj_token_keyslots, num); + if (jobj1) + json_object_object_add(jobj_token, "keyslots", jobj1); + } + + return 0; +} + +static int assign_one_token(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, int token, int assign) +{ + json_object *jobj_keyslots; + int r = 0; + + if (!LUKS2_get_token_jobj(hdr, token)) + return -EINVAL; + + if (keyslot == CRYPT_ANY_SLOT) { + json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots); + + json_object_object_foreach(jobj_keyslots, key, val) { + UNUSED(val); + r = assign_one_keyslot(cd, hdr, token, atoi(key), assign); + if (r < 0) + break; + } + } else + r = assign_one_keyslot(cd, hdr, token, keyslot, assign); + + return r; +} + +int LUKS2_token_assign(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, int token, int assign, int commit) +{ + json_object *jobj_tokens; + int r = 0; + + if (token == CRYPT_ANY_TOKEN) { + json_object_object_get_ex(hdr->jobj, "tokens", &jobj_tokens); + + json_object_object_foreach(jobj_tokens, key, val) { + UNUSED(val); + r = assign_one_token(cd, hdr, keyslot, atoi(key), assign); + if (r < 0) + break; + } + } else + r = assign_one_token(cd, hdr, keyslot, token, assign); + + if (r < 0) + return r; + + // FIXME: do not write header in nothing changed + if (commit) + return LUKS2_hdr_write(cd, hdr) ?: token; + + return token; +} + +static int token_is_assigned(struct luks2_hdr *hdr, int keyslot, int token) +{ + int i; + json_object *jobj, *jobj_token_keyslots, + *jobj_token = LUKS2_get_token_jobj(hdr, token); + + if (!jobj_token) + return -ENOENT; + + json_object_object_get_ex(jobj_token, "keyslots", &jobj_token_keyslots); + + for (i = 0; i < (int) json_object_array_length(jobj_token_keyslots); i++) { + jobj = json_object_array_get_idx(jobj_token_keyslots, i); + if (keyslot == atoi(json_object_get_string(jobj))) + return 0; + } + + return -ENOENT; +} + +int LUKS2_token_is_assigned(struct crypt_device *cd, struct luks2_hdr *hdr, + int keyslot, int token) +{ + if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX || token < 0 || token >= LUKS2_TOKENS_MAX) + return -EINVAL; + + return token_is_assigned(hdr, keyslot, token); +} + +int LUKS2_tokens_count(struct luks2_hdr *hdr) +{ + json_object *jobj_tokens = LUKS2_get_tokens_jobj(hdr); + if (!jobj_tokens) + return -EINVAL; + + return json_object_object_length(jobj_tokens); +} + +int LUKS2_token_assignment_copy(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot_from, + int keyslot_to, + int commit) +{ + int i, r; + + if (keyslot_from < 0 || keyslot_from >= LUKS2_KEYSLOTS_MAX || keyslot_to < 0 || keyslot_to >= LUKS2_KEYSLOTS_MAX) + return -EINVAL; + + r = LUKS2_tokens_count(hdr); + if (r <= 0) + return r; + + for (i = 0; i < LUKS2_TOKENS_MAX; i++) { + if (!token_is_assigned(hdr, keyslot_from, i)) { + if ((r = assign_one_token(cd, hdr, keyslot_to, i, 1))) + return r; + } + } + + return commit ? LUKS2_hdr_write(cd, hdr) : 0; +} diff --git a/lib/luks2/luks2_token_keyring.c b/lib/luks2/luks2_token_keyring.c new file mode 100644 index 0000000..be4f4a6 --- /dev/null +++ b/lib/luks2/luks2_token_keyring.c @@ -0,0 +1,170 @@ +/* + * LUKS - Linux Unified Key Setup v2, kernel keyring token + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include + +#include "luks2_internal.h" + +static int keyring_open(struct crypt_device *cd, + int token, + char **buffer, + size_t *buffer_len, + void *usrptr __attribute__((unused))) +{ + json_object *jobj_token, *jobj_key; + struct luks2_hdr *hdr; + int r; + + if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) + return -EINVAL; + + jobj_token = LUKS2_get_token_jobj(hdr, token); + if (!jobj_token) + return -EINVAL; + + json_object_object_get_ex(jobj_token, "key_description", &jobj_key); + + r = keyring_get_passphrase(json_object_get_string(jobj_key), buffer, buffer_len); + if (r == -ENOTSUP) { + log_dbg(cd, "Kernel keyring features disabled."); + return -EINVAL; + } else if (r < 0) { + log_dbg(cd, "keyring_get_passphrase failed (error %d)", r); + return -EINVAL; + } + + return 0; +} + +static int keyring_validate(struct crypt_device *cd __attribute__((unused)), + const char *json) +{ + enum json_tokener_error jerr; + json_object *jobj_token, *jobj_key; + int r = 1; + + log_dbg(cd, "Validating keyring token json"); + + jobj_token = json_tokener_parse_verbose(json, &jerr); + if (!jobj_token) { + log_dbg(cd, "Keyring token JSON parse failed."); + return r; + } + + if (json_object_object_length(jobj_token) != 3) { + log_dbg(cd, "Keyring token is expected to have exactly 3 fields."); + goto out; + } + + if (!json_object_object_get_ex(jobj_token, "key_description", &jobj_key)) { + log_dbg(cd, "missing key_description field."); + goto out; + } + + if (!json_object_is_type(jobj_key, json_type_string)) { + log_dbg(cd, "key_description is not a string."); + goto out; + } + + /* TODO: perhaps check that key description is in '%s:%s' + * format where both strings are not empty */ + r = !strlen(json_object_get_string(jobj_key)); +out: + json_object_put(jobj_token); + return r; +} + +static void keyring_dump(struct crypt_device *cd, const char *json) +{ + enum json_tokener_error jerr; + json_object *jobj_token, *jobj_key; + + jobj_token = json_tokener_parse_verbose(json, &jerr); + if (!jobj_token) + return; + + if (!json_object_object_get_ex(jobj_token, "key_description", &jobj_key)) { + json_object_put(jobj_token); + return; + } + + log_std(cd, "\tKey description: %s\n", json_object_get_string(jobj_key)); + + json_object_put(jobj_token); +} + +int token_keyring_set(json_object **jobj_builtin_token, + const void *params) +{ + json_object *jobj_token, *jobj; + const struct crypt_token_params_luks2_keyring *keyring_params = (const struct crypt_token_params_luks2_keyring *) params; + + jobj_token = json_object_new_object(); + if (!jobj_token) + return -ENOMEM; + + jobj = json_object_new_string(LUKS2_TOKEN_KEYRING); + if (!jobj) { + json_object_put(jobj_token); + return -ENOMEM; + } + json_object_object_add(jobj_token, "type", jobj); + + jobj = json_object_new_array(); + if (!jobj) { + json_object_put(jobj_token); + return -ENOMEM; + } + json_object_object_add(jobj_token, "keyslots", jobj); + + jobj = json_object_new_string(keyring_params->key_description); + if (!jobj) { + json_object_put(jobj_token); + return -ENOMEM; + } + json_object_object_add(jobj_token, "key_description", jobj); + + *jobj_builtin_token = jobj_token; + return 0; +} + +int token_keyring_get(json_object *jobj_token, + void *params) +{ + json_object *jobj; + struct crypt_token_params_luks2_keyring *keyring_params = (struct crypt_token_params_luks2_keyring *) params; + + json_object_object_get_ex(jobj_token, "type", &jobj); + assert(!strcmp(json_object_get_string(jobj), LUKS2_TOKEN_KEYRING)); + + json_object_object_get_ex(jobj_token, "key_description", &jobj); + + keyring_params->key_description = json_object_get_string(jobj); + + return 0; +} + +const crypt_token_handler keyring_handler = { + .name = LUKS2_TOKEN_KEYRING, + .open = keyring_open, + .validate = keyring_validate, + .dump = keyring_dump +}; diff --git a/lib/nls.h b/lib/nls.h new file mode 100644 index 0000000..39760b1 --- /dev/null +++ b/lib/nls.h @@ -0,0 +1,34 @@ +#ifndef CRYPTSETUP_NLS_H +#define CRYPTSETUP_NLS_H + +#ifndef LOCALEDIR +#define LOCALEDIR "/usr/share/locale" +#endif + +#ifdef HAVE_LOCALE_H +# include +#else +# undef setlocale +# define setlocale(Category, Locale) /* empty */ +#endif + +#ifdef ENABLE_NLS +# include +# define _(Text) gettext (Text) +# ifdef gettext_noop +# define N_(String) gettext_noop (String) +# else +# define N_(String) (String) +# endif +#else +# undef bindtextdomain +# define bindtextdomain(Domain, Directory) /* empty */ +# undef textdomain +# define textdomain(Domain) /* empty */ +# define _(Text) (Text) +# define N_(Text) (Text) +# define ngettext(Singular, Plural, Count) \ + ( (Count) == 1 ? (Singular) : (Plural) ) +#endif + +#endif /* CRYPTSETUP_NLS_H */ diff --git a/lib/random.c b/lib/random.c new file mode 100644 index 0000000..ee5df63 --- /dev/null +++ b/lib/random.c @@ -0,0 +1,245 @@ +/* + * cryptsetup kernel RNG access functions + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "internal.h" + +static int random_initialised = 0; + +#define URANDOM_DEVICE "/dev/urandom" +static int urandom_fd = -1; + +#define RANDOM_DEVICE "/dev/random" +static int random_fd = -1; + +/* Read random chunk - gathered data usually appears with this granularity */ +#define RANDOM_DEVICE_CHUNK 8 + +/* Timeout to print warning if no random data (entropy) */ +#define RANDOM_DEVICE_TIMEOUT 5 + +/* URANDOM_DEVICE access */ +static int _get_urandom(struct crypt_device *ctx __attribute__((unused)), + char *buf, size_t len) +{ + int r; + size_t old_len = len; + char *old_buf = buf; + + assert(urandom_fd != -1); + + while(len) { + r = read(urandom_fd, buf, len); + if (r == -1 && errno != EINTR) + return -EINVAL; + if (r > 0) { + len -= r; + buf += r; + } + } + + assert(len == 0); + assert((size_t)(buf - old_buf) == old_len); + + return 0; +} + +static void _get_random_progress(struct crypt_device *ctx, int warn, + size_t expected_len, size_t read_len) +{ + if (warn) + log_std(ctx, + _("System is out of entropy while generating volume key.\n" + "Please move mouse or type some text in another window " + "to gather some random events.\n")); + + log_std(ctx, _("Generating key (%d%% done).\n"), + (int)((expected_len - read_len) * 100 / expected_len)); +} + +/* RANDOM_DEVICE access */ +static int _get_random(struct crypt_device *ctx, char *buf, size_t len) +{ + int r, warn_once = 1; + size_t n, old_len = len; + char *old_buf = buf; + fd_set fds; + struct timeval tv; + + assert(random_fd != -1); + + while (len) { + FD_ZERO(&fds); + FD_SET(random_fd, &fds); + + tv.tv_sec = RANDOM_DEVICE_TIMEOUT; + tv.tv_usec = 0; + + r = select(random_fd + 1, &fds, NULL, NULL, &tv); + if(r == -1) + return -EINVAL; + + if(!r) { + _get_random_progress(ctx, warn_once, old_len, len); + warn_once = 0; + continue; + } + + do { + n = RANDOM_DEVICE_CHUNK; + if (len < RANDOM_DEVICE_CHUNK) + n = len; + + r = read(random_fd, buf, n); + + if (r == -1 && errno == EINTR) { + r = 0; + continue; + } + + /* bogus read? */ + if(r > (int)n) + return -EINVAL; + + /* random device is opened with O_NONBLOCK, EAGAIN is expected */ + if (r == -1 && (errno != EAGAIN && errno != EWOULDBLOCK)) + return -EINVAL; + + if (r > 0) { + len -= r; + buf += r; + } + } while (len && r > 0); + } + + assert(len == 0); + assert((size_t)(buf - old_buf) == old_len); + + if (!warn_once) + _get_random_progress(ctx, 0, old_len, len); + + return 0; +} +/* Initialisation of both RNG file descriptors is mandatory */ +int crypt_random_init(struct crypt_device *ctx) +{ + if (random_initialised) + return 0; + + /* Used for CRYPT_RND_NORMAL */ + if(urandom_fd == -1) + urandom_fd = open(URANDOM_DEVICE, O_RDONLY | O_CLOEXEC); + if(urandom_fd == -1) + goto fail; + + /* Used for CRYPT_RND_KEY */ + if(random_fd == -1) + random_fd = open(RANDOM_DEVICE, O_RDONLY | O_NONBLOCK | O_CLOEXEC); + if(random_fd == -1) + goto fail; + + if (crypt_fips_mode()) + log_verbose(ctx, _("Running in FIPS mode.")); + + random_initialised = 1; + return 0; +fail: + crypt_random_exit(); + log_err(ctx, _("Fatal error during RNG initialisation.")); + return -ENOSYS; +} + +int crypt_random_get(struct crypt_device *ctx, char *buf, size_t len, int quality) +{ + int status, rng_type; + + switch(quality) { + case CRYPT_RND_NORMAL: + status = _get_urandom(ctx, buf, len); + break; + case CRYPT_RND_SALT: + if (crypt_fips_mode()) + status = crypt_backend_rng(buf, len, quality, 1); + else + status = _get_urandom(ctx, buf, len); + break; + case CRYPT_RND_KEY: + if (crypt_fips_mode()) { + status = crypt_backend_rng(buf, len, quality, 1); + break; + } + rng_type = ctx ? crypt_get_rng_type(ctx) : + crypt_random_default_key_rng(); + switch (rng_type) { + case CRYPT_RNG_URANDOM: + status = _get_urandom(ctx, buf, len); + break; + case CRYPT_RNG_RANDOM: + status = _get_random(ctx, buf, len); + break; + default: + abort(); + } + break; + default: + log_err(ctx, _("Unknown RNG quality requested.")); + return -EINVAL; + } + + if (status) + log_err(ctx, _("Error reading from RNG.")); + + return status; +} + +void crypt_random_exit(void) +{ + random_initialised = 0; + + if(random_fd != -1) { + (void)close(random_fd); + random_fd = -1; + } + + if(urandom_fd != -1) { + (void)close(urandom_fd); + urandom_fd = -1; + } +} + +int crypt_random_default_key_rng(void) +{ + /* coverity[pointless_string_compare] */ + if (!strcmp(DEFAULT_RNG, RANDOM_DEVICE)) + return CRYPT_RNG_RANDOM; + + /* coverity[pointless_string_compare] */ + if (!strcmp(DEFAULT_RNG, URANDOM_DEVICE)) + return CRYPT_RNG_URANDOM; + + /* RNG misconfiguration is fatal */ + abort(); +} diff --git a/lib/setup.c b/lib/setup.c new file mode 100644 index 0000000..376b920 --- /dev/null +++ b/lib/setup.c @@ -0,0 +1,6110 @@ +/* + * libcryptsetup - cryptsetup library + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "luks.h" +#include "luks2.h" +#include "loopaes.h" +#include "verity.h" +#include "tcrypt.h" +#include "integrity.h" +#include "bitlk.h" +#include "utils_device_locking.h" +#include "internal.h" + +#define CRYPT_CD_UNRESTRICTED (1 << 0) +#define CRYPT_CD_QUIET (1 << 1) + +struct crypt_device { + char *type; + + struct device *device; + struct device *metadata_device; + + struct volume_key *volume_key; + int rng_type; + uint32_t compatibility; + struct crypt_pbkdf_type pbkdf; + + /* global context scope settings */ + unsigned key_in_keyring:1; + + uint64_t data_offset; + uint64_t metadata_size; /* Used in LUKS2 format */ + uint64_t keyslots_size; /* Used in LUKS2 format */ + + /* Workaround for OOM during parallel activation (like in systemd) */ + bool memory_hard_pbkdf_lock_enabled; + struct crypt_lock_handle *pbkdf_memory_hard_lock; + + // FIXME: private binary headers and access it properly + // through sub-library (LUKS1, TCRYPT) + + union { + struct { /* used in CRYPT_LUKS1 */ + struct luks_phdr hdr; + char *cipher_spec; + } luks1; + struct { /* used in CRYPT_LUKS2 */ + struct luks2_hdr hdr; + char cipher[MAX_CIPHER_LEN]; /* only for compatibility */ + char cipher_mode[MAX_CIPHER_LEN]; /* only for compatibility */ + char *keyslot_cipher; + unsigned int keyslot_key_size; + struct luks2_reencrypt *rh; + } luks2; + struct { /* used in CRYPT_PLAIN */ + struct crypt_params_plain hdr; + char *cipher_spec; + char *cipher; + const char *cipher_mode; + unsigned int key_size; + } plain; + struct { /* used in CRYPT_LOOPAES */ + struct crypt_params_loopaes hdr; + char *cipher_spec; + char *cipher; + const char *cipher_mode; + unsigned int key_size; + } loopaes; + struct { /* used in CRYPT_VERITY */ + struct crypt_params_verity hdr; + const char *root_hash; + unsigned int root_hash_size; + char *uuid; + struct device *fec_device; + } verity; + struct { /* used in CRYPT_TCRYPT */ + struct crypt_params_tcrypt params; + struct tcrypt_phdr hdr; + } tcrypt; + struct { /* used in CRYPT_INTEGRITY */ + struct crypt_params_integrity params; + struct volume_key *journal_mac_key; + struct volume_key *journal_crypt_key; + uint32_t sb_flags; + } integrity; + struct { /* used in CRYPT_BITLK */ + struct bitlk_metadata params; + char *cipher_spec; + } bitlk; + struct { /* used if initialized without header by name */ + char *active_name; + /* buffers, must refresh from kernel on every query */ + char cipher_spec[MAX_CIPHER_LEN*2+1]; + char cipher[MAX_CIPHER_LEN]; + const char *cipher_mode; + unsigned int key_size; + } none; + } u; + + /* callbacks definitions */ + void (*log)(int level, const char *msg, void *usrptr); + void *log_usrptr; + int (*confirm)(const char *msg, void *usrptr); + void *confirm_usrptr; +}; + +/* Just to suppress redundant messages about crypto backend */ +static int _crypto_logged = 0; + +/* Log helper */ +static void (*_default_log)(int level, const char *msg, void *usrptr) = NULL; +static int _debug_level = 0; + +/* Library can do metadata locking */ +static int _metadata_locking = 1; + +/* Library scope detection for kernel keyring support */ +static int _kernel_keyring_supported; + +/* Library allowed to use kernel keyring for loading VK in kernel crypto layer */ +static int _vk_via_keyring = 1; + +void crypt_set_debug_level(int level) +{ + _debug_level = level; +} + +int crypt_get_debug_level(void) +{ + return _debug_level; +} + +void crypt_log(struct crypt_device *cd, int level, const char *msg) +{ + if (!msg) + return; + + if (level < _debug_level) + return; + + if (cd && cd->log) + cd->log(level, msg, cd->log_usrptr); + else if (_default_log) + _default_log(level, msg, NULL); + /* Default to stdout/stderr if there is no callback. */ + else + fprintf(level == CRYPT_LOG_ERROR ? stderr : stdout, "%s", msg); +} + +__attribute__((format(printf, 5, 6))) +void logger(struct crypt_device *cd, int level, const char *file, + int line, const char *format, ...) +{ + va_list argp; + char target[LOG_MAX_LEN + 2]; + int len; + + va_start(argp, format); + + len = vsnprintf(&target[0], LOG_MAX_LEN, format, argp); + if (len > 0 && len < LOG_MAX_LEN) { + /* All verbose and error messages in tools end with EOL. */ + if (level == CRYPT_LOG_VERBOSE || level == CRYPT_LOG_ERROR || + level == CRYPT_LOG_DEBUG || level == CRYPT_LOG_DEBUG_JSON) + strncat(target, "\n", LOG_MAX_LEN); + + crypt_log(cd, level, target); + } + + va_end(argp); +} + +static const char *mdata_device_path(struct crypt_device *cd) +{ + return device_path(cd->metadata_device ?: cd->device); +} + +static const char *data_device_path(struct crypt_device *cd) +{ + return device_path(cd->device); +} + +/* internal only */ +struct device *crypt_metadata_device(struct crypt_device *cd) +{ + return cd->metadata_device ?: cd->device; +} + +struct device *crypt_data_device(struct crypt_device *cd) +{ + return cd->device; +} + +int init_crypto(struct crypt_device *ctx) +{ + struct utsname uts; + int r; + + r = crypt_random_init(ctx); + if (r < 0) { + log_err(ctx, _("Cannot initialize crypto RNG backend.")); + return r; + } + + r = crypt_backend_init(); + if (r < 0) + log_err(ctx, _("Cannot initialize crypto backend.")); + + if (!r && !_crypto_logged) { + log_dbg(ctx, "Crypto backend (%s) initialized in cryptsetup library version %s.", + crypt_backend_version(), PACKAGE_VERSION); + if (!uname(&uts)) + log_dbg(ctx, "Detected kernel %s %s %s.", + uts.sysname, uts.release, uts.machine); + _crypto_logged = 1; + } + + return r; +} + +static int process_key(struct crypt_device *cd, const char *hash_name, + size_t key_size, const char *pass, size_t passLen, + struct volume_key **vk) +{ + int r; + + if (!key_size) + return -EINVAL; + + *vk = crypt_alloc_volume_key(key_size, NULL); + if (!*vk) + return -ENOMEM; + + if (hash_name) { + r = crypt_plain_hash(cd, hash_name, (*vk)->key, key_size, pass, passLen); + if (r < 0) { + if (r == -ENOENT) + log_err(cd, _("Hash algorithm %s not supported."), + hash_name); + else + log_err(cd, _("Key processing error (using hash %s)."), + hash_name); + crypt_free_volume_key(*vk); + *vk = NULL; + return -EINVAL; + } + } else if (passLen > key_size) { + memcpy((*vk)->key, pass, key_size); + } else { + memcpy((*vk)->key, pass, passLen); + } + + return 0; +} + +static int isPLAIN(const char *type) +{ + return (type && !strcmp(CRYPT_PLAIN, type)); +} + +static int isLUKS1(const char *type) +{ + return (type && !strcmp(CRYPT_LUKS1, type)); +} + +static int isLUKS2(const char *type) +{ + return (type && !strcmp(CRYPT_LUKS2, type)); +} + +static int isLUKS(const char *type) +{ + return (isLUKS2(type) || isLUKS1(type)); +} + +static int isLOOPAES(const char *type) +{ + return (type && !strcmp(CRYPT_LOOPAES, type)); +} + +static int isVERITY(const char *type) +{ + return (type && !strcmp(CRYPT_VERITY, type)); +} + +static int isTCRYPT(const char *type) +{ + return (type && !strcmp(CRYPT_TCRYPT, type)); +} + +static int isINTEGRITY(const char *type) +{ + return (type && !strcmp(CRYPT_INTEGRITY, type)); +} + +static int isBITLK(const char *type) +{ + return (type && !strcmp(CRYPT_BITLK, type)); +} + +static int _onlyLUKS(struct crypt_device *cd, uint32_t cdflags) +{ + int r = 0; + + if (cd && !cd->type) { + if (!(cdflags & CRYPT_CD_QUIET)) + log_err(cd, _("Cannot determine device type. Incompatible activation of device?")); + r = -EINVAL; + } + + if (!cd || !isLUKS(cd->type)) { + if (!(cdflags & CRYPT_CD_QUIET)) + log_err(cd, _("This operation is supported only for LUKS device.")); + r = -EINVAL; + } + + if (r || (cdflags & CRYPT_CD_UNRESTRICTED) || isLUKS1(cd->type)) + return r; + + return LUKS2_unmet_requirements(cd, &cd->u.luks2.hdr, 0, cdflags & CRYPT_CD_QUIET); +} + +static int onlyLUKS(struct crypt_device *cd) +{ + return _onlyLUKS(cd, 0); +} + +static int _onlyLUKS2(struct crypt_device *cd, uint32_t cdflags, uint32_t mask) +{ + int r = 0; + + if (cd && !cd->type) { + if (!(cdflags & CRYPT_CD_QUIET)) + log_err(cd, _("Cannot determine device type. Incompatible activation of device?")); + r = -EINVAL; + } + + if (!cd || !isLUKS2(cd->type)) { + if (!(cdflags & CRYPT_CD_QUIET)) + log_err(cd, _("This operation is supported only for LUKS2 device.")); + r = -EINVAL; + } + + if (r || (cdflags & CRYPT_CD_UNRESTRICTED)) + return r; + + return LUKS2_unmet_requirements(cd, &cd->u.luks2.hdr, mask, cdflags & CRYPT_CD_QUIET); +} + +/* Internal only */ +int onlyLUKS2(struct crypt_device *cd) +{ + return _onlyLUKS2(cd, 0, 0); +} + +/* Internal only */ +int onlyLUKS2mask(struct crypt_device *cd, uint32_t mask) +{ + return _onlyLUKS2(cd, 0, mask); +} + +static void crypt_set_null_type(struct crypt_device *cd) +{ + if (!cd->type) + return; + + free(cd->type); + cd->type = NULL; + cd->u.none.active_name = NULL; + cd->data_offset = 0; + cd->metadata_size = 0; + cd->keyslots_size = 0; +} + +static void crypt_reset_null_type(struct crypt_device *cd) +{ + if (cd->type) + return; + + free(cd->u.none.active_name); + cd->u.none.active_name = NULL; +} + +/* keyslot helpers */ +static int keyslot_verify_or_find_empty(struct crypt_device *cd, int *keyslot) +{ + crypt_keyslot_info ki; + + if (*keyslot == CRYPT_ANY_SLOT) { + if (isLUKS1(cd->type)) + *keyslot = LUKS_keyslot_find_empty(&cd->u.luks1.hdr); + else + *keyslot = LUKS2_keyslot_find_empty(&cd->u.luks2.hdr); + if (*keyslot < 0) { + log_err(cd, _("All key slots full.")); + return -EINVAL; + } + } + + if (isLUKS1(cd->type)) + ki = LUKS_keyslot_info(&cd->u.luks1.hdr, *keyslot); + else + ki = LUKS2_keyslot_info(&cd->u.luks2.hdr, *keyslot); + switch (ki) { + case CRYPT_SLOT_INVALID: + log_err(cd, _("Key slot %d is invalid, please select between 0 and %d."), + *keyslot, LUKS_NUMKEYS - 1); + return -EINVAL; + case CRYPT_SLOT_INACTIVE: + break; + default: + log_err(cd, _("Key slot %d is full, please select another one."), + *keyslot); + return -EINVAL; + } + + log_dbg(cd, "Selected keyslot %d.", *keyslot); + return 0; +} + +/* + * compares UUIDs returned by device-mapper (striped by cryptsetup) and uuid in header + */ +int crypt_uuid_cmp(const char *dm_uuid, const char *hdr_uuid) +{ + int i, j; + char *str; + + if (!dm_uuid || !hdr_uuid) + return -EINVAL; + + str = strchr(dm_uuid, '-'); + if (!str) + return -EINVAL; + + for (i = 0, j = 1; hdr_uuid[i]; i++) { + if (hdr_uuid[i] == '-') + continue; + + if (!str[j] || str[j] == '-') + return -EINVAL; + + if (str[j] != hdr_uuid[i]) + return -EINVAL; + j++; + } + + return 0; +} + +/* + * compares type of active device to provided string (only if there is no explicit type) + */ +static int crypt_uuid_type_cmp(struct crypt_device *cd, const char *type) +{ + struct crypt_dm_active_device dmd; + size_t len; + int r; + + /* Must user header-on-disk if we know type here */ + if (cd->type || !cd->u.none.active_name) + return -EINVAL; + + log_dbg(cd, "Checking if active device %s without header has UUID type %s.", + cd->u.none.active_name, type); + + r = dm_query_device(cd, cd->u.none.active_name, DM_ACTIVE_UUID, &dmd); + if (r < 0) + return r; + + r = -ENODEV; + len = strlen(type); + if (dmd.uuid && strlen(dmd.uuid) > len && + !strncmp(dmd.uuid, type, len) && dmd.uuid[len] == '-') + r = 0; + + free(CONST_CAST(void*)dmd.uuid); + return r; +} + +int PLAIN_activate(struct crypt_device *cd, + const char *name, + struct volume_key *vk, + uint64_t size, + uint32_t flags) +{ + int r; + struct crypt_dm_active_device dmd = { + .flags = flags, + .size = size, + }; + + log_dbg(cd, "Trying to activate PLAIN device %s using cipher %s.", + name, crypt_get_cipher_spec(cd)); + + if (MISALIGNED(size, device_block_size(cd, crypt_data_device(cd)) >> SECTOR_SHIFT)) { + log_err(cd, _("Device size is not aligned to device logical block size.")); + return -EINVAL; + } + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), + vk, crypt_get_cipher_spec(cd), crypt_get_iv_offset(cd), + crypt_get_data_offset(cd), crypt_get_integrity(cd), + crypt_get_integrity_tag_size(cd), crypt_get_sector_size(cd)); + if (r < 0) + return r; + + r = create_or_reload_device(cd, name, CRYPT_PLAIN, &dmd); + + dm_targets_free(cd, &dmd); + return r; +} + +int crypt_confirm(struct crypt_device *cd, const char *msg) +{ + if (!cd || !cd->confirm) + return 1; + else + return cd->confirm(msg, cd->confirm_usrptr); +} + +void crypt_set_log_callback(struct crypt_device *cd, + void (*log)(int level, const char *msg, void *usrptr), + void *usrptr) +{ + if (!cd) + _default_log = log; + else { + cd->log = log; + cd->log_usrptr = usrptr; + } +} + +void crypt_set_confirm_callback(struct crypt_device *cd, + int (*confirm)(const char *msg, void *usrptr), + void *usrptr) +{ + if (cd) { + cd->confirm = confirm; + cd->confirm_usrptr = usrptr; + } +} + +const char *crypt_get_dir(void) +{ + return dm_get_dir(); +} + +int crypt_init(struct crypt_device **cd, const char *device) +{ + struct crypt_device *h = NULL; + int r; + + if (!cd) + return -EINVAL; + + log_dbg(NULL, "Allocating context for crypt device %s.", device ?: "(none)"); +#if !HAVE_DECL_O_CLOEXEC + log_dbg(NULL, "Running without O_CLOEXEC."); +#endif + + if (!(h = malloc(sizeof(struct crypt_device)))) + return -ENOMEM; + + memset(h, 0, sizeof(*h)); + + r = device_alloc(NULL, &h->device, device); + if (r < 0) + goto bad; + + dm_backend_init(NULL); + + h->rng_type = crypt_random_default_key_rng(); + + *cd = h; + return 0; +bad: + device_free(NULL, h->device); + free(h); + return r; +} + +static int crypt_check_data_device_size(struct crypt_device *cd) +{ + int r; + uint64_t size, size_min; + + /* Check data device size, require at least header or one sector */ + size_min = crypt_get_data_offset(cd) << SECTOR_SHIFT ?: SECTOR_SIZE; + + r = device_size(cd->device, &size); + if (r < 0) + return r; + + if (size < size_min) { + log_err(cd, _("Header detected but device %s is too small."), + device_path(cd->device)); + return -EINVAL; + } + + return r; +} + +static int _crypt_set_data_device(struct crypt_device *cd, const char *device) +{ + struct device *dev = NULL; + int r; + + r = device_alloc(cd, &dev, device); + if (r < 0) + return r; + + if (!cd->metadata_device) { + cd->metadata_device = cd->device; + } else + device_free(cd, cd->device); + + cd->device = dev; + + return crypt_check_data_device_size(cd); +} + +int crypt_set_data_device(struct crypt_device *cd, const char *device) +{ + /* metadata device must be set */ + if (!cd || !cd->device || !device) + return -EINVAL; + + log_dbg(cd, "Setting ciphertext data device to %s.", device ?: "(none)"); + + if (!isLUKS1(cd->type) && !isLUKS2(cd->type) && !isVERITY(cd->type) && + !isINTEGRITY(cd->type) && !isTCRYPT(cd->type)) { + log_err(cd, _("This operation is not supported for this device type.")); + return -EINVAL; + } + + if (isLUKS2(cd->type) && crypt_get_luks2_reencrypt(cd)) { + log_err(cd, _("Illegal operation with reencryption in-progress.")); + return -EINVAL; + } + + return _crypt_set_data_device(cd, device); +} + +int crypt_init_data_device(struct crypt_device **cd, const char *device, const char *data_device) +{ + int r; + + if (!cd) + return -EINVAL; + + r = crypt_init(cd, device); + if (r || !data_device || !strcmp(device, data_device)) + return r; + + log_dbg(NULL, "Setting ciphertext data device to %s.", data_device); + r = _crypt_set_data_device(*cd, data_device); + if (r) { + crypt_free(*cd); + *cd = NULL; + } + + return r; +} + + +/* internal only */ +struct crypt_pbkdf_type *crypt_get_pbkdf(struct crypt_device *cd) +{ + return &cd->pbkdf; +} + +/* + * crypt_load() helpers + */ +static int _crypt_load_luks2(struct crypt_device *cd, int reload, int repair) +{ + int r; + char *type = NULL; + struct luks2_hdr hdr2 = {}; + + log_dbg(cd, "%soading LUKS2 header (repair %sabled).", reload ? "Rel" : "L", repair ? "en" : "dis"); + + r = LUKS2_hdr_read(cd, &hdr2, repair); + if (r) + return r; + + if (!reload && !(type = strdup(CRYPT_LUKS2))) { + r = -ENOMEM; + goto out; + } + + if (verify_pbkdf_params(cd, &cd->pbkdf)) { + r = init_pbkdf_type(cd, NULL, CRYPT_LUKS2); + if (r) + goto out; + } + + if (reload) { + LUKS2_hdr_free(cd, &cd->u.luks2.hdr); + free(cd->u.luks2.keyslot_cipher); + } else + cd->type = type; + + r = 0; + memcpy(&cd->u.luks2.hdr, &hdr2, sizeof(hdr2)); + cd->u.luks2.keyslot_cipher = NULL; + cd->u.luks2.rh = NULL; + +out: + if (r) { + free(type); + LUKS2_hdr_free(cd, &hdr2); + } + return r; +} + +static void _luks2_reload(struct crypt_device *cd) +{ + if (!cd || !isLUKS2(cd->type)) + return; + + (void) _crypt_load_luks2(cd, 1, 0); +} + +static int _crypt_load_luks(struct crypt_device *cd, const char *requested_type, + int require_header, int repair) +{ + char *cipher_spec; + struct luks_phdr hdr = {}; + int r, version; + + r = init_crypto(cd); + if (r < 0) + return r; + + /* This will return 0 if primary LUKS2 header is damaged */ + version = LUKS2_hdr_version_unlocked(cd, NULL); + + if ((isLUKS1(requested_type) && version == 2) || + (isLUKS2(requested_type) && version == 1)) + return -EINVAL; + + if (requested_type) + version = 0; + + if (isLUKS1(requested_type) || version == 1) { + if (cd->type && isLUKS2(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + + if (verify_pbkdf_params(cd, &cd->pbkdf)) { + r = init_pbkdf_type(cd, NULL, CRYPT_LUKS1); + if (r) + return r; + } + + r = LUKS_read_phdr(&hdr, require_header, repair, cd); + if (r) + goto out; + + if (!cd->type && !(cd->type = strdup(CRYPT_LUKS1))) { + r = -ENOMEM; + goto out; + } + + /* Set hash to the same as in the loaded header */ + if (!cd->pbkdf.hash || strcmp(cd->pbkdf.hash, hdr.hashSpec)) { + free(CONST_CAST(void*)cd->pbkdf.hash); + cd->pbkdf.hash = strdup(hdr.hashSpec); + if (!cd->pbkdf.hash) { + r = -ENOMEM; + goto out; + } + } + + if (asprintf(&cipher_spec, "%s-%s", hdr.cipherName, hdr.cipherMode) < 0) { + r = -ENOMEM; + goto out; + } + + free(cd->u.luks1.cipher_spec); + cd->u.luks1.cipher_spec = cipher_spec; + + memcpy(&cd->u.luks1.hdr, &hdr, sizeof(hdr)); + } else if (isLUKS2(requested_type) || version == 2 || version == 0) { + if (cd->type && isLUKS1(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + + /* + * Current LUKS2 repair just overrides blkid probes + * and perform auto-recovery if possible. This is safe + * unless future LUKS2 repair code do something more + * sophisticated. In such case we would need to check + * for LUKS2 requirements and decide if it's safe to + * perform repair. + */ + r = _crypt_load_luks2(cd, cd->type != NULL, repair); + } else { + if (version > 2) + log_err(cd, _("Unsupported LUKS version %d."), version); + r = -EINVAL; + } +out: + crypt_safe_memzero(&hdr, sizeof(hdr)); + + return r; +} + +static int _crypt_load_tcrypt(struct crypt_device *cd, struct crypt_params_tcrypt *params) +{ + int r; + + if (!params) + return -EINVAL; + + r = init_crypto(cd); + if (r < 0) + return r; + + memcpy(&cd->u.tcrypt.params, params, sizeof(*params)); + + r = TCRYPT_read_phdr(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + + cd->u.tcrypt.params.passphrase = NULL; + cd->u.tcrypt.params.passphrase_size = 0; + cd->u.tcrypt.params.keyfiles = NULL; + cd->u.tcrypt.params.keyfiles_count = 0; + cd->u.tcrypt.params.veracrypt_pim = 0; + + if (r < 0) + return r; + + if (!cd->type && !(cd->type = strdup(CRYPT_TCRYPT))) + return -ENOMEM; + + return r; +} + +static int _crypt_load_verity(struct crypt_device *cd, struct crypt_params_verity *params) +{ + int r; + size_t sb_offset = 0; + + r = init_crypto(cd); + if (r < 0) + return r; + + if (params && params->flags & CRYPT_VERITY_NO_HEADER) + return -EINVAL; + + if (params) + sb_offset = params->hash_area_offset; + + r = VERITY_read_sb(cd, sb_offset, &cd->u.verity.uuid, &cd->u.verity.hdr); + if (r < 0) + return r; + + //FIXME: use crypt_free + if (!cd->type && !(cd->type = strdup(CRYPT_VERITY))) { + free(CONST_CAST(void*)cd->u.verity.hdr.hash_name); + free(CONST_CAST(void*)cd->u.verity.hdr.salt); + free(cd->u.verity.uuid); + crypt_safe_memzero(&cd->u.verity.hdr, sizeof(cd->u.verity.hdr)); + return -ENOMEM; + } + + if (params) + cd->u.verity.hdr.flags = params->flags; + + /* Hash availability checked in sb load */ + cd->u.verity.root_hash_size = crypt_hash_size(cd->u.verity.hdr.hash_name); + if (cd->u.verity.root_hash_size > 4096) + return -EINVAL; + + if (params && params->data_device && + (r = crypt_set_data_device(cd, params->data_device)) < 0) + return r; + + if (params && params->fec_device) { + r = device_alloc(cd, &cd->u.verity.fec_device, params->fec_device); + if (r < 0) + return r; + cd->u.verity.hdr.fec_area_offset = params->fec_area_offset; + cd->u.verity.hdr.fec_roots = params->fec_roots; + } + + return r; +} + +static int _crypt_load_integrity(struct crypt_device *cd, + struct crypt_params_integrity *params) +{ + int r; + + r = init_crypto(cd); + if (r < 0) + return r; + + r = INTEGRITY_read_sb(cd, &cd->u.integrity.params, &cd->u.integrity.sb_flags); + if (r < 0) + return r; + + // FIXME: add checks for fields in integrity sb vs params + + if (params) { + cd->u.integrity.params.journal_watermark = params->journal_watermark; + cd->u.integrity.params.journal_commit_time = params->journal_commit_time; + cd->u.integrity.params.buffer_sectors = params->buffer_sectors; + // FIXME: check ENOMEM + if (params->integrity) + cd->u.integrity.params.integrity = strdup(params->integrity); + cd->u.integrity.params.integrity_key_size = params->integrity_key_size; + if (params->journal_integrity) + cd->u.integrity.params.journal_integrity = strdup(params->journal_integrity); + if (params->journal_crypt) + cd->u.integrity.params.journal_crypt = strdup(params->journal_crypt); + + if (params->journal_crypt_key) { + cd->u.integrity.journal_crypt_key = + crypt_alloc_volume_key(params->journal_crypt_key_size, + params->journal_crypt_key); + if (!cd->u.integrity.journal_crypt_key) + return -ENOMEM; + } + if (params->journal_integrity_key) { + cd->u.integrity.journal_mac_key = + crypt_alloc_volume_key(params->journal_integrity_key_size, + params->journal_integrity_key); + if (!cd->u.integrity.journal_mac_key) + return -ENOMEM; + } + } + + if (!cd->type && !(cd->type = strdup(CRYPT_INTEGRITY))) { + free(CONST_CAST(void*)cd->u.integrity.params.integrity); + return -ENOMEM; + } + + return 0; +} + +static int _crypt_load_bitlk(struct crypt_device *cd, + struct bitlk_metadata *params) +{ + int r; + + r = init_crypto(cd); + if (r < 0) + return r; + + r = BITLK_read_sb(cd, &cd->u.bitlk.params); + if (r < 0) + return r; + + if (asprintf(&cd->u.bitlk.cipher_spec, "%s-%s", + cd->u.bitlk.params.cipher, cd->u.bitlk.params.cipher_mode) < 0) { + cd->u.bitlk.cipher_spec = NULL; + return -ENOMEM; + } + + if (!cd->type && !(cd->type = strdup(CRYPT_BITLK))) + return -ENOMEM; + + return 0; +} + +int crypt_load(struct crypt_device *cd, + const char *requested_type, + void *params) +{ + int r; + + if (!cd) + return -EINVAL; + + log_dbg(cd, "Trying to load %s crypt type from device %s.", + requested_type ?: "any", mdata_device_path(cd) ?: "(none)"); + + if (!crypt_metadata_device(cd)) + return -EINVAL; + + crypt_reset_null_type(cd); + cd->data_offset = 0; + cd->metadata_size = 0; + cd->keyslots_size = 0; + + if (!requested_type || isLUKS1(requested_type) || isLUKS2(requested_type)) { + if (cd->type && !isLUKS1(cd->type) && !isLUKS2(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + + r = _crypt_load_luks(cd, requested_type, 1, 0); + } else if (isVERITY(requested_type)) { + if (cd->type && !isVERITY(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + r = _crypt_load_verity(cd, params); + } else if (isTCRYPT(requested_type)) { + if (cd->type && !isTCRYPT(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + r = _crypt_load_tcrypt(cd, params); + } else if (isINTEGRITY(requested_type)) { + if (cd->type && !isINTEGRITY(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + r = _crypt_load_integrity(cd, params); + } else if (isBITLK(requested_type)) { + if (cd->type && !isBITLK(cd->type)) { + log_dbg(cd, "Context is already initialized to type %s", cd->type); + return -EINVAL; + } + r = _crypt_load_bitlk(cd, params); + } else + return -EINVAL; + + return r; +} + +/* + * crypt_init() helpers + */ +static int _init_by_name_crypt_none(struct crypt_device *cd) +{ + int r; + char _mode[MAX_CIPHER_LEN]; + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + + if (cd->type || !cd->u.none.active_name) + return -EINVAL; + + r = dm_query_device(cd, cd->u.none.active_name, + DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_CRYPT_KEYSIZE, &dmd); + if (r < 0) + return r; + if (!single_segment(&dmd) || tgt->type != DM_CRYPT) + r = -EINVAL; + if (r >= 0) + r = crypt_parse_name_and_mode(tgt->u.crypt.cipher, + cd->u.none.cipher, NULL, + _mode); + + if (!r) { + r = snprintf(cd->u.none.cipher_spec, sizeof(cd->u.none.cipher_spec), + "%s-%s", cd->u.none.cipher, _mode); + if (r < 0 || (size_t)r >= sizeof(cd->u.none.cipher_spec)) + r = -EINVAL; + else { + cd->u.none.cipher_mode = cd->u.none.cipher_spec + strlen(cd->u.none.cipher) + 1; + cd->u.none.key_size = tgt->u.crypt.vk->keylength; + r = 0; + } + } + + dm_targets_free(cd, &dmd); + return r; +} + +static const char *LUKS_UUID(struct crypt_device *cd) +{ + if (!cd) + return NULL; + else if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.uuid; + else if (isLUKS2(cd->type)) + return cd->u.luks2.hdr.uuid; + + return NULL; +} + +static void crypt_free_type(struct crypt_device *cd) +{ + if (isPLAIN(cd->type)) { + free(CONST_CAST(void*)cd->u.plain.hdr.hash); + free(cd->u.plain.cipher); + free(cd->u.plain.cipher_spec); + } else if (isLUKS2(cd->type)) { + LUKS2_reencrypt_free(cd, cd->u.luks2.rh); + LUKS2_hdr_free(cd, &cd->u.luks2.hdr); + free(cd->u.luks2.keyslot_cipher); + } else if (isLUKS1(cd->type)) { + free(cd->u.luks1.cipher_spec); + } else if (isLOOPAES(cd->type)) { + free(CONST_CAST(void*)cd->u.loopaes.hdr.hash); + free(cd->u.loopaes.cipher); + free(cd->u.loopaes.cipher_spec); + } else if (isVERITY(cd->type)) { + free(CONST_CAST(void*)cd->u.verity.hdr.hash_name); + free(CONST_CAST(void*)cd->u.verity.hdr.data_device); + free(CONST_CAST(void*)cd->u.verity.hdr.hash_device); + free(CONST_CAST(void*)cd->u.verity.hdr.fec_device); + free(CONST_CAST(void*)cd->u.verity.hdr.salt); + free(CONST_CAST(void*)cd->u.verity.root_hash); + free(cd->u.verity.uuid); + device_free(cd, cd->u.verity.fec_device); + } else if (isINTEGRITY(cd->type)) { + free(CONST_CAST(void*)cd->u.integrity.params.integrity); + free(CONST_CAST(void*)cd->u.integrity.params.journal_integrity); + free(CONST_CAST(void*)cd->u.integrity.params.journal_crypt); + crypt_free_volume_key(cd->u.integrity.journal_crypt_key); + crypt_free_volume_key(cd->u.integrity.journal_mac_key); + } else if (isBITLK(cd->type)) { + free(cd->u.bitlk.cipher_spec); + BITLK_bitlk_metadata_free(&cd->u.bitlk.params); + } else if (!cd->type) { + free(cd->u.none.active_name); + cd->u.none.active_name = NULL; + } + + crypt_set_null_type(cd); +} + +static int _init_by_name_crypt(struct crypt_device *cd, const char *name) +{ + bool found = false; + char **dep, *cipher_spec = NULL, cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN], deps_uuid_prefix[40], *deps[MAX_DM_DEPS+1] = {}; + const char *dev, *namei; + int key_nums, r; + struct crypt_dm_active_device dmd, dmdi = {}, dmdep = {}; + struct dm_target *tgt = &dmd.segment, *tgti = &dmdi.segment; + + r = dm_query_device(cd, name, + DM_ACTIVE_DEVICE | + DM_ACTIVE_UUID | + DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_CRYPT_KEYSIZE, &dmd); + if (r < 0) + return r; + + if (tgt->type != DM_CRYPT && tgt->type != DM_LINEAR) { + log_dbg(cd, "Unsupported device table detected in %s.", name); + r = -EINVAL; + goto out; + } + + r = -EINVAL; + + if (dmd.uuid) { + r = snprintf(deps_uuid_prefix, sizeof(deps_uuid_prefix), CRYPT_SUBDEV "-%.32s", dmd.uuid + 6); + if (r < 0 || (size_t)r != (sizeof(deps_uuid_prefix) - 1)) + r = -EINVAL; + } + + if (r >= 0) { + r = dm_device_deps(cd, name, deps_uuid_prefix, deps, ARRAY_SIZE(deps)); + if (r) + goto out; + } + + r = crypt_parse_name_and_mode(tgt->type == DM_LINEAR ? "null" : tgt->u.crypt.cipher, cipher, + &key_nums, cipher_mode); + if (r < 0) { + log_dbg(cd, "Cannot parse cipher and mode from active device."); + goto out; + } + + dep = deps; + + if (tgt->type == DM_CRYPT && tgt->u.crypt.integrity && (namei = device_dm_name(tgt->data_device))) { + r = dm_query_device(cd, namei, DM_ACTIVE_DEVICE, &dmdi); + if (r < 0) + goto out; + if (!single_segment(&dmdi) || tgti->type != DM_INTEGRITY) { + log_dbg(cd, "Unsupported device table detected in %s.", namei); + r = -EINVAL; + goto out; + } + if (!cd->metadata_device) { + device_free(cd, cd->device); + MOVE_REF(cd->device, tgti->data_device); + } + } + + /* do not try to lookup LUKS2 header in detached header mode */ + if (dmd.uuid && !cd->metadata_device && !found) { + while (*dep && !found) { + r = dm_query_device(cd, *dep, DM_ACTIVE_DEVICE, &dmdep); + if (r < 0) + goto out; + + tgt = &dmdep.segment; + + while (tgt && !found) { + dev = device_path(tgt->data_device); + if (!dev) { + tgt = tgt->next; + continue; + } + if (!strstr(dev, dm_get_dir()) || + !crypt_string_in(dev + strlen(dm_get_dir()) + 1, deps, ARRAY_SIZE(deps))) { + device_free(cd, cd->device); + MOVE_REF(cd->device, tgt->data_device); + found = true; + } + tgt = tgt->next; + } + dep++; + dm_targets_free(cd, &dmdep); + } + } + + if (asprintf(&cipher_spec, "%s-%s", cipher, cipher_mode) < 0) { + cipher_spec = NULL; + r = -ENOMEM; + goto out; + } + + tgt = &dmd.segment; + r = 0; + + if (isPLAIN(cd->type) && single_segment(&dmd) && tgt->type == DM_CRYPT) { + cd->u.plain.hdr.hash = NULL; /* no way to get this */ + cd->u.plain.hdr.offset = tgt->u.crypt.offset; + cd->u.plain.hdr.skip = tgt->u.crypt.iv_offset; + cd->u.plain.hdr.sector_size = tgt->u.crypt.sector_size; + cd->u.plain.key_size = tgt->u.crypt.vk->keylength; + cd->u.plain.cipher = strdup(cipher); + MOVE_REF(cd->u.plain.cipher_spec, cipher_spec); + cd->u.plain.cipher_mode = cd->u.plain.cipher_spec + strlen(cipher) + 1; + } else if (isLOOPAES(cd->type) && single_segment(&dmd) && tgt->type == DM_CRYPT) { + cd->u.loopaes.hdr.offset = tgt->u.crypt.offset; + cd->u.loopaes.cipher = strdup(cipher); + MOVE_REF(cd->u.loopaes.cipher_spec, cipher_spec); + cd->u.loopaes.cipher_mode = cd->u.loopaes.cipher_spec + strlen(cipher) + 1; + /* version 3 uses last key for IV */ + if (tgt->u.crypt.vk->keylength % key_nums) + key_nums++; + cd->u.loopaes.key_size = tgt->u.crypt.vk->keylength / key_nums; + } else if (isLUKS1(cd->type) || isLUKS2(cd->type)) { + if (crypt_metadata_device(cd)) { + r = _crypt_load_luks(cd, cd->type, 0, 0); + if (r < 0) { + log_dbg(cd, "LUKS device header does not match active device."); + crypt_set_null_type(cd); + device_close(cd, cd->metadata_device); + device_close(cd, cd->device); + r = 0; + goto out; + } + /* check whether UUIDs match each other */ + r = crypt_uuid_cmp(dmd.uuid, LUKS_UUID(cd)); + if (r < 0) { + log_dbg(cd, "LUKS device header uuid: %s mismatches DM returned uuid %s", + LUKS_UUID(cd), dmd.uuid); + crypt_free_type(cd); + r = 0; + goto out; + } + } else { + log_dbg(cd, "LUKS device header not available."); + crypt_set_null_type(cd); + r = 0; + } + } else if (isTCRYPT(cd->type) && single_segment(&dmd) && tgt->type == DM_CRYPT) { + r = TCRYPT_init_by_name(cd, name, dmd.uuid, tgt, &cd->device, + &cd->u.tcrypt.params, &cd->u.tcrypt.hdr); + } else if (isBITLK(cd->type)) { + r = _crypt_load_bitlk(cd, NULL); + if (r < 0) { + log_dbg(cd, "BITLK device header not available."); + crypt_set_null_type(cd); + r = 0; + } + } +out: + dm_targets_free(cd, &dmd); + dm_targets_free(cd, &dmdi); + dm_targets_free(cd, &dmdep); + free(CONST_CAST(void*)dmd.uuid); + free(cipher_spec); + dep = deps; + while (*dep) + free(*dep++); + return r; +} + +static int _init_by_name_verity(struct crypt_device *cd, const char *name) +{ + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + int r; + + r = dm_query_device(cd, name, + DM_ACTIVE_DEVICE | + DM_ACTIVE_VERITY_HASH_DEVICE | + DM_ACTIVE_VERITY_ROOT_HASH | + DM_ACTIVE_VERITY_PARAMS, &dmd); + if (r < 0) + return r; + if (!single_segment(&dmd) || tgt->type != DM_VERITY) { + log_dbg(cd, "Unsupported device table detected in %s.", name); + r = -EINVAL; + goto out; + } + if (r > 0) + r = 0; + + if (isVERITY(cd->type)) { + cd->u.verity.uuid = NULL; // FIXME + cd->u.verity.hdr.flags = CRYPT_VERITY_NO_HEADER; //FIXME + cd->u.verity.hdr.data_size = tgt->u.verity.vp->data_size; + cd->u.verity.root_hash_size = tgt->u.verity.root_hash_size; + MOVE_REF(cd->u.verity.hdr.hash_name, tgt->u.verity.vp->hash_name); + cd->u.verity.hdr.data_device = NULL; + cd->u.verity.hdr.hash_device = NULL; + cd->u.verity.hdr.data_block_size = tgt->u.verity.vp->data_block_size; + cd->u.verity.hdr.hash_block_size = tgt->u.verity.vp->hash_block_size; + cd->u.verity.hdr.hash_area_offset = tgt->u.verity.hash_offset; + cd->u.verity.hdr.fec_area_offset = tgt->u.verity.fec_offset; + cd->u.verity.hdr.hash_type = tgt->u.verity.vp->hash_type; + cd->u.verity.hdr.flags = tgt->u.verity.vp->flags; + cd->u.verity.hdr.salt_size = tgt->u.verity.vp->salt_size; + MOVE_REF(cd->u.verity.hdr.salt, tgt->u.verity.vp->salt); + MOVE_REF(cd->u.verity.hdr.fec_device, tgt->u.verity.vp->fec_device); + cd->u.verity.hdr.fec_roots = tgt->u.verity.vp->fec_roots; + MOVE_REF(cd->u.verity.fec_device, tgt->u.verity.fec_device); + MOVE_REF(cd->metadata_device, tgt->u.verity.hash_device); + MOVE_REF(cd->u.verity.root_hash, tgt->u.verity.root_hash); + } +out: + dm_targets_free(cd, &dmd); + return r; +} + +static int _init_by_name_integrity(struct crypt_device *cd, const char *name) +{ + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + int r; + + r = dm_query_device(cd, name, DM_ACTIVE_DEVICE | + DM_ACTIVE_CRYPT_KEY | + DM_ACTIVE_CRYPT_KEYSIZE | + DM_ACTIVE_INTEGRITY_PARAMS, &dmd); + if (r < 0) + return r; + if (!single_segment(&dmd) || tgt->type != DM_INTEGRITY) { + log_dbg(cd, "Unsupported device table detected in %s.", name); + r = -EINVAL; + goto out; + } + if (r > 0) + r = 0; + + if (isINTEGRITY(cd->type)) { + cd->u.integrity.params.tag_size = tgt->u.integrity.tag_size; + cd->u.integrity.params.sector_size = tgt->u.integrity.sector_size; + cd->u.integrity.params.journal_size = tgt->u.integrity.journal_size; + cd->u.integrity.params.journal_watermark = tgt->u.integrity.journal_watermark; + cd->u.integrity.params.journal_commit_time = tgt->u.integrity.journal_commit_time; + cd->u.integrity.params.interleave_sectors = tgt->u.integrity.interleave_sectors; + cd->u.integrity.params.buffer_sectors = tgt->u.integrity.buffer_sectors; + MOVE_REF(cd->u.integrity.params.integrity, tgt->u.integrity.integrity); + MOVE_REF(cd->u.integrity.params.journal_integrity, tgt->u.integrity.journal_integrity); + MOVE_REF(cd->u.integrity.params.journal_crypt, tgt->u.integrity.journal_crypt); + + if (tgt->u.integrity.vk) + cd->u.integrity.params.integrity_key_size = tgt->u.integrity.vk->keylength; + if (tgt->u.integrity.journal_integrity_key) + cd->u.integrity.params.journal_integrity_key_size = tgt->u.integrity.journal_integrity_key->keylength; + if (tgt->u.integrity.journal_crypt_key) + cd->u.integrity.params.integrity_key_size = tgt->u.integrity.journal_crypt_key->keylength; + MOVE_REF(cd->metadata_device, tgt->u.integrity.meta_device); + } +out: + dm_targets_free(cd, &dmd); + return r; +} + +int crypt_init_by_name_and_header(struct crypt_device **cd, + const char *name, + const char *header_device) +{ + crypt_status_info ci; + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + int r; + + if (!cd || !name) + return -EINVAL; + + log_dbg(NULL, "Allocating crypt device context by device %s.", name); + + ci = crypt_status(NULL, name); + if (ci == CRYPT_INVALID) + return -ENODEV; + + if (ci < CRYPT_ACTIVE) { + log_err(NULL, _("Device %s is not active."), name); + return -ENODEV; + } + + r = dm_query_device(NULL, name, DM_ACTIVE_DEVICE | DM_ACTIVE_UUID, &dmd); + if (r < 0) + return r; + + *cd = NULL; + + if (header_device) { + r = crypt_init(cd, header_device); + } else { + r = crypt_init(cd, device_path(tgt->data_device)); + + /* Underlying device disappeared but mapping still active */ + if (!tgt->data_device || r == -ENOTBLK) + log_verbose(NULL, _("Underlying device for crypt device %s disappeared."), + name); + + /* Underlying device is not readable but crypt mapping exists */ + if (r == -ENOTBLK) + r = crypt_init(cd, NULL); + } + + if (r < 0) + goto out; + + if (dmd.uuid) { + if (!strncmp(CRYPT_PLAIN, dmd.uuid, sizeof(CRYPT_PLAIN)-1)) + (*cd)->type = strdup(CRYPT_PLAIN); + else if (!strncmp(CRYPT_LOOPAES, dmd.uuid, sizeof(CRYPT_LOOPAES)-1)) + (*cd)->type = strdup(CRYPT_LOOPAES); + else if (!strncmp(CRYPT_LUKS1, dmd.uuid, sizeof(CRYPT_LUKS1)-1)) + (*cd)->type = strdup(CRYPT_LUKS1); + else if (!strncmp(CRYPT_LUKS2, dmd.uuid, sizeof(CRYPT_LUKS2)-1)) + (*cd)->type = strdup(CRYPT_LUKS2); + else if (!strncmp(CRYPT_VERITY, dmd.uuid, sizeof(CRYPT_VERITY)-1)) + (*cd)->type = strdup(CRYPT_VERITY); + else if (!strncmp(CRYPT_TCRYPT, dmd.uuid, sizeof(CRYPT_TCRYPT)-1)) + (*cd)->type = strdup(CRYPT_TCRYPT); + else if (!strncmp(CRYPT_INTEGRITY, dmd.uuid, sizeof(CRYPT_INTEGRITY)-1)) + (*cd)->type = strdup(CRYPT_INTEGRITY); + else if (!strncmp(CRYPT_BITLK, dmd.uuid, sizeof(CRYPT_BITLK)-1)) + (*cd)->type = strdup(CRYPT_BITLK); + else + log_dbg(NULL, "Unknown UUID set, some parameters are not set."); + } else + log_dbg(NULL, "Active device has no UUID set, some parameters are not set."); + + if (header_device) { + r = crypt_set_data_device(*cd, device_path(tgt->data_device)); + if (r < 0) + goto out; + } + + /* Try to initialize basic parameters from active device */ + + if (tgt->type == DM_CRYPT || tgt->type == DM_LINEAR) + r = _init_by_name_crypt(*cd, name); + else if (tgt->type == DM_VERITY) + r = _init_by_name_verity(*cd, name); + else if (tgt->type == DM_INTEGRITY) + r = _init_by_name_integrity(*cd, name); +out: + if (r < 0) { + crypt_free(*cd); + *cd = NULL; + } else if (!(*cd)->type) { + /* For anonymous device (no header found) remember initialized name */ + (*cd)->u.none.active_name = strdup(name); + } + + free(CONST_CAST(void*)dmd.uuid); + dm_targets_free(NULL, &dmd); + return r; +} + +int crypt_init_by_name(struct crypt_device **cd, const char *name) +{ + return crypt_init_by_name_and_header(cd, name, NULL); +} + +/* + * crypt_format() helpers + */ +static int _crypt_format_plain(struct crypt_device *cd, + const char *cipher, + const char *cipher_mode, + const char *uuid, + size_t volume_key_size, + struct crypt_params_plain *params) +{ + unsigned int sector_size = params ? params->sector_size : SECTOR_SIZE; + uint64_t dev_size; + + if (!cipher || !cipher_mode) { + log_err(cd, _("Invalid plain crypt parameters.")); + return -EINVAL; + } + + if (volume_key_size > 1024) { + log_err(cd, _("Invalid key size.")); + return -EINVAL; + } + + if (uuid) { + log_err(cd, _("UUID is not supported for this crypt type.")); + return -EINVAL; + } + + if (cd->metadata_device) { + log_err(cd, _("Detached metadata device is not supported for this crypt type.")); + return -EINVAL; + } + + /* For compatibility with old params structure */ + if (!sector_size) + sector_size = SECTOR_SIZE; + + if (sector_size < SECTOR_SIZE || sector_size > MAX_SECTOR_SIZE || + NOTPOW2(sector_size)) { + log_err(cd, _("Unsupported encryption sector size.")); + return -EINVAL; + } + + if (sector_size > SECTOR_SIZE && !device_size(cd->device, &dev_size)) { + if (params && params->offset) + dev_size -= (params->offset * SECTOR_SIZE); + if (dev_size % sector_size) { + log_err(cd, _("Device size is not aligned to requested sector size.")); + return -EINVAL; + } + } + + if (!(cd->type = strdup(CRYPT_PLAIN))) + return -ENOMEM; + + cd->u.plain.key_size = volume_key_size; + cd->volume_key = crypt_alloc_volume_key(volume_key_size, NULL); + if (!cd->volume_key) + return -ENOMEM; + + if (asprintf(&cd->u.plain.cipher_spec, "%s-%s", cipher, cipher_mode) < 0) { + cd->u.plain.cipher_spec = NULL; + return -ENOMEM; + } + cd->u.plain.cipher = strdup(cipher); + cd->u.plain.cipher_mode = cd->u.plain.cipher_spec + strlen(cipher) + 1; + + if (params && params->hash) + cd->u.plain.hdr.hash = strdup(params->hash); + + cd->u.plain.hdr.offset = params ? params->offset : 0; + cd->u.plain.hdr.skip = params ? params->skip : 0; + cd->u.plain.hdr.size = params ? params->size : 0; + cd->u.plain.hdr.sector_size = sector_size; + + if (!cd->u.plain.cipher) + return -ENOMEM; + + return 0; +} + +static int _crypt_format_luks1(struct crypt_device *cd, + const char *cipher, + const char *cipher_mode, + const char *uuid, + const char *volume_key, + size_t volume_key_size, + struct crypt_params_luks1 *params) +{ + int r; + unsigned long required_alignment = DEFAULT_DISK_ALIGNMENT; + unsigned long alignment_offset = 0; + uint64_t dev_size; + + if (!cipher || !cipher_mode) + return -EINVAL; + + if (!crypt_metadata_device(cd)) { + log_err(cd, _("Can't format LUKS without device.")); + return -EINVAL; + } + + if (params && cd->data_offset && params->data_alignment && + (cd->data_offset % params->data_alignment)) { + log_err(cd, _("Requested data alignment is not compatible with data offset.")); + return -EINVAL; + } + + if (!(cd->type = strdup(CRYPT_LUKS1))) + return -ENOMEM; + + if (volume_key) + cd->volume_key = crypt_alloc_volume_key(volume_key_size, + volume_key); + else + cd->volume_key = crypt_generate_volume_key(cd, volume_key_size); + + if (!cd->volume_key) + return -ENOMEM; + + if (verify_pbkdf_params(cd, &cd->pbkdf)) { + r = init_pbkdf_type(cd, NULL, CRYPT_LUKS1); + if (r) + return r; + } + + if (params && params->hash && strcmp(params->hash, cd->pbkdf.hash)) { + free(CONST_CAST(void*)cd->pbkdf.hash); + cd->pbkdf.hash = strdup(params->hash); + if (!cd->pbkdf.hash) + return -ENOMEM; + } + + if (params && params->data_device) { + if (!cd->metadata_device) + cd->metadata_device = cd->device; + else + device_free(cd, cd->device); + cd->device = NULL; + if (device_alloc(cd, &cd->device, params->data_device) < 0) + return -ENOMEM; + } + + if (params && cd->metadata_device) { + /* For detached header the alignment is used directly as data offset */ + if (!cd->data_offset) + cd->data_offset = params->data_alignment; + required_alignment = params->data_alignment * SECTOR_SIZE; + } else if (params && params->data_alignment) { + required_alignment = params->data_alignment * SECTOR_SIZE; + } else + device_topology_alignment(cd, cd->device, + &required_alignment, + &alignment_offset, DEFAULT_DISK_ALIGNMENT); + + r = LUKS_check_cipher(cd, volume_key_size, cipher, cipher_mode); + if (r < 0) + return r; + + r = LUKS_generate_phdr(&cd->u.luks1.hdr, cd->volume_key, cipher, cipher_mode, + cd->pbkdf.hash, uuid, + cd->data_offset * SECTOR_SIZE, + alignment_offset, required_alignment, cd); + if (r < 0) + return r; + + r = device_check_access(cd, crypt_metadata_device(cd), DEV_EXCL); + if (r < 0) + return r; + + if (!device_size(crypt_data_device(cd), &dev_size) && + dev_size < (crypt_get_data_offset(cd) * SECTOR_SIZE)) + log_std(cd, _("WARNING: Data offset is outside of currently available data device.\n")); + + if (asprintf(&cd->u.luks1.cipher_spec, "%s-%s", cipher, cipher_mode) < 0) { + cd->u.luks1.cipher_spec = NULL; + return -ENOMEM; + } + + r = LUKS_wipe_header_areas(&cd->u.luks1.hdr, cd); + if (r < 0) { + free(cd->u.luks1.cipher_spec); + log_err(cd, _("Cannot wipe header on device %s."), + mdata_device_path(cd)); + return r; + } + + r = LUKS_write_phdr(&cd->u.luks1.hdr, cd); + if (r) + free(cd->u.luks1.cipher_spec); + + return r; +} + +static int _crypt_format_luks2(struct crypt_device *cd, + const char *cipher, + const char *cipher_mode, + const char *uuid, + const char *volume_key, + size_t volume_key_size, + struct crypt_params_luks2 *params) +{ + int r, integrity_key_size = 0; + unsigned long required_alignment = DEFAULT_DISK_ALIGNMENT; + unsigned long alignment_offset = 0; + unsigned int sector_size = params ? params->sector_size : SECTOR_SIZE; + const char *integrity = params ? params->integrity : NULL; + uint64_t dev_size; + uint32_t dmc_flags; + + cd->u.luks2.hdr.jobj = NULL; + cd->u.luks2.keyslot_cipher = NULL; + + if (!cipher || !cipher_mode) + return -EINVAL; + + if (!crypt_metadata_device(cd)) { + log_err(cd, _("Can't format LUKS without device.")); + return -EINVAL; + } + + if (params && cd->data_offset && params->data_alignment && + (cd->data_offset % params->data_alignment)) { + log_err(cd, _("Requested data alignment is not compatible with data offset.")); + return -EINVAL; + } + + if (sector_size < SECTOR_SIZE || sector_size > MAX_SECTOR_SIZE || + NOTPOW2(sector_size)) { + log_err(cd, _("Unsupported encryption sector size.")); + return -EINVAL; + } + if (sector_size != SECTOR_SIZE && !dm_flags(cd, DM_CRYPT, &dmc_flags) && + !(dmc_flags & DM_SECTOR_SIZE_SUPPORTED)) + log_std(cd, _("WARNING: The device activation will fail, dm-crypt is missing " + "support for requested encryption sector size.\n")); + + if (integrity) { + if (params->integrity_params) { + /* Standalone dm-integrity must not be used */ + if (params->integrity_params->integrity || + params->integrity_params->integrity_key_size) + return -EINVAL; + /* FIXME: journal encryption and MAC is here not yet supported */ + if (params->integrity_params->journal_crypt || + params->integrity_params->journal_integrity) + return -ENOTSUP; + } + if (!INTEGRITY_tag_size(cd, integrity, cipher, cipher_mode)) { + if (!strcmp(integrity, "none")) + integrity = NULL; + else + return -EINVAL; + } + integrity_key_size = INTEGRITY_key_size(cd, integrity); + if ((integrity_key_size < 0) || (integrity_key_size >= (int)volume_key_size)) { + log_err(cd, _("Volume key is too small for encryption with integrity extensions.")); + return -EINVAL; + } + } + + r = device_check_access(cd, crypt_metadata_device(cd), DEV_EXCL); + if (r < 0) + return r; + + if (!(cd->type = strdup(CRYPT_LUKS2))) + return -ENOMEM; + + if (volume_key) + cd->volume_key = crypt_alloc_volume_key(volume_key_size, + volume_key); + else + cd->volume_key = crypt_generate_volume_key(cd, volume_key_size); + + if (!cd->volume_key) + return -ENOMEM; + + if (params && params->pbkdf) + r = crypt_set_pbkdf_type(cd, params->pbkdf); + else if (verify_pbkdf_params(cd, &cd->pbkdf)) + r = init_pbkdf_type(cd, NULL, CRYPT_LUKS2); + + if (r < 0) + return r; + + if (params && params->data_device) { + if (!cd->metadata_device) + cd->metadata_device = cd->device; + else + device_free(cd, cd->device); + cd->device = NULL; + if (device_alloc(cd, &cd->device, params->data_device) < 0) + return -ENOMEM; + } + + if (params && cd->metadata_device) { + /* For detached header the alignment is used directly as data offset */ + if (!cd->data_offset) + cd->data_offset = params->data_alignment; + required_alignment = params->data_alignment * SECTOR_SIZE; + } else if (params && params->data_alignment) { + required_alignment = params->data_alignment * SECTOR_SIZE; + } else + device_topology_alignment(cd, cd->device, + &required_alignment, + &alignment_offset, DEFAULT_DISK_ALIGNMENT); + + /* FIXME: allow this later also for normal ciphers (check AF_ALG availability. */ + if (integrity && !integrity_key_size) { + r = crypt_cipher_check_kernel(cipher, cipher_mode, integrity, volume_key_size); + if (r < 0) { + log_err(cd, _("Cipher %s-%s (key size %zd bits) is not available."), + cipher, cipher_mode, volume_key_size * 8); + goto out; + } + } + + if ((!integrity || integrity_key_size) && !crypt_cipher_wrapped_key(cipher, cipher_mode) && + !INTEGRITY_tag_size(cd, NULL, cipher, cipher_mode)) { + r = LUKS_check_cipher(cd, volume_key_size - integrity_key_size, + cipher, cipher_mode); + if (r < 0) + goto out; + } + + r = LUKS2_generate_hdr(cd, &cd->u.luks2.hdr, cd->volume_key, + cipher, cipher_mode, + integrity, uuid, + sector_size, + cd->data_offset * SECTOR_SIZE, + alignment_offset, + required_alignment, + cd->metadata_size, cd->keyslots_size); + if (r < 0) + goto out; + + r = device_size(crypt_data_device(cd), &dev_size); + if (r < 0) + goto out; + + if (dev_size < (crypt_get_data_offset(cd) * SECTOR_SIZE)) + log_std(cd, _("WARNING: Data offset is outside of currently available data device.\n")); + + if (cd->metadata_size && (cd->metadata_size != LUKS2_metadata_size(&cd->u.luks2.hdr))) + log_std(cd, _("WARNING: LUKS2 metadata size changed to %" PRIu64 " bytes.\n"), + LUKS2_metadata_size(&cd->u.luks2.hdr)); + + if (cd->keyslots_size && (cd->keyslots_size != LUKS2_keyslots_size(&cd->u.luks2.hdr))) + log_std(cd, _("WARNING: LUKS2 keyslots area size changed to %" PRIu64 " bytes.\n"), + LUKS2_keyslots_size(&cd->u.luks2.hdr)); + + if (!integrity && sector_size > SECTOR_SIZE) { + dev_size -= (crypt_get_data_offset(cd) * SECTOR_SIZE); + if (dev_size % sector_size) { + log_err(cd, _("Device size is not aligned to requested sector size.")); + r = -EINVAL; + goto out; + } + } + + if (params && (params->label || params->subsystem)) { + r = LUKS2_hdr_labels(cd, &cd->u.luks2.hdr, + params->label, params->subsystem, 0); + if (r < 0) + goto out; + } + + r = LUKS2_wipe_header_areas(cd, &cd->u.luks2.hdr, cd->metadata_device != NULL); + if (r < 0) { + log_err(cd, _("Cannot wipe header on device %s."), + mdata_device_path(cd)); + if (dev_size < LUKS2_hdr_and_areas_size(&cd->u.luks2.hdr)) + log_err(cd, _("Device %s is too small."), device_path(crypt_metadata_device(cd))); + goto out; + } + + /* Wipe integrity superblock and create integrity superblock */ + if (crypt_get_integrity_tag_size(cd)) { + r = crypt_wipe_device(cd, crypt_data_device(cd), CRYPT_WIPE_ZERO, + crypt_get_data_offset(cd) * SECTOR_SIZE, + 8 * SECTOR_SIZE, 8 * SECTOR_SIZE, NULL, NULL); + if (r < 0) { + if (r == -EBUSY) + log_err(cd, _("Cannot format device %s in use."), + data_device_path(cd)); + else if (r == -EACCES) { + log_err(cd, _("Cannot format device %s, permission denied."), + data_device_path(cd)); + r = -EINVAL; + } else + log_err(cd, _("Cannot wipe header on device %s."), + data_device_path(cd)); + + goto out; + } + + r = INTEGRITY_format(cd, params ? params->integrity_params : NULL, NULL, NULL); + if (r) + log_err(cd, _("Cannot format integrity for device %s."), + data_device_path(cd)); + } + + if (r < 0) + goto out; + + /* override sequence id check with format */ + r = LUKS2_hdr_write_force(cd, &cd->u.luks2.hdr); + if (r < 0) { + if (r == -EBUSY) + log_err(cd, _("Cannot format device %s in use."), + mdata_device_path(cd)); + else if (r == -EACCES) { + log_err(cd, _("Cannot format device %s, permission denied."), + mdata_device_path(cd)); + r = -EINVAL; + } else + log_err(cd, _("Cannot format device %s."), + mdata_device_path(cd)); + } + +out: + if (r) + LUKS2_hdr_free(cd, &cd->u.luks2.hdr); + + return r; +} + +static int _crypt_format_loopaes(struct crypt_device *cd, + const char *cipher, + const char *uuid, + size_t volume_key_size, + struct crypt_params_loopaes *params) +{ + if (!crypt_metadata_device(cd)) { + log_err(cd, _("Can't format LOOPAES without device.")); + return -EINVAL; + } + + if (volume_key_size > 1024) { + log_err(cd, _("Invalid key size.")); + return -EINVAL; + } + + if (uuid) { + log_err(cd, _("UUID is not supported for this crypt type.")); + return -EINVAL; + } + + if (cd->metadata_device) { + log_err(cd, _("Detached metadata device is not supported for this crypt type.")); + return -EINVAL; + } + + if (!(cd->type = strdup(CRYPT_LOOPAES))) + return -ENOMEM; + + cd->u.loopaes.key_size = volume_key_size; + + cd->u.loopaes.cipher = strdup(cipher ?: DEFAULT_LOOPAES_CIPHER); + + if (params && params->hash) + cd->u.loopaes.hdr.hash = strdup(params->hash); + + cd->u.loopaes.hdr.offset = params ? params->offset : 0; + cd->u.loopaes.hdr.skip = params ? params->skip : 0; + + return 0; +} + +static int _crypt_format_verity(struct crypt_device *cd, + const char *uuid, + struct crypt_params_verity *params) +{ + int r = 0, hash_size; + uint64_t data_device_size, hash_blocks_size; + struct device *fec_device = NULL; + char *fec_device_path = NULL, *hash_name = NULL, *root_hash = NULL, *salt = NULL; + + if (!crypt_metadata_device(cd)) { + log_err(cd, _("Can't format VERITY without device.")); + return -EINVAL; + } + + if (!params) + return -EINVAL; + + if (!params->data_device && !cd->metadata_device) + return -EINVAL; + + if (params->hash_type > VERITY_MAX_HASH_TYPE) { + log_err(cd, _("Unsupported VERITY hash type %d."), params->hash_type); + return -EINVAL; + } + + if (VERITY_BLOCK_SIZE_OK(params->data_block_size) || + VERITY_BLOCK_SIZE_OK(params->hash_block_size)) { + log_err(cd, _("Unsupported VERITY block size.")); + return -EINVAL; + } + + if (MISALIGNED_512(params->hash_area_offset)) { + log_err(cd, _("Unsupported VERITY hash offset.")); + return -EINVAL; + } + + if (MISALIGNED_512(params->fec_area_offset)) { + log_err(cd, _("Unsupported VERITY FEC offset.")); + return -EINVAL; + } + + if (!(cd->type = strdup(CRYPT_VERITY))) + return -ENOMEM; + + if (params->data_device) { + r = crypt_set_data_device(cd, params->data_device); + if (r) + return r; + } + + if (!params->data_size) { + r = device_size(cd->device, &data_device_size); + if (r < 0) + return r; + + cd->u.verity.hdr.data_size = data_device_size / params->data_block_size; + } else + cd->u.verity.hdr.data_size = params->data_size; + + if (device_is_identical(crypt_metadata_device(cd), crypt_data_device(cd)) > 0 && + (cd->u.verity.hdr.data_size * params->data_block_size) > params->hash_area_offset) { + log_err(cd, _("Data area overlaps with hash area.")); + return -EINVAL; + } + + hash_size = crypt_hash_size(params->hash_name); + if (hash_size <= 0) { + log_err(cd, _("Hash algorithm %s not supported."), + params->hash_name); + return -EINVAL; + } + cd->u.verity.root_hash_size = hash_size; + + if (params->fec_device) { + fec_device_path = strdup(params->fec_device); + if (!fec_device_path) + return -ENOMEM; + r = device_alloc(cd, &fec_device, params->fec_device); + if (r < 0) { + r = -ENOMEM; + goto err; + } + + hash_blocks_size = VERITY_hash_blocks(cd, params) * params->hash_block_size; + if (device_is_identical(crypt_metadata_device(cd), fec_device) > 0 && + (params->hash_area_offset + hash_blocks_size) > params->fec_area_offset) { + log_err(cd, _("Hash area overlaps with FEC area.")); + r = -EINVAL; + goto err; + } + + if (device_is_identical(crypt_data_device(cd), fec_device) > 0 && + (cd->u.verity.hdr.data_size * params->data_block_size) > params->fec_area_offset) { + log_err(cd, _("Data area overlaps with FEC area.")); + r = -EINVAL; + goto err; + } + } + + root_hash = malloc(cd->u.verity.root_hash_size); + hash_name = strdup(params->hash_name); + salt = malloc(params->salt_size); + + if (!root_hash || !hash_name || !salt) { + r = -ENOMEM; + goto err; + } + + cd->u.verity.hdr.flags = params->flags; + cd->u.verity.root_hash = root_hash; + cd->u.verity.hdr.hash_name = hash_name; + cd->u.verity.hdr.data_device = NULL; + cd->u.verity.fec_device = fec_device; + cd->u.verity.hdr.fec_device = fec_device_path; + cd->u.verity.hdr.fec_roots = params->fec_roots; + cd->u.verity.hdr.data_block_size = params->data_block_size; + cd->u.verity.hdr.hash_block_size = params->hash_block_size; + cd->u.verity.hdr.hash_area_offset = params->hash_area_offset; + cd->u.verity.hdr.fec_area_offset = params->fec_area_offset; + cd->u.verity.hdr.hash_type = params->hash_type; + cd->u.verity.hdr.flags = params->flags; + cd->u.verity.hdr.salt_size = params->salt_size; + cd->u.verity.hdr.salt = salt; + + if (params->salt) + memcpy(salt, params->salt, params->salt_size); + else + r = crypt_random_get(cd, salt, params->salt_size, CRYPT_RND_SALT); + if (r) + goto err; + + if (params->flags & CRYPT_VERITY_CREATE_HASH) { + r = VERITY_create(cd, &cd->u.verity.hdr, + cd->u.verity.root_hash, cd->u.verity.root_hash_size); + if (!r && params->fec_device) + r = VERITY_FEC_process(cd, &cd->u.verity.hdr, cd->u.verity.fec_device, 0, NULL); + if (r) + goto err; + } + + if (!(params->flags & CRYPT_VERITY_NO_HEADER)) { + if (uuid) { + if (!(cd->u.verity.uuid = strdup(uuid))) + r = -ENOMEM; + } else + r = VERITY_UUID_generate(cd, &cd->u.verity.uuid); + + if (!r) + r = VERITY_write_sb(cd, cd->u.verity.hdr.hash_area_offset, + cd->u.verity.uuid, + &cd->u.verity.hdr); + } + +err: + if (r) { + device_free(cd, fec_device); + free(root_hash); + free(hash_name); + free(fec_device_path); + free(salt); + } + + return r; +} + +static int _crypt_format_integrity(struct crypt_device *cd, + const char *uuid, + struct crypt_params_integrity *params) +{ + int r; + uint32_t integrity_tag_size; + char *integrity = NULL, *journal_integrity = NULL, *journal_crypt = NULL; + struct volume_key *journal_crypt_key = NULL, *journal_mac_key = NULL; + + if (!params) + return -EINVAL; + + if (uuid) { + log_err(cd, _("UUID is not supported for this crypt type.")); + return -EINVAL; + } + + r = device_check_access(cd, crypt_metadata_device(cd), DEV_EXCL); + if (r < 0) + return r; + + /* Wipe first 8 sectors - fs magic numbers etc. */ + r = crypt_wipe_device(cd, crypt_metadata_device(cd), CRYPT_WIPE_ZERO, 0, + 8 * SECTOR_SIZE, 8 * SECTOR_SIZE, NULL, NULL); + if (r < 0) { + log_err(cd, _("Cannot wipe header on device %s."), + mdata_device_path(cd)); + return r; + } + + if (!(cd->type = strdup(CRYPT_INTEGRITY))) + return -ENOMEM; + + if (params->journal_crypt_key) { + journal_crypt_key = crypt_alloc_volume_key(params->journal_crypt_key_size, + params->journal_crypt_key); + if (!journal_crypt_key) + return -ENOMEM; + } + + if (params->journal_integrity_key) { + journal_mac_key = crypt_alloc_volume_key(params->journal_integrity_key_size, + params->journal_integrity_key); + if (!journal_mac_key) { + r = -ENOMEM; + goto err; + } + } + + if (params->integrity && !(integrity = strdup(params->integrity))) { + r = -ENOMEM; + goto err; + } + if (params->journal_integrity && !(journal_integrity = strdup(params->journal_integrity))) { + r = -ENOMEM; + goto err; + } + if (params->journal_crypt && !(journal_crypt = strdup(params->journal_crypt))) { + r = -ENOMEM; + goto err; + } + + integrity_tag_size = INTEGRITY_hash_tag_size(integrity); + if (integrity_tag_size > 0 && params->tag_size && integrity_tag_size != params->tag_size) + log_std(cd, _("WARNING: Requested tag size %d bytes differs from %s size output (%d bytes).\n"), + params->tag_size, integrity, integrity_tag_size); + + if (params->tag_size) + integrity_tag_size = params->tag_size; + + cd->u.integrity.journal_crypt_key = journal_crypt_key; + cd->u.integrity.journal_mac_key = journal_mac_key; + cd->u.integrity.params.journal_size = params->journal_size; + cd->u.integrity.params.journal_watermark = params->journal_watermark; + cd->u.integrity.params.journal_commit_time = params->journal_commit_time; + cd->u.integrity.params.interleave_sectors = params->interleave_sectors; + cd->u.integrity.params.buffer_sectors = params->buffer_sectors; + cd->u.integrity.params.sector_size = params->sector_size; + cd->u.integrity.params.tag_size = integrity_tag_size; + cd->u.integrity.params.integrity = integrity; + cd->u.integrity.params.journal_integrity = journal_integrity; + cd->u.integrity.params.journal_crypt = journal_crypt; + + r = INTEGRITY_format(cd, params, cd->u.integrity.journal_crypt_key, cd->u.integrity.journal_mac_key); + if (r) + log_err(cd, _("Cannot format integrity for device %s."), + mdata_device_path(cd)); +err: + if (r) { + crypt_free_volume_key(journal_crypt_key); + crypt_free_volume_key(journal_mac_key); + free(integrity); + free(journal_integrity); + free(journal_crypt); + } + + return r; +} + +int crypt_format(struct crypt_device *cd, + const char *type, + const char *cipher, + const char *cipher_mode, + const char *uuid, + const char *volume_key, + size_t volume_key_size, + void *params) +{ + int r; + + if (!cd || !type) + return -EINVAL; + + if (cd->type) { + log_dbg(cd, "Context already formatted as %s.", cd->type); + return -EINVAL; + } + + log_dbg(cd, "Formatting device %s as type %s.", mdata_device_path(cd) ?: "(none)", type); + + crypt_reset_null_type(cd); + + r = init_crypto(cd); + if (r < 0) + return r; + + if (isPLAIN(type)) + r = _crypt_format_plain(cd, cipher, cipher_mode, + uuid, volume_key_size, params); + else if (isLUKS1(type)) + r = _crypt_format_luks1(cd, cipher, cipher_mode, + uuid, volume_key, volume_key_size, params); + else if (isLUKS2(type)) + r = _crypt_format_luks2(cd, cipher, cipher_mode, + uuid, volume_key, volume_key_size, params); + else if (isLOOPAES(type)) + r = _crypt_format_loopaes(cd, cipher, uuid, volume_key_size, params); + else if (isVERITY(type)) + r = _crypt_format_verity(cd, uuid, params); + else if (isINTEGRITY(type)) + r = _crypt_format_integrity(cd, uuid, params); + else { + log_err(cd, _("Unknown crypt device type %s requested."), type); + r = -EINVAL; + } + + if (r < 0) { + crypt_set_null_type(cd); + crypt_free_volume_key(cd->volume_key); + cd->volume_key = NULL; + } + + return r; +} + +int crypt_repair(struct crypt_device *cd, + const char *requested_type, + void *params __attribute__((unused))) +{ + int r; + + if (!cd) + return -EINVAL; + + log_dbg(cd, "Trying to repair %s crypt type from device %s.", + requested_type ?: "any", mdata_device_path(cd) ?: "(none)"); + + if (!crypt_metadata_device(cd)) + return -EINVAL; + + if (requested_type && !isLUKS(requested_type)) + return -EINVAL; + + /* Load with repair */ + r = _crypt_load_luks(cd, requested_type, 1, 1); + if (r < 0) + return r; + + /* cd->type and header must be set in context */ + r = crypt_check_data_device_size(cd); + if (r < 0) + crypt_set_null_type(cd); + + return r; +} + +/* compare volume keys */ +static int _compare_volume_keys(struct volume_key *svk, unsigned skeyring_only, struct volume_key *tvk, unsigned tkeyring_only) +{ + if (!svk && !tvk) + return 0; + else if (!svk || !tvk) + return 1; + + if (svk->keylength != tvk->keylength) + return 1; + + if (!skeyring_only && !tkeyring_only) + return memcmp(svk->key, tvk->key, svk->keylength); + + if (svk->key_description && tvk->key_description) + return strcmp(svk->key_description, tvk->key_description); + + return 0; +} + +static int _compare_device_types(struct crypt_device *cd, + const struct crypt_dm_active_device *src, + const struct crypt_dm_active_device *tgt) +{ + if (!tgt->uuid) { + log_dbg(cd, "Missing device uuid in target device."); + return -EINVAL; + } + + if (isLUKS2(cd->type) && !strncmp("INTEGRITY-", tgt->uuid, strlen("INTEGRITY-"))) { + if (crypt_uuid_cmp(tgt->uuid, src->uuid)) { + log_dbg(cd, "LUKS UUID mismatch."); + return -EINVAL; + } + } else if (isLUKS(cd->type)) { + if (!src->uuid || strncmp(cd->type, tgt->uuid, strlen(cd->type)) || + crypt_uuid_cmp(tgt->uuid, src->uuid)) { + log_dbg(cd, "LUKS UUID mismatch."); + return -EINVAL; + } + } else if (isPLAIN(cd->type) || isLOOPAES(cd->type)) { + if (strncmp(cd->type, tgt->uuid, strlen(cd->type))) { + log_dbg(cd, "Unexpected uuid prefix %s in target device.", tgt->uuid); + return -EINVAL; + } + } else { + log_dbg(cd, "Unsupported device type %s for reload.", cd->type ?: ""); + return -ENOTSUP; + } + + return 0; +} + +static int _compare_crypt_devices(struct crypt_device *cd, + const struct dm_target *src, + const struct dm_target *tgt) +{ + /* for crypt devices keys are mandatory */ + if (!src->u.crypt.vk || !tgt->u.crypt.vk) + return -EINVAL; + + /* CIPHER checks */ + if (!src->u.crypt.cipher || !tgt->u.crypt.cipher) + return -EINVAL; + if (strcmp(src->u.crypt.cipher, tgt->u.crypt.cipher)) { + log_dbg(cd, "Cipher specs do not match."); + return -EINVAL; + } + + if (tgt->u.crypt.vk->keylength == 0 && crypt_is_cipher_null(tgt->u.crypt.cipher)) + log_dbg(cd, "Existing device uses cipher null. Skipping key comparison."); + else if (_compare_volume_keys(src->u.crypt.vk, 0, tgt->u.crypt.vk, tgt->u.crypt.vk->key_description != NULL)) { + log_dbg(cd, "Keys in context and target device do not match."); + return -EINVAL; + } + + if (crypt_strcmp(src->u.crypt.integrity, tgt->u.crypt.integrity)) { + log_dbg(cd, "Integrity parameters do not match."); + return -EINVAL; + } + + if (src->u.crypt.offset != tgt->u.crypt.offset || + src->u.crypt.sector_size != tgt->u.crypt.sector_size || + src->u.crypt.iv_offset != tgt->u.crypt.iv_offset || + src->u.crypt.tag_size != tgt->u.crypt.tag_size) { + log_dbg(cd, "Integer parameters do not match."); + return -EINVAL; + } + + if (device_is_identical(src->data_device, tgt->data_device) <= 0) { + log_dbg(cd, "Data devices do not match."); + return -EINVAL; + } + + return 0; +} + +static int _compare_integrity_devices(struct crypt_device *cd, + const struct dm_target *src, + const struct dm_target *tgt) +{ + /* + * some parameters may be implicit (and set in dm-integrity ctor) + * + * journal_size + * journal_watermark + * journal_commit_time + * buffer_sectors + * interleave_sectors + */ + + /* check remaining integer values that makes sense */ + if (src->u.integrity.tag_size != tgt->u.integrity.tag_size || + src->u.integrity.offset != tgt->u.integrity.offset || + src->u.integrity.sector_size != tgt->u.integrity.sector_size) { + log_dbg(cd, "Integer parameters do not match."); + return -EINVAL; + } + + if (crypt_strcmp(src->u.integrity.integrity, tgt->u.integrity.integrity) || + crypt_strcmp(src->u.integrity.journal_integrity, tgt->u.integrity.journal_integrity) || + crypt_strcmp(src->u.integrity.journal_crypt, tgt->u.integrity.journal_crypt)) { + log_dbg(cd, "Journal parameters do not match."); + return -EINVAL; + } + + /* unfortunately dm-integrity doesn't support keyring */ + if (_compare_volume_keys(src->u.integrity.vk, 0, tgt->u.integrity.vk, 0) || + _compare_volume_keys(src->u.integrity.journal_integrity_key, 0, tgt->u.integrity.journal_integrity_key, 0) || + _compare_volume_keys(src->u.integrity.journal_crypt_key, 0, tgt->u.integrity.journal_crypt_key, 0)) { + log_dbg(cd, "Journal keys do not match."); + return -EINVAL; + } + + /* unsupported underneath dm-crypt with auth. encryption */ + if (src->u.integrity.meta_device || tgt->u.integrity.meta_device) + return -ENOTSUP; + + if (src->size != tgt->size) { + log_dbg(cd, "Device size parameters do not match."); + return -EINVAL; + } + + if (device_is_identical(src->data_device, tgt->data_device) <= 0) { + log_dbg(cd, "Data devices do not match."); + return -EINVAL; + } + + return 0; +} + +int crypt_compare_dm_devices(struct crypt_device *cd, + const struct crypt_dm_active_device *src, + const struct crypt_dm_active_device *tgt) +{ + int r; + const struct dm_target *s, *t; + + if (!src || !tgt) + return -EINVAL; + + r = _compare_device_types(cd, src, tgt); + if (r) + return r; + + s = &src->segment; + t = &tgt->segment; + + while (s || t) { + if (!s || !t) { + log_dbg(cd, "segments count mismatch."); + return -EINVAL; + } + if (s->type != t->type) { + log_dbg(cd, "segment type mismatch."); + r = -EINVAL; + break; + } + + switch (s->type) { + case DM_CRYPT: + r = _compare_crypt_devices(cd, s, t); + break; + case DM_INTEGRITY: + r = _compare_integrity_devices(cd, s, t); + break; + case DM_LINEAR: + r = (s->u.linear.offset == t->u.linear.offset) ? 0 : -EINVAL; + break; + default: + r = -ENOTSUP; + } + + if (r) + break; + + s = s->next; + t = t->next; + } + + return r; +} + +static int _reload_device(struct crypt_device *cd, const char *name, + struct crypt_dm_active_device *sdmd) +{ + int r; + struct crypt_dm_active_device tdmd; + struct dm_target *src, *tgt = &tdmd.segment; + + if (!cd || !cd->type || !name || !(sdmd->flags & CRYPT_ACTIVATE_REFRESH)) + return -EINVAL; + + r = dm_query_device(cd, name, DM_ACTIVE_DEVICE | DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_UUID | DM_ACTIVE_CRYPT_KEYSIZE | + DM_ACTIVE_CRYPT_KEY, &tdmd); + if (r < 0) { + log_err(cd, _("Device %s is not active."), name); + return -EINVAL; + } + + if (!single_segment(&tdmd) || tgt->type != DM_CRYPT || tgt->u.crypt.tag_size) { + r = -ENOTSUP; + log_err(cd, _("Unsupported parameters on device %s."), name); + goto out; + } + + r = crypt_compare_dm_devices(cd, sdmd, &tdmd); + if (r) { + log_err(cd, _("Mismatching parameters on device %s."), name); + goto out; + } + + src = &sdmd->segment; + + /* Changing read only flag for active device makes no sense */ + if (tdmd.flags & CRYPT_ACTIVATE_READONLY) + sdmd->flags |= CRYPT_ACTIVATE_READONLY; + else + sdmd->flags &= ~CRYPT_ACTIVATE_READONLY; + + if (sdmd->flags & CRYPT_ACTIVATE_KEYRING_KEY) { + r = crypt_volume_key_set_description(tgt->u.crypt.vk, src->u.crypt.vk->key_description); + if (r) + goto out; + } else { + crypt_free_volume_key(tgt->u.crypt.vk); + tgt->u.crypt.vk = crypt_alloc_volume_key(src->u.crypt.vk->keylength, src->u.crypt.vk->key); + if (!tgt->u.crypt.vk) { + r = -ENOMEM; + goto out; + } + } + + r = device_block_adjust(cd, src->data_device, DEV_OK, + src->u.crypt.offset, &sdmd->size, NULL); + if (r) + goto out; + + tdmd.flags = sdmd->flags; + tgt->size = tdmd.size = sdmd->size; + + r = dm_reload_device(cd, name, &tdmd, 0, 1); +out: + dm_targets_free(cd, &tdmd); + free(CONST_CAST(void*)tdmd.uuid); + + return r; +} + +static int _reload_device_with_integrity(struct crypt_device *cd, + const char *name, + const char *iname, + const char *ipath, + struct crypt_dm_active_device *sdmd, + struct crypt_dm_active_device *sdmdi) +{ + int r; + struct crypt_dm_active_device tdmd, tdmdi = {}; + struct dm_target *src, *srci, *tgt = &tdmd.segment, *tgti = &tdmdi.segment; + struct device *data_device = NULL; + + if (!cd || !cd->type || !name || !iname || !(sdmd->flags & CRYPT_ACTIVATE_REFRESH)) + return -EINVAL; + + r = dm_query_device(cd, name, DM_ACTIVE_DEVICE | DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_UUID | DM_ACTIVE_CRYPT_KEYSIZE | + DM_ACTIVE_CRYPT_KEY, &tdmd); + if (r < 0) { + log_err(cd, _("Device %s is not active."), name); + return -EINVAL; + } + + if (!single_segment(&tdmd) || tgt->type != DM_CRYPT || !tgt->u.crypt.tag_size) { + r = -ENOTSUP; + log_err(cd, _("Unsupported parameters on device %s."), name); + goto out; + } + + r = dm_query_device(cd, iname, DM_ACTIVE_DEVICE | DM_ACTIVE_UUID, &tdmdi); + if (r < 0) { + log_err(cd, _("Device %s is not active."), iname); + r = -EINVAL; + goto out; + } + + if (!single_segment(&tdmdi) || tgti->type != DM_INTEGRITY) { + r = -ENOTSUP; + log_err(cd, _("Unsupported parameters on device %s."), iname); + goto out; + } + + r = crypt_compare_dm_devices(cd, sdmdi, &tdmdi); + if (r) { + log_err(cd, _("Mismatching parameters on device %s."), iname); + goto out; + } + + src = &sdmd->segment; + srci = &sdmdi->segment; + + r = device_alloc(cd, &data_device, ipath); + if (r < 0) + goto out; + + r = device_block_adjust(cd, srci->data_device, DEV_OK, + srci->u.integrity.offset, &sdmdi->size, NULL); + if (r) + goto out; + + src->data_device = data_device; + + r = crypt_compare_dm_devices(cd, sdmd, &tdmd); + if (r) { + log_err(cd, _("Crypt devices mismatch.")); + goto out; + } + + /* Changing read only flag for active device makes no sense */ + if (tdmd.flags & CRYPT_ACTIVATE_READONLY) + sdmd->flags |= CRYPT_ACTIVATE_READONLY; + else + sdmd->flags &= ~CRYPT_ACTIVATE_READONLY; + + if (tdmdi.flags & CRYPT_ACTIVATE_READONLY) + sdmdi->flags |= CRYPT_ACTIVATE_READONLY; + else + sdmdi->flags &= ~CRYPT_ACTIVATE_READONLY; + + if (sdmd->flags & CRYPT_ACTIVATE_KEYRING_KEY) { + r = crypt_volume_key_set_description(tgt->u.crypt.vk, src->u.crypt.vk->key_description); + if (r) + goto out; + } else { + crypt_free_volume_key(tgt->u.crypt.vk); + tgt->u.crypt.vk = crypt_alloc_volume_key(src->u.crypt.vk->keylength, src->u.crypt.vk->key); + if (!tgt->u.crypt.vk) { + r = -ENOMEM; + goto out; + } + } + + r = device_block_adjust(cd, src->data_device, DEV_OK, + src->u.crypt.offset, &sdmd->size, NULL); + if (r) + goto out; + + tdmd.flags = sdmd->flags; + tdmd.size = sdmd->size; + + if ((r = dm_reload_device(cd, iname, sdmdi, 0, 0))) { + log_err(cd, _("Failed to reload device %s."), iname); + goto out; + } + + if ((r = dm_reload_device(cd, name, &tdmd, 0, 0))) { + log_err(cd, _("Failed to reload device %s."), name); + goto err_clear; + } + + if ((r = dm_suspend_device(cd, name, 0))) { + log_err(cd, _("Failed to suspend device %s."), name); + goto err_clear; + } + + if ((r = dm_suspend_device(cd, iname, 0))) { + log_err(cd, _("Failed to suspend device %s."), iname); + goto err_clear; + } + + if ((r = dm_resume_device(cd, iname, act2dmflags(sdmdi->flags)))) { + log_err(cd, _("Failed to resume device %s."), iname); + goto err_clear; + } + + r = dm_resume_device(cd, name, act2dmflags(tdmd.flags)); + if (!r) + goto out; + + /* + * This is worst case scenario. We have active underlying dm-integrity device with + * new table but dm-crypt resume failed for some reason. Tear everything down and + * burn it for good. + */ + + log_err(cd, _("Fatal error while reloading device %s (on top of device %s)."), name, iname); + + if (dm_error_device(cd, name)) + log_err(cd, _("Failed to switch device %s to dm-error."), name); + if (dm_error_device(cd, iname)) + log_err(cd, _("Failed to switch device %s to dm-error."), iname); + goto out; + +err_clear: + dm_clear_device(cd, name); + dm_clear_device(cd, iname); + + if (dm_status_suspended(cd, name) > 0) + dm_resume_device(cd, name, 0); + if (dm_status_suspended(cd, iname) > 0) + dm_resume_device(cd, iname, 0); +out: + dm_targets_free(cd, &tdmd); + dm_targets_free(cd, &tdmdi); + free(CONST_CAST(void*)tdmdi.uuid); + free(CONST_CAST(void*)tdmd.uuid); + device_free(cd, data_device); + + return r; +} + +int crypt_resize(struct crypt_device *cd, const char *name, uint64_t new_size) +{ + struct crypt_dm_active_device dmdq, dmd = {}; + struct dm_target *tgt = &dmdq.segment; + int r; + + /* + * FIXME: Also with LUKS2 we must not allow resize when there's + * explicit size stored in metadata (length != "dynamic") + */ + + /* Device context type must be initialized */ + if (!cd || !cd->type || !name) + return -EINVAL; + + if (isTCRYPT(cd->type) || isBITLK(cd->type)) { + log_err(cd, _("This operation is not supported for this device type.")); + return -ENOTSUP; + } + + log_dbg(cd, "Resizing device %s to %" PRIu64 " sectors.", name, new_size); + + r = dm_query_device(cd, name, DM_ACTIVE_CRYPT_KEYSIZE | DM_ACTIVE_CRYPT_KEY, &dmdq); + if (r < 0) { + log_err(cd, _("Device %s is not active."), name); + return -EINVAL; + } + if (!single_segment(&dmdq) || tgt->type != DM_CRYPT) { + log_dbg(cd, "Unsupported device table detected in %s.", name); + r = -EINVAL; + goto out; + } + + if ((dmdq.flags & CRYPT_ACTIVATE_KEYRING_KEY) && !crypt_key_in_keyring(cd)) { + r = -EPERM; + goto out; + } + + if (crypt_key_in_keyring(cd)) { + if (!isLUKS2(cd->type)) { + r = -EINVAL; + goto out; + } + r = LUKS2_key_description_by_segment(cd, &cd->u.luks2.hdr, + tgt->u.crypt.vk, CRYPT_DEFAULT_SEGMENT); + if (r) + goto out; + + dmdq.flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + if (crypt_loop_device(crypt_get_device_name(cd))) { + log_dbg(cd, "Trying to resize underlying loop device %s.", + crypt_get_device_name(cd)); + /* Here we always use default size not new_size */ + if (crypt_loop_resize(crypt_get_device_name(cd))) + log_err(cd, _("Cannot resize loop device.")); + } + + r = device_block_adjust(cd, crypt_data_device(cd), DEV_OK, + crypt_get_data_offset(cd), &new_size, &dmdq.flags); + if (r) + goto out; + + if (MISALIGNED(new_size, tgt->u.crypt.sector_size >> SECTOR_SHIFT)) { + log_err(cd, _("Device size is not aligned to requested sector size.")); + r = -EINVAL; + goto out; + } + + if (MISALIGNED(new_size, device_block_size(cd, crypt_data_device(cd)) >> SECTOR_SHIFT)) { + log_err(cd, _("Device size is not aligned to device logical block size.")); + r = -EINVAL; + goto out; + } + + dmd.uuid = crypt_get_uuid(cd); + dmd.size = new_size; + dmd.flags = dmdq.flags | CRYPT_ACTIVATE_REFRESH; + r = dm_crypt_target_set(&dmd.segment, 0, new_size, crypt_data_device(cd), + tgt->u.crypt.vk, crypt_get_cipher_spec(cd), + crypt_get_iv_offset(cd), crypt_get_data_offset(cd), + crypt_get_integrity(cd), crypt_get_integrity_tag_size(cd), + crypt_get_sector_size(cd)); + if (r < 0) + goto out; + + if (new_size == dmdq.size) { + log_dbg(cd, "Device has already requested size %" PRIu64 + " sectors.", dmdq.size); + r = 0; + } else { + if (isTCRYPT(cd->type)) + r = -ENOTSUP; + else if (isLUKS2(cd->type)) + r = LUKS2_unmet_requirements(cd, &cd->u.luks2.hdr, 0, 0); + if (!r) + r = _reload_device(cd, name, &dmd); + } +out: + dm_targets_free(cd, &dmd); + dm_targets_free(cd, &dmdq); + + return r; +} + +int crypt_set_uuid(struct crypt_device *cd, const char *uuid) +{ + const char *active_uuid; + int r; + + log_dbg(cd, "%s device uuid.", uuid ? "Setting new" : "Refreshing"); + + if ((r = onlyLUKS(cd))) + return r; + + active_uuid = crypt_get_uuid(cd); + + if (uuid && active_uuid && !strncmp(uuid, active_uuid, UUID_STRING_L)) { + log_dbg(cd, "UUID is the same as requested (%s) for device %s.", + uuid, mdata_device_path(cd)); + return 0; + } + + if (uuid) + log_dbg(cd, "Requested new UUID change to %s for %s.", uuid, mdata_device_path(cd)); + else + log_dbg(cd, "Requested new UUID refresh for %s.", mdata_device_path(cd)); + + if (!crypt_confirm(cd, _("Do you really want to change UUID of device?"))) + return -EPERM; + + if (isLUKS1(cd->type)) + return LUKS_hdr_uuid_set(&cd->u.luks1.hdr, uuid, cd); + else + return LUKS2_hdr_uuid(cd, &cd->u.luks2.hdr, uuid); +} + +int crypt_set_label(struct crypt_device *cd, const char *label, const char *subsystem) +{ + int r; + + log_dbg(cd, "Setting new labels."); + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_hdr_labels(cd, &cd->u.luks2.hdr, label, subsystem, 1); +} + +int crypt_header_backup(struct crypt_device *cd, + const char *requested_type, + const char *backup_file) +{ + int r; + + if (requested_type && !isLUKS(requested_type)) + return -EINVAL; + + if (!backup_file) + return -EINVAL; + + /* Load with repair */ + r = _crypt_load_luks(cd, requested_type, 1, 0); + if (r < 0) + return r; + + log_dbg(cd, "Requested header backup of device %s (%s) to " + "file %s.", mdata_device_path(cd), requested_type ?: "any type", backup_file); + + if (isLUKS1(cd->type) && (!requested_type || isLUKS1(requested_type))) + r = LUKS_hdr_backup(backup_file, cd); + else if (isLUKS2(cd->type) && (!requested_type || isLUKS2(requested_type))) + r = LUKS2_hdr_backup(cd, &cd->u.luks2.hdr, backup_file); + else + r = -EINVAL; + + return r; +} + +int crypt_header_restore(struct crypt_device *cd, + const char *requested_type, + const char *backup_file) +{ + struct luks_phdr hdr1; + struct luks2_hdr hdr2; + int r, version; + + if (requested_type && !isLUKS(requested_type)) + return -EINVAL; + + if (!cd || (cd->type && !isLUKS(cd->type)) || !backup_file) + return -EINVAL; + + r = init_crypto(cd); + if (r < 0) + return r; + + log_dbg(cd, "Requested header restore to device %s (%s) from " + "file %s.", mdata_device_path(cd), requested_type ?: "any type", backup_file); + + version = LUKS2_hdr_version_unlocked(cd, backup_file); + if (!version || + (requested_type && version == 1 && !isLUKS1(requested_type)) || + (requested_type && version == 2 && !isLUKS2(requested_type))) { + log_err(cd, _("Header backup file does not contain compatible LUKS header.")); + return -EINVAL; + } + + memset(&hdr2, 0, sizeof(hdr2)); + + if (!cd->type) { + if (version == 1) + r = LUKS_hdr_restore(backup_file, &hdr1, cd); + else + r = LUKS2_hdr_restore(cd, &hdr2, backup_file); + + crypt_safe_memzero(&hdr1, sizeof(hdr1)); + crypt_safe_memzero(&hdr2, sizeof(hdr2)); + } else if (isLUKS2(cd->type) && (!requested_type || isLUKS2(requested_type))) { + r = LUKS2_hdr_restore(cd, &cd->u.luks2.hdr, backup_file); + if (r) + _luks2_reload(cd); + } else if (isLUKS1(cd->type) && (!requested_type || isLUKS1(requested_type))) + r = LUKS_hdr_restore(backup_file, &cd->u.luks1.hdr, cd); + else + r = -EINVAL; + + if (!r) + r = _crypt_load_luks(cd, version == 1 ? CRYPT_LUKS1 : CRYPT_LUKS2, 1, 1); + + return r; +} + +void crypt_free(struct crypt_device *cd) +{ + if (!cd) + return; + + log_dbg(cd, "Releasing crypt device %s context.", mdata_device_path(cd)); + + dm_backend_exit(cd); + crypt_free_volume_key(cd->volume_key); + + crypt_free_type(cd); + + device_free(cd, cd->device); + device_free(cd, cd->metadata_device); + + free(CONST_CAST(void*)cd->pbkdf.type); + free(CONST_CAST(void*)cd->pbkdf.hash); + + /* Some structures can contain keys (TCRYPT), wipe it */ + crypt_safe_memzero(cd, sizeof(*cd)); + free(cd); +} + +static char *crypt_get_device_key_description(struct crypt_device *cd, const char *name) +{ + char *desc = NULL; + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + + if (dm_query_device(cd, name, DM_ACTIVE_CRYPT_KEY | DM_ACTIVE_CRYPT_KEYSIZE, &dmd) < 0) + return NULL; + + if (single_segment(&dmd) && tgt->type == DM_CRYPT && + (dmd.flags & CRYPT_ACTIVATE_KEYRING_KEY) && tgt->u.crypt.vk->key_description) + desc = strdup(tgt->u.crypt.vk->key_description); + + dm_targets_free(cd, &dmd); + + return desc; +} + +int crypt_suspend(struct crypt_device *cd, + const char *name) +{ + char *key_desc; + crypt_status_info ci; + int r; + uint32_t dmflags = DM_SUSPEND_WIPE_KEY; + + /* FIXME: check context uuid matches the dm-crypt device uuid (onlyLUKS branching) */ + + if (!cd || !name) + return -EINVAL; + + log_dbg(cd, "Suspending volume %s.", name); + + if (cd->type) + r = onlyLUKS(cd); + else { + r = crypt_uuid_type_cmp(cd, CRYPT_LUKS1); + if (r < 0) + r = crypt_uuid_type_cmp(cd, CRYPT_LUKS2); + if (r < 0) + log_err(cd, _("This operation is supported only for LUKS device.")); + } + + if (r < 0) + return r; + + ci = crypt_status(NULL, name); + if (ci < CRYPT_ACTIVE) { + log_err(cd, _("Volume %s is not active."), name); + return -EINVAL; + } + + dm_backend_init(cd); + + r = dm_status_suspended(cd, name); + if (r < 0) + goto out; + + if (r) { + log_err(cd, _("Volume %s is already suspended."), name); + r = -EINVAL; + goto out; + } + + key_desc = crypt_get_device_key_description(cd, name); + + /* we can't simply wipe wrapped keys */ + if (crypt_cipher_wrapped_key(crypt_get_cipher(cd), crypt_get_cipher_mode(cd))) + dmflags &= ~DM_SUSPEND_WIPE_KEY; + + r = dm_suspend_device(cd, name, dmflags); + if (r == -ENOTSUP) + log_err(cd, _("Suspend is not supported for device %s."), name); + else if (r) + log_err(cd, _("Error during suspending device %s."), name); + else + crypt_drop_keyring_key_by_description(cd, key_desc, LOGON_KEY); + free(key_desc); +out: + dm_backend_exit(cd); + return r; +} + +/* key must be properly verified */ +static int resume_by_volume_key(struct crypt_device *cd, + struct volume_key *vk, + const char *name) +{ + int digest, r; + struct volume_key *zerokey = NULL; + + if (crypt_is_cipher_null(crypt_get_cipher_spec(cd))) { + zerokey = crypt_alloc_volume_key(0, NULL); + if (!zerokey) + return -ENOMEM; + vk = zerokey; + } else if (crypt_use_keyring_for_vk(cd)) { + /* LUKS2 path only */ + digest = LUKS2_digest_by_segment(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + if (digest < 0) + return -EINVAL; + r = LUKS2_volume_key_load_in_keyring_by_digest(cd, + &cd->u.luks2.hdr, vk, digest); + if (r < 0) + return r; + } + + r = dm_resume_and_reinstate_key(cd, name, vk); + + if (r == -ENOTSUP) + log_err(cd, _("Resume is not supported for device %s."), name); + else if (r) + log_err(cd, _("Error during resuming device %s."), name); + + if (r < 0) + crypt_drop_keyring_key(cd, vk); + + crypt_free_volume_key(zerokey); + + return r; +} + +int crypt_resume_by_passphrase(struct crypt_device *cd, + const char *name, + int keyslot, + const char *passphrase, + size_t passphrase_size) +{ + struct volume_key *vk = NULL; + int r; + + /* FIXME: check context uuid matches the dm-crypt device uuid */ + + if (!passphrase || !name) + return -EINVAL; + + log_dbg(cd, "Resuming volume %s.", name); + + if ((r = onlyLUKS(cd))) + return r; + + r = dm_status_suspended(cd, name); + if (r < 0) + return r; + + if (!r) { + log_err(cd, _("Volume %s is not suspended."), name); + return -EINVAL; + } + + if (isLUKS1(cd->type)) + r = LUKS_open_key_with_hdr(keyslot, passphrase, passphrase_size, + &cd->u.luks1.hdr, &vk, cd); + else + r = LUKS2_keyslot_open(cd, keyslot, CRYPT_DEFAULT_SEGMENT, passphrase, passphrase_size, &vk); + + if (r < 0) + return r; + + keyslot = r; + + r = resume_by_volume_key(cd, vk, name); + + crypt_free_volume_key(vk); + return r < 0 ? r : keyslot; +} + +int crypt_resume_by_keyfile_device_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset) +{ + struct volume_key *vk = NULL; + char *passphrase_read = NULL; + size_t passphrase_size_read; + int r; + + /* FIXME: check context uuid matches the dm-crypt device uuid */ + + if (!name || !keyfile) + return -EINVAL; + + log_dbg(cd, "Resuming volume %s.", name); + + if ((r = onlyLUKS(cd))) + return r; + + r = dm_status_suspended(cd, name); + if (r < 0) + return r; + + if (!r) { + log_err(cd, _("Volume %s is not suspended."), name); + return -EINVAL; + } + + r = crypt_keyfile_device_read(cd, keyfile, + &passphrase_read, &passphrase_size_read, + keyfile_offset, keyfile_size, 0); + if (r < 0) + return r; + + if (isLUKS1(cd->type)) + r = LUKS_open_key_with_hdr(keyslot, passphrase_read, passphrase_size_read, + &cd->u.luks1.hdr, &vk, cd); + else + r = LUKS2_keyslot_open(cd, keyslot, CRYPT_DEFAULT_SEGMENT, passphrase_read, passphrase_size_read, &vk); + + crypt_safe_free(passphrase_read); + if (r < 0) + return r; + + keyslot = r; + + r = resume_by_volume_key(cd, vk, name); + + crypt_free_volume_key(vk); + return r < 0 ? r : keyslot; +} + +int crypt_resume_by_keyfile(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size) +{ + return crypt_resume_by_keyfile_device_offset(cd, name, keyslot, + keyfile, keyfile_size, 0); +} + +int crypt_resume_by_keyfile_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset) +{ + return crypt_resume_by_keyfile_device_offset(cd, name, keyslot, + keyfile, keyfile_size, keyfile_offset); +} + +int crypt_resume_by_volume_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size) +{ + struct volume_key *vk = NULL; + int r; + + if (!name || !volume_key) + return -EINVAL; + + log_dbg(cd, "Resuming volume %s by volume key.", name); + + if ((r = onlyLUKS(cd))) + return r; + + r = dm_status_suspended(cd, name); + if (r < 0) + return r; + + if (!r) { + log_err(cd, _("Volume %s is not suspended."), name); + return -EINVAL; + } + + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + + if (isLUKS1(cd->type)) + r = LUKS_verify_volume_key(&cd->u.luks1.hdr, vk); + else if (isLUKS2(cd->type)) + r = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + else + r = -EINVAL; + if (r == -EPERM || r == -ENOENT) + log_err(cd, _("Volume key does not match the volume.")); + + if (r >= 0) + r = resume_by_volume_key(cd, vk, name); + + crypt_free_volume_key(vk); + return r; +} + +/* + * Keyslot manipulation + */ +int crypt_keyslot_add_by_passphrase(struct crypt_device *cd, + int keyslot, // -1 any + const char *passphrase, + size_t passphrase_size, + const char *new_passphrase, + size_t new_passphrase_size) +{ + int digest, r, active_slots; + struct luks2_keyslot_params params; + struct volume_key *vk = NULL; + + log_dbg(cd, "Adding new keyslot, existing passphrase %sprovided," + "new passphrase %sprovided.", + passphrase ? "" : "not ", new_passphrase ? "" : "not "); + + if ((r = onlyLUKS(cd))) + return r; + + if (!passphrase || !new_passphrase) + return -EINVAL; + + r = keyslot_verify_or_find_empty(cd, &keyslot); + if (r) + return r; + + if (isLUKS1(cd->type)) + active_slots = LUKS_keyslot_active_count(&cd->u.luks1.hdr); + else + active_slots = LUKS2_keyslot_active_count(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + if (active_slots == 0) { + /* No slots used, try to use pre-generated key in header */ + if (cd->volume_key) { + vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key); + r = vk ? 0 : -ENOMEM; + } else { + log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.")); + return -EINVAL; + } + } else if (active_slots < 0) + return -EINVAL; + else { + /* Passphrase provided, use it to unlock existing keyslot */ + if (isLUKS1(cd->type)) + r = LUKS_open_key_with_hdr(CRYPT_ANY_SLOT, passphrase, + passphrase_size, &cd->u.luks1.hdr, &vk, cd); + else + r = LUKS2_keyslot_open(cd, CRYPT_ANY_SLOT, CRYPT_DEFAULT_SEGMENT, passphrase, + passphrase_size, &vk); + } + + if (r < 0) + goto out; + + if (isLUKS1(cd->type)) + r = LUKS_set_key(keyslot, CONST_CAST(char*)new_passphrase, + new_passphrase_size, &cd->u.luks1.hdr, vk, cd); + else { + r = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + digest = r; + + if (r >= 0) + r = LUKS2_keyslot_params_default(cd, &cd->u.luks2.hdr, ¶ms); + + if (r >= 0) + r = LUKS2_digest_assign(cd, &cd->u.luks2.hdr, keyslot, digest, 1, 0); + + if (r >= 0) + r = LUKS2_keyslot_store(cd, &cd->u.luks2.hdr, keyslot, + CONST_CAST(char*)new_passphrase, + new_passphrase_size, vk, ¶ms); + } + + if (r < 0) + goto out; + + r = 0; +out: + crypt_free_volume_key(vk); + if (r < 0) { + _luks2_reload(cd); + return r; + } + return keyslot; +} + +int crypt_keyslot_change_by_passphrase(struct crypt_device *cd, + int keyslot_old, + int keyslot_new, + const char *passphrase, + size_t passphrase_size, + const char *new_passphrase, + size_t new_passphrase_size) +{ + int digest = -1, r; + struct luks2_keyslot_params params; + struct volume_key *vk = NULL; + + if (!passphrase || !new_passphrase) + return -EINVAL; + + log_dbg(cd, "Changing passphrase from old keyslot %d to new %d.", + keyslot_old, keyslot_new); + + if ((r = onlyLUKS(cd))) + return r; + + if (isLUKS1(cd->type)) + r = LUKS_open_key_with_hdr(keyslot_old, passphrase, passphrase_size, + &cd->u.luks1.hdr, &vk, cd); + else if (isLUKS2(cd->type)) { + r = LUKS2_keyslot_open(cd, keyslot_old, CRYPT_ANY_SEGMENT, passphrase, passphrase_size, &vk); + /* will fail for keyslots w/o digest. fix if supported in a future */ + if (r >= 0) { + digest = LUKS2_digest_by_keyslot(&cd->u.luks2.hdr, r); + if (digest < 0) + r = -EINVAL; + } + } else + r = -EINVAL; + if (r < 0) + goto out; + + if (keyslot_old != CRYPT_ANY_SLOT && keyslot_old != r) { + log_dbg(cd, "Keyslot mismatch."); + goto out; + } + keyslot_old = r; + + if (keyslot_new == CRYPT_ANY_SLOT) { + if (isLUKS1(cd->type)) + keyslot_new = LUKS_keyslot_find_empty(&cd->u.luks1.hdr); + else if (isLUKS2(cd->type)) + keyslot_new = LUKS2_keyslot_find_empty(&cd->u.luks2.hdr); + if (keyslot_new < 0) + keyslot_new = keyslot_old; + } + log_dbg(cd, "Key change, old slot %d, new slot %d.", keyslot_old, keyslot_new); + + if (isLUKS1(cd->type)) { + if (keyslot_old == keyslot_new) { + log_dbg(cd, "Key slot %d is going to be overwritten.", keyslot_old); + (void)crypt_keyslot_destroy(cd, keyslot_old); + } + r = LUKS_set_key(keyslot_new, new_passphrase, new_passphrase_size, + &cd->u.luks1.hdr, vk, cd); + } else if (isLUKS2(cd->type)) { + r = LUKS2_keyslot_params_default(cd, &cd->u.luks2.hdr, ¶ms); + if (r) + goto out; + + if (keyslot_old != keyslot_new) { + r = LUKS2_digest_assign(cd, &cd->u.luks2.hdr, keyslot_new, digest, 1, 0); + if (r < 0) + goto out; + r = LUKS2_token_assignment_copy(cd, &cd->u.luks2.hdr, keyslot_old, keyslot_new, 0); + if (r < 0) + goto out; + } else { + log_dbg(cd, "Key slot %d is going to be overwritten.", keyslot_old); + /* FIXME: improve return code so that we can detect area is damaged */ + r = LUKS2_keyslot_wipe(cd, &cd->u.luks2.hdr, keyslot_old, 1); + if (r) { + /* (void)crypt_keyslot_destroy(cd, keyslot_old); */ + r = -EINVAL; + goto out; + } + } + + r = LUKS2_keyslot_store(cd, &cd->u.luks2.hdr, + keyslot_new, new_passphrase, + new_passphrase_size, vk, ¶ms); + } else + r = -EINVAL; + + if (r >= 0 && keyslot_old != keyslot_new) + r = crypt_keyslot_destroy(cd, keyslot_old); + + if (r < 0) + log_err(cd, _("Failed to swap new key slot.")); +out: + crypt_free_volume_key(vk); + if (r < 0) { + _luks2_reload(cd); + return r; + } + return keyslot_new; +} + +int crypt_keyslot_add_by_keyfile_device_offset(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset, + const char *new_keyfile, + size_t new_keyfile_size, + uint64_t new_keyfile_offset) +{ + int digest, r, active_slots; + size_t passwordLen, new_passwordLen; + struct luks2_keyslot_params params; + char *password = NULL, *new_password = NULL; + struct volume_key *vk = NULL; + + if (!keyfile || !new_keyfile) + return -EINVAL; + + log_dbg(cd, "Adding new keyslot, existing keyfile %s, new keyfile %s.", + keyfile, new_keyfile); + + if ((r = onlyLUKS(cd))) + return r; + + r = keyslot_verify_or_find_empty(cd, &keyslot); + if (r) + return r; + + if (isLUKS1(cd->type)) + active_slots = LUKS_keyslot_active_count(&cd->u.luks1.hdr); + else + active_slots = LUKS2_keyslot_active_count(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + if (active_slots == 0) { + /* No slots used, try to use pre-generated key in header */ + if (cd->volume_key) { + vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key); + r = vk ? 0 : -ENOMEM; + } else { + log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.")); + return -EINVAL; + } + } else { + r = crypt_keyfile_device_read(cd, keyfile, + &password, &passwordLen, + keyfile_offset, keyfile_size, 0); + if (r < 0) + goto out; + + if (isLUKS1(cd->type)) + r = LUKS_open_key_with_hdr(CRYPT_ANY_SLOT, password, passwordLen, + &cd->u.luks1.hdr, &vk, cd); + else + r = LUKS2_keyslot_open(cd, CRYPT_ANY_SLOT, CRYPT_DEFAULT_SEGMENT, password, passwordLen, &vk); + } + + if (r < 0) + goto out; + + r = crypt_keyfile_device_read(cd, new_keyfile, + &new_password, &new_passwordLen, + new_keyfile_offset, new_keyfile_size, 0); + if (r < 0) + goto out; + + if (isLUKS1(cd->type)) + r = LUKS_set_key(keyslot, new_password, new_passwordLen, + &cd->u.luks1.hdr, vk, cd); + else { + r = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + digest = r; + + if (r >= 0) + r = LUKS2_keyslot_params_default(cd, &cd->u.luks2.hdr, ¶ms); + + if (r >= 0) + r = LUKS2_digest_assign(cd, &cd->u.luks2.hdr, keyslot, digest, 1, 0); + + if (r >= 0) + r = LUKS2_keyslot_store(cd, &cd->u.luks2.hdr, keyslot, + new_password, new_passwordLen, vk, ¶ms); + } +out: + crypt_safe_free(password); + crypt_safe_free(new_password); + crypt_free_volume_key(vk); + if (r < 0) { + _luks2_reload(cd); + return r; + } + return keyslot; +} + +int crypt_keyslot_add_by_keyfile(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + const char *new_keyfile, + size_t new_keyfile_size) +{ + return crypt_keyslot_add_by_keyfile_device_offset(cd, keyslot, + keyfile, keyfile_size, 0, + new_keyfile, new_keyfile_size, 0); +} + +int crypt_keyslot_add_by_keyfile_offset(struct crypt_device *cd, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset, + const char *new_keyfile, + size_t new_keyfile_size, + size_t new_keyfile_offset) +{ + return crypt_keyslot_add_by_keyfile_device_offset(cd, keyslot, + keyfile, keyfile_size, keyfile_offset, + new_keyfile, new_keyfile_size, new_keyfile_offset); +} + +int crypt_keyslot_add_by_volume_key(struct crypt_device *cd, + int keyslot, + const char *volume_key, + size_t volume_key_size, + const char *passphrase, + size_t passphrase_size) +{ + struct volume_key *vk = NULL; + int r; + + if (!passphrase) + return -EINVAL; + + log_dbg(cd, "Adding new keyslot %d using volume key.", keyslot); + + if ((r = onlyLUKS(cd))) + return r; + + if (isLUKS2(cd->type)) + return crypt_keyslot_add_by_key(cd, keyslot, + volume_key, volume_key_size, passphrase, + passphrase_size, 0); + + r = keyslot_verify_or_find_empty(cd, &keyslot); + if (r < 0) + return r; + + if (volume_key) + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + else if (cd->volume_key) + vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key); + + if (!vk) + return -ENOMEM; + + r = LUKS_verify_volume_key(&cd->u.luks1.hdr, vk); + if (r < 0) + log_err(cd, _("Volume key does not match the volume.")); + else + r = LUKS_set_key(keyslot, passphrase, passphrase_size, + &cd->u.luks1.hdr, vk, cd); + + crypt_free_volume_key(vk); + return (r < 0) ? r : keyslot; +} + +int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot) +{ + crypt_keyslot_info ki; + int r; + + log_dbg(cd, "Destroying keyslot %d.", keyslot); + + if ((r = _onlyLUKS(cd, CRYPT_CD_UNRESTRICTED))) + return r; + + ki = crypt_keyslot_status(cd, keyslot); + if (ki == CRYPT_SLOT_INVALID) { + log_err(cd, _("Key slot %d is invalid."), keyslot); + return -EINVAL; + } + + if (isLUKS1(cd->type)) { + if (ki == CRYPT_SLOT_INACTIVE) { + log_err(cd, _("Keyslot %d is not active."), keyslot); + return -EINVAL; + } + return LUKS_del_key(keyslot, &cd->u.luks1.hdr, cd); + } + + return LUKS2_keyslot_wipe(cd, &cd->u.luks2.hdr, keyslot, 0); +} + +static int _check_header_data_overlap(struct crypt_device *cd, const char *name) +{ + if (!name || !isLUKS(cd->type)) + return 0; + + if (device_is_identical(crypt_data_device(cd), crypt_metadata_device(cd)) <= 0) + return 0; + + /* FIXME: check real header size */ + if (crypt_get_data_offset(cd) == 0) { + log_err(cd, _("Device header overlaps with data area.")); + return -EINVAL; + } + + return 0; +} + +static int check_devices(struct crypt_device *cd, const char *name, const char *iname, uint32_t *flags) +{ + int r; + + if (!flags || !name) + return -EINVAL; + + if (iname) { + r = dm_status_device(cd, iname); + if (r >= 0 && !(*flags & CRYPT_ACTIVATE_REFRESH)) + return -EBUSY; + if (r < 0 && r != -ENODEV) + return r; + if (r == -ENODEV) + *flags &= ~CRYPT_ACTIVATE_REFRESH; + } + + r = dm_status_device(cd, name); + if (r >= 0 && !(*flags & CRYPT_ACTIVATE_REFRESH)) + return -EBUSY; + if (r < 0 && r != -ENODEV) + return r; + if (r == -ENODEV) + *flags &= ~CRYPT_ACTIVATE_REFRESH; + + return 0; +} + +static int _create_device_with_integrity(struct crypt_device *cd, + const char *type, const char *name, const char *iname, + const char *ipath, struct crypt_dm_active_device *dmd, + struct crypt_dm_active_device *dmdi) +{ + int r; + enum devcheck device_check; + struct dm_target *tgt; + struct device *device = NULL; + + if (!single_segment(dmd)) + return -EINVAL; + + tgt = &dmd->segment; + if (tgt->type != DM_CRYPT) + return -EINVAL; + + device_check = dmd->flags & CRYPT_ACTIVATE_SHARED ? DEV_OK : DEV_EXCL; + + r = INTEGRITY_activate_dmd_device(cd, iname, CRYPT_INTEGRITY, dmdi, 0); + if (r) + return r; + + r = device_alloc(cd, &device, ipath); + if (r < 0) + goto out; + tgt->data_device = device; + + r = device_block_adjust(cd, tgt->data_device, device_check, + tgt->u.crypt.offset, &dmd->size, &dmd->flags); + + if (!r) + r = dm_create_device(cd, name, type, dmd); +out: + if (r < 0) + dm_remove_device(cd, iname, 0); + + device_free(cd, device); + return r; +} + +static int kernel_keyring_support(void) +{ + static unsigned _checked = 0; + + if (!_checked) { + _kernel_keyring_supported = keyring_check(); + _checked = 1; + } + + return _kernel_keyring_supported; +} + +static int dmcrypt_keyring_bug(void) +{ + uint64_t kversion; + + if (kernel_version(&kversion)) + return 1; + return kversion < version(4,15,0,0); +} + +int create_or_reload_device(struct crypt_device *cd, const char *name, + const char *type, struct crypt_dm_active_device *dmd) +{ + int r; + enum devcheck device_check; + struct dm_target *tgt; + + if (!type || !name || !single_segment(dmd)) + return -EINVAL; + + tgt = &dmd->segment; + if (tgt->type != DM_CRYPT) + return -EINVAL; + + /* drop CRYPT_ACTIVATE_REFRESH flag if any device is inactive */ + r = check_devices(cd, name, NULL, &dmd->flags); + if (r) + return r; + + if (dmd->flags & CRYPT_ACTIVATE_REFRESH) + r = _reload_device(cd, name, dmd); + else { + device_check = dmd->flags & CRYPT_ACTIVATE_SHARED ? DEV_OK : DEV_EXCL; + + r = device_block_adjust(cd, tgt->data_device, device_check, + tgt->u.crypt.offset, &dmd->size, &dmd->flags); + if (!r) { + tgt->size = dmd->size; + r = dm_create_device(cd, name, type, dmd); + } + } + + return r; +} + +int create_or_reload_device_with_integrity(struct crypt_device *cd, const char *name, + const char *type, struct crypt_dm_active_device *dmd, + struct crypt_dm_active_device *dmdi) +{ + int r; + const char *iname = NULL; + char *ipath = NULL; + + if (!type || !name || !dmd || !dmdi) + return -EINVAL; + + if (asprintf(&ipath, "%s/%s_dif", dm_get_dir(), name) < 0) + return -ENOMEM; + iname = ipath + strlen(dm_get_dir()) + 1; + + /* drop CRYPT_ACTIVATE_REFRESH flag if any device is inactive */ + r = check_devices(cd, name, iname, &dmd->flags); + if (r) + goto out; + + if (dmd->flags & CRYPT_ACTIVATE_REFRESH) + r = _reload_device_with_integrity(cd, name, iname, ipath, dmd, dmdi); + else + r = _create_device_with_integrity(cd, type, name, iname, ipath, dmd, dmdi); +out: + free(ipath); + + return r; +} + +/* See fixmes in _open_and_activate_luks2 */ +int update_reencryption_flag(struct crypt_device *cd, int enable, bool commit); + +/* TODO: This function should 1:1 with pre-reencryption code */ +static int _open_and_activate(struct crypt_device *cd, + int keyslot, + const char *name, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + bool use_keyring; + int r; + struct volume_key *vk = NULL; + + r = LUKS2_keyslot_open(cd, keyslot, + (flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) ? + CRYPT_ANY_SEGMENT : CRYPT_DEFAULT_SEGMENT, + passphrase, passphrase_size, &vk); + if (r < 0) + return r; + keyslot = r; + + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = ((name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || + (flags & CRYPT_ACTIVATE_KEYRING_KEY)); + + if (use_keyring) { + r = LUKS2_volume_key_load_in_keyring_by_keyslot(cd, + &cd->u.luks2.hdr, vk, keyslot); + if (r < 0) + goto out; + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + if (name) + r = LUKS2_activate(cd, name, vk, flags); +out: + if (r < 0) + crypt_drop_keyring_key(cd, vk); + crypt_free_volume_key(vk); + + return r < 0 ? r : keyslot; +} + +#if USE_LUKS2_REENCRYPTION +static int load_all_keys(struct crypt_device *cd, struct luks2_hdr *hdr, struct volume_key *vks) +{ + int r; + struct volume_key *vk = vks; + + while (vk) { + r = LUKS2_volume_key_load_in_keyring_by_digest(cd, hdr, vk, crypt_volume_key_get_id(vk)); + if (r < 0) + return r; + vk = crypt_volume_key_next(vk); + } + + return 0; +} + +static int _open_all_keys(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const char *passphrase, + size_t passphrase_size, + uint32_t flags, + struct volume_key **vks) +{ + int r, segment; + struct volume_key *_vks = NULL; + crypt_reencrypt_info ri = LUKS2_reencrypt_status(hdr); + + segment = (flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) ? CRYPT_ANY_SEGMENT : CRYPT_DEFAULT_SEGMENT; + + switch (ri) { + case CRYPT_REENCRYPT_NONE: + r = LUKS2_keyslot_open(cd, keyslot, segment, passphrase, passphrase_size, &_vks); + break; + case CRYPT_REENCRYPT_CLEAN: + case CRYPT_REENCRYPT_CRASH: + if (segment == CRYPT_ANY_SEGMENT) + r = LUKS2_keyslot_open(cd, keyslot, segment, passphrase, + passphrase_size, &_vks); + else + r = LUKS2_keyslot_open_all_segments(cd, keyslot, + keyslot, passphrase, passphrase_size, + &_vks); + break; + default: + r = -EINVAL; + } + + if (keyslot == CRYPT_ANY_SLOT) + keyslot = r; + + if (r >= 0 && (flags & CRYPT_ACTIVATE_KEYRING_KEY)) + r = load_all_keys(cd, hdr, _vks); + + if (r >= 0 && vks) + MOVE_REF(*vks, _vks); + + if (r < 0) + crypt_drop_keyring_key(cd, _vks); + crypt_free_volume_key(_vks); + + return r < 0 ? r : keyslot; +} + +static int _open_and_activate_reencrypt_device(struct crypt_device *cd, + struct luks2_hdr *hdr, + int keyslot, + const char *name, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + bool dynamic_size; + crypt_reencrypt_info ri; + uint64_t minimal_size, device_size; + struct volume_key *vks = NULL; + int r = 0; + struct crypt_lock_handle *reencrypt_lock = NULL; + + if (crypt_use_keyring_for_vk(cd)) + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + + r = LUKS2_reencrypt_lock(cd, &reencrypt_lock); + if (r) { + if (r == -EBUSY) + log_err(cd, _("Reencryption in-progress. Cannot activate device.")); + else + log_err(cd, _("Failed to get reencryption lock.")); + return r; + } + + if ((r = crypt_load(cd, CRYPT_LUKS2, NULL))) + goto err; + + ri = LUKS2_reencrypt_status(hdr); + + if (ri == CRYPT_REENCRYPT_CRASH) { + r = LUKS2_reencrypt_locked_recovery_by_passphrase(cd, keyslot, + keyslot, passphrase, passphrase_size, flags, &vks); + if (r < 0) { + log_err(cd, _("LUKS2 reencryption recovery failed.")); + goto err; + } + keyslot = r; + + ri = LUKS2_reencrypt_status(hdr); + } + + /* recovery finished reencryption or it's already finished */ + if (ri == CRYPT_REENCRYPT_NONE) { + crypt_drop_keyring_key(cd, vks); + crypt_free_volume_key(vks); + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + return _open_and_activate(cd, keyslot, name, passphrase, passphrase_size, flags); + } + + if (ri > CRYPT_REENCRYPT_CLEAN) { + r = -EINVAL; + goto err; + } + + if (LUKS2_get_data_size(hdr, &minimal_size, &dynamic_size)) + goto err; + + if (!vks) { + r = _open_all_keys(cd, hdr, keyslot, passphrase, passphrase_size, flags, &vks); + if (r >= 0) + keyslot = r; + } + + if (r >= 0) { + r = LUKS2_reencrypt_digest_verify(cd, hdr, vks); + if (r < 0) + goto err; + } + + log_dbg(cd, "Entering clean reencryption state mode."); + + if (r >= 0) + r = LUKS2_reencrypt_check_device_size(cd, hdr, minimal_size, &device_size, true, dynamic_size); + + if (r >= 0) + r = LUKS2_activate_multi(cd, name, vks, device_size >> SECTOR_SHIFT, flags); +err: + LUKS2_reencrypt_unlock(cd, reencrypt_lock); + if (r < 0) + crypt_drop_keyring_key(cd, vks); + crypt_free_volume_key(vks); + + return r < 0 ? r : keyslot; +} + +/* + * Activation/deactivation of a device + */ +static int _open_and_activate_luks2(struct crypt_device *cd, + int keyslot, + const char *name, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + crypt_reencrypt_info ri; + int r, rv; + struct luks2_hdr *hdr = &cd->u.luks2.hdr; + struct volume_key *vks = NULL; + + ri = LUKS2_reencrypt_status(hdr); + if (ri == CRYPT_REENCRYPT_INVALID) + return -EINVAL; + + if (ri > CRYPT_REENCRYPT_NONE) { + if (name) + r = _open_and_activate_reencrypt_device(cd, hdr, keyslot, name, passphrase, + passphrase_size, flags); + else { + r = _open_all_keys(cd, hdr, keyslot, passphrase, + passphrase_size, flags, &vks); + if (r < 0) + return r; + + rv = LUKS2_reencrypt_digest_verify(cd, hdr, vks); + crypt_free_volume_key(vks); + if (rv < 0) + return rv; + } + } else + r = _open_and_activate(cd, keyslot, name, passphrase, + passphrase_size, flags); + + return r; +} +#else +static int _open_and_activate_luks2(struct crypt_device *cd, + int keyslot, + const char *name, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + crypt_reencrypt_info ri; + + ri = LUKS2_reencrypt_status(&cd->u.luks2.hdr); + if (ri == CRYPT_REENCRYPT_INVALID) + return -EINVAL; + + if (ri > CRYPT_REENCRYPT_NONE) { + log_err(cd, _("This operation is not supported for this device type.")); + return -ENOTSUP; + } + + return _open_and_activate(cd, keyslot, name, passphrase, passphrase_size, flags); +} +#endif + +static int _activate_by_passphrase(struct crypt_device *cd, + const char *name, + int keyslot, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + int r; + struct volume_key *vk = NULL; + + if ((flags & CRYPT_ACTIVATE_KEYRING_KEY) && !crypt_use_keyring_for_vk(cd)) + return -EINVAL; + + if ((flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) && name) + return -EINVAL; + + r = _check_header_data_overlap(cd, name); + if (r < 0) + return r; + + if (flags & CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF) + cd->memory_hard_pbkdf_lock_enabled = true; + + /* plain, use hashed passphrase */ + if (isPLAIN(cd->type)) { + r = -EINVAL; + if (!name) + goto out; + + r = process_key(cd, cd->u.plain.hdr.hash, + cd->u.plain.key_size, + passphrase, passphrase_size, &vk); + if (r < 0) + goto out; + + r = PLAIN_activate(cd, name, vk, cd->u.plain.hdr.size, flags); + keyslot = 0; + } else if (isLUKS1(cd->type)) { + r = LUKS_open_key_with_hdr(keyslot, passphrase, + passphrase_size, &cd->u.luks1.hdr, &vk, cd); + if (r >= 0) { + keyslot = r; + if (name) + r = LUKS1_activate(cd, name, vk, flags); + } + } else if (isLUKS2(cd->type)) { + r = _open_and_activate_luks2(cd, keyslot, name, passphrase, passphrase_size, flags); + keyslot = r; + } else if (isBITLK(cd->type)) { + r = BITLK_activate(cd, name, passphrase, passphrase_size, + &cd->u.bitlk.params, flags); + keyslot = 0; + } else { + log_err(cd, _("Device type is not properly initialized.")); + r = -EINVAL; + } +out: + if (r < 0) + crypt_drop_keyring_key(cd, vk); + crypt_free_volume_key(vk); + + cd->memory_hard_pbkdf_lock_enabled = false; + + return r < 0 ? r : keyslot; +} + +static int _activate_loopaes(struct crypt_device *cd, + const char *name, + char *buffer, + size_t buffer_size, + uint32_t flags) +{ + int r; + unsigned int key_count = 0; + struct volume_key *vk = NULL; + + r = LOOPAES_parse_keyfile(cd, &vk, cd->u.loopaes.hdr.hash, &key_count, + buffer, buffer_size); + + if (!r && name) + r = LOOPAES_activate(cd, name, cd->u.loopaes.cipher, key_count, + vk, flags); + + crypt_free_volume_key(vk); + + return r; +} + +static int _activate_check_status(struct crypt_device *cd, const char *name, unsigned reload) +{ + int r; + + if (!name) + return 0; + + r = dm_status_device(cd, name); + + if (r >= 0 && reload) + return 0; + + if (r >= 0 || r == -EEXIST) { + log_err(cd, _("Device %s already exists."), name); + return -EEXIST; + } + + if (r == -ENODEV) + return 0; + + log_err(cd, _("Cannot use device %s, name is invalid or still in use."), name); + return r; +} + +// activation/deactivation of device mapping +int crypt_activate_by_passphrase(struct crypt_device *cd, + const char *name, + int keyslot, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + int r; + + if (!cd || !passphrase || (!name && (flags & CRYPT_ACTIVATE_REFRESH))) + return -EINVAL; + + log_dbg(cd, "%s volume %s [keyslot %d] using passphrase.", + name ? "Activating" : "Checking", name ?: "passphrase", + keyslot); + + r = _activate_check_status(cd, name, flags & CRYPT_ACTIVATE_REFRESH); + if (r < 0) + return r; + + return _activate_by_passphrase(cd, name, keyslot, passphrase, passphrase_size, flags); +} + +int crypt_activate_by_keyfile_device_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint64_t keyfile_offset, + uint32_t flags) +{ + char *passphrase_read = NULL; + size_t passphrase_size_read; + int r; + + if (!cd || !keyfile || + ((flags & CRYPT_ACTIVATE_KEYRING_KEY) && !crypt_use_keyring_for_vk(cd))) + return -EINVAL; + + log_dbg(cd, "%s volume %s [keyslot %d] using keyfile %s.", + name ? "Activating" : "Checking", name ?: "passphrase", keyslot, keyfile); + + r = _activate_check_status(cd, name, flags & CRYPT_ACTIVATE_REFRESH); + if (r < 0) + return r; + + r = crypt_keyfile_device_read(cd, keyfile, + &passphrase_read, &passphrase_size_read, + keyfile_offset, keyfile_size, 0); + if (r < 0) + goto out; + + if (isLOOPAES(cd->type)) + r = _activate_loopaes(cd, name, passphrase_read, passphrase_size_read, flags); + else + r = _activate_by_passphrase(cd, name, keyslot, passphrase_read, passphrase_size_read, flags); + +out: + crypt_safe_free(passphrase_read); + return r; +} + +int crypt_activate_by_keyfile(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + uint32_t flags) +{ + return crypt_activate_by_keyfile_device_offset(cd, name, keyslot, keyfile, + keyfile_size, 0, flags); +} + +int crypt_activate_by_keyfile_offset(struct crypt_device *cd, + const char *name, + int keyslot, + const char *keyfile, + size_t keyfile_size, + size_t keyfile_offset, + uint32_t flags) +{ + return crypt_activate_by_keyfile_device_offset(cd, name, keyslot, keyfile, + keyfile_size, keyfile_offset, flags); +} +int crypt_activate_by_volume_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size, + uint32_t flags) +{ + bool use_keyring; + struct volume_key *vk = NULL; + int r; + + if (!cd || + ((flags & CRYPT_ACTIVATE_KEYRING_KEY) && !crypt_use_keyring_for_vk(cd))) + return -EINVAL; + + log_dbg(cd, "%s volume %s by volume key.", name ? "Activating" : "Checking", + name ?: ""); + + r = _activate_check_status(cd, name, flags & CRYPT_ACTIVATE_REFRESH); + if (r < 0) + return r; + + r = _check_header_data_overlap(cd, name); + if (r < 0) + return r; + + /* use key directly, no hash */ + if (isPLAIN(cd->type)) { + if (!name) + return -EINVAL; + + if (!volume_key || !volume_key_size || volume_key_size != cd->u.plain.key_size) { + log_err(cd, _("Incorrect volume key specified for plain device.")); + return -EINVAL; + } + + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + + r = PLAIN_activate(cd, name, vk, cd->u.plain.hdr.size, flags); + } else if (isLUKS1(cd->type)) { + /* If key is not provided, try to use internal key */ + if (!volume_key) { + if (!cd->volume_key) { + log_err(cd, _("Volume key does not match the volume.")); + return -EINVAL; + } + volume_key_size = cd->volume_key->keylength; + volume_key = cd->volume_key->key; + } + + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + r = LUKS_verify_volume_key(&cd->u.luks1.hdr, vk); + + if (r == -EPERM) + log_err(cd, _("Volume key does not match the volume.")); + + if (!r && name) + r = LUKS1_activate(cd, name, vk, flags); + } else if (isLUKS2(cd->type)) { + /* If key is not provided, try to use internal key */ + if (!volume_key) { + if (!cd->volume_key) { + log_err(cd, _("Volume key does not match the volume.")); + return -EINVAL; + } + volume_key_size = cd->volume_key->keylength; + volume_key = cd->volume_key->key; + } + + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + + r = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + if (r == -EPERM || r == -ENOENT) + log_err(cd, _("Volume key does not match the volume.")); + if (r > 0) + r = 0; + + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = (name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || (flags & CRYPT_ACTIVATE_KEYRING_KEY); + + if (!r && use_keyring) { + r = LUKS2_key_description_by_segment(cd, + &cd->u.luks2.hdr, vk, CRYPT_DEFAULT_SEGMENT); + if (!r) + r = crypt_volume_key_load_in_keyring(cd, vk); + if (!r) + flags |= CRYPT_ACTIVATE_KEYRING_KEY; + } + + if (!r && name) + r = LUKS2_activate(cd, name, vk, flags); + } else if (isVERITY(cd->type)) { + r = crypt_activate_by_signed_key(cd, name, volume_key, volume_key_size, NULL, 0, flags); + } else if (isTCRYPT(cd->type)) { + if (!name) + return 0; + r = TCRYPT_activate(cd, name, &cd->u.tcrypt.hdr, + &cd->u.tcrypt.params, flags); + } else if (isINTEGRITY(cd->type)) { + if (!name) + return 0; + if (volume_key) { + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + } + r = INTEGRITY_activate(cd, name, &cd->u.integrity.params, vk, + cd->u.integrity.journal_crypt_key, + cd->u.integrity.journal_mac_key, flags, + cd->u.integrity.sb_flags); + } else { + log_err(cd, _("Device type is not properly initialized.")); + r = -EINVAL; + } + + if (r < 0) + crypt_drop_keyring_key(cd, vk); + crypt_free_volume_key(vk); + + return r; +} + +int crypt_activate_by_signed_key(struct crypt_device *cd, + const char *name, + const char *volume_key, + size_t volume_key_size, + const char *signature, + size_t signature_size, + uint32_t flags) +{ + char description[512]; + int r; + + if (!cd || !isVERITY(cd->type)) + return -EINVAL; + + if (!volume_key || !volume_key_size || (!name && signature)) { + log_err(cd, _("Incorrect root hash specified for verity device.")); + return -EINVAL; + } + + log_dbg(cd, "%s volume %s by %skey.", name ? "Activating" : "Checking", name ?: "", signature ? "signed " : ""); + + if (cd->u.verity.hdr.flags & CRYPT_VERITY_ROOT_HASH_SIGNATURE && !signature) { + log_err(cd, _("Root hash signature required.")); + return -EINVAL; + } + + r = _activate_check_status(cd, name, flags & CRYPT_ACTIVATE_REFRESH); + if (r < 0) + return r; + + if (signature && !kernel_keyring_support()) { + log_err(cd, _("Kernel keyring missing: required for passing signature to kernel.")); + return -EINVAL; + } + + /* volume_key == root hash */ + free(CONST_CAST(void*)cd->u.verity.root_hash); + cd->u.verity.root_hash = NULL; + + if (signature) { + r = snprintf(description, sizeof(description)-1, "cryptsetup:%s%s%s", + crypt_get_uuid(cd) ?: "", crypt_get_uuid(cd) ? "-" : "", name); + if (r < 0) + return -EINVAL; + + log_dbg(cd, "Adding signature into keyring %s", description); + r = keyring_add_key_in_thread_keyring(USER_KEY, description, signature, signature_size); + if (r) { + log_err(cd, _("Failed to load key in kernel keyring.")); + return r; + } + } + + r = VERITY_activate(cd, name, volume_key, volume_key_size, + signature ? description : NULL, + cd->u.verity.fec_device, + &cd->u.verity.hdr, flags | CRYPT_ACTIVATE_READONLY); + + if (!r) { + cd->u.verity.root_hash_size = volume_key_size; + cd->u.verity.root_hash = malloc(volume_key_size); + if (cd->u.verity.root_hash) + memcpy(CONST_CAST(void*)cd->u.verity.root_hash, volume_key, volume_key_size); + } + + if (signature) + crypt_drop_keyring_key_by_description(cd, description, USER_KEY); + + return r; +} + +int crypt_deactivate_by_name(struct crypt_device *cd, const char *name, uint32_t flags) +{ + struct crypt_device *fake_cd = NULL; + struct luks2_hdr *hdr2 = NULL; + struct crypt_dm_active_device dmd = {}; + int r; + uint32_t get_flags = DM_ACTIVE_DEVICE | DM_ACTIVE_UUID | DM_ACTIVE_HOLDERS; + + if (!name) + return -EINVAL; + + log_dbg(cd, "Deactivating volume %s.", name); + + if (!cd) { + r = crypt_init_by_name(&fake_cd, name); + if (r < 0) + return r; + cd = fake_cd; + } + + /* skip holders detection and early abort when some flags raised */ + if (flags & (CRYPT_DEACTIVATE_FORCE | CRYPT_DEACTIVATE_DEFERRED)) + get_flags &= ~DM_ACTIVE_HOLDERS; + + switch (crypt_status(cd, name)) { + case CRYPT_ACTIVE: + case CRYPT_BUSY: + r = dm_query_device(cd, name, get_flags, &dmd); + if (r >= 0) { + if (dmd.holders) { + log_err(cd, _("Device %s is still in use."), name); + r = -EBUSY; + break; + } + } + + if (isLUKS2(cd->type)) + hdr2 = crypt_get_hdr(cd, CRYPT_LUKS2); + + if ((dmd.uuid && !strncmp(CRYPT_LUKS2, dmd.uuid, sizeof(CRYPT_LUKS2)-1)) || hdr2) + r = LUKS2_deactivate(cd, name, hdr2, &dmd, flags); + else if (isTCRYPT(cd->type)) + r = TCRYPT_deactivate(cd, name, flags); + else + r = dm_remove_device(cd, name, flags); + if (r < 0 && crypt_status(cd, name) == CRYPT_BUSY) { + log_err(cd, _("Device %s is still in use."), name); + r = -EBUSY; + } + break; + case CRYPT_INACTIVE: + log_err(cd, _("Device %s is not active."), name); + r = -ENODEV; + break; + default: + log_err(cd, _("Invalid device %s."), name); + r = -EINVAL; + } + + dm_targets_free(cd, &dmd); + free(CONST_CAST(void*)dmd.uuid); + crypt_free(fake_cd); + + return r; +} + +int crypt_deactivate(struct crypt_device *cd, const char *name) +{ + return crypt_deactivate_by_name(cd, name, 0); +} + +int crypt_get_active_device(struct crypt_device *cd, const char *name, + struct crypt_active_device *cad) +{ + int r; + struct crypt_dm_active_device dmd, dmdi = {}; + const char *namei = NULL; + struct dm_target *tgt = &dmd.segment; + uint64_t min_offset = UINT64_MAX; + + if (!cd || !name || !cad) + return -EINVAL; + + r = dm_query_device(cd, name, DM_ACTIVE_DEVICE, &dmd); + if (r < 0) + return r; + + /* For LUKS2 with integrity we need flags from underlying dm-integrity */ + if (isLUKS2(cd->type) && crypt_get_integrity_tag_size(cd) && single_segment(&dmd)) { + namei = device_dm_name(tgt->data_device); + if (namei && dm_query_device(cd, namei, 0, &dmdi) >= 0) + dmd.flags |= dmdi.flags; + } + + if (cd && isTCRYPT(cd->type)) { + cad->offset = TCRYPT_get_data_offset(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + cad->iv_offset = TCRYPT_get_iv_offset(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + } else { + while (tgt) { + if (tgt->type == DM_CRYPT && (min_offset > tgt->u.crypt.offset)) { + min_offset = tgt->u.crypt.offset; + cad->iv_offset = tgt->u.crypt.iv_offset; + } else if (tgt->type == DM_INTEGRITY && (min_offset > tgt->u.integrity.offset)) { + min_offset = tgt->u.integrity.offset; + cad->iv_offset = 0; + } else if (tgt->type == DM_LINEAR && (min_offset > tgt->u.linear.offset)) { + min_offset = tgt->u.linear.offset; + cad->iv_offset = 0; + } + tgt = tgt->next; + } + } + + if (min_offset != UINT64_MAX) + cad->offset = min_offset; + + cad->size = dmd.size; + cad->flags = dmd.flags; + + r = 0; + dm_targets_free(cd, &dmd); + dm_targets_free(cd, &dmdi); + + return r; +} + +uint64_t crypt_get_active_integrity_failures(struct crypt_device *cd, const char *name) +{ + struct crypt_dm_active_device dmd; + uint64_t failures = 0; + + if (!name) + return 0; + + /* FIXME: LUKS2 / dm-crypt does not provide this count. */ + if (dm_query_device(cd, name, 0, &dmd) < 0) + return 0; + + if (single_segment(&dmd) && dmd.segment.type == DM_INTEGRITY) + (void)dm_status_integrity_failures(cd, name, &failures); + + dm_targets_free(cd, &dmd); + + return failures; +} + +/* + * Volume key handling + */ +int crypt_volume_key_get(struct crypt_device *cd, + int keyslot, + char *volume_key, + size_t *volume_key_size, + const char *passphrase, + size_t passphrase_size) +{ + struct volume_key *vk = NULL; + int key_len, r = -EINVAL; + + if (!cd || !volume_key || !volume_key_size || (!isTCRYPT(cd->type) && !isVERITY(cd->type) && !passphrase)) + return -EINVAL; + + if (isLUKS2(cd->type) && keyslot != CRYPT_ANY_SLOT) + key_len = LUKS2_get_keyslot_stored_key_size(&cd->u.luks2.hdr, keyslot); + else + key_len = crypt_get_volume_key_size(cd); + + if (key_len < 0) + return -EINVAL; + + if (key_len > (int)*volume_key_size) { + log_err(cd, _("Volume key buffer too small.")); + return -ENOMEM; + } + + if (isPLAIN(cd->type) && cd->u.plain.hdr.hash) { + r = process_key(cd, cd->u.plain.hdr.hash, key_len, + passphrase, passphrase_size, &vk); + if (r < 0) + log_err(cd, _("Cannot retrieve volume key for plain device.")); + } else if (isLUKS1(cd->type)) { + r = LUKS_open_key_with_hdr(keyslot, passphrase, + passphrase_size, &cd->u.luks1.hdr, &vk, cd); + } else if (isLUKS2(cd->type)) { + r = LUKS2_keyslot_open(cd, keyslot, + keyslot == CRYPT_ANY_SLOT ? CRYPT_DEFAULT_SEGMENT : CRYPT_ANY_SEGMENT, + passphrase, passphrase_size, &vk); + } else if (isTCRYPT(cd->type)) { + r = TCRYPT_get_volume_key(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params, &vk); + } else if (isVERITY(cd->type)) { + /* volume_key == root hash */ + if (cd->u.verity.root_hash) { + memcpy(volume_key, cd->u.verity.root_hash, cd->u.verity.root_hash_size); + *volume_key_size = cd->u.verity.root_hash_size; + r = 0; + } else + log_err(cd, _("Cannot retrieve root hash for verity device.")); + } else + log_err(cd, _("This operation is not supported for %s crypt device."), cd->type ?: "(none)"); + + if (r >= 0 && vk) { + memcpy(volume_key, vk->key, vk->keylength); + *volume_key_size = vk->keylength; + } + + crypt_free_volume_key(vk); + return r; +} + +int crypt_volume_key_verify(struct crypt_device *cd, + const char *volume_key, + size_t volume_key_size) +{ + struct volume_key *vk; + int r; + + if ((r = _onlyLUKS(cd, CRYPT_CD_UNRESTRICTED))) + return r; + + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + if (!vk) + return -ENOMEM; + + if (isLUKS1(cd->type)) + r = LUKS_verify_volume_key(&cd->u.luks1.hdr, vk); + else if (isLUKS2(cd->type)) + r = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + else + r = -EINVAL; + + + if (r == -EPERM) + log_err(cd, _("Volume key does not match the volume.")); + + crypt_free_volume_key(vk); + + return r >= 0 ? 0 : r; +} + +/* + * RNG and memory locking + */ +void crypt_set_rng_type(struct crypt_device *cd, int rng_type) +{ + if (!cd) + return; + + switch (rng_type) { + case CRYPT_RNG_URANDOM: + case CRYPT_RNG_RANDOM: + log_dbg(cd, "RNG set to %d (%s).", rng_type, rng_type ? "random" : "urandom"); + cd->rng_type = rng_type; + } +} + +int crypt_get_rng_type(struct crypt_device *cd) +{ + if (!cd) + return -EINVAL; + + return cd->rng_type; +} + +int crypt_memory_lock(struct crypt_device *cd, int lock) +{ + return lock ? crypt_memlock_inc(cd) : crypt_memlock_dec(cd); +} + +void crypt_set_compatibility(struct crypt_device *cd, uint32_t flags) +{ + if (cd) + cd->compatibility = flags; +} + +uint32_t crypt_get_compatibility(struct crypt_device *cd) +{ + if (cd) + return cd->compatibility; + + return 0; +} + +/* + * Reporting + */ +crypt_status_info crypt_status(struct crypt_device *cd, const char *name) +{ + int r; + + if (!name) + return CRYPT_INVALID; + + if (!cd) + dm_backend_init(cd); + + r = dm_status_device(cd, name); + + if (!cd) + dm_backend_exit(cd); + + if (r < 0 && r != -ENODEV) + return CRYPT_INVALID; + + if (r == 0) + return CRYPT_ACTIVE; + + if (r > 0) + return CRYPT_BUSY; + + return CRYPT_INACTIVE; +} + +static void hexprint(struct crypt_device *cd, const char *d, int n, const char *sep) +{ + int i; + for(i = 0; i < n; i++) + log_std(cd, "%02hhx%s", (const char)d[i], sep); +} + +static int _luks_dump(struct crypt_device *cd) +{ + int i; + + log_std(cd, "LUKS header information for %s\n\n", mdata_device_path(cd)); + log_std(cd, "Version: \t%" PRIu16 "\n", cd->u.luks1.hdr.version); + log_std(cd, "Cipher name: \t%s\n", cd->u.luks1.hdr.cipherName); + log_std(cd, "Cipher mode: \t%s\n", cd->u.luks1.hdr.cipherMode); + log_std(cd, "Hash spec: \t%s\n", cd->u.luks1.hdr.hashSpec); + log_std(cd, "Payload offset:\t%" PRIu32 "\n", cd->u.luks1.hdr.payloadOffset); + log_std(cd, "MK bits: \t%" PRIu32 "\n", cd->u.luks1.hdr.keyBytes * 8); + log_std(cd, "MK digest: \t"); + hexprint(cd, cd->u.luks1.hdr.mkDigest, LUKS_DIGESTSIZE, " "); + log_std(cd, "\n"); + log_std(cd, "MK salt: \t"); + hexprint(cd, cd->u.luks1.hdr.mkDigestSalt, LUKS_SALTSIZE/2, " "); + log_std(cd, "\n \t"); + hexprint(cd, cd->u.luks1.hdr.mkDigestSalt+LUKS_SALTSIZE/2, LUKS_SALTSIZE/2, " "); + log_std(cd, "\n"); + log_std(cd, "MK iterations: \t%" PRIu32 "\n", cd->u.luks1.hdr.mkDigestIterations); + log_std(cd, "UUID: \t%s\n\n", cd->u.luks1.hdr.uuid); + for(i = 0; i < LUKS_NUMKEYS; i++) { + if(cd->u.luks1.hdr.keyblock[i].active == LUKS_KEY_ENABLED) { + log_std(cd, "Key Slot %d: ENABLED\n",i); + log_std(cd, "\tIterations: \t%" PRIu32 "\n", + cd->u.luks1.hdr.keyblock[i].passwordIterations); + log_std(cd, "\tSalt: \t"); + hexprint(cd, cd->u.luks1.hdr.keyblock[i].passwordSalt, + LUKS_SALTSIZE/2, " "); + log_std(cd, "\n\t \t"); + hexprint(cd, cd->u.luks1.hdr.keyblock[i].passwordSalt + + LUKS_SALTSIZE/2, LUKS_SALTSIZE/2, " "); + log_std(cd, "\n"); + + log_std(cd, "\tKey material offset:\t%" PRIu32 "\n", + cd->u.luks1.hdr.keyblock[i].keyMaterialOffset); + log_std(cd, "\tAF stripes: \t%" PRIu32 "\n", + cd->u.luks1.hdr.keyblock[i].stripes); + } + else + log_std(cd, "Key Slot %d: DISABLED\n", i); + } + return 0; +} + +static int _verity_dump(struct crypt_device *cd) +{ + log_std(cd, "VERITY header information for %s\n", mdata_device_path(cd)); + log_std(cd, "UUID: \t%s\n", cd->u.verity.uuid ?: ""); + log_std(cd, "Hash type: \t%u\n", cd->u.verity.hdr.hash_type); + log_std(cd, "Data blocks: \t%" PRIu64 "\n", cd->u.verity.hdr.data_size); + log_std(cd, "Data block size: \t%u\n", cd->u.verity.hdr.data_block_size); + log_std(cd, "Hash block size: \t%u\n", cd->u.verity.hdr.hash_block_size); + log_std(cd, "Hash algorithm: \t%s\n", cd->u.verity.hdr.hash_name); + log_std(cd, "Salt: \t"); + if (cd->u.verity.hdr.salt_size) + hexprint(cd, cd->u.verity.hdr.salt, cd->u.verity.hdr.salt_size, ""); + else + log_std(cd, "-"); + log_std(cd, "\n"); + if (cd->u.verity.root_hash) { + log_std(cd, "Root hash: \t"); + hexprint(cd, cd->u.verity.root_hash, cd->u.verity.root_hash_size, ""); + log_std(cd, "\n"); + } + return 0; +} + +int crypt_dump(struct crypt_device *cd) +{ + if (!cd) + return -EINVAL; + if (isLUKS1(cd->type)) + return _luks_dump(cd); + else if (isLUKS2(cd->type)) + return LUKS2_hdr_dump(cd, &cd->u.luks2.hdr); + else if (isVERITY(cd->type)) + return _verity_dump(cd); + else if (isTCRYPT(cd->type)) + return TCRYPT_dump(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + else if (isINTEGRITY(cd->type)) + return INTEGRITY_dump(cd, crypt_data_device(cd), 0); + else if (isBITLK(cd->type)) + return BITLK_dump(cd, crypt_data_device(cd), &cd->u.bitlk.params); + + log_err(cd, _("Dump operation is not supported for this device type.")); + return -EINVAL; +} + +/* internal only */ +const char *crypt_get_cipher_spec(struct crypt_device *cd) +{ + if (!cd) + return NULL; + else if (isLUKS2(cd->type)) + return LUKS2_get_cipher(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + else if (isLUKS1(cd->type)) + return cd->u.luks1.cipher_spec; + else if (isPLAIN(cd->type)) + return cd->u.plain.cipher_spec; + else if (isLOOPAES(cd->type)) + return cd->u.loopaes.cipher_spec; + else if (isBITLK(cd->type)) + return cd->u.bitlk.cipher_spec; + else if (!cd->type && !_init_by_name_crypt_none(cd)) + return cd->u.none.cipher_spec; + + return NULL; +} + +const char *crypt_get_cipher(struct crypt_device *cd) +{ + if (!cd) + return NULL; + + if (isPLAIN(cd->type)) + return cd->u.plain.cipher; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.cipherName; + + if (isLUKS2(cd->type)) { + if (crypt_parse_name_and_mode(LUKS2_get_cipher(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT), + cd->u.luks2.cipher, NULL, cd->u.luks2.cipher_mode)) + return NULL; + return cd->u.luks2.cipher; + } + + if (isLOOPAES(cd->type)) + return cd->u.loopaes.cipher; + + if (isTCRYPT(cd->type)) + return cd->u.tcrypt.params.cipher; + + if (isBITLK(cd->type)) + return cd->u.bitlk.params.cipher; + + if (!cd->type && !_init_by_name_crypt_none(cd)) + return cd->u.none.cipher; + + return NULL; +} + +const char *crypt_get_cipher_mode(struct crypt_device *cd) +{ + if (!cd) + return NULL; + + if (isPLAIN(cd->type)) + return cd->u.plain.cipher_mode; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.cipherMode; + + if (isLUKS2(cd->type)) { + if (crypt_parse_name_and_mode(LUKS2_get_cipher(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT), + cd->u.luks2.cipher, NULL, cd->u.luks2.cipher_mode)) + return NULL; + return cd->u.luks2.cipher_mode; + } + + if (isLOOPAES(cd->type)) + return cd->u.loopaes.cipher_mode; + + if (isTCRYPT(cd->type)) + return cd->u.tcrypt.params.mode; + + if (isBITLK(cd->type)) + return cd->u.bitlk.params.cipher_mode; + + if (!cd->type && !_init_by_name_crypt_none(cd)) + return cd->u.none.cipher_mode; + + return NULL; +} + +/* INTERNAL only */ +const char *crypt_get_integrity(struct crypt_device *cd) +{ + if (!cd) + return NULL; + + if (isINTEGRITY(cd->type)) + return cd->u.integrity.params.integrity; + + if (isLUKS2(cd->type)) + return LUKS2_get_integrity(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + + return NULL; +} + +/* INTERNAL only */ +int crypt_get_integrity_key_size(struct crypt_device *cd) +{ + if (isINTEGRITY(cd->type)) + return INTEGRITY_key_size(cd, crypt_get_integrity(cd)); + + if (isLUKS2(cd->type)) + return INTEGRITY_key_size(cd, crypt_get_integrity(cd)); + + return 0; +} + +/* INTERNAL only */ +int crypt_get_integrity_tag_size(struct crypt_device *cd) +{ + if (isINTEGRITY(cd->type)) + return cd->u.integrity.params.tag_size; + + if (isLUKS2(cd->type)) + return INTEGRITY_tag_size(cd, crypt_get_integrity(cd), + crypt_get_cipher(cd), + crypt_get_cipher_mode(cd)); + return 0; +} + +int crypt_get_sector_size(struct crypt_device *cd) +{ + if (!cd) + return SECTOR_SIZE; + + if (isPLAIN(cd->type)) + return cd->u.plain.hdr.sector_size; + + if (isINTEGRITY(cd->type)) + return cd->u.integrity.params.sector_size; + + if (isLUKS2(cd->type)) + return LUKS2_get_sector_size(&cd->u.luks2.hdr); + + return SECTOR_SIZE; +} + +const char *crypt_get_uuid(struct crypt_device *cd) +{ + if (!cd) + return NULL; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.uuid; + + if (isLUKS2(cd->type)) + return cd->u.luks2.hdr.uuid; + + if (isVERITY(cd->type)) + return cd->u.verity.uuid; + + if (isBITLK(cd->type)) + return cd->u.bitlk.params.guid; + + return NULL; +} + +const char *crypt_get_device_name(struct crypt_device *cd) +{ + const char *path; + + if (!cd) + return NULL; + + path = device_block_path(cd->device); + if (!path) + path = device_path(cd->device); + + return path; +} + +const char *crypt_get_metadata_device_name(struct crypt_device *cd) +{ + const char *path; + + if (!cd || !cd->metadata_device) + return NULL; + + path = device_block_path(cd->metadata_device); + if (!path) + path = device_path(cd->metadata_device); + + return path; +} + +int crypt_get_volume_key_size(struct crypt_device *cd) +{ + int r; + + if (!cd) + return 0; + + if (isPLAIN(cd->type)) + return cd->u.plain.key_size; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.keyBytes; + + if (isLUKS2(cd->type)) { + r = LUKS2_get_volume_key_size(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + if (r < 0 && cd->volume_key) + r = cd->volume_key->keylength; + return r < 0 ? 0 : r; + } + + if (isLOOPAES(cd->type)) + return cd->u.loopaes.key_size; + + if (isVERITY(cd->type)) + return cd->u.verity.root_hash_size; + + if (isTCRYPT(cd->type)) + return cd->u.tcrypt.params.key_size; + + if (isBITLK(cd->type)) + return cd->u.bitlk.params.key_size / 8; + + if (!cd->type && !_init_by_name_crypt_none(cd)) + return cd->u.none.key_size; + + return 0; +} + +int crypt_keyslot_get_key_size(struct crypt_device *cd, int keyslot) +{ + if (!cd || !isLUKS(cd->type)) + return -EINVAL; + + if (keyslot < 0 || keyslot >= crypt_keyslot_max(cd->type)) + return -EINVAL; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.keyBytes; + + if (isLUKS2(cd->type)) + return LUKS2_get_keyslot_stored_key_size(&cd->u.luks2.hdr, keyslot); + + return -EINVAL; +} + +int crypt_keyslot_set_encryption(struct crypt_device *cd, + const char *cipher, + size_t key_size) +{ + char *tmp; + + if (!cd || !cipher || ! key_size || !isLUKS2(cd->type)) + return -EINVAL; + + if (LUKS2_keyslot_cipher_incompatible(cd, cipher)) + return -EINVAL; + + tmp = strdup(cipher); + free(cd->u.luks2.keyslot_cipher); + cd->u.luks2.keyslot_cipher = tmp; + if (!cd->u.luks2.keyslot_cipher) + return -ENOMEM; + cd->u.luks2.keyslot_key_size = key_size; + + return 0; +} + +const char *crypt_keyslot_get_encryption(struct crypt_device *cd, int keyslot, size_t *key_size) +{ + const char *cipher; + + if (!cd || !isLUKS(cd->type) || !key_size) + return NULL; + + if (isLUKS1(cd->type)) { + if (keyslot != CRYPT_ANY_SLOT && + LUKS_keyslot_info(&cd->u.luks1.hdr, keyslot) < CRYPT_SLOT_ACTIVE) + return NULL; + *key_size = crypt_get_volume_key_size(cd); + return cd->u.luks1.cipher_spec; + } + + if (keyslot != CRYPT_ANY_SLOT) + return LUKS2_get_keyslot_cipher(&cd->u.luks2.hdr, keyslot, key_size); + + /* Keyslot encryption was set through crypt_keyslot_set_encryption() */ + if (cd->u.luks2.keyslot_cipher) { + *key_size = cd->u.luks2.keyslot_key_size; + return cd->u.luks2.keyslot_cipher; + } + + /* Try to reuse volume encryption parameters */ + cipher = LUKS2_get_cipher(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + if (!LUKS2_keyslot_cipher_incompatible(cd, cipher)) { + *key_size = crypt_get_volume_key_size(cd); + if (*key_size) + return cipher; + } + + /* Fallback to default LUKS2 keyslot encryption */ + *key_size = DEFAULT_LUKS2_KEYSLOT_KEYBITS / 8; + return DEFAULT_LUKS2_KEYSLOT_CIPHER; +} + +int crypt_keyslot_get_pbkdf(struct crypt_device *cd, int keyslot, struct crypt_pbkdf_type *pbkdf) +{ + if (!cd || !pbkdf || keyslot == CRYPT_ANY_SLOT) + return -EINVAL; + + if (isLUKS1(cd->type)) + return LUKS_keyslot_pbkdf(&cd->u.luks1.hdr, keyslot, pbkdf); + else if (isLUKS2(cd->type)) + return LUKS2_keyslot_pbkdf(&cd->u.luks2.hdr, keyslot, pbkdf); + + return -EINVAL; +} + +int crypt_set_data_offset(struct crypt_device *cd, uint64_t data_offset) +{ + if (!cd) + return -EINVAL; + if (data_offset % (MAX_SECTOR_SIZE >> SECTOR_SHIFT)) { + log_err(cd, _("Data offset is not multiple of %u bytes."), MAX_SECTOR_SIZE); + return -EINVAL; + } + + cd->data_offset = data_offset; + log_dbg(cd, "Data offset set to %" PRIu64 " (512-byte) sectors.", data_offset); + + return 0; +} + +int crypt_set_metadata_size(struct crypt_device *cd, + uint64_t metadata_size, + uint64_t keyslots_size) +{ + if (!cd) + return -EINVAL; + + if (cd->type && !isLUKS2(cd->type)) + return -EINVAL; + + if (metadata_size && LUKS2_check_metadata_area_size(metadata_size)) + return -EINVAL; + + if (keyslots_size && LUKS2_check_keyslots_area_size(keyslots_size)) + return -EINVAL; + + cd->metadata_size = metadata_size; + cd->keyslots_size = keyslots_size; + + return 0; +} + +int crypt_get_metadata_size(struct crypt_device *cd, + uint64_t *metadata_size, + uint64_t *keyslots_size) +{ + uint64_t msize, ksize; + + if (!cd) + return -EINVAL; + + if (!cd->type) { + msize = cd->metadata_size; + ksize = cd->keyslots_size; + } else if (isLUKS1(cd->type)) { + msize = LUKS_ALIGN_KEYSLOTS; + ksize = LUKS_device_sectors(&cd->u.luks1.hdr) * SECTOR_SIZE - msize; + } else if (isLUKS2(cd->type)) { + msize = LUKS2_metadata_size(&cd->u.luks2.hdr); + ksize = LUKS2_keyslots_size(&cd->u.luks2.hdr); + } else + return -EINVAL; + + if (metadata_size) + *metadata_size = msize; + if (keyslots_size) + *keyslots_size = ksize; + + return 0; +} + +uint64_t crypt_get_data_offset(struct crypt_device *cd) +{ + if (!cd) + return 0; + + if (isPLAIN(cd->type)) + return cd->u.plain.hdr.offset; + + if (isLUKS1(cd->type)) + return cd->u.luks1.hdr.payloadOffset; + + if (isLUKS2(cd->type)) + return LUKS2_get_data_offset(&cd->u.luks2.hdr); + + if (isLOOPAES(cd->type)) + return cd->u.loopaes.hdr.offset; + + if (isTCRYPT(cd->type)) + return TCRYPT_get_data_offset(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + + if (isBITLK(cd->type)) + return cd->u.bitlk.params.volume_header_size / SECTOR_SIZE; + + return cd->data_offset; +} + +uint64_t crypt_get_iv_offset(struct crypt_device *cd) +{ + if (!cd) + return 0; + + if (isPLAIN(cd->type)) + return cd->u.plain.hdr.skip; + + if (isLOOPAES(cd->type)) + return cd->u.loopaes.hdr.skip; + + if (isTCRYPT(cd->type)) + return TCRYPT_get_iv_offset(cd, &cd->u.tcrypt.hdr, &cd->u.tcrypt.params); + + return 0; +} + +crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot) +{ + if (_onlyLUKS(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED) < 0) + return CRYPT_SLOT_INVALID; + + if (isLUKS1(cd->type)) + return LUKS_keyslot_info(&cd->u.luks1.hdr, keyslot); + else if(isLUKS2(cd->type)) + return LUKS2_keyslot_info(&cd->u.luks2.hdr, keyslot); + + return CRYPT_SLOT_INVALID; +} + +int crypt_keyslot_max(const char *type) +{ + if (type && isLUKS1(type)) + return LUKS_NUMKEYS; + + if (type && isLUKS2(type)) + return LUKS2_KEYSLOTS_MAX; + + return -EINVAL; +} + +int crypt_keyslot_area(struct crypt_device *cd, + int keyslot, + uint64_t *offset, + uint64_t *length) +{ + if (_onlyLUKS(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED) || !offset || !length) + return -EINVAL; + + if (isLUKS2(cd->type)) + return LUKS2_keyslot_area(&cd->u.luks2.hdr, keyslot, offset, length); + + return LUKS_keyslot_area(&cd->u.luks1.hdr, keyslot, offset, length); +} + +crypt_keyslot_priority crypt_keyslot_get_priority(struct crypt_device *cd, int keyslot) +{ + if (_onlyLUKS(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED)) + return CRYPT_SLOT_PRIORITY_INVALID; + + if (keyslot < 0 || keyslot >= crypt_keyslot_max(cd->type)) + return CRYPT_SLOT_PRIORITY_INVALID; + + if (isLUKS2(cd->type)) + return LUKS2_keyslot_priority_get(cd, &cd->u.luks2.hdr, keyslot); + + return CRYPT_SLOT_PRIORITY_NORMAL; +} + +int crypt_keyslot_set_priority(struct crypt_device *cd, int keyslot, crypt_keyslot_priority priority) +{ + int r; + + log_dbg(cd, "Setting keyslot %d to priority %d.", keyslot, priority); + + if (priority == CRYPT_SLOT_PRIORITY_INVALID) + return -EINVAL; + + if (keyslot < 0 || keyslot >= crypt_keyslot_max(cd->type)) + return -EINVAL; + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_keyslot_priority_set(cd, &cd->u.luks2.hdr, keyslot, priority, 1); +} + +const char *crypt_get_type(struct crypt_device *cd) +{ + return cd ? cd->type : NULL; +} + +const char *crypt_get_default_type(void) +{ + return DEFAULT_LUKS_FORMAT; +} + +int crypt_get_verity_info(struct crypt_device *cd, + struct crypt_params_verity *vp) +{ + if (!cd || !isVERITY(cd->type) || !vp) + return -EINVAL; + + vp->data_device = device_path(cd->device); + vp->hash_device = mdata_device_path(cd); + vp->fec_device = device_path(cd->u.verity.fec_device); + vp->fec_area_offset = cd->u.verity.hdr.fec_area_offset; + vp->fec_roots = cd->u.verity.hdr.fec_roots; + vp->hash_name = cd->u.verity.hdr.hash_name; + vp->salt = cd->u.verity.hdr.salt; + vp->salt_size = cd->u.verity.hdr.salt_size; + vp->data_block_size = cd->u.verity.hdr.data_block_size; + vp->hash_block_size = cd->u.verity.hdr.hash_block_size; + vp->data_size = cd->u.verity.hdr.data_size; + vp->hash_area_offset = cd->u.verity.hdr.hash_area_offset; + vp->hash_type = cd->u.verity.hdr.hash_type; + vp->flags = cd->u.verity.hdr.flags & (CRYPT_VERITY_NO_HEADER | CRYPT_VERITY_ROOT_HASH_SIGNATURE); + return 0; +} + +int crypt_get_integrity_info(struct crypt_device *cd, + struct crypt_params_integrity *ip) +{ + if (!cd || !ip) + return -EINVAL; + + if (isINTEGRITY(cd->type)) { + ip->journal_size = cd->u.integrity.params.journal_size; + ip->journal_watermark = cd->u.integrity.params.journal_watermark; + ip->journal_commit_time = cd->u.integrity.params.journal_commit_time; + ip->interleave_sectors = cd->u.integrity.params.interleave_sectors; + ip->tag_size = cd->u.integrity.params.tag_size; + ip->sector_size = cd->u.integrity.params.sector_size; + ip->buffer_sectors = cd->u.integrity.params.buffer_sectors; + + ip->integrity = cd->u.integrity.params.integrity; + ip->integrity_key_size = crypt_get_integrity_key_size(cd); + + ip->journal_integrity = cd->u.integrity.params.journal_integrity; + ip->journal_integrity_key_size = cd->u.integrity.params.journal_integrity_key_size; + ip->journal_integrity_key = NULL; + + ip->journal_crypt = cd->u.integrity.params.journal_crypt; + ip->journal_crypt_key_size = cd->u.integrity.params.journal_crypt_key_size; + ip->journal_crypt_key = NULL; + return 0; + } else if (isLUKS2(cd->type)) { + ip->journal_size = 0; // FIXME + ip->journal_watermark = 0; // FIXME + ip->journal_commit_time = 0; // FIXME + ip->interleave_sectors = 0; // FIXME + ip->sector_size = crypt_get_sector_size(cd); + ip->buffer_sectors = 0; // FIXME + + ip->integrity = LUKS2_get_integrity(&cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT); + ip->integrity_key_size = crypt_get_integrity_key_size(cd); + ip->tag_size = INTEGRITY_tag_size(cd, ip->integrity, crypt_get_cipher(cd), crypt_get_cipher_mode(cd)); + + ip->journal_integrity = NULL; + ip->journal_integrity_key_size = 0; + ip->journal_integrity_key = NULL; + + ip->journal_crypt = NULL; + ip->journal_crypt_key_size = 0; + ip->journal_crypt_key = NULL; + return 0; + } + + return -ENOTSUP; +} + +int crypt_convert(struct crypt_device *cd, + const char *type, + void *params) +{ + struct luks_phdr hdr1; + struct luks2_hdr hdr2; + int r; + + if (!type) + return -EINVAL; + + log_dbg(cd, "Converting LUKS device to type %s", type); + + if ((r = onlyLUKS(cd))) + return r; + + if (isLUKS1(cd->type) && isLUKS2(type)) + r = LUKS2_luks1_to_luks2(cd, &cd->u.luks1.hdr, &hdr2); + else if (isLUKS2(cd->type) && isLUKS1(type)) + r = LUKS2_luks2_to_luks1(cd, &cd->u.luks2.hdr, &hdr1); + else + return -EINVAL; + + if (r < 0) { + /* in-memory header may be invalid after failed conversion */ + _luks2_reload(cd); + if (r == -EBUSY) + log_err(cd, _("Cannot convert device %s which is still in use."), mdata_device_path(cd)); + return r; + } + + crypt_free_type(cd); + + return crypt_load(cd, type, params); +} + +/* Internal access function to header pointer */ +void *crypt_get_hdr(struct crypt_device *cd, const char *type) +{ + /* If requested type differs, ignore it */ + if (strcmp(cd->type, type)) + return NULL; + + if (isPLAIN(cd->type)) + return &cd->u.plain; + + if (isLUKS1(cd->type)) + return &cd->u.luks1.hdr; + + if (isLUKS2(cd->type)) + return &cd->u.luks2.hdr; + + if (isLOOPAES(cd->type)) + return &cd->u.loopaes; + + if (isVERITY(cd->type)) + return &cd->u.verity; + + if (isTCRYPT(cd->type)) + return &cd->u.tcrypt; + + return NULL; +} + +/* internal only */ +struct luks2_reencrypt *crypt_get_luks2_reencrypt(struct crypt_device *cd) +{ + return cd->u.luks2.rh; +} + +/* internal only */ +void crypt_set_luks2_reencrypt(struct crypt_device *cd, struct luks2_reencrypt *rh) +{ + cd->u.luks2.rh = rh; +} + +/* + * Token handling + */ +int crypt_activate_by_token(struct crypt_device *cd, + const char *name, int token, void *usrptr, uint32_t flags) +{ + int r; + + log_dbg(cd, "%s volume %s using token %d.", + name ? "Activating" : "Checking", name ?: "passphrase", token); + + if ((r = _onlyLUKS2(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED, 0))) + return r; + + if ((flags & CRYPT_ACTIVATE_KEYRING_KEY) && !crypt_use_keyring_for_vk(cd)) + return -EINVAL; + + if ((flags & CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY) && name) + return -EINVAL; + + if (token == CRYPT_ANY_TOKEN) + return LUKS2_token_open_and_activate_any(cd, &cd->u.luks2.hdr, name, flags); + + return LUKS2_token_open_and_activate(cd, &cd->u.luks2.hdr, token, name, flags, usrptr); +} + +int crypt_token_json_get(struct crypt_device *cd, int token, const char **json) +{ + int r; + + if (!json) + return -EINVAL; + + log_dbg(cd, "Requesting JSON for token %d.", token); + + if ((r = _onlyLUKS2(cd, CRYPT_CD_UNRESTRICTED, 0))) + return r; + + return LUKS2_token_json_get(cd, &cd->u.luks2.hdr, token, json) ?: token; +} + +int crypt_token_json_set(struct crypt_device *cd, int token, const char *json) +{ + int r; + + log_dbg(cd, "Updating JSON for token %d.", token); + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_token_create(cd, &cd->u.luks2.hdr, token, json, 1); +} + +crypt_token_info crypt_token_status(struct crypt_device *cd, int token, const char **type) +{ + if (_onlyLUKS2(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED, 0)) + return CRYPT_TOKEN_INVALID; + + return LUKS2_token_status(cd, &cd->u.luks2.hdr, token, type); +} + +int crypt_token_luks2_keyring_get(struct crypt_device *cd, + int token, + struct crypt_token_params_luks2_keyring *params) +{ + crypt_token_info token_info; + const char *type; + int r; + + if (!params) + return -EINVAL; + + log_dbg(cd, "Requesting LUKS2 keyring token %d.", token); + + if ((r = _onlyLUKS2(cd, CRYPT_CD_UNRESTRICTED, 0))) + return r; + + token_info = LUKS2_token_status(cd, &cd->u.luks2.hdr, token, &type); + switch (token_info) { + case CRYPT_TOKEN_INVALID: + log_dbg(cd, "Token %d is invalid.", token); + return -EINVAL; + case CRYPT_TOKEN_INACTIVE: + log_dbg(cd, "Token %d is inactive.", token); + return -EINVAL; + case CRYPT_TOKEN_INTERNAL: + if (!strcmp(type, LUKS2_TOKEN_KEYRING)) + break; + /* Fall through */ + case CRYPT_TOKEN_INTERNAL_UNKNOWN: + case CRYPT_TOKEN_EXTERNAL: + case CRYPT_TOKEN_EXTERNAL_UNKNOWN: + log_dbg(cd, "Token %d has unexpected type %s.", token, type); + return -EINVAL; + } + + return LUKS2_builtin_token_get(cd, &cd->u.luks2.hdr, token, LUKS2_TOKEN_KEYRING, params); +} + +int crypt_token_luks2_keyring_set(struct crypt_device *cd, + int token, + const struct crypt_token_params_luks2_keyring *params) +{ + int r; + + if (!params) + return -EINVAL; + + log_dbg(cd, "Creating new LUKS2 keyring token (%d).", token); + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_builtin_token_create(cd, &cd->u.luks2.hdr, token, LUKS2_TOKEN_KEYRING, params, 1); +} + +int crypt_token_assign_keyslot(struct crypt_device *cd, int token, int keyslot) +{ + int r; + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_token_assign(cd, &cd->u.luks2.hdr, keyslot, token, 1, 1); +} + +int crypt_token_unassign_keyslot(struct crypt_device *cd, int token, int keyslot) +{ + int r; + + if ((r = onlyLUKS2(cd))) + return r; + + return LUKS2_token_assign(cd, &cd->u.luks2.hdr, keyslot, token, 0, 1); +} + +int crypt_token_is_assigned(struct crypt_device *cd, int token, int keyslot) +{ + int r; + + if ((r = _onlyLUKS2(cd, CRYPT_CD_QUIET | CRYPT_CD_UNRESTRICTED, 0))) + return r; + + return LUKS2_token_is_assigned(cd, &cd->u.luks2.hdr, keyslot, token); +} + +/* Internal only */ +int crypt_metadata_locking_enabled(void) +{ + return _metadata_locking; +} + +int crypt_metadata_locking(struct crypt_device *cd, int enable) +{ + if (enable && !_metadata_locking) + return -EPERM; + + _metadata_locking = enable ? 1 : 0; + return 0; +} + +int crypt_persistent_flags_set(struct crypt_device *cd, crypt_flags_type type, uint32_t flags) +{ + int r; + + if ((r = onlyLUKS2(cd))) + return r; + + if (type == CRYPT_FLAGS_ACTIVATION) + return LUKS2_config_set_flags(cd, &cd->u.luks2.hdr, flags); + + if (type == CRYPT_FLAGS_REQUIREMENTS) + return LUKS2_config_set_requirements(cd, &cd->u.luks2.hdr, flags, true); + + return -EINVAL; +} + +int crypt_persistent_flags_get(struct crypt_device *cd, crypt_flags_type type, uint32_t *flags) +{ + int r; + + if (!flags) + return -EINVAL; + + if ((r = _onlyLUKS2(cd, CRYPT_CD_UNRESTRICTED, 0))) + return r; + + if (type == CRYPT_FLAGS_ACTIVATION) + return LUKS2_config_get_flags(cd, &cd->u.luks2.hdr, flags); + + if (type == CRYPT_FLAGS_REQUIREMENTS) + return LUKS2_config_get_requirements(cd, &cd->u.luks2.hdr, flags); + + return -EINVAL; +} + +static int update_volume_key_segment_digest(struct crypt_device *cd, struct luks2_hdr *hdr, int digest, int commit) +{ + int r; + + /* Remove any assignments in memory */ + r = LUKS2_digest_segment_assign(cd, hdr, CRYPT_DEFAULT_SEGMENT, CRYPT_ANY_DIGEST, 0, 0); + if (r) + return r; + + /* Assign it to the specific digest */ + return LUKS2_digest_segment_assign(cd, hdr, CRYPT_DEFAULT_SEGMENT, digest, 1, commit); +} + +static int verify_and_update_segment_digest(struct crypt_device *cd, + struct luks2_hdr *hdr, int keyslot, + const char *volume_key, size_t volume_key_size, + const char *password, size_t password_size) +{ + int digest, r; + struct volume_key *vk = NULL; + + if (keyslot < 0 || (volume_key && !volume_key_size)) + return -EINVAL; + + if (volume_key) + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + else { + r = LUKS2_keyslot_open(cd, keyslot, CRYPT_ANY_SEGMENT, password, password_size, &vk); + if (r != keyslot) { + r = -EINVAL; + goto out; + } + } + + if (!vk) + return -ENOMEM; + + /* check volume_key (param) digest matches keyslot digest */ + r = LUKS2_digest_verify(cd, hdr, vk, keyslot); + if (r < 0) + goto out; + digest = r; + + /* nothing to do, volume key in keyslot is already assigned to default segment */ + r = LUKS2_digest_verify_by_segment(cd, hdr, CRYPT_DEFAULT_SEGMENT, vk); + if (r >= 0) + goto out; + + /* FIXME: check new volume key is usable with current default segment */ + + r = update_volume_key_segment_digest(cd, &cd->u.luks2.hdr, digest, 1); + if (r) + log_err(cd, _("Failed to assign keyslot %u as the new volume key."), keyslot); +out: + crypt_free_volume_key(vk); + return r < 0 ? r : keyslot; +} + + +int crypt_keyslot_add_by_key(struct crypt_device *cd, + int keyslot, + const char *volume_key, + size_t volume_key_size, + const char *passphrase, + size_t passphrase_size, + uint32_t flags) +{ + int digest, r; + struct luks2_keyslot_params params; + struct volume_key *vk = NULL; + + if (!passphrase || ((flags & CRYPT_VOLUME_KEY_NO_SEGMENT) && + (flags & CRYPT_VOLUME_KEY_SET))) + return -EINVAL; + + log_dbg(cd, "Adding new keyslot %d with volume key %sassigned to a crypt segment.", + keyslot, flags & CRYPT_VOLUME_KEY_NO_SEGMENT ? "un" : ""); + + if ((r = onlyLUKS2(cd))) + return r; + + /* new volume key assignment */ + if ((flags & CRYPT_VOLUME_KEY_SET) && crypt_keyslot_status(cd, keyslot) > CRYPT_SLOT_INACTIVE) + return verify_and_update_segment_digest(cd, &cd->u.luks2.hdr, + keyslot, volume_key, volume_key_size, passphrase, passphrase_size); + + r = keyslot_verify_or_find_empty(cd, &keyslot); + if (r < 0) + return r; + + if (volume_key) + vk = crypt_alloc_volume_key(volume_key_size, volume_key); + else if (flags & CRYPT_VOLUME_KEY_NO_SEGMENT) + vk = crypt_generate_volume_key(cd, volume_key_size); + else if (cd->volume_key) + vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key); + else + return -EINVAL; + + if (!vk) + return -ENOMEM; + + /* if key matches volume key digest tear down new vk flag */ + digest = LUKS2_digest_verify_by_segment(cd, &cd->u.luks2.hdr, CRYPT_DEFAULT_SEGMENT, vk); + if (digest >= 0) + flags &= ~CRYPT_VOLUME_KEY_SET; + + /* if key matches any existing digest, do not create new digest */ + if (digest < 0 && (flags & CRYPT_VOLUME_KEY_DIGEST_REUSE)) + digest = LUKS2_digest_any_matching(cd, &cd->u.luks2.hdr, vk); + + /* no segment flag or new vk flag requires new key digest */ + if (flags & (CRYPT_VOLUME_KEY_NO_SEGMENT | CRYPT_VOLUME_KEY_SET)) { + if (digest < 0 || !(flags & CRYPT_VOLUME_KEY_DIGEST_REUSE)) + digest = LUKS2_digest_create(cd, "pbkdf2", &cd->u.luks2.hdr, vk); + } + + r = digest; + if (r < 0) { + log_err(cd, _("Volume key does not match the volume.")); + goto out; + } + + r = LUKS2_keyslot_params_default(cd, &cd->u.luks2.hdr, ¶ms); + if (r < 0) { + log_err(cd, _("Failed to initialize default LUKS2 keyslot parameters.")); + goto out; + } + + r = LUKS2_digest_assign(cd, &cd->u.luks2.hdr, keyslot, digest, 1, 0); + if (r < 0) { + log_err(cd, _("Failed to assign keyslot %d to digest."), keyslot); + goto out; + } + + r = LUKS2_keyslot_store(cd, &cd->u.luks2.hdr, keyslot, + passphrase, passphrase_size, vk, ¶ms); + + if (r >= 0 && (flags & CRYPT_VOLUME_KEY_SET)) + r = update_volume_key_segment_digest(cd, &cd->u.luks2.hdr, digest, 1); +out: + crypt_free_volume_key(vk); + if (r < 0) { + _luks2_reload(cd); + return r; + } + return keyslot; +} + +/* + * Keyring handling + */ + +int crypt_use_keyring_for_vk(struct crypt_device *cd) +{ + uint32_t dmc_flags; + + /* dm backend must be initialized */ + if (!cd || !isLUKS2(cd->type)) + return 0; + + if (!_vk_via_keyring || !kernel_keyring_support()) + return 0; + + if (dm_flags(cd, DM_CRYPT, &dmc_flags)) + return dmcrypt_keyring_bug() ? 0 : 1; + + return (dmc_flags & DM_KERNEL_KEYRING_SUPPORTED); +} + +int crypt_volume_key_keyring(struct crypt_device *cd, int enable) +{ + _vk_via_keyring = enable ? 1 : 0; + return 0; +} + +/* internal only */ +int crypt_volume_key_load_in_keyring(struct crypt_device *cd, struct volume_key *vk) +{ + int r; + const char *type_name = key_type_name(LOGON_KEY); + + if (!vk || !cd || !type_name) + return -EINVAL; + + if (!vk->key_description) { + log_dbg(cd, "Invalid key description"); + return -EINVAL; + } + + log_dbg(cd, "Loading key (%zu bytes, type %s) in thread keyring.", vk->keylength, type_name); + + r = keyring_add_key_in_thread_keyring(LOGON_KEY, vk->key_description, vk->key, vk->keylength); + if (r) { + log_dbg(cd, "keyring_add_key_in_thread_keyring failed (error %d)", r); + log_err(cd, _("Failed to load key in kernel keyring.")); + } else + crypt_set_key_in_keyring(cd, 1); + + return r; +} + +/* internal only */ +int crypt_key_in_keyring(struct crypt_device *cd) +{ + return cd ? cd->key_in_keyring : 0; +} + +/* internal only */ +void crypt_set_key_in_keyring(struct crypt_device *cd, unsigned key_in_keyring) +{ + if (!cd) + return; + + cd->key_in_keyring = key_in_keyring; +} + +/* internal only */ +void crypt_drop_keyring_key_by_description(struct crypt_device *cd, const char *key_description, key_type_t ktype) +{ + int r; + const char *type_name = key_type_name(ktype); + + if (!key_description || !type_name) + return; + + log_dbg(cd, "Requesting keyring %s key for revoke and unlink.", type_name); + + r = keyring_revoke_and_unlink_key(ktype, key_description); + if (r) + log_dbg(cd, "keyring_revoke_and_unlink_key failed (error %d)", r); + crypt_set_key_in_keyring(cd, 0); +} + +/* internal only */ +void crypt_drop_keyring_key(struct crypt_device *cd, struct volume_key *vks) +{ + struct volume_key *vk = vks; + + while (vk) { + crypt_drop_keyring_key_by_description(cd, vk->key_description, LOGON_KEY); + vk = crypt_volume_key_next(vk); + } +} + +int crypt_activate_by_keyring(struct crypt_device *cd, + const char *name, + const char *key_description, + int keyslot, + uint32_t flags) +{ + char *passphrase; + size_t passphrase_size; + int r; + + if (!cd || !key_description) + return -EINVAL; + + log_dbg(cd, "%s volume %s [keyslot %d] using passphrase in keyring.", + name ? "Activating" : "Checking", name ?: "passphrase", keyslot); + + if (!kernel_keyring_support()) { + log_err(cd, _("Kernel keyring is not supported by the kernel.")); + return -EINVAL; + } + + r = _activate_check_status(cd, name, flags & CRYPT_ACTIVATE_REFRESH); + if (r < 0) + return r; + + r = keyring_get_passphrase(key_description, &passphrase, &passphrase_size); + if (r < 0) { + log_err(cd, _("Failed to read passphrase from keyring (error %d)."), r); + return -EINVAL; + } + + r = _activate_by_passphrase(cd, name, keyslot, passphrase, passphrase_size, flags); + + crypt_safe_memzero(passphrase, passphrase_size); + free(passphrase); + + return r; +} + +/* + * Workaround for serialization of parallel activation and memory-hard PBKDF + * In specific situation (systemd activation) this causes OOM killer activation. + * For now, let's provide this ugly way to serialize unlocking of devices. + */ +int crypt_serialize_lock(struct crypt_device *cd) +{ + if (!cd->memory_hard_pbkdf_lock_enabled) + return 0; + + log_dbg(cd, "Taking global memory-hard access serialization lock."); + if (crypt_write_lock(cd, "memory-hard-access", true, &cd->pbkdf_memory_hard_lock)) { + log_err(cd, _("Failed to acquire global memory-hard access serialization lock.")); + cd->pbkdf_memory_hard_lock = NULL; + return -EINVAL; + } + + return 0; +} + +void crypt_serialize_unlock(struct crypt_device *cd) +{ + if (!cd->memory_hard_pbkdf_lock_enabled) + return; + + crypt_unlock_internal(cd, cd->pbkdf_memory_hard_lock); + cd->pbkdf_memory_hard_lock = NULL; +} + +crypt_reencrypt_info crypt_reencrypt_status(struct crypt_device *cd, + struct crypt_params_reencrypt *params) +{ + if (!cd || !isLUKS2(cd->type)) + return CRYPT_REENCRYPT_NONE; + + if (_onlyLUKS2(cd, CRYPT_CD_QUIET, CRYPT_REQUIREMENT_ONLINE_REENCRYPT)) + return CRYPT_REENCRYPT_INVALID; + + return LUKS2_reencrypt_get_params(&cd->u.luks2.hdr, params); +} + +static void __attribute__((destructor)) libcryptsetup_exit(void) +{ + crypt_backend_destroy(); + crypt_random_exit(); +} diff --git a/lib/tcrypt/tcrypt.c b/lib/tcrypt/tcrypt.c new file mode 100644 index 0000000..bf20b69 --- /dev/null +++ b/lib/tcrypt/tcrypt.c @@ -0,0 +1,1131 @@ +/* + * TCRYPT (TrueCrypt-compatible) and VeraCrypt volume handling + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "tcrypt.h" +#include "internal.h" + +/* TCRYPT PBKDF variants */ +static const struct { + unsigned int legacy:1; + unsigned int veracrypt:1; + const char *name; + const char *hash; + unsigned int iterations; + uint32_t veracrypt_pim_const; + uint32_t veracrypt_pim_mult; +} tcrypt_kdf[] = { + { 0, 0, "pbkdf2", "ripemd160", 2000, 0, 0 }, + { 0, 0, "pbkdf2", "ripemd160", 1000, 0, 0 }, + { 0, 0, "pbkdf2", "sha512", 1000, 0, 0 }, + { 0, 0, "pbkdf2", "whirlpool", 1000, 0, 0 }, + { 1, 0, "pbkdf2", "sha1", 2000, 0, 0 }, + { 0, 1, "pbkdf2", "sha512", 500000, 15000, 1000 }, + { 0, 1, "pbkdf2", "whirlpool", 500000, 15000, 1000 }, + { 0, 1, "pbkdf2", "sha256", 500000, 15000, 1000 }, // VeraCrypt 1.0f + { 0, 1, "pbkdf2", "sha256", 200000, 0, 2048 }, // boot only + { 0, 1, "pbkdf2", "ripemd160", 655331, 15000, 1000 }, + { 0, 1, "pbkdf2", "ripemd160", 327661, 0, 2048 }, // boot only + { 0, 1, "pbkdf2", "stribog512",500000, 15000, 1000 }, +// { 0, 1, "pbkdf2", "stribog512",200000, 0, 2048 }, // boot only + { 0, 0, NULL, NULL, 0, 0, 0 } +}; + +struct tcrypt_alg { + const char *name; + unsigned int key_size; + unsigned int iv_size; + unsigned int key_offset; + unsigned int iv_offset; /* or tweak key offset */ + unsigned int key_extra_size; +}; + +struct tcrypt_algs { + unsigned int legacy:1; + unsigned int chain_count; + unsigned int chain_key_size; + const char *long_name; + const char *mode; + struct tcrypt_alg cipher[3]; +}; + +/* TCRYPT cipher variants */ +static struct tcrypt_algs tcrypt_cipher[] = { +/* XTS mode */ +{0,1,64,"aes","xts-plain64", + {{"aes", 64,16,0,32,0}}}, +{0,1,64,"serpent","xts-plain64", + {{"serpent",64,16,0,32,0}}}, +{0,1,64,"twofish","xts-plain64", + {{"twofish",64,16,0,32,0}}}, +{0,2,128,"twofish-aes","xts-plain64", + {{"twofish",64,16, 0,64,0}, + {"aes", 64,16,32,96,0}}}, +{0,3,192,"serpent-twofish-aes","xts-plain64", + {{"serpent",64,16, 0, 96,0}, + {"twofish",64,16,32,128,0}, + {"aes", 64,16,64,160,0}}}, +{0,2,128,"aes-serpent","xts-plain64", + {{"aes", 64,16, 0,64,0}, + {"serpent",64,16,32,96,0}}}, +{0,3,192,"aes-twofish-serpent","xts-plain64", + {{"aes", 64,16, 0, 96,0}, + {"twofish",64,16,32,128,0}, + {"serpent",64,16,64,160,0}}}, +{0,2,128,"serpent-twofish","xts-plain64", + {{"serpent",64,16, 0,64,0}, + {"twofish",64,16,32,96,0}}}, +{0,1,64,"camellia","xts-plain64", + {{"camellia", 64,16,0,32,0}}}, +{0,1,64,"kuznyechik","xts-plain64", + {{"kuznyechik", 64,16,0,32,0}}}, +{0,2,128,"kuznyechik-camellia","xts-plain64", + {{"kuznyechik",64,16, 0,64,0}, + {"camellia", 64,16,32,96,0}}}, +{0,2,128,"twofish-kuznyechik","xts-plain64", + {{"twofish", 64,16, 0,64,0}, + {"kuznyechik",64,16,32,96,0}}}, +{0,2,128,"serpent-camellia","xts-plain64", + {{"serpent", 64,16, 0,64,0}, + {"camellia", 64,16,32,96,0}}}, +{0,2,128,"aes-kuznyechik","xts-plain64", + {{"aes", 64,16, 0,64,0}, + {"kuznyechik",64,16,32,96,0}}}, +{0,3,192,"camellia-serpent-kuznyechik","xts-plain64", + {{"camellia", 64,16, 0, 96,0}, + {"serpent", 64,16,32,128,0}, + {"kuznyechik",64,16,64,160,0}}}, + +/* LRW mode */ +{0,1,48,"aes","lrw-benbi", + {{"aes", 48,16,32,0,0}}}, +{0,1,48,"serpent","lrw-benbi", + {{"serpent",48,16,32,0,0}}}, +{0,1,48,"twofish","lrw-benbi", + {{"twofish",48,16,32,0,0}}}, +{0,2,96,"twofish-aes","lrw-benbi", + {{"twofish",48,16,32,0,0}, + {"aes", 48,16,64,0,0}}}, +{0,3,144,"serpent-twofish-aes","lrw-benbi", + {{"serpent",48,16,32,0,0}, + {"twofish",48,16,64,0,0}, + {"aes", 48,16,96,0,0}}}, +{0,2,96,"aes-serpent","lrw-benbi", + {{"aes", 48,16,32,0,0}, + {"serpent",48,16,64,0,0}}}, +{0,3,144,"aes-twofish-serpent","lrw-benbi", + {{"aes", 48,16,32,0,0}, + {"twofish",48,16,64,0,0}, + {"serpent",48,16,96,0,0}}}, +{0,2,96,"serpent-twofish", "lrw-benbi", + {{"serpent",48,16,32,0,0}, + {"twofish",48,16,64,0,0}}}, + +/* Kernel LRW block size is fixed to 16 bytes for GF(2^128) + * thus cannot be used with blowfish where block is 8 bytes. + * There also no GF(2^64) support. +{1,1,64,"blowfish_le","lrw-benbi", + {{"blowfish_le",64,8,32,0,0}}}, +{1,2,112,"blowfish_le-aes","lrw-benbi", + {{"blowfish_le",64, 8,32,0,0}, + {"aes", 48,16,88,0,0}}}, +{1,3,160,"serpent-blowfish_le-aes","lrw-benbi", + {{"serpent", 48,16, 32,0,0}, + {"blowfish_le",64, 8, 64,0,0}, + {"aes", 48,16,120,0,0}}},*/ + +/* + * CBC + "outer" CBC (both with whitening) + * chain_key_size: alg_keys_bytes + IV_seed_bytes + whitening_bytes + */ +{1,1,32+16+16,"aes","cbc-tcw", + {{"aes", 32,16,32,0,32}}}, +{1,1,32+16+16,"serpent","cbc-tcw", + {{"serpent",32,16,32,0,32}}}, +{1,1,32+16+16,"twofish","cbc-tcw", + {{"twofish",32,16,32,0,32}}}, +{1,2,64+16+16,"twofish-aes","cbci-tcrypt", + {{"twofish",32,16,32,0,0}, + {"aes", 32,16,64,0,32}}}, +{1,3,96+16+16,"serpent-twofish-aes","cbci-tcrypt", + {{"serpent",32,16,32,0,0}, + {"twofish",32,16,64,0,0}, + {"aes", 32,16,96,0,32}}}, +{1,2,64+16+16,"aes-serpent","cbci-tcrypt", + {{"aes", 32,16,32,0,0}, + {"serpent",32,16,64,0,32}}}, +{1,3,96+16+16,"aes-twofish-serpent", "cbci-tcrypt", + {{"aes", 32,16,32,0,0}, + {"twofish",32,16,64,0,0}, + {"serpent",32,16,96,0,32}}}, +{1,2,64+16+16,"serpent-twofish", "cbci-tcrypt", + {{"serpent",32,16,32,0,0}, + {"twofish",32,16,64,0,32}}}, +{1,1,16+8+16,"cast5","cbc-tcw", + {{"cast5", 16,8,32,0,24}}}, +{1,1,24+8+16,"des3_ede","cbc-tcw", + {{"des3_ede",24,8,32,0,24}}}, +{1,1,56+8+16,"blowfish_le","cbc-tcrypt", + {{"blowfish_le",56,8,32,0,24}}}, +{1,2,88+16+16,"blowfish_le-aes","cbc-tcrypt", + {{"blowfish_le",56, 8,32,0,0}, + {"aes", 32,16,88,0,32}}}, +{1,3,120+16+16,"serpent-blowfish_le-aes","cbc-tcrypt", + {{"serpent", 32,16, 32,0,0}, + {"blowfish_le",56, 8, 64,0,0}, + {"aes", 32,16,120,0,32}}}, +{} +}; + +static int TCRYPT_hdr_from_disk(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params, + int kdf_index, int cipher_index) +{ + uint32_t crc32; + size_t size; + + /* Check CRC32 of header */ + size = TCRYPT_HDR_LEN - sizeof(hdr->d.keys) - sizeof(hdr->d.header_crc32); + crc32 = crypt_crc32(~0, (unsigned char*)&hdr->d, size) ^ ~0; + if (be16_to_cpu(hdr->d.version) > 3 && + crc32 != be32_to_cpu(hdr->d.header_crc32)) { + log_dbg(cd, "TCRYPT header CRC32 mismatch."); + return -EINVAL; + } + + /* Check CRC32 of keys */ + crc32 = crypt_crc32(~0, (unsigned char*)hdr->d.keys, sizeof(hdr->d.keys)) ^ ~0; + if (crc32 != be32_to_cpu(hdr->d.keys_crc32)) { + log_dbg(cd, "TCRYPT keys CRC32 mismatch."); + return -EINVAL; + } + + /* Convert header to cpu format */ + hdr->d.version = be16_to_cpu(hdr->d.version); + hdr->d.version_tc = be16_to_cpu(hdr->d.version_tc); + + hdr->d.keys_crc32 = be32_to_cpu(hdr->d.keys_crc32); + + hdr->d.hidden_volume_size = be64_to_cpu(hdr->d.hidden_volume_size); + hdr->d.volume_size = be64_to_cpu(hdr->d.volume_size); + + hdr->d.mk_offset = be64_to_cpu(hdr->d.mk_offset); + if (!hdr->d.mk_offset) + hdr->d.mk_offset = 512; + + hdr->d.mk_size = be64_to_cpu(hdr->d.mk_size); + + hdr->d.flags = be32_to_cpu(hdr->d.flags); + + hdr->d.sector_size = be32_to_cpu(hdr->d.sector_size); + if (!hdr->d.sector_size) + hdr->d.sector_size = 512; + + hdr->d.header_crc32 = be32_to_cpu(hdr->d.header_crc32); + + /* Set params */ + params->passphrase = NULL; + params->passphrase_size = 0; + params->hash_name = tcrypt_kdf[kdf_index].hash; + params->key_size = tcrypt_cipher[cipher_index].chain_key_size; + params->cipher = tcrypt_cipher[cipher_index].long_name; + params->mode = tcrypt_cipher[cipher_index].mode; + + return 0; +} + +/* + * Kernel implements just big-endian version of blowfish, hack it here + */ +static void TCRYPT_swab_le(char *buf) +{ + uint32_t *l = (uint32_t*)&buf[0]; + uint32_t *r = (uint32_t*)&buf[4]; + *l = swab32(*l); + *r = swab32(*r); +} + +static int decrypt_blowfish_le_cbc(struct tcrypt_alg *alg, + const char *key, char *buf) +{ + int bs = alg->iv_size; + char iv[bs], iv_old[bs]; + struct crypt_cipher *cipher = NULL; + int i, j, r; + + assert(bs == 2*sizeof(uint32_t)); + + r = crypt_cipher_init(&cipher, "blowfish", "ecb", + &key[alg->key_offset], alg->key_size); + if (r < 0) + return r; + + memcpy(iv, &key[alg->iv_offset], alg->iv_size); + for (i = 0; i < TCRYPT_HDR_LEN; i += bs) { + memcpy(iv_old, &buf[i], bs); + TCRYPT_swab_le(&buf[i]); + r = crypt_cipher_decrypt(cipher, &buf[i], &buf[i], + bs, NULL, 0); + TCRYPT_swab_le(&buf[i]); + if (r < 0) + break; + for (j = 0; j < bs; j++) + buf[i + j] ^= iv[j]; + memcpy(iv, iv_old, bs); + } + + crypt_cipher_destroy(cipher); + crypt_safe_memzero(iv, bs); + crypt_safe_memzero(iv_old, bs); + return r; +} + +static void TCRYPT_remove_whitening(char *buf, const char *key) +{ + int j; + + for (j = 0; j < TCRYPT_HDR_LEN; j++) + buf[j] ^= key[j % 8]; +} + +static void TCRYPT_copy_key(struct tcrypt_alg *alg, const char *mode, + char *out_key, const char *key) +{ + int ks2; + if (!strncmp(mode, "xts", 3)) { + ks2 = alg->key_size / 2; + memcpy(out_key, &key[alg->key_offset], ks2); + memcpy(&out_key[ks2], &key[alg->iv_offset], ks2); + } else if (!strncmp(mode, "lrw", 3)) { + ks2 = alg->key_size - TCRYPT_LRW_IKEY_LEN; + memcpy(out_key, &key[alg->key_offset], ks2); + memcpy(&out_key[ks2], key, TCRYPT_LRW_IKEY_LEN); + } else if (!strncmp(mode, "cbc", 3)) { + memcpy(out_key, &key[alg->key_offset], alg->key_size); + /* IV + whitening */ + memcpy(&out_key[alg->key_size], &key[alg->iv_offset], + alg->key_extra_size); + } +} + +static int TCRYPT_decrypt_hdr_one(struct tcrypt_alg *alg, const char *mode, + const char *key,struct tcrypt_phdr *hdr) +{ + char backend_key[TCRYPT_HDR_KEY_LEN]; + char iv[TCRYPT_HDR_IV_LEN] = {}; + char mode_name[MAX_CIPHER_LEN + 1]; + struct crypt_cipher *cipher; + char *c, *buf = (char*)&hdr->e; + int r; + + /* Remove IV if present */ + mode_name[MAX_CIPHER_LEN] = '\0'; + strncpy(mode_name, mode, MAX_CIPHER_LEN); + c = strchr(mode_name, '-'); + if (c) + *c = '\0'; + + if (!strncmp(mode, "lrw", 3)) + iv[alg->iv_size - 1] = 1; + else if (!strncmp(mode, "cbc", 3)) { + TCRYPT_remove_whitening(buf, &key[8]); + if (!strcmp(alg->name, "blowfish_le")) + return decrypt_blowfish_le_cbc(alg, key, buf); + memcpy(iv, &key[alg->iv_offset], alg->iv_size); + } + + TCRYPT_copy_key(alg, mode, backend_key, key); + r = crypt_cipher_init(&cipher, alg->name, mode_name, + backend_key, alg->key_size); + if (!r) { + r = crypt_cipher_decrypt(cipher, buf, buf, TCRYPT_HDR_LEN, + iv, alg->iv_size); + crypt_cipher_destroy(cipher); + } + + crypt_safe_memzero(backend_key, sizeof(backend_key)); + crypt_safe_memzero(iv, TCRYPT_HDR_IV_LEN); + return r; +} + +/* + * For chained ciphers and CBC mode we need "outer" decryption. + * Backend doesn't provide this, so implement it here directly using ECB. + */ +static int TCRYPT_decrypt_cbci(struct tcrypt_algs *ciphers, + const char *key, struct tcrypt_phdr *hdr) +{ + struct crypt_cipher *cipher[ciphers->chain_count]; + unsigned int bs = ciphers->cipher[0].iv_size; + char *buf = (char*)&hdr->e, iv[bs], iv_old[bs]; + unsigned int i, j; + int r = -EINVAL; + + TCRYPT_remove_whitening(buf, &key[8]); + + memcpy(iv, &key[ciphers->cipher[0].iv_offset], bs); + + /* Initialize all ciphers in chain in ECB mode */ + for (j = 0; j < ciphers->chain_count; j++) + cipher[j] = NULL; + for (j = 0; j < ciphers->chain_count; j++) { + r = crypt_cipher_init(&cipher[j], ciphers->cipher[j].name, "ecb", + &key[ciphers->cipher[j].key_offset], + ciphers->cipher[j].key_size); + if (r < 0) + goto out; + } + + /* Implements CBC with chained ciphers in loop inside */ + for (i = 0; i < TCRYPT_HDR_LEN; i += bs) { + memcpy(iv_old, &buf[i], bs); + for (j = ciphers->chain_count; j > 0; j--) { + r = crypt_cipher_decrypt(cipher[j - 1], &buf[i], &buf[i], + bs, NULL, 0); + if (r < 0) + goto out; + } + for (j = 0; j < bs; j++) + buf[i + j] ^= iv[j]; + memcpy(iv, iv_old, bs); + } +out: + for (j = 0; j < ciphers->chain_count; j++) + if (cipher[j]) + crypt_cipher_destroy(cipher[j]); + + crypt_safe_memzero(iv, bs); + crypt_safe_memzero(iv_old, bs); + return r; +} + +static int TCRYPT_decrypt_hdr(struct crypt_device *cd, struct tcrypt_phdr *hdr, + const char *key, uint32_t flags) +{ + struct tcrypt_phdr hdr2; + int i, j, r = -EINVAL; + + for (i = 0; tcrypt_cipher[i].chain_count; i++) { + if (!(flags & CRYPT_TCRYPT_LEGACY_MODES) && tcrypt_cipher[i].legacy) + continue; + log_dbg(cd, "TCRYPT: trying cipher %s-%s", + tcrypt_cipher[i].long_name, tcrypt_cipher[i].mode); + + memcpy(&hdr2.e, &hdr->e, TCRYPT_HDR_LEN); + + if (!strncmp(tcrypt_cipher[i].mode, "cbci", 4)) + r = TCRYPT_decrypt_cbci(&tcrypt_cipher[i], key, &hdr2); + else for (j = tcrypt_cipher[i].chain_count - 1; j >= 0 ; j--) { + if (!tcrypt_cipher[i].cipher[j].name) + continue; + r = TCRYPT_decrypt_hdr_one(&tcrypt_cipher[i].cipher[j], + tcrypt_cipher[i].mode, key, &hdr2); + if (r < 0) + break; + } + + if (r < 0) { + log_dbg(cd, "TCRYPT: returned error %d, skipped.", r); + if (r == -ENOTSUP) + break; + r = -ENOENT; + continue; + } + + if (!strncmp(hdr2.d.magic, TCRYPT_HDR_MAGIC, TCRYPT_HDR_MAGIC_LEN)) { + log_dbg(cd, "TCRYPT: Signature magic detected."); + memcpy(&hdr->e, &hdr2.e, TCRYPT_HDR_LEN); + r = i; + break; + } + if ((flags & CRYPT_TCRYPT_VERA_MODES) && + !strncmp(hdr2.d.magic, VCRYPT_HDR_MAGIC, TCRYPT_HDR_MAGIC_LEN)) { + log_dbg(cd, "TCRYPT: Signature magic detected (Veracrypt)."); + memcpy(&hdr->e, &hdr2.e, TCRYPT_HDR_LEN); + r = i; + break; + } + r = -EPERM; + } + + crypt_safe_memzero(&hdr2, sizeof(hdr2)); + return r; +} + +static int TCRYPT_pool_keyfile(struct crypt_device *cd, + unsigned char pool[VCRYPT_KEY_POOL_LEN], + const char *keyfile, int keyfiles_pool_length) +{ + unsigned char *data; + int i, j, fd, data_size, r = -EIO; + uint32_t crc; + + log_dbg(cd, "TCRYPT: using keyfile %s.", keyfile); + + data = malloc(TCRYPT_KEYFILE_LEN); + if (!data) + return -ENOMEM; + memset(data, 0, TCRYPT_KEYFILE_LEN); + + fd = open(keyfile, O_RDONLY); + if (fd < 0) { + log_err(cd, _("Failed to open key file.")); + goto out; + } + + data_size = read_buffer(fd, data, TCRYPT_KEYFILE_LEN); + close(fd); + if (data_size < 0) { + log_err(cd, _("Error reading keyfile %s."), keyfile); + goto out; + } + + for (i = 0, j = 0, crc = ~0U; i < data_size; i++) { + crc = crypt_crc32(crc, &data[i], 1); + pool[j++] += (unsigned char)(crc >> 24); + pool[j++] += (unsigned char)(crc >> 16); + pool[j++] += (unsigned char)(crc >> 8); + pool[j++] += (unsigned char)(crc); + j %= keyfiles_pool_length; + } + r = 0; +out: + crypt_safe_memzero(&crc, sizeof(crc)); + crypt_safe_memzero(data, TCRYPT_KEYFILE_LEN); + free(data); + + return r; +} + +static int TCRYPT_init_hdr(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params) +{ + unsigned char pwd[VCRYPT_KEY_POOL_LEN] = {}; + size_t passphrase_size, max_passphrase_size; + char *key; + unsigned int i, skipped = 0, iterations; + int r = -EPERM, keyfiles_pool_length; + + if (posix_memalign((void*)&key, crypt_getpagesize(), TCRYPT_HDR_KEY_LEN)) + return -ENOMEM; + + if (params->flags & CRYPT_TCRYPT_VERA_MODES && + params->passphrase_size > TCRYPT_KEY_POOL_LEN) { + /* Really. Keyfile pool length depends on passphrase size in Veracrypt. */ + max_passphrase_size = VCRYPT_KEY_POOL_LEN; + keyfiles_pool_length = VCRYPT_KEY_POOL_LEN; + } else { + max_passphrase_size = TCRYPT_KEY_POOL_LEN; + keyfiles_pool_length = TCRYPT_KEY_POOL_LEN; + } + + if (params->keyfiles_count) + passphrase_size = max_passphrase_size; + else + passphrase_size = params->passphrase_size; + + if (params->passphrase_size > max_passphrase_size) { + log_err(cd, _("Maximum TCRYPT passphrase length (%zu) exceeded."), + max_passphrase_size); + goto out; + } + + /* Calculate pool content from keyfiles */ + for (i = 0; i < params->keyfiles_count; i++) { + r = TCRYPT_pool_keyfile(cd, pwd, params->keyfiles[i], keyfiles_pool_length); + if (r < 0) + goto out; + } + + /* If provided password, combine it with pool */ + for (i = 0; i < params->passphrase_size; i++) + pwd[i] += params->passphrase[i]; + + for (i = 0; tcrypt_kdf[i].name; i++) { + if (!(params->flags & CRYPT_TCRYPT_LEGACY_MODES) && tcrypt_kdf[i].legacy) + continue; + if (!(params->flags & CRYPT_TCRYPT_VERA_MODES) && tcrypt_kdf[i].veracrypt) + continue; + if ((params->flags & CRYPT_TCRYPT_VERA_MODES) && params->veracrypt_pim) { + /* Do not try TrueCrypt modes if we have PIM value */ + if (!tcrypt_kdf[i].veracrypt) + continue; + /* adjust iterations to given PIM cmdline parameter */ + iterations = tcrypt_kdf[i].veracrypt_pim_const + + (tcrypt_kdf[i].veracrypt_pim_mult * params->veracrypt_pim); + } else + iterations = tcrypt_kdf[i].iterations; + + /* Derive header key */ + log_dbg(cd, "TCRYPT: trying KDF: %s-%s-%d%s.", + tcrypt_kdf[i].name, tcrypt_kdf[i].hash, tcrypt_kdf[i].iterations, + params->veracrypt_pim && tcrypt_kdf[i].veracrypt ? "-PIM" : ""); + r = crypt_pbkdf(tcrypt_kdf[i].name, tcrypt_kdf[i].hash, + (char*)pwd, passphrase_size, + hdr->salt, TCRYPT_HDR_SALT_LEN, + key, TCRYPT_HDR_KEY_LEN, + iterations, 0, 0); + if (r < 0) { + log_verbose(cd, _("PBKDF2 hash algorithm %s not available, skipping."), + tcrypt_kdf[i].hash); + continue; + } + + /* Decrypt header */ + r = TCRYPT_decrypt_hdr(cd, hdr, key, params->flags); + if (r == -ENOENT) { + skipped++; + r = -EPERM; + } + if (r != -EPERM) + break; + } + + if ((r < 0 && r != -EPERM && skipped && skipped == i) || r == -ENOTSUP) { + log_err(cd, _("Required kernel crypto interface not available.")); +#ifdef ENABLE_AF_ALG + log_err(cd, _("Ensure you have algif_skcipher kernel module loaded.")); +#endif + } + if (r < 0) + goto out; + + r = TCRYPT_hdr_from_disk(cd, hdr, params, i, r); + if (!r) { + log_dbg(cd, "TCRYPT: Magic: %s, Header version: %d, req. %d, sector %d" + ", mk_offset %" PRIu64 ", hidden_size %" PRIu64 + ", volume size %" PRIu64, tcrypt_kdf[i].veracrypt ? + VCRYPT_HDR_MAGIC : TCRYPT_HDR_MAGIC, + (int)hdr->d.version, (int)hdr->d.version_tc, (int)hdr->d.sector_size, + hdr->d.mk_offset, hdr->d.hidden_volume_size, hdr->d.volume_size); + log_dbg(cd, "TCRYPT: Header cipher %s-%s, key size %zu", + params->cipher, params->mode, params->key_size); + } +out: + crypt_safe_memzero(pwd, TCRYPT_KEY_POOL_LEN); + if (key) + crypt_safe_memzero(key, TCRYPT_HDR_KEY_LEN); + free(key); + return r; +} + +int TCRYPT_read_phdr(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params) +{ + struct device *base_device = NULL, *device = crypt_metadata_device(cd); + ssize_t hdr_size = sizeof(struct tcrypt_phdr); + char *base_device_path; + int devfd, r; + + assert(sizeof(struct tcrypt_phdr) == 512); + + log_dbg(cd, "Reading TCRYPT header of size %zu bytes from device %s.", + hdr_size, device_path(device)); + + if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER && + crypt_dev_is_partition(device_path(device))) { + base_device_path = crypt_get_base_device(device_path(device)); + + log_dbg(cd, "Reading TCRYPT system header from device %s.", base_device_path ?: "?"); + if (!base_device_path) + return -EINVAL; + + r = device_alloc(cd, &base_device, base_device_path); + free(base_device_path); + if (r < 0) + return r; + devfd = device_open(cd, base_device, O_RDONLY); + } else + devfd = device_open(cd, device, O_RDONLY); + + if (devfd < 0) { + device_free(cd, base_device); + log_err(cd, _("Cannot open device %s."), device_path(device)); + return -EINVAL; + } + + r = -EIO; + if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) { + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, + TCRYPT_HDR_SYSTEM_OFFSET) == hdr_size) { + r = TCRYPT_init_hdr(cd, hdr, params); + } + } else if (params->flags & CRYPT_TCRYPT_HIDDEN_HEADER) { + if (params->flags & CRYPT_TCRYPT_BACKUP_HEADER) { + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, + TCRYPT_HDR_HIDDEN_OFFSET_BCK) == hdr_size) + r = TCRYPT_init_hdr(cd, hdr, params); + } else { + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, + TCRYPT_HDR_HIDDEN_OFFSET) == hdr_size) + r = TCRYPT_init_hdr(cd, hdr, params); + if (r && read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, + TCRYPT_HDR_HIDDEN_OFFSET_OLD) == hdr_size) + r = TCRYPT_init_hdr(cd, hdr, params); + } + } else if (params->flags & CRYPT_TCRYPT_BACKUP_HEADER) { + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, + TCRYPT_HDR_OFFSET_BCK) == hdr_size) + r = TCRYPT_init_hdr(cd, hdr, params); + } else if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), hdr, hdr_size, 0) == hdr_size) + r = TCRYPT_init_hdr(cd, hdr, params); + + device_free(cd, base_device); + if (r < 0) + memset(hdr, 0, sizeof (*hdr)); + return r; +} + +static struct tcrypt_algs *TCRYPT_get_algs(const char *cipher, const char *mode) +{ + int i; + + if (!cipher || !mode) + return NULL; + + for (i = 0; tcrypt_cipher[i].chain_count; i++) + if (!strcmp(tcrypt_cipher[i].long_name, cipher) && + !strcmp(tcrypt_cipher[i].mode, mode)) + return &tcrypt_cipher[i]; + + return NULL; +} + +int TCRYPT_activate(struct crypt_device *cd, + const char *name, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params, + uint32_t flags) +{ + char dm_name[PATH_MAX], dm_dev_name[PATH_MAX], cipher_spec[MAX_CIPHER_LEN*2+1]; + char *part_path; + unsigned int i; + int r; + uint32_t req_flags, dmc_flags; + struct tcrypt_algs *algs; + enum devcheck device_check; + uint64_t offset = crypt_get_data_offset(cd); + struct volume_key *vk = NULL; + struct device *ptr_dev = crypt_data_device(cd), *device = NULL, *part_device = NULL; + struct crypt_dm_active_device dmd = { + .flags = flags + }; + + if (!hdr->d.version) { + log_dbg(cd, "TCRYPT: this function is not supported without encrypted header load."); + return -ENOTSUP; + } + + if (hdr->d.sector_size % SECTOR_SIZE) { + log_err(cd, _("Activation is not supported for %d sector size."), + hdr->d.sector_size); + return -ENOTSUP; + } + + if (strstr(params->mode, "-tcrypt")) { + log_err(cd, _("Kernel does not support activation for this TCRYPT legacy mode.")); + return -ENOTSUP; + } + + if (strstr(params->mode, "-tcw")) + req_flags = DM_TCW_SUPPORTED; + else + req_flags = DM_PLAIN64_SUPPORTED; + + algs = TCRYPT_get_algs(params->cipher, params->mode); + if (!algs) + return -EINVAL; + + if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) + dmd.size = 0; + else if (params->flags & CRYPT_TCRYPT_HIDDEN_HEADER) + dmd.size = hdr->d.hidden_volume_size / SECTOR_SIZE; + else + dmd.size = hdr->d.volume_size / SECTOR_SIZE; + + if (dmd.flags & CRYPT_ACTIVATE_SHARED) + device_check = DEV_OK; + else + device_check = DEV_EXCL; + + if ((params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) && + !crypt_dev_is_partition(device_path(crypt_data_device(cd)))) { + part_path = crypt_get_partition_device(device_path(crypt_data_device(cd)), + crypt_get_data_offset(cd), dmd.size); + if (part_path) { + if (!device_alloc(cd, &part_device, part_path)) { + log_verbose(cd, _("Activating TCRYPT system encryption for partition %s."), + part_path); + ptr_dev = part_device; + offset = 0; + } + free(part_path); + } else + /* + * System encryption use the whole device mapping, there can + * be active partitions. + */ + device_check = DEV_OK; + } + + r = device_block_adjust(cd, ptr_dev, device_check, + offset, &dmd.size, &dmd.flags); + if (r) + goto out; + + /* From here, key size for every cipher must be the same */ + vk = crypt_alloc_volume_key(algs->cipher[0].key_size + + algs->cipher[0].key_extra_size, NULL); + if (!vk) { + r = -ENOMEM; + goto out; + } + + for (i = algs->chain_count; i > 0; i--) { + if (i == 1) { + dm_name[sizeof(dm_name)-1] = '\0'; + strncpy(dm_name, name, sizeof(dm_name)-1); + dmd.flags = flags; + } else { + snprintf(dm_name, sizeof(dm_name), "%s_%d", name, i-1); + dmd.flags = flags | CRYPT_ACTIVATE_PRIVATE; + } + + TCRYPT_copy_key(&algs->cipher[i-1], algs->mode, + vk->key, hdr->d.keys); + + if (algs->chain_count != i) { + snprintf(dm_dev_name, sizeof(dm_dev_name), "%s/%s_%d", + dm_get_dir(), name, i); + r = device_alloc(cd, &device, dm_dev_name); + if (r) + break; + ptr_dev = device; + offset = 0; + } + + r = snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", algs->cipher[i-1].name, algs->mode); + if (r < 0 || (size_t)r >= sizeof(cipher_spec)) { + r = -ENOMEM; + break; + } + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, ptr_dev, vk, + cipher_spec, crypt_get_iv_offset(cd), offset, + crypt_get_integrity(cd), + crypt_get_integrity_tag_size(cd), + crypt_get_sector_size(cd)); + if (r) + break; + + log_dbg(cd, "Trying to activate TCRYPT device %s using cipher %s.", + dm_name, dmd.segment.u.crypt.cipher); + r = dm_create_device(cd, dm_name, CRYPT_TCRYPT, &dmd); + + dm_targets_free(cd, &dmd); + device_free(cd, device); + device = NULL; + + if (r) + break; + } + + if (r < 0 && + (dm_flags(cd, DM_CRYPT, &dmc_flags) || ((dmc_flags & req_flags) != req_flags))) { + log_err(cd, _("Kernel does not support TCRYPT compatible mapping.")); + r = -ENOTSUP; + } + +out: + crypt_free_volume_key(vk); + device_free(cd, device); + device_free(cd, part_device); + return r; +} + +static int TCRYPT_remove_one(struct crypt_device *cd, const char *name, + const char *base_uuid, int index, uint32_t flags) +{ + struct crypt_dm_active_device dmd; + char dm_name[PATH_MAX]; + int r; + + if (snprintf(dm_name, sizeof(dm_name), "%s_%d", name, index) < 0) + return -ENOMEM; + + r = dm_status_device(cd, dm_name); + if (r < 0) + return r; + + r = dm_query_device(cd, dm_name, DM_ACTIVE_UUID, &dmd); + if (!r && !strncmp(dmd.uuid, base_uuid, strlen(base_uuid))) + r = dm_remove_device(cd, dm_name, flags); + + free(CONST_CAST(void*)dmd.uuid); + return r; +} + +int TCRYPT_deactivate(struct crypt_device *cd, const char *name, uint32_t flags) +{ + struct crypt_dm_active_device dmd; + int r; + + r = dm_query_device(cd, name, DM_ACTIVE_UUID, &dmd); + if (r < 0) + return r; + if (!dmd.uuid) + return -EINVAL; + + r = dm_remove_device(cd, name, flags); + if (r < 0) + goto out; + + r = TCRYPT_remove_one(cd, name, dmd.uuid, 1, flags); + if (r < 0) + goto out; + + r = TCRYPT_remove_one(cd, name, dmd.uuid, 2, flags); +out: + free(CONST_CAST(void*)dmd.uuid); + return (r == -ENODEV) ? 0 : r; +} + +static int TCRYPT_status_one(struct crypt_device *cd, const char *name, + const char *base_uuid, int index, + size_t *key_size, char *cipher, + struct tcrypt_phdr *tcrypt_hdr, + struct device **device) +{ + struct crypt_dm_active_device dmd; + struct dm_target *tgt = &dmd.segment; + char dm_name[PATH_MAX], *c; + int r; + + if (snprintf(dm_name, sizeof(dm_name), "%s_%d", name, index) < 0) + return -ENOMEM; + + r = dm_status_device(cd, dm_name); + if (r < 0) + return r; + + r = dm_query_device(cd, dm_name, DM_ACTIVE_DEVICE | + DM_ACTIVE_UUID | + DM_ACTIVE_CRYPT_CIPHER | + DM_ACTIVE_CRYPT_KEYSIZE, &dmd); + if (r < 0) + return r; + if (!single_segment(&dmd) || tgt->type != DM_CRYPT) { + r = -ENOTSUP; + goto out; + } + + r = 0; + + if (!strncmp(dmd.uuid, base_uuid, strlen(base_uuid))) { + if ((c = strchr(tgt->u.crypt.cipher, '-'))) + *c = '\0'; + strcat(cipher, "-"); + strncat(cipher, tgt->u.crypt.cipher, MAX_CIPHER_LEN); + *key_size += tgt->u.crypt.vk->keylength; + tcrypt_hdr->d.mk_offset = tgt->u.crypt.offset * SECTOR_SIZE; + device_free(cd, *device); + MOVE_REF(*device, tgt->data_device); + } else + r = -ENODEV; +out: + dm_targets_free(cd, &dmd); + free(CONST_CAST(void*)dmd.uuid); + return r; +} + +int TCRYPT_init_by_name(struct crypt_device *cd, const char *name, + const char *uuid, + const struct dm_target *tgt, + struct device **device, + struct crypt_params_tcrypt *tcrypt_params, + struct tcrypt_phdr *tcrypt_hdr) +{ + struct tcrypt_algs *algs; + char cipher[MAX_CIPHER_LEN * 4], mode[MAX_CIPHER_LEN+1], *tmp; + size_t key_size; + int r; + + memset(tcrypt_params, 0, sizeof(*tcrypt_params)); + memset(tcrypt_hdr, 0, sizeof(*tcrypt_hdr)); + tcrypt_hdr->d.sector_size = SECTOR_SIZE; + tcrypt_hdr->d.mk_offset = tgt->u.crypt.offset * SECTOR_SIZE; + + strncpy(cipher, tgt->u.crypt.cipher, MAX_CIPHER_LEN); + tmp = strchr(cipher, '-'); + if (!tmp) + return -EINVAL; + *tmp = '\0'; + mode[MAX_CIPHER_LEN] = '\0'; + strncpy(mode, ++tmp, MAX_CIPHER_LEN); + + key_size = tgt->u.crypt.vk->keylength; + r = TCRYPT_status_one(cd, name, uuid, 1, &key_size, + cipher, tcrypt_hdr, device); + if (!r) + r = TCRYPT_status_one(cd, name, uuid, 2, &key_size, + cipher, tcrypt_hdr, device); + + if (r < 0 && r != -ENODEV) + return r; + + algs = TCRYPT_get_algs(cipher, mode); + if (!algs || key_size != algs->chain_key_size) + return -EINVAL; + + tcrypt_params->key_size = algs->chain_key_size; + tcrypt_params->cipher = algs->long_name; + tcrypt_params->mode = algs->mode; + return 0; +} + +uint64_t TCRYPT_get_data_offset(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params) +{ + uint64_t size; + + /* No real header loaded, initialized by active device */ + if (!hdr->d.version) + goto hdr_offset; + + /* Mapping through whole device, not partition! */ + if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) { + if (crypt_dev_is_partition(device_path(crypt_data_device(cd)))) + return 0; + goto hdr_offset; + } + + if (params->mode && !strncmp(params->mode, "xts", 3)) { + if (hdr->d.version < 3) + return 1; + + if (params->flags & CRYPT_TCRYPT_HIDDEN_HEADER) { + if (hdr->d.version > 3) + return (hdr->d.mk_offset / SECTOR_SIZE); + if (device_size(crypt_metadata_device(cd), &size) < 0) + return 0; + return (size - hdr->d.hidden_volume_size + + (TCRYPT_HDR_HIDDEN_OFFSET_OLD)) / SECTOR_SIZE; + } + goto hdr_offset; + } + + if (params->flags & CRYPT_TCRYPT_HIDDEN_HEADER) { + if (device_size(crypt_metadata_device(cd), &size) < 0) + return 0; + return (size - hdr->d.hidden_volume_size + + (TCRYPT_HDR_HIDDEN_OFFSET_OLD)) / SECTOR_SIZE; + } + +hdr_offset: + return hdr->d.mk_offset / SECTOR_SIZE; +} + +uint64_t TCRYPT_get_iv_offset(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params) +{ + uint64_t iv_offset; + + if (params->mode && !strncmp(params->mode, "xts", 3)) + iv_offset = TCRYPT_get_data_offset(cd, hdr, params); + else if (params->mode && !strncmp(params->mode, "lrw", 3)) + iv_offset = 0; + else + iv_offset = hdr->d.mk_offset / SECTOR_SIZE; + + if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) + iv_offset += crypt_dev_partition_offset(device_path(crypt_data_device(cd))); + + return iv_offset; +} + +int TCRYPT_get_volume_key(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params, + struct volume_key **vk) +{ + struct tcrypt_algs *algs; + unsigned int i, key_index; + + if (!hdr->d.version) { + log_err(cd, _("This function is not supported without TCRYPT header load.")); + return -ENOTSUP; + } + + algs = TCRYPT_get_algs(params->cipher, params->mode); + if (!algs) + return -EINVAL; + + *vk = crypt_alloc_volume_key(params->key_size, NULL); + if (!*vk) + return -ENOMEM; + + for (i = 0, key_index = 0; i < algs->chain_count; i++) { + TCRYPT_copy_key(&algs->cipher[i], algs->mode, + &(*vk)->key[key_index], hdr->d.keys); + key_index += algs->cipher[i].key_size; + } + + return 0; +} + +int TCRYPT_dump(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params) +{ + log_std(cd, "%s header information for %s\n", + hdr->d.magic[0] == 'T' ? "TCRYPT" : "VERACRYPT", + device_path(crypt_metadata_device(cd))); + if (hdr->d.version) { + log_std(cd, "Version: \t%d\n", hdr->d.version); + log_std(cd, "Driver req.:\t%x.%x\n", hdr->d.version_tc >> 8, + hdr->d.version_tc & 0xFF); + + log_std(cd, "Sector size:\t%" PRIu32 "\n", hdr->d.sector_size); + log_std(cd, "MK offset:\t%" PRIu64 "\n", hdr->d.mk_offset); + log_std(cd, "PBKDF2 hash:\t%s\n", params->hash_name); + } + log_std(cd, "Cipher chain:\t%s\n", params->cipher); + log_std(cd, "Cipher mode:\t%s\n", params->mode); + log_std(cd, "MK bits: \t%zu\n", params->key_size * 8); + return 0; +} diff --git a/lib/tcrypt/tcrypt.h b/lib/tcrypt/tcrypt.h new file mode 100644 index 0000000..ff12cbd --- /dev/null +++ b/lib/tcrypt/tcrypt.h @@ -0,0 +1,121 @@ +/* + * TCRYPT (TrueCrypt-compatible) header definition + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_TCRYPT_H +#define _CRYPTSETUP_TCRYPT_H + +#include + +#define TCRYPT_HDR_SALT_LEN 64 +#define TCRYPT_HDR_IV_LEN 16 +#define TCRYPT_HDR_LEN 448 +#define TCRYPT_HDR_KEY_LEN 192 +#define TCRYPT_HDR_MAGIC "TRUE" +#define VCRYPT_HDR_MAGIC "VERA" +#define TCRYPT_HDR_MAGIC_LEN 4 + +#define TCRYPT_HDR_HIDDEN_OFFSET_OLD -1536 +#define TCRYPT_HDR_HIDDEN_OFFSET 65536 + +#define TCRYPT_HDR_HIDDEN_OFFSET_BCK -65536 +#define TCRYPT_HDR_OFFSET_BCK -131072 + +#define TCRYPT_HDR_SYSTEM_OFFSET 31744 + +#define TCRYPT_LRW_IKEY_LEN 16 +#define TCRYPT_KEY_POOL_LEN 64 +#define VCRYPT_KEY_POOL_LEN 128 +#define TCRYPT_KEYFILE_LEN 1048576 + +#define TCRYPT_HDR_FLAG_SYSTEM (1 << 0) +#define TCRYPT_HDR_FLAG_NONSYSTEM (1 << 1) + +struct tcrypt_phdr { + char salt[TCRYPT_HDR_SALT_LEN]; + + /* encrypted part, TCRYPT_HDR_LEN bytes */ + union { + struct __attribute__((__packed__)) { + char magic[TCRYPT_HDR_MAGIC_LEN]; + uint16_t version; + uint16_t version_tc; + uint32_t keys_crc32; + uint64_t _reserved1[2]; /* data/header ctime */ + uint64_t hidden_volume_size; + uint64_t volume_size; + uint64_t mk_offset; + uint64_t mk_size; + uint32_t flags; + uint32_t sector_size; + uint8_t _reserved2[120]; + uint32_t header_crc32; + char keys[256]; + } d; + char e[TCRYPT_HDR_LEN]; + }; +} __attribute__((__packed__)); + +struct crypt_device; +struct crypt_params_tcrypt; +struct crypt_dm_active_device; +struct dm_target; +struct volume_key; +struct device; + +int TCRYPT_read_phdr(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params); + +int TCRYPT_init_by_name(struct crypt_device *cd, const char *name, + const char *uuid, + const struct dm_target *tgt, + struct device **device, + struct crypt_params_tcrypt *tcrypt_params, + struct tcrypt_phdr *tcrypt_hdr); + +int TCRYPT_activate(struct crypt_device *cd, + const char *name, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params, + uint32_t flags); + +int TCRYPT_deactivate(struct crypt_device *cd, + const char *name, + uint32_t flags); + +uint64_t TCRYPT_get_data_offset(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params); + +uint64_t TCRYPT_get_iv_offset(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params); + +int TCRYPT_get_volume_key(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params, + struct volume_key **vk); + +int TCRYPT_dump(struct crypt_device *cd, + struct tcrypt_phdr *hdr, + struct crypt_params_tcrypt *params); + +#endif diff --git a/lib/utils.c b/lib/utils.c new file mode 100644 index 0000000..7e850a6 --- /dev/null +++ b/lib/utils.c @@ -0,0 +1,345 @@ +/* + * utils - miscellaneous device utilities for cryptsetup + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include + +#include "internal.h" + +size_t crypt_getpagesize(void) +{ + long r = sysconf(_SC_PAGESIZE); + return r <= 0 ? DEFAULT_MEM_ALIGNMENT : (size_t)r; +} + +unsigned crypt_cpusonline(void) +{ + long r = sysconf(_SC_NPROCESSORS_ONLN); + return r < 0 ? 1 : r; +} + +uint64_t crypt_getphysmemory_kb(void) +{ + long pagesize, phys_pages; + uint64_t phys_memory_kb; + + pagesize = sysconf(_SC_PAGESIZE); + phys_pages = sysconf(_SC_PHYS_PAGES); + + if (pagesize < 0 || phys_pages < 0) + return 0; + + phys_memory_kb = pagesize / 1024; + phys_memory_kb *= phys_pages; + + return phys_memory_kb; +} + +/* MEMLOCK */ +#define DEFAULT_PROCESS_PRIORITY -18 + +static int _priority; +static int _memlock_count = 0; + +// return 1 if memory is locked +int crypt_memlock_inc(struct crypt_device *ctx) +{ + if (!_memlock_count++) { + log_dbg(ctx, "Locking memory."); + if (mlockall(MCL_CURRENT | MCL_FUTURE) == -1) { + log_dbg(ctx, "Cannot lock memory with mlockall."); + _memlock_count--; + return 0; + } + errno = 0; + if (((_priority = getpriority(PRIO_PROCESS, 0)) == -1) && errno) + log_err(ctx, _("Cannot get process priority.")); + else + if (setpriority(PRIO_PROCESS, 0, DEFAULT_PROCESS_PRIORITY)) + log_dbg(ctx, "setpriority %d failed: %s", + DEFAULT_PROCESS_PRIORITY, strerror(errno)); + } + return _memlock_count ? 1 : 0; +} + +int crypt_memlock_dec(struct crypt_device *ctx) +{ + if (_memlock_count && (!--_memlock_count)) { + log_dbg(ctx, "Unlocking memory."); + if (munlockall() == -1) + log_err(ctx, _("Cannot unlock memory.")); + if (setpriority(PRIO_PROCESS, 0, _priority)) + log_dbg(ctx, "setpriority %d failed: %s", _priority, strerror(errno)); + } + return _memlock_count ? 1 : 0; +} + +/* Keyfile processing */ + +/* + * A simple call to lseek(3) might not be possible for some inputs (e.g. + * reading from a pipe), so this function instead reads of up to BUFSIZ bytes + * at a time until the specified number of bytes. It returns -1 on read error + * or when it reaches EOF before the requested number of bytes have been + * discarded. + */ +static int keyfile_seek(int fd, uint64_t bytes) +{ + char tmp[BUFSIZ]; + size_t next_read; + ssize_t bytes_r; + off64_t r; + + r = lseek64(fd, bytes, SEEK_CUR); + if (r > 0) + return 0; + if (r < 0 && errno != ESPIPE) + return -1; + + while (bytes > 0) { + /* figure out how much to read */ + next_read = bytes > sizeof(tmp) ? sizeof(tmp) : (size_t)bytes; + + bytes_r = read(fd, tmp, next_read); + if (bytes_r < 0) { + if (errno == EINTR) + continue; + + crypt_safe_memzero(tmp, sizeof(tmp)); + /* read error */ + return -1; + } + + if (bytes_r == 0) + /* EOF */ + break; + + bytes -= bytes_r; + } + + crypt_safe_memzero(tmp, sizeof(tmp)); + return bytes == 0 ? 0 : -1; +} + +int crypt_keyfile_device_read(struct crypt_device *cd, const char *keyfile, + char **key, size_t *key_size_read, + uint64_t keyfile_offset, size_t key_size, + uint32_t flags) +{ + int fd, regular_file, char_to_read = 0, char_read = 0, unlimited_read = 0; + int r = -EINVAL, newline; + char *pass = NULL; + size_t buflen, i; + uint64_t file_read_size; + struct stat st; + + if (!key || !key_size_read) + return -EINVAL; + + *key = NULL; + *key_size_read = 0; + + fd = keyfile ? open(keyfile, O_RDONLY) : STDIN_FILENO; + if (fd < 0) { + log_err(cd, _("Failed to open key file.")); + return -EINVAL; + } + + if (isatty(fd)) { + log_err(cd, _("Cannot read keyfile from a terminal.")); + r = -EINVAL; + goto out_err; + } + + /* If not requested otherwise, we limit input to prevent memory exhaustion */ + if (key_size == 0) { + key_size = DEFAULT_KEYFILE_SIZE_MAXKB * 1024 + 1; + unlimited_read = 1; + /* use 4k for buffer (page divisor but avoid huge pages) */ + buflen = 4096 - sizeof(size_t); // sizeof(struct safe_allocation); + } else + buflen = key_size; + + regular_file = 0; + if (keyfile) { + if (stat(keyfile, &st) < 0) { + log_err(cd, _("Failed to stat key file.")); + goto out_err; + } + if (S_ISREG(st.st_mode)) { + regular_file = 1; + file_read_size = (uint64_t)st.st_size; + + if (keyfile_offset > file_read_size) { + log_err(cd, _("Cannot seek to requested keyfile offset.")); + goto out_err; + } + file_read_size -= keyfile_offset; + + /* known keyfile size, alloc it in one step */ + if (file_read_size >= (uint64_t)key_size) + buflen = key_size; + else if (file_read_size) + buflen = file_read_size; + } + } + + pass = crypt_safe_alloc(buflen); + if (!pass) { + log_err(cd, _("Out of memory while reading passphrase.")); + goto out_err; + } + + /* Discard keyfile_offset bytes on input */ + if (keyfile_offset && keyfile_seek(fd, keyfile_offset) < 0) { + log_err(cd, _("Cannot seek to requested keyfile offset.")); + goto out_err; + } + + for (i = 0, newline = 0; i < key_size; i += char_read) { + if (i == buflen) { + buflen += 4096; + pass = crypt_safe_realloc(pass, buflen); + if (!pass) { + log_err(cd, _("Out of memory while reading passphrase.")); + r = -ENOMEM; + goto out_err; + } + } + + if (flags & CRYPT_KEYFILE_STOP_EOL) { + /* If we should stop on newline, we must read the input + * one character at the time. Otherwise we might end up + * having read some bytes after the newline, which we + * promised not to do. + */ + char_to_read = 1; + } else { + /* char_to_read = min(key_size - i, buflen - i) */ + char_to_read = key_size < buflen ? + key_size - i : buflen - i; + } + char_read = read_buffer(fd, &pass[i], char_to_read); + if (char_read < 0) { + log_err(cd, _("Error reading passphrase.")); + r = -EPIPE; + goto out_err; + } + + if (char_read == 0) + break; + /* Stop on newline only if not requested read from keyfile */ + if ((flags & CRYPT_KEYFILE_STOP_EOL) && pass[i] == '\n') { + newline = 1; + pass[i] = '\0'; + break; + } + } + + /* Fail if piped input dies reading nothing */ + if (!i && !regular_file && !newline) { + log_err(cd, _("Nothing to read on input.")); + r = -EPIPE; + goto out_err; + } + + /* Fail if we exceeded internal default (no specified size) */ + if (unlimited_read && i == key_size) { + log_err(cd, _("Maximum keyfile size exceeded.")); + goto out_err; + } + + if (!unlimited_read && i != key_size) { + log_err(cd, _("Cannot read requested amount of data.")); + goto out_err; + } + + *key = pass; + *key_size_read = i; + r = 0; +out_err: + if (fd != STDIN_FILENO) + close(fd); + + if (r) + crypt_safe_free(pass); + return r; +} + +int crypt_keyfile_read(struct crypt_device *cd, const char *keyfile, + char **key, size_t *key_size_read, + size_t keyfile_offset, size_t keyfile_size_max, + uint32_t flags) +{ + return crypt_keyfile_device_read(cd, keyfile, key, key_size_read, + keyfile_offset, keyfile_size_max, flags); +} + +int kernel_version(uint64_t *kversion) +{ + struct utsname uts; + uint16_t maj, min, patch, rel; + int r = -EINVAL; + + if (uname(&uts) < 0) + return r; + + if (sscanf(uts.release, "%" SCNu16 ".%" SCNu16 ".%" SCNu16 "-%" SCNu16, + &maj, &min, &patch, &rel) == 4) + r = 0; + else if (sscanf(uts.release, "%" SCNu16 ".%" SCNu16 ".%" SCNu16, + &maj, &min, &patch) == 3) { + rel = 0; + r = 0; + } + + if (!r) + *kversion = version(maj, min, patch, rel); + + return r; +} + +bool crypt_string_in(const char *str, char **list, size_t list_size) +{ + size_t i; + + for (i = 0; *list && i < list_size; i++, list++) + if (!strcmp(str, *list)) + return true; + + return false; +} + +/* compare two strings (allows NULL values) */ +int crypt_strcmp(const char *a, const char *b) +{ + if (!a && !b) + return 0; + else if (!a || !b) + return 1; + return strcmp(a, b); +} diff --git a/lib/utils_benchmark.c b/lib/utils_benchmark.c new file mode 100644 index 0000000..6b2efdc --- /dev/null +++ b/lib/utils_benchmark.c @@ -0,0 +1,215 @@ +/* + * libcryptsetup - cryptsetup library, cipher benchmark + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2012-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include + +#include "internal.h" + +int crypt_benchmark(struct crypt_device *cd, + const char *cipher, + const char *cipher_mode, + size_t volume_key_size, + size_t iv_size, + size_t buffer_size, + double *encryption_mbs, + double *decryption_mbs) +{ + void *buffer = NULL; + char *iv = NULL, *key = NULL, mode[MAX_CIPHER_LEN], *c; + int r; + + if (!cipher || !cipher_mode || !volume_key_size || !encryption_mbs || !decryption_mbs) + return -EINVAL; + + r = init_crypto(cd); + if (r < 0) + return r; + + r = -ENOMEM; + if (posix_memalign(&buffer, crypt_getpagesize(), buffer_size)) + goto out; + + r = crypt_cipher_ivsize(cipher, cipher_mode); + if (r >= 0 && iv_size != (size_t)r) { + log_dbg(cd, "IV length for benchmark adjusted to %i bytes (requested %zu).", r, iv_size); + iv_size = r; + } + + if (iv_size) { + iv = malloc(iv_size); + if (!iv) + goto out; + crypt_random_get(cd, iv, iv_size, CRYPT_RND_NORMAL); + } + + key = malloc(volume_key_size); + if (!key) + goto out; + + crypt_random_get(cd, key, volume_key_size, CRYPT_RND_NORMAL); + + strncpy(mode, cipher_mode, sizeof(mode)-1); + /* Ignore IV generator */ + if ((c = strchr(mode, '-'))) + *c = '\0'; + + r = crypt_cipher_perf_kernel(cipher, cipher_mode, buffer, buffer_size, key, volume_key_size, + iv, iv_size, encryption_mbs, decryption_mbs); + + if (r == -ERANGE) + log_dbg(cd, "Measured cipher runtime is too low."); + else if (r) + log_dbg(cd, "Cannot initialize cipher %s, mode %s, key size %zu, IV size %zu.", + cipher, cipher_mode, volume_key_size, iv_size); +out: + free(buffer); + free(key); + free(iv); + + return r; +} + +int crypt_benchmark_pbkdf(struct crypt_device *cd, + struct crypt_pbkdf_type *pbkdf, + const char *password, + size_t password_size, + const char *salt, + size_t salt_size, + size_t volume_key_size, + int (*progress)(uint32_t time_ms, void *usrptr), + void *usrptr) +{ + int r; + const char *kdf_opt; + + if (!pbkdf || (!password && password_size)) + return -EINVAL; + + r = init_crypto(cd); + if (r < 0) + return r; + + kdf_opt = !strcmp(pbkdf->type, CRYPT_KDF_PBKDF2) ? pbkdf->hash : ""; + + log_dbg(cd, "Running %s(%s) benchmark.", pbkdf->type, kdf_opt); + + r = crypt_pbkdf_perf(pbkdf->type, pbkdf->hash, password, password_size, + salt, salt_size, volume_key_size, pbkdf->time_ms, + pbkdf->max_memory_kb, pbkdf->parallel_threads, + &pbkdf->iterations, &pbkdf->max_memory_kb, progress, usrptr); + + if (!r) + log_dbg(cd, "Benchmark returns %s(%s) %u iterations, %u memory, %u threads (for %zu-bits key).", + pbkdf->type, kdf_opt, pbkdf->iterations, pbkdf->max_memory_kb, + pbkdf->parallel_threads, volume_key_size * 8); + return r; +} + +struct benchmark_usrptr { + struct crypt_device *cd; + struct crypt_pbkdf_type *pbkdf; +}; + +static int benchmark_callback(uint32_t time_ms, void *usrptr) +{ + struct benchmark_usrptr *u = usrptr; + + log_dbg(u->cd, "PBKDF benchmark: memory cost = %u, iterations = %u, " + "threads = %u (took %u ms)", u->pbkdf->max_memory_kb, + u->pbkdf->iterations, u->pbkdf->parallel_threads, time_ms); + + return 0; +} + +/* + * Used in internal places to benchmark crypt_device context PBKDF. + * Once requested parameters are benchmarked, iterations attribute is set, + * and the benchmarked values can be reused. + * Note that memory cost can be changed after benchmark (if used). + * NOTE: You need to check that you are benchmarking for the same key size. + */ +int crypt_benchmark_pbkdf_internal(struct crypt_device *cd, + struct crypt_pbkdf_type *pbkdf, + size_t volume_key_size) +{ + struct crypt_pbkdf_limits pbkdf_limits; + double PBKDF2_tmp; + uint32_t ms_tmp; + int r = -EINVAL; + struct benchmark_usrptr u = { + .cd = cd, + .pbkdf = pbkdf + }; + + r = crypt_pbkdf_get_limits(pbkdf->type, &pbkdf_limits); + if (r) + return r; + + if (pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK) { + if (pbkdf->iterations) { + log_dbg(cd, "Reusing PBKDF values (no benchmark flag is set)."); + return 0; + } + log_err(cd, _("PBKDF benchmark disabled but iterations not set.")); + return -EINVAL; + } + + /* For PBKDF2 run benchmark always. Also note it depends on volume_key_size! */ + if (!strcmp(pbkdf->type, CRYPT_KDF_PBKDF2)) { + /* + * For PBKDF2 it is enough to run benchmark for only 1 second + * and interpolate final iterations value from it. + */ + ms_tmp = pbkdf->time_ms; + pbkdf->time_ms = 1000; + pbkdf->parallel_threads = 0; /* N/A in PBKDF2 */ + pbkdf->max_memory_kb = 0; /* N/A in PBKDF2 */ + + r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, "bar", 3, + volume_key_size, &benchmark_callback, &u); + pbkdf->time_ms = ms_tmp; + if (r < 0) { + log_err(cd, _("Not compatible PBKDF2 options (using hash algorithm %s)."), + pbkdf->hash); + return r; + } + + PBKDF2_tmp = ((double)pbkdf->iterations * pbkdf->time_ms / 1000.); + if (PBKDF2_tmp > (double)UINT32_MAX) + return -EINVAL; + pbkdf->iterations = at_least((uint32_t)PBKDF2_tmp, pbkdf_limits.min_iterations); + } else { + /* Already benchmarked */ + if (pbkdf->iterations) { + log_dbg(cd, "Reusing PBKDF values."); + return 0; + } + + r = crypt_benchmark_pbkdf(cd, pbkdf, "foo", 3, + "0123456789abcdef0123456789abcdef", 32, + volume_key_size, &benchmark_callback, &u); + if (r < 0) + log_err(cd, _("Not compatible PBKDF options.")); + } + + return r; +} diff --git a/lib/utils_blkid.c b/lib/utils_blkid.c new file mode 100644 index 0000000..562b136 --- /dev/null +++ b/lib/utils_blkid.c @@ -0,0 +1,323 @@ +/* + * blkid probe utilities + * + * Copyright (C) 2018-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "utils_blkid.h" +#include "utils_io.h" + +#ifdef HAVE_BLKID +#include +/* make bad checksums flag optional */ +#ifndef BLKID_SUBLKS_BADCSUM +#define BLKID_SUBLKS_BADCSUM 0 +#endif +struct blkid_handle { + int fd; + blkid_probe pr; +}; +#ifndef HAVE_BLKID_WIPE +static size_t crypt_getpagesize(void) +{ + long r = sysconf(_SC_PAGESIZE); + return r <= 0 ? 4096 : (size_t)r; +} +#endif +#endif + +void blk_set_chains_for_wipes(struct blkid_handle *h) +{ +#ifdef HAVE_BLKID + blkid_probe_enable_partitions(h->pr, 1); + blkid_probe_set_partitions_flags(h->pr, 0 +#ifdef HAVE_BLKID_WIPE + | BLKID_PARTS_MAGIC +#endif + ); + + blkid_probe_enable_superblocks(h->pr, 1); + blkid_probe_set_superblocks_flags(h->pr, BLKID_SUBLKS_LABEL | + BLKID_SUBLKS_UUID | + BLKID_SUBLKS_TYPE | + BLKID_SUBLKS_USAGE | + BLKID_SUBLKS_VERSION | + BLKID_SUBLKS_MAGIC | + BLKID_SUBLKS_BADCSUM); +#endif +} + +void blk_set_chains_for_full_print(struct blkid_handle *h) +{ + blk_set_chains_for_wipes(h); +} + +void blk_set_chains_for_fast_detection(struct blkid_handle *h) +{ +#ifdef HAVE_BLKID + blkid_probe_enable_partitions(h->pr, 1); + blkid_probe_set_partitions_flags(h->pr, 0); + + blkid_probe_enable_superblocks(h->pr, 1); + blkid_probe_set_superblocks_flags(h->pr, BLKID_SUBLKS_TYPE); +#endif +} + +int blk_init_by_path(struct blkid_handle **h, const char *path) +{ + int r = -ENOTSUP; +#ifdef HAVE_BLKID + struct blkid_handle *tmp = malloc(sizeof(*tmp)); + if (!tmp) + return -ENOMEM; + + tmp->fd = -1; + + tmp->pr = blkid_new_probe_from_filename(path); + if (!tmp->pr) { + free(tmp); + return -EINVAL; + } + + *h = tmp; + + r = 0; +#endif + return r; +} + +int blk_init_by_fd(struct blkid_handle **h, int fd) +{ + int r = -ENOTSUP; +#ifdef HAVE_BLKID + struct blkid_handle *tmp = malloc(sizeof(*tmp)); + if (!tmp) + return -ENOMEM; + + tmp->pr = blkid_new_probe(); + if (!tmp->pr) { + free(tmp); + return -EINVAL; + } + + if (blkid_probe_set_device(tmp->pr, fd, 0, 0)) { + blkid_free_probe(tmp->pr); + free(tmp); + return -EINVAL; + } + + tmp->fd = fd; + + *h = tmp; + + r = 0; +#endif + return r; +} + +int blk_superblocks_filter_luks(struct blkid_handle *h) +{ + int r = -ENOTSUP; +#ifdef HAVE_BLKID + char luks[] = "crypto_LUKS"; + char *luks_filter[] = { + luks, + NULL + }; + r = blkid_probe_filter_superblocks_type(h->pr, BLKID_FLTR_NOTIN, luks_filter); +#endif + return r; +} + +blk_probe_status blk_probe(struct blkid_handle *h) +{ + blk_probe_status pr = PRB_FAIL; +#ifdef HAVE_BLKID + int r = blkid_do_probe(h->pr); + + if (r == 0) + pr = PRB_OK; + else if (r == 1) + pr = PRB_EMPTY; +#endif + return pr; +} + +blk_probe_status blk_safeprobe(struct blkid_handle *h) +{ + int r = -1; +#ifdef HAVE_BLKID + r = blkid_do_safeprobe(h->pr); +#endif + switch (r) { + case -2: + return PRB_AMBIGUOUS; + case 1: + return PRB_EMPTY; + case 0: + return PRB_OK; + default: + return PRB_FAIL; + } +} + +int blk_is_partition(struct blkid_handle *h) +{ + int r = 0; +#ifdef HAVE_BLKID + r = blkid_probe_has_value(h->pr, "PTTYPE"); +#endif + return r; +} + +int blk_is_superblock(struct blkid_handle *h) +{ + int r = 0; +#ifdef HAVE_BLKID + r = blkid_probe_has_value(h->pr, "TYPE"); +#endif + return r; +} + +const char *blk_get_partition_type(struct blkid_handle *h) +{ + const char *value = NULL; +#ifdef HAVE_BLKID + (void) blkid_probe_lookup_value(h->pr, "PTTYPE", &value, NULL); +#endif + return value; +} + +const char *blk_get_superblock_type(struct blkid_handle *h) +{ + const char *value = NULL; +#ifdef HAVE_BLKID + (void) blkid_probe_lookup_value(h->pr, "TYPE", &value, NULL); +#endif + return value; +} + +void blk_free(struct blkid_handle *h) +{ +#ifdef HAVE_BLKID + if (!h) + return; + + if (h->pr) + blkid_free_probe(h->pr); + + free(h); +#endif +} + +#ifdef HAVE_BLKID +#ifndef HAVE_BLKID_WIPE +static int blk_step_back(struct blkid_handle *h) +{ +#ifdef HAVE_BLKID_STEP_BACK + return blkid_probe_step_back(h->pr); +#else + blkid_reset_probe(h->pr); + blkid_probe_set_device(h->pr, h->fd, 0, 0); + return 0; +#endif +} +#endif /* not HAVE_BLKID_WIPE */ +#endif /* HAVE_BLKID */ + +int blk_do_wipe(struct blkid_handle *h) +{ +#ifdef HAVE_BLKID +#ifdef HAVE_BLKID_WIPE + return blkid_do_wipe(h->pr, 0); +#else + const char *offset; + off_t offset_val; + void *buf; + ssize_t ret; + size_t alignment, len, bsize = blkid_probe_get_sectorsize(h->pr); + + if (h->fd < 0 || !bsize) + return -EINVAL; + + if (blk_is_partition(h)) { + if (blkid_probe_lookup_value(h->pr, "PTMAGIC_OFFSET", &offset, NULL)) + return -EINVAL; + if (blkid_probe_lookup_value(h->pr, "PTMAGIC", NULL, &len)) + return -EINVAL; + } else if (blk_is_superblock(h)) { + if (blkid_probe_lookup_value(h->pr, "SBMAGIC_OFFSET", &offset, NULL)) + return -EINVAL; + if (blkid_probe_lookup_value(h->pr, "SBMAGIC", NULL, &len)) + return -EINVAL; + } else + return 0; + + alignment = crypt_getpagesize(); + + if (posix_memalign(&buf, alignment, len)) + return -EINVAL; + memset(buf, 0, len); + + offset_val = strtoll(offset, NULL, 10); + + /* TODO: missing crypt_wipe_fd() */ + ret = write_lseek_blockwise(h->fd, bsize, alignment, buf, len, offset_val); + free(buf); + if (ret < 0) + return -EIO; + + if ((size_t)ret == len) { + blk_step_back(h); + return 0; + } + + return -EIO; +#endif +#else /* HAVE_BLKID */ + return -ENOTSUP; +#endif +} + +int blk_supported(void) +{ + int r = 0; +#ifdef HAVE_BLKID + r = 1; +#endif + return r; +} + +off_t blk_get_offset(struct blkid_handle *h) +{ + off_t offset_value = -1; +#ifdef HAVE_BLKID + const char *offset; + if (blk_is_superblock(h)) { + if (!blkid_probe_lookup_value(h->pr, "SBMAGIC_OFFSET", &offset, NULL)) + offset_value = strtoll(offset, NULL, 10); + } else if (blk_is_partition(h) && !blkid_probe_lookup_value(h->pr, "PTMAGIC_OFFSET", &offset, NULL)) + offset_value = strtoll(offset, NULL, 10); +#endif + return offset_value; +} diff --git a/lib/utils_blkid.h b/lib/utils_blkid.h new file mode 100644 index 0000000..5b61873 --- /dev/null +++ b/lib/utils_blkid.h @@ -0,0 +1,66 @@ +/* + * blkid probe utilities + * + * Copyright (C) 2018-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_BLKID_H +#define _UTILS_BLKID_H + +#include + +struct blkid_handle; + +typedef enum { PRB_OK = 0, PRB_EMPTY, PRB_AMBIGUOUS, PRB_FAIL } blk_probe_status; + +int blk_init_by_path(struct blkid_handle **h, const char *path); + +void blk_free(struct blkid_handle *h); + +/* + * WARNING: This will reset file description offset as if + * lseek(devfd, 0, SEEK_SET) was called! + */ +int blk_init_by_fd(struct blkid_handle **h, int fd); + +void blk_set_chains_for_wipes(struct blkid_handle *h); + +void blk_set_chains_for_full_print(struct blkid_handle *h); + +void blk_set_chains_for_fast_detection(struct blkid_handle *h); + +int blk_superblocks_filter_luks(struct blkid_handle *h); + +blk_probe_status blk_safeprobe(struct blkid_handle *h); + +blk_probe_status blk_probe(struct blkid_handle *h); + +int blk_is_partition(struct blkid_handle *h); + +int blk_is_superblock(struct blkid_handle *h); + +const char *blk_get_partition_type(struct blkid_handle *h); + +const char *blk_get_superblock_type(struct blkid_handle *h); + +int blk_do_wipe(struct blkid_handle *h); + +int blk_supported(void); + +off_t blk_get_offset(struct blkid_handle *h); + +#endif diff --git a/lib/utils_crypt.c b/lib/utils_crypt.c new file mode 100644 index 0000000..f2519c1 --- /dev/null +++ b/lib/utils_crypt.c @@ -0,0 +1,186 @@ +/* + * utils_crypt - cipher utilities for cryptsetup + * + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "utils_crypt.h" + +int crypt_parse_name_and_mode(const char *s, char *cipher, int *key_nums, + char *cipher_mode) +{ + if (!s || !cipher || !cipher_mode) + return -EINVAL; + + if (sscanf(s, "%" MAX_CIPHER_LEN_STR "[^-]-%" MAX_CIPHER_LEN_STR "s", + cipher, cipher_mode) == 2) { + if (!strcmp(cipher_mode, "plain")) + strcpy(cipher_mode, "cbc-plain"); + if (key_nums) { + char *tmp = strchr(cipher, ':'); + *key_nums = tmp ? atoi(++tmp) : 1; + if (!*key_nums) + return -EINVAL; + } + + return 0; + } + + /* Short version for "empty" cipher */ + if (!strcmp(s, "null") || !strcmp(s, "cipher_null")) { + strcpy(cipher, "cipher_null"); + strcpy(cipher_mode, "ecb"); + if (key_nums) + *key_nums = 0; + return 0; + } + + if (sscanf(s, "%" MAX_CIPHER_LEN_STR "[^-]", cipher) == 1) { + strcpy(cipher_mode, "cbc-plain"); + if (key_nums) + *key_nums = 1; + return 0; + } + + return -EINVAL; +} + +int crypt_parse_hash_integrity_mode(const char *s, char *integrity) +{ + char mode[MAX_CIPHER_LEN], hash[MAX_CIPHER_LEN]; + int r; + + if (!s || !integrity || strchr(s, '(') || strchr(s, ')')) + return -EINVAL; + + r = sscanf(s, "%" MAX_CIPHER_LEN_STR "[^-]-%" MAX_CIPHER_LEN_STR "s", mode, hash); + if (r == 2 && !isdigit(hash[0])) + r = snprintf(integrity, MAX_CIPHER_LEN, "%s(%s)", mode, hash); + else if (r == 2) + r = snprintf(integrity, MAX_CIPHER_LEN, "%s-%s", mode, hash); + else if (r == 1) + r = snprintf(integrity, MAX_CIPHER_LEN, "%s", mode); + else + return -EINVAL; + + if (r < 0 || r >= MAX_CIPHER_LEN) + return -EINVAL; + + return 0; +} + +int crypt_parse_integrity_mode(const char *s, char *integrity, + int *integrity_key_size) +{ + int ks = 0, r = 0; + + if (!s || !integrity) + return -EINVAL; + + // FIXME: do not hardcode it here + + /* AEAD modes */ + if (!strcmp(s, "aead") || + !strcmp(s, "poly1305") || + !strcmp(s, "none")) { + strncpy(integrity, s, MAX_CIPHER_LEN); + ks = 0; + } else if (!strcmp(s, "hmac-sha1")) { + strncpy(integrity, "hmac(sha1)", MAX_CIPHER_LEN); + ks = 20; + } else if (!strcmp(s, "hmac-sha256")) { + strncpy(integrity, "hmac(sha256)", MAX_CIPHER_LEN); + ks = 32; + } else if (!strcmp(s, "hmac-sha512")) { + ks = 64; + strncpy(integrity, "hmac(sha512)", MAX_CIPHER_LEN); + } else if (!strcmp(s, "cmac-aes")) { + ks = 16; + strncpy(integrity, "cmac(aes)", MAX_CIPHER_LEN); + } else + r = -EINVAL; + + if (integrity_key_size) + *integrity_key_size = ks; + + return r; +} + +int crypt_parse_pbkdf(const char *s, const char **pbkdf) +{ + const char *tmp = NULL; + + if (!s) + return -EINVAL; + + if (!strcasecmp(s, CRYPT_KDF_PBKDF2)) + tmp = CRYPT_KDF_PBKDF2; + else if (!strcasecmp(s, CRYPT_KDF_ARGON2I)) + tmp = CRYPT_KDF_ARGON2I; + else if (!strcasecmp(s, CRYPT_KDF_ARGON2ID)) + tmp = CRYPT_KDF_ARGON2ID; + + if (!tmp) + return -EINVAL; + + if (pbkdf) + *pbkdf = tmp; + + return 0; +} + +ssize_t crypt_hex_to_bytes(const char *hex, char **result, int safe_alloc) +{ + char buf[3] = "xx\0", *endp, *bytes; + size_t i, len; + + len = strlen(hex); + if (len % 2) + return -EINVAL; + len /= 2; + + bytes = safe_alloc ? crypt_safe_alloc(len) : malloc(len); + if (!bytes) + return -ENOMEM; + + for (i = 0; i < len; i++) { + memcpy(buf, &hex[i * 2], 2); + bytes[i] = strtoul(buf, &endp, 16); + if (endp != &buf[2]) { + safe_alloc ? crypt_safe_free(bytes) : free(bytes); + return -EINVAL; + } + } + *result = bytes; + return i; +} + +bool crypt_is_cipher_null(const char *cipher_spec) +{ + if (!cipher_spec) + return false; + return (strstr(cipher_spec, "cipher_null") || !strcmp(cipher_spec, "null")); +} diff --git a/lib/utils_crypt.h b/lib/utils_crypt.h new file mode 100644 index 0000000..9b74969 --- /dev/null +++ b/lib/utils_crypt.h @@ -0,0 +1,44 @@ +/* + * utils_crypt - cipher utilities for cryptsetup + * + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_CRYPT_H +#define _UTILS_CRYPT_H + +#include +#include + +#define MAX_CIPHER_LEN 32 +#define MAX_CIPHER_LEN_STR "31" +#define MAX_KEYFILES 32 + +int crypt_parse_name_and_mode(const char *s, char *cipher, + int *key_nums, char *cipher_mode); +int crypt_parse_hash_integrity_mode(const char *s, char *integrity); +int crypt_parse_integrity_mode(const char *s, char *integrity, + int *integrity_key_size); +int crypt_parse_pbkdf(const char *s, const char **pbkdf); + +ssize_t crypt_hex_to_bytes(const char *hex, char **result, int safe_alloc); + +bool crypt_is_cipher_null(const char *cipher_spec); + +#endif /* _UTILS_CRYPT_H */ diff --git a/lib/utils_device.c b/lib/utils_device.c new file mode 100644 index 0000000..f4bb058 --- /dev/null +++ b/lib/utils_device.c @@ -0,0 +1,1022 @@ +/* + * device backend utilities + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef HAVE_SYS_SYSMACROS_H +# include /* for major, minor */ +#endif +#ifdef HAVE_SYS_STATVFS_H +# include +#endif +#include "internal.h" +#include "utils_device_locking.h" + +struct device { + char *path; + + char *file_path; + int loop_fd; + + int ro_dev_fd; + int dev_fd; + int dev_fd_excl; + + struct crypt_lock_handle *lh; + + unsigned int o_direct:1; + unsigned int init_done:1; /* path is bdev or loop already initialized */ + + /* cached values */ + size_t alignment; + size_t block_size; +}; + +static size_t device_fs_block_size_fd(int fd) +{ + size_t page_size = crypt_getpagesize(); + +#ifdef HAVE_SYS_STATVFS_H + struct statvfs buf; + + /* + * NOTE: some filesystems (NFS) returns bogus blocksize (1MB). + * Page-size io should always work and avoids increasing IO beyond aligned LUKS header. + */ + if (!fstatvfs(fd, &buf) && buf.f_bsize && buf.f_bsize <= page_size) + return (size_t)buf.f_bsize; +#endif + return page_size; +} + +static size_t device_block_size_fd(int fd, size_t *min_size) +{ + struct stat st; + size_t bsize; + int arg; + + if (fstat(fd, &st) < 0) + return 0; + + if (S_ISREG(st.st_mode)) + bsize = device_fs_block_size_fd(fd); + else { + if (ioctl(fd, BLKSSZGET, &arg) < 0) + bsize = crypt_getpagesize(); + else + bsize = (size_t)arg; + } + + if (!min_size) + return bsize; + + if (S_ISREG(st.st_mode)) { + /* file can be empty as well */ + if (st.st_size > (ssize_t)bsize) + *min_size = bsize; + else + *min_size = st.st_size; + } else { + /* block device must have at least one block */ + *min_size = bsize; + } + + return bsize; +} + +static size_t device_alignment_fd(int devfd) +{ + long alignment = DEFAULT_MEM_ALIGNMENT; + +#ifdef _PC_REC_XFER_ALIGN + alignment = fpathconf(devfd, _PC_REC_XFER_ALIGN); + if (alignment < 0) + alignment = DEFAULT_MEM_ALIGNMENT; +#endif + return (size_t)alignment; +} + +static int device_read_test(int devfd) +{ + char buffer[512]; + int r = -EIO; + size_t minsize = 0, blocksize, alignment; + + blocksize = device_block_size_fd(devfd, &minsize); + alignment = device_alignment_fd(devfd); + + if (!blocksize || !alignment) + return -EINVAL; + + if (minsize == 0) + return 0; + + if (minsize > sizeof(buffer)) + minsize = sizeof(buffer); + + if (read_blockwise(devfd, blocksize, alignment, buffer, minsize) == (ssize_t)minsize) + r = 0; + + crypt_safe_memzero(buffer, sizeof(buffer)); + return r; +} + +/* + * The direct-io is always preferred. The header is usually mapped to the same + * device and can be accessed when the rest of device is mapped to data device. + * Using direct-io ensures that we do not mess with data in cache. + * (But proper alignment should prevent this in the first place.) + * The read test is needed to detect broken configurations (seen with remote + * block devices) that allow open with direct-io but then fails on read. + */ +static int device_ready(struct crypt_device *cd, struct device *device) +{ + int devfd = -1, r = 0; + struct stat st; + size_t tmp_size; + + if (!device) + return -EINVAL; + + if (device->o_direct) { + log_dbg(cd, "Trying to open and read device %s with direct-io.", + device_path(device)); + device->o_direct = 0; + devfd = open(device_path(device), O_RDONLY | O_DIRECT); + if (devfd >= 0) { + if (device_read_test(devfd) == 0) { + device->o_direct = 1; + } else { + close(devfd); + devfd = -1; + } + } + } + + if (devfd < 0) { + log_dbg(cd, "Trying to open device %s without direct-io.", + device_path(device)); + devfd = open(device_path(device), O_RDONLY); + } + + if (devfd < 0) { + log_err(cd, _("Device %s does not exist or access denied."), + device_path(device)); + return -EINVAL; + } + + if (fstat(devfd, &st) < 0) + r = -EINVAL; + else if (!S_ISBLK(st.st_mode)) + r = S_ISREG(st.st_mode) ? -ENOTBLK : -EINVAL; + if (r == -EINVAL) { + log_err(cd, _("Device %s is not compatible."), + device_path(device)); + close(devfd); + return r; + } + + /* Allow only increase (loop device) */ + tmp_size = device_alignment_fd(devfd); + if (tmp_size > device->alignment) + device->alignment = tmp_size; + + tmp_size = device_block_size_fd(devfd, NULL); + if (tmp_size > device->block_size) + device->block_size = tmp_size; + + close(devfd); + return r; +} + +static int _open_locked(struct crypt_device *cd, struct device *device, int flags) +{ + int fd; + + if (!device) + return -EINVAL; + + log_dbg(cd, "Opening locked device %s", device_path(device)); + + if ((flags & O_ACCMODE) != O_RDONLY && device_locked_readonly(device->lh)) { + log_dbg(cd, "Cannot open locked device %s in write mode. Read lock held.", device_path(device)); + return -EAGAIN; + } + + fd = open(device_path(device), flags); + if (fd < 0) + return -errno; + + if (device_locked_verify(cd, fd, device->lh)) { + /* fd doesn't correspond to a locked resource */ + close(fd); + log_dbg(cd, "Failed to verify lock resource for device %s.", device_path(device)); + return -EINVAL; + } + + return fd; +} + +/* + * Common wrapper for device sync. + */ +void device_sync(struct crypt_device *cd, struct device *device) +{ + if (!device || device->dev_fd < 0) + return; + + if (fsync(device->dev_fd) == -1) + log_dbg(cd, "Cannot sync device %s.", device_path(device)); +} + +/* + * in non-locked mode returns always fd or -1 + * + * in locked mode: + * opened fd or one of: + * -EAGAIN : requested write mode while device being locked in via shared lock + * -EINVAL : invalid lock fd state + * -1 : all other errors + */ +static int device_open_internal(struct crypt_device *cd, struct device *device, int flags) +{ + int access, devfd; + + if (device->o_direct) + flags |= O_DIRECT; + + access = flags & O_ACCMODE; + if (access == O_WRONLY) + access = O_RDWR; + + if (access == O_RDONLY && device->ro_dev_fd >= 0) { + log_dbg(cd, "Reusing open r%c fd on device %s", 'o', device_path(device)); + return device->ro_dev_fd; + } else if (access == O_RDWR && device->dev_fd >= 0) { + log_dbg(cd, "Reusing open r%c fd on device %s", 'w', device_path(device)); + return device->dev_fd; + } + + if (device_locked(device->lh)) + devfd = _open_locked(cd, device, flags); + else + devfd = open(device_path(device), flags); + + if (devfd < 0) { + log_dbg(cd, "Cannot open device %s%s.", + device_path(device), + access != O_RDONLY ? " for write" : ""); + return devfd; + } + + if (access == O_RDONLY) + device->ro_dev_fd = devfd; + else + device->dev_fd = devfd; + + return devfd; +} + +int device_open(struct crypt_device *cd, struct device *device, int flags) +{ + if (!device) + return -EINVAL; + + assert(!device_locked(device->lh)); + return device_open_internal(cd, device, flags); +} + +int device_open_excl(struct crypt_device *cd, struct device *device, int flags) +{ + const char *path; + struct stat st; + + if (!device) + return -EINVAL; + + assert(!device_locked(device->lh)); + + if (device->dev_fd_excl < 0) { + path = device_path(device); + if (stat(path, &st)) + return -EINVAL; + if (!S_ISBLK(st.st_mode)) + log_dbg(cd, "%s is not a block device. Can't open in exclusive mode.", + path); + else { + /* open(2) with O_EXCL (w/o O_CREAT) on regular file is undefined behaviour according to man page */ + /* coverity[toctou] */ + device->dev_fd_excl = open(path, O_RDONLY | O_EXCL); + if (device->dev_fd_excl < 0) + return errno == EBUSY ? -EBUSY : device->dev_fd_excl; + if (fstat(device->dev_fd_excl, &st) || !S_ISBLK(st.st_mode)) { + log_dbg(cd, "%s is not a block device. Can't open in exclusive mode.", + path); + close(device->dev_fd_excl); + device->dev_fd_excl = -1; + } else + log_dbg(cd, "Device %s is blocked for exclusive open.", path); + } + } + + return device_open_internal(cd, device, flags); +} + +void device_release_excl(struct crypt_device *cd, struct device *device) +{ + if (device && device->dev_fd_excl >= 0) { + if (close(device->dev_fd_excl)) + log_dbg(cd, "Failed to release exclusive handle on device %s.", + device_path(device)); + else + log_dbg(cd, "Closed exclusive fd for %s.", device_path(device)); + device->dev_fd_excl = -1; + } +} + +int device_open_locked(struct crypt_device *cd, struct device *device, int flags) +{ + if (!device) + return -EINVAL; + + assert(!crypt_metadata_locking_enabled() || device_locked(device->lh)); + return device_open_internal(cd, device, flags); +} + +/* Avoid any read from device, expects direct-io to work. */ +int device_alloc_no_check(struct device **device, const char *path) +{ + struct device *dev; + + if (!path) { + *device = NULL; + return 0; + } + + dev = malloc(sizeof(struct device)); + if (!dev) + return -ENOMEM; + + memset(dev, 0, sizeof(struct device)); + dev->path = strdup(path); + if (!dev->path) { + free(dev); + return -ENOMEM; + } + dev->loop_fd = -1; + dev->ro_dev_fd = -1; + dev->dev_fd = -1; + dev->dev_fd_excl = -1; + dev->o_direct = 1; + + *device = dev; + return 0; +} + +int device_alloc(struct crypt_device *cd, struct device **device, const char *path) +{ + struct device *dev; + int r; + + r = device_alloc_no_check(&dev, path); + if (r < 0) + return r; + + if (dev) { + r = device_ready(cd, dev); + if (!r) { + dev->init_done = 1; + } else if (r == -ENOTBLK) { + /* alloc loop later */ + } else if (r < 0) { + free(dev->path); + free(dev); + return -ENOTBLK; + } + } + + *device = dev; + return 0; +} + +void device_free(struct crypt_device *cd, struct device *device) +{ + if (!device) + return; + + device_close(cd, device); + + if (device->dev_fd_excl != -1) { + log_dbg(cd, "Closed exclusive fd for %s.", device_path(device)); + close(device->dev_fd_excl); + } + + if (device->loop_fd != -1) { + log_dbg(cd, "Closed loop %s (%s).", device->path, device->file_path); + close(device->loop_fd); + } + + assert(!device_locked(device->lh)); + + free(device->file_path); + free(device->path); + free(device); +} + +/* Get block device path */ +const char *device_block_path(const struct device *device) +{ + if (!device || !device->init_done) + return NULL; + + return device->path; +} + +/* Get device-mapper name of device (if possible) */ +const char *device_dm_name(const struct device *device) +{ + const char *dmdir = dm_get_dir(); + size_t dmdir_len = strlen(dmdir); + + if (!device || !device->init_done) + return NULL; + + if (strncmp(device->path, dmdir, dmdir_len)) + return NULL; + + return &device->path[dmdir_len+1]; +} + +/* Get path to device / file */ +const char *device_path(const struct device *device) +{ + if (!device) + return NULL; + + if (device->file_path) + return device->file_path; + + return device->path; +} + +/* block device topology ioctls, introduced in 2.6.32 */ +#ifndef BLKIOMIN +#define BLKIOMIN _IO(0x12,120) +#define BLKIOOPT _IO(0x12,121) +#define BLKALIGNOFF _IO(0x12,122) +#endif + +void device_topology_alignment(struct crypt_device *cd, + struct device *device, + unsigned long *required_alignment, /* bytes */ + unsigned long *alignment_offset, /* bytes */ + unsigned long default_alignment) +{ + int dev_alignment_offset = 0; + unsigned int min_io_size = 0, opt_io_size = 0; + unsigned long temp_alignment = 0; + int fd; + + *required_alignment = default_alignment; + *alignment_offset = 0; + + if (!device || !device->path) //FIXME + return; + + fd = open(device->path, O_RDONLY); + if (fd == -1) + return; + + /* minimum io size */ + if (ioctl(fd, BLKIOMIN, &min_io_size) == -1) { + log_dbg(cd, "Topology info for %s not supported, using default offset %lu bytes.", + device->path, default_alignment); + goto out; + } + + /* optimal io size */ + if (ioctl(fd, BLKIOOPT, &opt_io_size) == -1) + opt_io_size = min_io_size; + + /* alignment offset, bogus -1 means misaligned/unknown */ + if (ioctl(fd, BLKALIGNOFF, &dev_alignment_offset) == -1 || dev_alignment_offset < 0) + dev_alignment_offset = 0; + *alignment_offset = (unsigned long)dev_alignment_offset; + + temp_alignment = (unsigned long)min_io_size; + + /* + * Ignore bogus opt-io that could break alignment. + * Also real opt_io_size should be aligned to minimal page size (4k). + * Some bogus USB enclosures reports wrong data here. + */ + if ((temp_alignment < (unsigned long)opt_io_size) && + !((unsigned long)opt_io_size % temp_alignment) && !MISALIGNED_4K(opt_io_size)) + temp_alignment = (unsigned long)opt_io_size; + else if (opt_io_size && (opt_io_size != min_io_size)) + log_err(cd, _("Ignoring bogus optimal-io size for data device (%u bytes)."), opt_io_size); + + /* If calculated alignment is multiple of default, keep default */ + if (temp_alignment && (default_alignment % temp_alignment)) + *required_alignment = temp_alignment; + + log_dbg(cd, "Topology: IO (%u/%u), offset = %lu; Required alignment is %lu bytes.", + min_io_size, opt_io_size, *alignment_offset, *required_alignment); +out: + (void)close(fd); +} + +size_t device_block_size(struct crypt_device *cd, struct device *device) +{ + int fd; + + if (!device) + return 0; + + if (device->block_size) + return device->block_size; + + fd = open(device->file_path ?: device->path, O_RDONLY); + if (fd >= 0) { + device->block_size = device_block_size_fd(fd, NULL); + close(fd); + } + + if (!device->block_size) + log_dbg(cd, "Cannot get block size for device %s.", device_path(device)); + + return device->block_size; +} + +int device_read_ahead(struct device *device, uint32_t *read_ahead) +{ + int fd, r = 0; + long read_ahead_long; + + if (!device) + return 0; + + if ((fd = open(device->path, O_RDONLY)) < 0) + return 0; + + r = ioctl(fd, BLKRAGET, &read_ahead_long) ? 0 : 1; + close(fd); + + if (r) + *read_ahead = (uint32_t) read_ahead_long; + + return r; +} + +/* Get data size in bytes */ +int device_size(struct device *device, uint64_t *size) +{ + struct stat st; + int devfd, r = -EINVAL; + + if (!device) + return -EINVAL; + + devfd = open(device->path, O_RDONLY); + if (devfd == -1) + return -EINVAL; + + if (fstat(devfd, &st) < 0) + goto out; + + if (S_ISREG(st.st_mode)) { + *size = (uint64_t)st.st_size; + r = 0; + } else if (ioctl(devfd, BLKGETSIZE64, size) >= 0) + r = 0; +out: + close(devfd); + return r; +} + +/* For a file, allocate the required space */ +int device_fallocate(struct device *device, uint64_t size) +{ + struct stat st; + int devfd, r = -EINVAL; + + if (!device) + return -EINVAL; + + devfd = open(device_path(device), O_RDWR); + if (devfd == -1) + return -EINVAL; + + if (!fstat(devfd, &st) && S_ISREG(st.st_mode) && + ((uint64_t)st.st_size >= size || !posix_fallocate(devfd, 0, size))) { + r = 0; + if (device->file_path && crypt_loop_resize(device->path)) + r = -EINVAL; + } + + close(devfd); + return r; +} + +int device_check_size(struct crypt_device *cd, + struct device *device, + uint64_t req_offset, int falloc) +{ + uint64_t dev_size; + + if (device_size(device, &dev_size)) { + log_dbg(cd, "Cannot get device size for device %s.", device_path(device)); + return -EIO; + } + + log_dbg(cd, "Device size %" PRIu64 ", offset %" PRIu64 ".", dev_size, req_offset); + + if (req_offset > dev_size) { + /* If it is header file, increase its size */ + if (falloc && !device_fallocate(device, req_offset)) + return 0; + + log_err(cd, _("Device %s is too small. Need at least %" PRIu64 " bytes."), + device_path(device), req_offset); + return -EINVAL; + } + + return 0; +} + +static int device_info(struct crypt_device *cd, + struct device *device, + enum devcheck device_check, + int *readonly, uint64_t *size) +{ + struct stat st; + int fd = -1, r, flags = 0, real_readonly; + uint64_t real_size; + + if (!device) + return -ENOTBLK; + + real_readonly = 0; + real_size = 0; + + if (stat(device->path, &st) < 0) { + r = -EINVAL; + goto out; + } + + /* never wipe header on mounted device */ + if (device_check == DEV_EXCL && S_ISBLK(st.st_mode)) + flags |= O_EXCL; + + /* Try to open read-write to check whether it is a read-only device */ + /* coverity[toctou] */ + fd = open(device->path, O_RDWR | flags); + if (fd == -1 && errno == EROFS) { + real_readonly = 1; + fd = open(device->path, O_RDONLY | flags); + } + + if (fd == -1 && device_check == DEV_EXCL && errno == EBUSY) { + r = -EBUSY; + goto out; + } + + if (fd == -1) { + r = errno ? -errno : -EINVAL; + goto out; + } + + r = 0; + if (S_ISREG(st.st_mode)) { + //FIXME: add readonly check + real_size = (uint64_t)st.st_size; + real_size >>= SECTOR_SHIFT; + } else { + /* If the device can be opened read-write, i.e. readonly is still 0, then + * check whether BKROGET says that it is read-only. E.g. read-only loop + * devices may be opened read-write but are read-only according to BLKROGET + */ + if (real_readonly == 0 && (r = ioctl(fd, BLKROGET, &real_readonly)) < 0) + goto out; + + r = ioctl(fd, BLKGETSIZE64, &real_size); + if (r >= 0) { + real_size >>= SECTOR_SHIFT; + goto out; + } + } +out: + if (fd != -1) + close(fd); + + switch (r) { + case 0: + if (readonly) + *readonly = real_readonly; + if (size) + *size = real_size; + break; + case -EBUSY: + log_err(cd, _("Cannot use device %s which is in use " + "(already mapped or mounted)."), device_path(device)); + break; + case -EACCES: + log_err(cd, _("Cannot use device %s, permission denied."), device_path(device)); + break; + default: + log_err(cd, _("Cannot get info about device %s."), device_path(device)); + r = -EINVAL; + } + + return r; +} + +int device_check_access(struct crypt_device *cd, + struct device *device, + enum devcheck device_check) +{ + return device_info(cd, device, device_check, NULL, NULL); +} + +static int device_internal_prepare(struct crypt_device *cd, struct device *device) +{ + char *loop_device = NULL, *file_path = NULL; + int r, loop_fd, readonly = 0; + + if (device->init_done) + return 0; + + if (getuid() || geteuid()) { + log_err(cd, _("Cannot use a loopback device, " + "running as non-root user.")); + return -ENOTSUP; + } + + log_dbg(cd, "Allocating a free loop device."); + + /* Keep the loop open, detached on last close. */ + loop_fd = crypt_loop_attach(&loop_device, device->path, 0, 1, &readonly); + if (loop_fd == -1) { + log_err(cd, _("Attaching loopback device failed " + "(loop device with autoclear flag is required).")); + free(loop_device); + return -EINVAL; + } + + file_path = device->path; + device->path = loop_device; + + r = device_ready(cd, device); + if (r < 0) { + device->path = file_path; + crypt_loop_detach(loop_device); + free(loop_device); + return r; + } + + device->loop_fd = loop_fd; + device->file_path = file_path; + device->init_done = 1; + + return 0; +} + +int device_block_adjust(struct crypt_device *cd, + struct device *device, + enum devcheck device_check, + uint64_t device_offset, + uint64_t *size, + uint32_t *flags) +{ + int r, real_readonly; + uint64_t real_size; + + if (!device) + return -ENOTBLK; + + r = device_internal_prepare(cd, device); + if (r) + return r; + + r = device_info(cd, device, device_check, &real_readonly, &real_size); + if (r) + return r; + + if (device_offset >= real_size) { + log_err(cd, _("Requested offset is beyond real size of device %s."), + device_path(device)); + return -EINVAL; + } + + if (size && !*size) { + *size = real_size; + if (!*size) { + log_err(cd, _("Device %s has zero size."), device_path(device)); + return -ENOTBLK; + } + *size -= device_offset; + } + + /* in case of size is set by parameter */ + if (size && ((real_size - device_offset) < *size)) { + log_dbg(cd, "Device %s: offset = %" PRIu64 " requested size = %" PRIu64 + ", backing device size = %" PRIu64, + device->path, device_offset, *size, real_size); + log_err(cd, _("Device %s is too small."), device_path(device)); + return -EINVAL; + } + + if (flags && real_readonly) + *flags |= CRYPT_ACTIVATE_READONLY; + + if (size) + log_dbg(cd, "Calculated device size is %" PRIu64" sectors (%s), offset %" PRIu64 ".", + *size, real_readonly ? "RO" : "RW", device_offset); + return 0; +} + +size_t size_round_up(size_t size, size_t block) +{ + size_t s = (size + (block - 1)) / block; + return s * block; +} + +void device_disable_direct_io(struct device *device) +{ + if (device) + device->o_direct = 0; +} + +int device_direct_io(const struct device *device) +{ + return device ? device->o_direct : 0; +} + +static int device_compare_path(const char *path1, const char *path2) +{ + struct stat st_path1, st_path2; + + if (stat(path1, &st_path1 ) < 0 || stat(path2, &st_path2 ) < 0) + return -EINVAL; + + if (S_ISBLK(st_path1.st_mode) && S_ISBLK(st_path2.st_mode)) + return (st_path1.st_rdev == st_path2.st_rdev) ? 1 : 0; + + if (S_ISREG(st_path1.st_mode) && S_ISREG(st_path2.st_mode)) + return (st_path1.st_ino == st_path2.st_ino && + st_path1.st_dev == st_path2.st_dev) ? 1 : 0; + + return 0; +} + +int device_is_identical(struct device *device1, struct device *device2) +{ + if (!device1 || !device2) + return 0; + + if (device1 == device2) + return 1; + + if (!strcmp(device_path(device1), device_path(device2))) + return 1; + + return device_compare_path(device_path(device1), device_path(device2)); +} + +int device_is_rotational(struct device *device) +{ + struct stat st; + + if (!device) + return -EINVAL; + + if (stat(device_path(device), &st) < 0) + return -EINVAL; + + if (!S_ISBLK(st.st_mode)) + return 0; + + return crypt_dev_is_rotational(major(st.st_rdev), minor(st.st_rdev)); +} + +size_t device_alignment(struct device *device) +{ + int devfd; + + if (!device) + return -EINVAL; + + if (!device->alignment) { + devfd = open(device_path(device), O_RDONLY); + if (devfd != -1) { + device->alignment = device_alignment_fd(devfd); + close(devfd); + } + } + + return device->alignment; +} + +void device_set_lock_handle(struct device *device, struct crypt_lock_handle *h) +{ + if (device) + device->lh = h; +} + +struct crypt_lock_handle *device_get_lock_handle(struct device *device) +{ + return device ? device->lh : NULL; +} + +int device_read_lock(struct crypt_device *cd, struct device *device) +{ + if (!device || !crypt_metadata_locking_enabled()) + return 0; + + if (device_read_lock_internal(cd, device)) + return -EBUSY; + + return 0; +} + +int device_write_lock(struct crypt_device *cd, struct device *device) +{ + if (!device || !crypt_metadata_locking_enabled()) + return 0; + + assert(!device_locked(device->lh) || !device_locked_readonly(device->lh)); + + return device_write_lock_internal(cd, device); +} + +void device_read_unlock(struct crypt_device *cd, struct device *device) +{ + if (!device || !crypt_metadata_locking_enabled()) + return; + + assert(device_locked(device->lh)); + + device_unlock_internal(cd, device); +} + +void device_write_unlock(struct crypt_device *cd, struct device *device) +{ + if (!device || !crypt_metadata_locking_enabled()) + return; + + assert(device_locked(device->lh) && !device_locked_readonly(device->lh)); + + device_unlock_internal(cd, device); +} + +bool device_is_locked(struct device *device) +{ + return device ? device_locked(device->lh) : 0; +} + +void device_close(struct crypt_device *cd, struct device *device) +{ + if (!device) + return; + + if (device->ro_dev_fd != -1) { + log_dbg(cd, "Closing read only fd for %s.", device_path(device)); + if (close(device->ro_dev_fd)) + log_dbg(cd, "Failed to close read only fd for %s.", device_path(device)); + device->ro_dev_fd = -1; + } + + if (device->dev_fd != -1) { + log_dbg(cd, "Closing read write fd for %s.", device_path(device)); + if (close(device->dev_fd)) + log_dbg(cd, "Failed to close read write fd for %s.", device_path(device)); + device->dev_fd = -1; + } +} diff --git a/lib/utils_device_locking.c b/lib/utils_device_locking.c new file mode 100644 index 0000000..36e6496 --- /dev/null +++ b/lib/utils_device_locking.c @@ -0,0 +1,521 @@ +/* + * Metadata on-disk locking for processes serialization + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef HAVE_SYS_SYSMACROS_H +# include /* for major, minor */ +#endif +#include +#include + +#include "internal.h" +#include "utils_device_locking.h" + +#define same_inode(buf1, buf2) \ + ((buf1).st_ino == (buf2).st_ino && \ + (buf1).st_dev == (buf2).st_dev) + +enum lock_type { + DEV_LOCK_READ = 0, + DEV_LOCK_WRITE +}; + +enum lock_mode { + DEV_LOCK_FILE = 0, + DEV_LOCK_BDEV, + DEV_LOCK_NAME +}; + +struct crypt_lock_handle { + unsigned refcnt; + int flock_fd; + enum lock_type type; + enum lock_mode mode; + union { + struct { + dev_t devno; + } bdev; + struct { + char *name; + } name; + } u; +}; + +static int resource_by_name(char *res, size_t res_size, const char *name, bool fullpath) +{ + int r; + + if (fullpath) + r = snprintf(res, res_size, "%s/LN_%s", DEFAULT_LUKS2_LOCK_PATH, name); + else + r = snprintf(res, res_size, "LN_%s", name); + + return (r < 0 || (size_t)r >= res_size) ? -EINVAL : 0; +} + +static int resource_by_devno(char *res, size_t res_size, dev_t devno, unsigned fullpath) +{ + int r; + + if (fullpath) + r = snprintf(res, res_size, "%s/L_%d:%d", DEFAULT_LUKS2_LOCK_PATH, major(devno), minor(devno)); + else + r = snprintf(res, res_size, "L_%d:%d", major(devno), minor(devno)); + + return (r < 0 || (size_t)r >= res_size) ? -EINVAL : 0; +} + +static int open_lock_dir(struct crypt_device *cd, const char *dir, const char *base) +{ + int dirfd, lockdfd; + + dirfd = open(dir, O_RDONLY | O_DIRECTORY | O_CLOEXEC); + if (dirfd < 0) { + log_dbg(cd, "Failed to open directory %s: (%d: %s).", dir, errno, strerror(errno)); + if (errno == ENOTDIR || errno == ENOENT) + log_err(cd, _("Locking aborted. The locking path %s/%s is unusable (not a directory or missing)."), dir, base); + return -EINVAL; + } + + lockdfd = openat(dirfd, base, O_RDONLY | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); + if (lockdfd < 0) { + if (errno == ENOENT) { + log_dbg(cd, _("Locking directory %s/%s will be created with default compiled-in permissions."), dir, base); + + /* success or failure w/ errno == EEXIST either way just try to open the 'base' directory again */ + if (mkdirat(dirfd, base, DEFAULT_LUKS2_LOCK_DIR_PERMS) && errno != EEXIST) + log_dbg(cd, "Failed to create directory %s in %s (%d: %s).", base, dir, errno, strerror(errno)); + else + lockdfd = openat(dirfd, base, O_RDONLY | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC); + } else { + log_dbg(cd, "Failed to open directory %s/%s: (%d: %s)", dir, base, errno, strerror(errno)); + if (errno == ENOTDIR || errno == ELOOP) + log_err(cd, _("Locking aborted. The locking path %s/%s is unusable (%s is not a directory)."), dir, base, base); + } + } + + close(dirfd); + return lockdfd >= 0 ? lockdfd : -EINVAL; +} + +static int open_resource(struct crypt_device *cd, const char *res) +{ + int err, lockdir_fd, r; + char dir[] = DEFAULT_LUKS2_LOCK_PATH, + base[] = DEFAULT_LUKS2_LOCK_PATH; + + lockdir_fd = open_lock_dir(cd, dirname(dir), basename(base)); + if (lockdir_fd < 0) + return -EINVAL; + + log_dbg(cd, "Opening lock resource file %s/%s", DEFAULT_LUKS2_LOCK_PATH, res); + r = openat(lockdir_fd, res, O_CREAT | O_NOFOLLOW | O_RDWR | O_CLOEXEC, 0777); + err = errno; + + close(lockdir_fd); + + return r < 0 ? -err : r; +} + +static int acquire_lock_handle(struct crypt_device *cd, struct device *device, struct crypt_lock_handle *h) +{ + char res[PATH_MAX]; + int dev_fd, fd; + struct stat st; + + dev_fd = open(device_path(device), O_RDONLY | O_NONBLOCK | O_CLOEXEC); + if (dev_fd < 0) + return -EINVAL; + + if (fstat(dev_fd, &st)) { + close(dev_fd); + return -EINVAL; + } + + if (S_ISBLK(st.st_mode)) { + if (resource_by_devno(res, sizeof(res), st.st_rdev, 0)) { + close(dev_fd); + return -EINVAL; + } + + fd = open_resource(cd, res); + close(dev_fd); + if (fd < 0) + return fd; + + h->flock_fd = fd; + h->u.bdev.devno = st.st_rdev; + h->mode = DEV_LOCK_BDEV; + } else if (S_ISREG(st.st_mode)) { + // FIXME: workaround for nfsv4 + fd = open(device_path(device), O_RDWR | O_NONBLOCK | O_CLOEXEC); + if (fd < 0) + h->flock_fd = dev_fd; + else { + h->flock_fd = fd; + close(dev_fd); + } + h->mode = DEV_LOCK_FILE; + } else { + /* Wrong device type */ + close(dev_fd); + return -EINVAL; + } + + return 0; +} + +static int acquire_lock_handle_by_name(struct crypt_device *cd, const char *name, struct crypt_lock_handle *h) +{ + char res[PATH_MAX]; + int fd; + + h->u.name.name = strdup(name); + if (!h->u.name.name) + return -ENOMEM; + + if (resource_by_name(res, sizeof(res), name, false)) { + free(h->u.name.name); + return -EINVAL; + } + + fd = open_resource(cd, res); + if (fd < 0) { + free(h->u.name.name); + return fd; + } + + h->flock_fd = fd; + h->mode = DEV_LOCK_NAME; + + return 0; +} + +static void release_lock_handle(struct crypt_device *cd, struct crypt_lock_handle *h) +{ + char res[PATH_MAX]; + struct stat buf_a, buf_b; + + if ((h->mode == DEV_LOCK_NAME) && /* was it name lock */ + !flock(h->flock_fd, LOCK_EX | LOCK_NB) && /* lock to drop the file */ + !resource_by_name(res, sizeof(res), h->u.name.name, true) && /* acquire lock resource name */ + !fstat(h->flock_fd, &buf_a) && /* read inode id referred by fd */ + !stat(res, &buf_b) && /* does path file still exist? */ + same_inode(buf_a, buf_b)) { /* is it same id as the one referenced by fd? */ + /* coverity[toctou] */ + if (unlink(res)) /* yes? unlink the file */ + log_dbg(cd, "Failed to unlink resource file: %s", res); + } + + if ((h->mode == DEV_LOCK_BDEV) && /* was it block device */ + !flock(h->flock_fd, LOCK_EX | LOCK_NB) && /* lock to drop the file */ + !resource_by_devno(res, sizeof(res), h->u.bdev.devno, 1) && /* acquire lock resource name */ + !fstat(h->flock_fd, &buf_a) && /* read inode id referred by fd */ + !stat(res, &buf_b) && /* does path file still exist? */ + same_inode(buf_a, buf_b)) { /* is it same id as the one referenced by fd? */ + /* coverity[toctou] */ + if (unlink(res)) /* yes? unlink the file */ + log_dbg(cd, "Failed to unlink resource file: %s", res); + } + + if (h->mode == DEV_LOCK_NAME) + free(h->u.name.name); + + if (close(h->flock_fd)) + log_dbg(cd, "Failed to close lock resource fd (%d).", h->flock_fd); +} + +int device_locked(struct crypt_lock_handle *h) +{ + return (h && (h->type == DEV_LOCK_READ || h->type == DEV_LOCK_WRITE)); +} + +int device_locked_readonly(struct crypt_lock_handle *h) +{ + return (h && h->type == DEV_LOCK_READ); +} + +static int verify_lock_handle(const char *device_path, struct crypt_lock_handle *h) +{ + char res[PATH_MAX]; + struct stat lck_st, res_st; + + /* we locked a regular file, check during device_open() instead. No reason to check now */ + if (h->mode == DEV_LOCK_FILE) + return 0; + + if (h->mode == DEV_LOCK_NAME) { + if (resource_by_name(res, sizeof(res), h->u.name.name, true)) + return -EINVAL; + } else if (h->mode == DEV_LOCK_BDEV) { + if (resource_by_devno(res, sizeof(res), h->u.bdev.devno, true)) + return -EINVAL; + } else + return -EINVAL; + + if (fstat(h->flock_fd, &lck_st)) + return -EINVAL; + + return (stat(res, &res_st) || !same_inode(lck_st, res_st)) ? -EAGAIN : 0; +} + +static unsigned device_lock_inc(struct crypt_lock_handle *h) +{ + return ++h->refcnt; +} + +static unsigned device_lock_dec(struct crypt_lock_handle *h) +{ + assert(h->refcnt); + + return --h->refcnt; +} + +static int acquire_and_verify(struct crypt_device *cd, struct device *device, const char *resource, int flock_op, struct crypt_lock_handle **lock) +{ + int r; + struct crypt_lock_handle *h; + + if (device && resource) + return -EINVAL; + + if (!(h = malloc(sizeof(*h)))) + return -ENOMEM; + + do { + r = device ? acquire_lock_handle(cd, device, h) : acquire_lock_handle_by_name(cd, resource, h); + if (r < 0) + break; + + if (flock(h->flock_fd, flock_op)) { + log_dbg(cd, "Flock on fd %d failed with errno %d.", h->flock_fd, errno); + r = (errno == EWOULDBLOCK) ? -EBUSY : -EINVAL; + release_lock_handle(cd, h); + break; + } + + log_dbg(cd, "Verifying lock handle for %s.", device ? device_path(device) : resource); + + /* + * check whether another libcryptsetup process removed resource file before this + * one managed to flock() it. See release_lock_handle() for details + */ + r = verify_lock_handle(device_path(device), h); + if (r < 0) { + if (flock(h->flock_fd, LOCK_UN)) + log_dbg(cd, "flock on fd %d failed.", h->flock_fd); + release_lock_handle(cd, h); + log_dbg(cd, "Lock handle verification failed."); + } + } while (r == -EAGAIN); + + if (r < 0) { + free(h); + return r; + } + + *lock = h; + + return 0; +} + +int device_read_lock_internal(struct crypt_device *cd, struct device *device) +{ + int r; + struct crypt_lock_handle *h; + + if (!device) + return -EINVAL; + + h = device_get_lock_handle(device); + + if (device_locked(h)) { + device_lock_inc(h); + log_dbg(cd, "Device %s READ lock (or higher) already held.", device_path(device)); + return 0; + } + + log_dbg(cd, "Acquiring read lock for device %s.", device_path(device)); + + r = acquire_and_verify(cd, device, NULL, LOCK_SH, &h); + if (r < 0) + return r; + + h->type = DEV_LOCK_READ; + h->refcnt = 1; + device_set_lock_handle(device, h); + + log_dbg(cd, "Device %s READ lock taken.", device_path(device)); + + return 0; +} + +int device_write_lock_internal(struct crypt_device *cd, struct device *device) +{ + int r; + struct crypt_lock_handle *h; + + if (!device) + return -EINVAL; + + h = device_get_lock_handle(device); + + if (device_locked(h)) { + log_dbg(cd, "Device %s WRITE lock already held.", device_path(device)); + return device_lock_inc(h); + } + + log_dbg(cd, "Acquiring write lock for device %s.", device_path(device)); + + r = acquire_and_verify(cd, device, NULL, LOCK_EX, &h); + if (r < 0) + return r; + + h->type = DEV_LOCK_WRITE; + h->refcnt = 1; + device_set_lock_handle(device, h); + + log_dbg(cd, "Device %s WRITE lock taken.", device_path(device)); + + return 1; +} + +int crypt_read_lock(struct crypt_device *cd, const char *resource, bool blocking, struct crypt_lock_handle **lock) +{ + int r; + struct crypt_lock_handle *h; + + if (!resource) + return -EINVAL; + + log_dbg(cd, "Acquiring %sblocking read lock for resource %s.", blocking ? "" : "non", resource); + + r = acquire_and_verify(cd, NULL, resource, LOCK_SH | (blocking ? 0 : LOCK_NB), &h); + if (r < 0) + return r; + + h->type = DEV_LOCK_READ; + h->refcnt = 1; + + log_dbg(cd, "READ lock for resource %s taken.", resource); + + *lock = h; + + return 0; +} + +int crypt_write_lock(struct crypt_device *cd, const char *resource, bool blocking, struct crypt_lock_handle **lock) +{ + int r; + struct crypt_lock_handle *h; + + if (!resource) + return -EINVAL; + + log_dbg(cd, "Acquiring %sblocking write lock for resource %s.", blocking ? "" : "non", resource); + + r = acquire_and_verify(cd, NULL, resource, LOCK_EX | (blocking ? 0 : LOCK_NB), &h); + if (r < 0) + return r; + + h->type = DEV_LOCK_WRITE; + h->refcnt = 1; + + log_dbg(cd, "WRITE lock for resource %s taken.", resource); + + *lock = h; + + return 0; +} + +static void unlock_internal(struct crypt_device *cd, struct crypt_lock_handle *h) +{ + if (flock(h->flock_fd, LOCK_UN)) + log_dbg(cd, "flock on fd %d failed.", h->flock_fd); + release_lock_handle(cd, h); + free(h); +} + +void crypt_unlock_internal(struct crypt_device *cd, struct crypt_lock_handle *h) +{ + if (!h) + return; + + /* nested locks are illegal */ + assert(!device_lock_dec(h)); + + log_dbg(cd, "Unlocking %s lock for resource %s.", + device_locked_readonly(h) ? "READ" : "WRITE", h->u.name.name); + + unlock_internal(cd, h); +} + +void device_unlock_internal(struct crypt_device *cd, struct device *device) +{ + bool readonly; + struct crypt_lock_handle *h = device_get_lock_handle(device); + unsigned u = device_lock_dec(h); + + if (u) + return; + + readonly = device_locked_readonly(h); + + unlock_internal(cd, h); + + log_dbg(cd, "Device %s %s lock released.", device_path(device), + readonly ? "READ" : "WRITE"); + + device_set_lock_handle(device, NULL); +} + +int device_locked_verify(struct crypt_device *cd, int dev_fd, struct crypt_lock_handle *h) +{ + char res[PATH_MAX]; + struct stat dev_st, lck_st, st; + + if (fstat(dev_fd, &dev_st) || fstat(h->flock_fd, &lck_st)) + return 1; + + /* if device handle is regular file the handle must match the lock handle */ + if (S_ISREG(dev_st.st_mode)) { + log_dbg(cd, "Veryfing locked device handle (regular file)"); + if (!same_inode(dev_st, lck_st)) + return 1; + } else if (S_ISBLK(dev_st.st_mode)) { + log_dbg(cd, "Veryfing locked device handle (bdev)"); + if (resource_by_devno(res, sizeof(res), dev_st.st_rdev, 1) || + stat(res, &st) || + !same_inode(lck_st, st)) + return 1; + } else + return 1; + + return 0; +} diff --git a/lib/utils_device_locking.h b/lib/utils_device_locking.h new file mode 100644 index 0000000..d3b55a0 --- /dev/null +++ b/lib/utils_device_locking.h @@ -0,0 +1,49 @@ +/* + * Metadata on-disk locking for processes serialization + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_UTILS_LOCKING_H +#define _CRYPTSETUP_UTILS_LOCKING_H + +#include + +struct crypt_device; +struct crypt_lock_handle; +struct device; + +int device_locked_readonly(struct crypt_lock_handle *h); +int device_locked(struct crypt_lock_handle *h); + +int device_read_lock_internal(struct crypt_device *cd, struct device *device); +int device_write_lock_internal(struct crypt_device *cd, struct device *device); +void device_unlock_internal(struct crypt_device *cd, struct device *device); + +int device_locked_verify(struct crypt_device *cd, int fd, struct crypt_lock_handle *h); + +int crypt_read_lock(struct crypt_device *cd, const char *name, bool blocking, struct crypt_lock_handle **lock); +int crypt_write_lock(struct crypt_device *cd, const char *name, bool blocking, struct crypt_lock_handle **lock); +void crypt_unlock_internal(struct crypt_device *cd, struct crypt_lock_handle *h); + + +/* Used only in device internal allocation */ +void device_set_lock_handle(struct device *device, struct crypt_lock_handle *h); +struct crypt_lock_handle *device_get_lock_handle(struct device *device); + +#endif diff --git a/lib/utils_devpath.c b/lib/utils_devpath.c new file mode 100644 index 0000000..44d7028 --- /dev/null +++ b/lib/utils_devpath.c @@ -0,0 +1,459 @@ +/* + * devname - search for device name + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef HAVE_SYS_SYSMACROS_H +# include /* for major, minor */ +#endif +#include "internal.h" + +static char *__lookup_dev(char *path, dev_t dev, int dir_level, const int max_level) +{ + struct dirent *entry; + struct stat st; + char *ptr; + char *result = NULL; + DIR *dir; + int space; + + /* Ignore strange nested directories */ + if (dir_level > max_level) + return NULL; + + path[PATH_MAX - 1] = '\0'; + ptr = path + strlen(path); + *ptr++ = '/'; + *ptr = '\0'; + space = PATH_MAX - (ptr - path); + + dir = opendir(path); + if (!dir) + return NULL; + + while((entry = readdir(dir))) { + if (entry->d_name[0] == '.' || + !strncmp(entry->d_name, "..", 2)) + continue; + + if (dir_level == 0 && + (!strcmp(entry->d_name, "shm") || + !strcmp(entry->d_name, "fd") || + !strcmp(entry->d_name, "char") || + !strcmp(entry->d_name, "pts"))) + continue; + + strncpy(ptr, entry->d_name, space); + if (stat(path, &st) < 0) + continue; + + if (S_ISDIR(st.st_mode)) { + result = __lookup_dev(path, dev, dir_level + 1, max_level); + if (result) + break; + } else if (S_ISBLK(st.st_mode)) { + /* workaround: ignore dm-X devices, these are internal kernel names */ + if (dir_level == 0 && dm_is_dm_kernel_name(entry->d_name)) + continue; + if (st.st_rdev == dev) { + result = strdup(path); + break; + } + } + } + + closedir(dir); + return result; +} + +/* + * Non-udev systemd need to scan for device here. + */ +static char *lookup_dev_old(int major, int minor) +{ + dev_t dev; + char *result = NULL, buf[PATH_MAX + 1]; + + dev = makedev(major, minor); + strncpy(buf, "/dev", PATH_MAX); + buf[PATH_MAX] = '\0'; + + /* First try low level device */ + if ((result = __lookup_dev(buf, dev, 0, 0))) + return result; + + /* If it is dm, try DM dir */ + if (dm_is_dm_device(major)) { + strncpy(buf, dm_get_dir(), PATH_MAX); + if ((result = __lookup_dev(buf, dev, 0, 0))) + return result; + } + + strncpy(buf, "/dev", PATH_MAX); + return __lookup_dev(buf, dev, 0, 4); +} + +/* + * Returns string pointing to device in /dev according to "major:minor" dev_id + */ +char *crypt_lookup_dev(const char *dev_id) +{ + int major, minor; + char link[PATH_MAX], path[PATH_MAX], *devname, *devpath = NULL; + struct stat st; + ssize_t len; + + if (sscanf(dev_id, "%d:%d", &major, &minor) != 2) + return NULL; + + if (snprintf(path, sizeof(path), "/sys/dev/block/%s", dev_id) < 0) + return NULL; + + len = readlink(path, link, sizeof(link) - 1); + if (len < 0) { + /* Without /sys use old scan */ + if (stat("/sys/dev/block", &st) < 0) + return lookup_dev_old(major, minor); + return NULL; + } + + link[len] = '\0'; + devname = strrchr(link, '/'); + if (!devname) + return NULL; + devname++; + + if (dm_is_dm_kernel_name(devname)) + devpath = dm_device_path("/dev/mapper/", major, minor); + else if (snprintf(path, sizeof(path), "/dev/%s", devname) > 0) + devpath = strdup(path); + + /* + * Check that path is correct. + */ + if (devpath && ((stat(devpath, &st) < 0) || + !S_ISBLK(st.st_mode) || + (st.st_rdev != makedev(major, minor)))) { + free(devpath); + /* Should never happen unless user mangles with dev nodes. */ + return lookup_dev_old(major, minor); + } + + return devpath; +} + +static int _read_uint64(const char *sysfs_path, uint64_t *value) +{ + char tmp[64] = {0}; + int fd, r; + + if ((fd = open(sysfs_path, O_RDONLY)) < 0) + return 0; + r = read(fd, tmp, sizeof(tmp)); + close(fd); + + if (r <= 0) + return 0; + + if (sscanf(tmp, "%" PRIu64, value) != 1) + return 0; + + return 1; +} + +static int _sysfs_get_uint64(int major, int minor, uint64_t *value, const char *attr) +{ + char path[PATH_MAX]; + + if (snprintf(path, sizeof(path), "/sys/dev/block/%d:%d/%s", + major, minor, attr) < 0) + return 0; + + return _read_uint64(path, value); +} + +static int _path_get_uint64(const char *sysfs_path, uint64_t *value, const char *attr) +{ + char path[PATH_MAX]; + + if (snprintf(path, sizeof(path), "%s/%s", + sysfs_path, attr) < 0) + return 0; + + return _read_uint64(path, value); +} + +int crypt_dev_is_rotational(int major, int minor) +{ + uint64_t val; + + if (!_sysfs_get_uint64(major, minor, &val, "queue/rotational")) + return 1; /* if failed, expect rotational disk */ + + return val ? 1 : 0; +} + +int crypt_dev_is_partition(const char *dev_path) +{ + uint64_t val; + struct stat st; + + if (stat(dev_path, &st) < 0) + return 0; + + if (!S_ISBLK(st.st_mode)) + return 0; + + if (!_sysfs_get_uint64(major(st.st_rdev), minor(st.st_rdev), + &val, "partition")) + return 0; + + return val ? 1 : 0; +} + +uint64_t crypt_dev_partition_offset(const char *dev_path) +{ + uint64_t val; + struct stat st; + + if (!crypt_dev_is_partition(dev_path)) + return 0; + + if (stat(dev_path, &st) < 0) + return 0; + + if (!_sysfs_get_uint64(major(st.st_rdev), minor(st.st_rdev), + &val, "start")) + return 0; + + return val; +} + +/* Try to find partition which match offset and size on top level device */ +char *crypt_get_partition_device(const char *dev_path, uint64_t offset, uint64_t size) +{ + char link[PATH_MAX], path[PATH_MAX], part_path[PATH_MAX], *devname; + char *result = NULL; + struct stat st; + size_t devname_len; + ssize_t len; + struct dirent *entry; + DIR *dir; + uint64_t part_offset, part_size; + + if (stat(dev_path, &st) < 0) + return NULL; + + if (!S_ISBLK(st.st_mode)) + return NULL; + + if (snprintf(path, sizeof(path), "/sys/dev/block/%d:%d", + major(st.st_rdev), minor(st.st_rdev)) < 0) + return NULL; + + dir = opendir(path); + if (!dir) + return NULL; + + len = readlink(path, link, sizeof(link) - 1); + if (len < 0) { + closedir(dir); + return NULL; + } + + /* Get top level disk name for sysfs search */ + link[len] = '\0'; + devname = strrchr(link, '/'); + if (!devname) { + closedir(dir); + return NULL; + } + devname++; + + /* DM devices do not use kernel partitions. */ + if (dm_is_dm_kernel_name(devname)) { + closedir(dir); + return NULL; + } + + devname_len = strlen(devname); + while((entry = readdir(dir))) { + if (strncmp(entry->d_name, devname, devname_len)) + continue; + + if (snprintf(part_path, sizeof(part_path), "%s/%s", + path, entry->d_name) < 0) + continue; + + if (stat(part_path, &st) < 0) + continue; + + if (S_ISDIR(st.st_mode)) { + if (!_path_get_uint64(part_path, &part_offset, "start") || + !_path_get_uint64(part_path, &part_size, "size")) + continue; + if (part_offset == offset && part_size == size && + snprintf(part_path, sizeof(part_path), "/dev/%s", + entry->d_name) > 0) { + result = strdup(part_path); + break; + } + } + } + closedir(dir); + + return result; +} + +/* Try to find base device from partition */ +char *crypt_get_base_device(const char *dev_path) +{ + char link[PATH_MAX], path[PATH_MAX], part_path[PATH_MAX], *devname; + struct stat st; + ssize_t len; + + if (!crypt_dev_is_partition(dev_path)) + return NULL; + + if (stat(dev_path, &st) < 0) + return NULL; + + if (snprintf(path, sizeof(path), "/sys/dev/block/%d:%d", + major(st.st_rdev), minor(st.st_rdev)) < 0) + return NULL; + + len = readlink(path, link, sizeof(link) - 1); + if (len < 0) + return NULL; + + /* Get top level disk name for sysfs search */ + link[len] = '\0'; + devname = strrchr(link, '/'); + if (!devname) + return NULL; + *devname = '\0'; + devname = strrchr(link, '/'); + if (!devname) + return NULL; + devname++; + + if (dm_is_dm_kernel_name(devname)) + return NULL; + + if (snprintf(part_path, sizeof(part_path), "/dev/%s", devname) < 0) + return NULL; + + return strdup(part_path); +} + +int lookup_by_disk_id(const char *dm_uuid) +{ + struct dirent *entry; + struct stat st; + int r = 0; /* not found */ + DIR *dir = opendir("/dev/disk/by-id"); + + if (!dir) + /* map ENOTDIR to ENOENT we'll handle both errors same */ + return errno == ENOTDIR ? -ENOENT : -errno; + + while ((entry = readdir(dir))) { + if (entry->d_name[0] == '.' || + !strncmp(entry->d_name, "..", 2)) + continue; + + if (fstatat(dirfd(dir), entry->d_name, &st, AT_SYMLINK_NOFOLLOW)) { + r = -EINVAL; + break; + } + + if (!S_ISREG(st.st_mode) && !S_ISLNK(st.st_mode)) + continue; + + if (!strncmp(entry->d_name, dm_uuid, strlen(dm_uuid))) { + r = 1; + break; + } + } + + closedir(dir); + + return r; +} + +int lookup_by_sysfs_uuid_field(const char *dm_uuid, size_t max_len) +{ + struct dirent *entry; + char subpath[PATH_MAX], uuid[max_len]; + ssize_t s; + struct stat st; + int fd, len, r = 0; /* not found */ + DIR *dir = opendir("/sys/block/"); + + if (!dir) + /* map ENOTDIR to ENOENT we'll handle both errors same */ + return errno == ENOTDIR ? -ENOENT : -errno; + + while (r != 1 && (entry = readdir(dir))) { + if (entry->d_name[0] == '.' || + !strncmp(entry->d_name, "..", 2)) + continue; + + len = snprintf(subpath, PATH_MAX, "%s/%s", entry->d_name, "dm/uuid"); + if (len < 0 || len >= PATH_MAX) { + r = -EINVAL; + break; + } + + /* looking for dm-X/dm/uuid file, symlinks are fine */ + fd = openat(dirfd(dir), subpath, O_RDONLY | O_CLOEXEC); + if (fd < 0) + continue; + + if (fstat(fd, &st) || !S_ISREG(st.st_mode)) { + close(fd); + continue; + } + + /* reads binary data */ + s = read_buffer(fd, uuid, max_len - 1); + if (s > 0) { + uuid[s] = '\0'; + if (!strncmp(uuid, dm_uuid, strlen(dm_uuid))) + r = 1; + } + + close(fd); + } + + closedir(dir); + + return r; +} diff --git a/lib/utils_dm.h b/lib/utils_dm.h new file mode 100644 index 0000000..d5a2b43 --- /dev/null +++ b/lib/utils_dm.h @@ -0,0 +1,236 @@ +/* + * libdevmapper - device-mapper backend for cryptsetup + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_DM_H +#define _UTILS_DM_H + +/* device-mapper library helpers */ +#include +#include + +struct crypt_device; +struct volume_key; +struct crypt_params_verity; +struct device; +struct crypt_params_integrity; + +/* Device mapper internal flags */ +#define DM_RESUME_PRIVATE (1 << 4) /* CRYPT_ACTIVATE_PRIVATE */ +#define DM_SUSPEND_SKIP_LOCKFS (1 << 5) +#define DM_SUSPEND_WIPE_KEY (1 << 6) +#define DM_SUSPEND_NOFLUSH (1 << 7) + +static inline uint32_t act2dmflags(uint32_t act_flags) +{ + return (act_flags & DM_RESUME_PRIVATE); +} + +/* Device mapper backend - kernel support flags */ +#define DM_KEY_WIPE_SUPPORTED (1 << 0) /* key wipe message */ +#define DM_LMK_SUPPORTED (1 << 1) /* lmk mode */ +#define DM_SECURE_SUPPORTED (1 << 2) /* wipe (secure) buffer flag */ +#define DM_PLAIN64_SUPPORTED (1 << 3) /* plain64 IV */ +#define DM_DISCARDS_SUPPORTED (1 << 4) /* discards/TRIM option is supported */ +#define DM_VERITY_SUPPORTED (1 << 5) /* dm-verity target supported */ +#define DM_TCW_SUPPORTED (1 << 6) /* tcw (TCRYPT CBC with whitening) */ +#define DM_SAME_CPU_CRYPT_SUPPORTED (1 << 7) /* same_cpu_crypt */ +#define DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED (1 << 8) /* submit_from_crypt_cpus */ +#define DM_VERITY_ON_CORRUPTION_SUPPORTED (1 << 9) /* ignore/restart_on_corruption, ignore_zero_block */ +#define DM_VERITY_FEC_SUPPORTED (1 << 10) /* Forward Error Correction (FEC) */ +#define DM_KERNEL_KEYRING_SUPPORTED (1 << 11) /* dm-crypt allows loading kernel keyring keys */ +#define DM_INTEGRITY_SUPPORTED (1 << 12) /* dm-integrity target supported */ +#define DM_SECTOR_SIZE_SUPPORTED (1 << 13) /* support for sector size setting in dm-crypt/dm-integrity */ +#define DM_CAPI_STRING_SUPPORTED (1 << 14) /* support for cryptoapi format cipher definition */ +#define DM_DEFERRED_SUPPORTED (1 << 15) /* deferred removal of device */ +#define DM_INTEGRITY_RECALC_SUPPORTED (1 << 16) /* dm-integrity automatic recalculation supported */ +#define DM_INTEGRITY_BITMAP_SUPPORTED (1 << 17) /* dm-integrity bitmap mode supported */ +#define DM_GET_TARGET_VERSION_SUPPORTED (1 << 18) /* dm DM_GET_TARGET version ioctl supported */ +#define DM_INTEGRITY_FIX_PADDING_SUPPORTED (1 << 19) /* supports the parameter fix_padding that fixes a bug that caused excessive padding */ +#define DM_BITLK_EBOIV_SUPPORTED (1 << 20) /* EBOIV for BITLK supported */ +#define DM_BITLK_ELEPHANT_SUPPORTED (1 << 21) /* Elephant diffuser for BITLK supported */ +#define DM_VERITY_SIGNATURE_SUPPORTED (1 << 22) /* Verity option root_hash_sig_key_desc supported */ +#define DM_INTEGRITY_DISCARDS_SUPPORTED (1 << 23) /* dm-integrity discards/TRIM option is supported */ +#define DM_VERITY_PANIC_CORRUPTION_SUPPORTED (1 << 24) /* dm-verity panic on corruption */ +#define DM_CRYPT_NO_WORKQUEUE_SUPPORTED (1 << 25) /* dm-crypt suppot for bypassing workqueues */ +#define DM_INTEGRITY_FIX_HMAC_SUPPORTED (1 << 26) /* hmac covers also superblock */ + +typedef enum { DM_CRYPT = 0, DM_VERITY, DM_INTEGRITY, DM_LINEAR, DM_ERROR, DM_ZERO, DM_UNKNOWN } dm_target_type; +enum tdirection { TARGET_SET = 1, TARGET_QUERY }; + +int dm_flags(struct crypt_device *cd, dm_target_type target, uint32_t *flags); + +#define DM_ACTIVE_DEVICE (1 << 0) +#define DM_ACTIVE_UUID (1 << 1) +#define DM_ACTIVE_HOLDERS (1 << 2) + +#define DM_ACTIVE_CRYPT_CIPHER (1 << 3) +#define DM_ACTIVE_CRYPT_KEYSIZE (1 << 4) +#define DM_ACTIVE_CRYPT_KEY (1 << 5) + +#define DM_ACTIVE_VERITY_ROOT_HASH (1 << 6) +#define DM_ACTIVE_VERITY_HASH_DEVICE (1 << 7) +#define DM_ACTIVE_VERITY_PARAMS (1 << 8) + +#define DM_ACTIVE_INTEGRITY_PARAMS (1 << 9) + +struct dm_target { + dm_target_type type; + enum tdirection direction; + uint64_t offset; + uint64_t size; + struct device *data_device; + union { + struct { + const char *cipher; + const char *integrity; + + /* Active key for device */ + struct volume_key *vk; + + /* struct crypt_active_device */ + uint64_t offset; /* offset in sectors */ + uint64_t iv_offset; /* IV initialisation sector */ + uint32_t tag_size; /* additional on-disk tag size */ + uint32_t sector_size; /* encryption sector size */ + } crypt; + struct { + struct device *hash_device; + struct device *fec_device; + + const char *root_hash; + uint32_t root_hash_size; + const char *root_hash_sig_key_desc; + + uint64_t hash_offset; /* hash offset in blocks (not header) */ + uint64_t fec_offset; /* FEC offset in blocks (not header) */ + uint64_t fec_blocks; /* FEC blocks covering data + hash + padding (foreign metadata)*/ + struct crypt_params_verity *vp; + } verity; + struct { + uint64_t journal_size; + uint32_t journal_watermark; + uint32_t journal_commit_time; + uint32_t interleave_sectors; + uint32_t tag_size; + uint64_t offset; /* offset in sectors */ + uint32_t sector_size; /* integrity sector size */ + uint32_t buffer_sectors; + + const char *integrity; + /* Active key for device */ + struct volume_key *vk; + + const char *journal_integrity; + struct volume_key *journal_integrity_key; + + const char *journal_crypt; + struct volume_key *journal_crypt_key; + + struct device *meta_device; + + bool fix_padding; + bool fix_hmac; + bool legacy_recalc; + } integrity; + struct { + uint64_t offset; + } linear; + struct { + } zero; + } u; + + char *params; + struct dm_target *next; +}; + +struct crypt_dm_active_device { + uint64_t size; /* active device size */ + uint32_t flags; /* activation flags */ + const char *uuid; + + unsigned holders:1; /* device holders detected (on query only) */ + + struct dm_target segment; +}; + +static inline bool single_segment(const struct crypt_dm_active_device *dmd) +{ + return dmd && !dmd->segment.next; +} + +void dm_backend_init(struct crypt_device *cd); +void dm_backend_exit(struct crypt_device *cd); + +int dm_targets_allocate(struct dm_target *first, unsigned count); +void dm_targets_free(struct crypt_device *cd, struct crypt_dm_active_device *dmd); + +int dm_crypt_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, struct volume_key *vk, const char *cipher, + uint64_t iv_offset, uint64_t data_offset, const char *integrity, + uint32_t tag_size, uint32_t sector_size); +int dm_verity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, struct device *hash_device, struct device *fec_device, + const char *root_hash, uint32_t root_hash_size, const char* root_hash_sig_key_desc, + uint64_t hash_offset_block, uint64_t fec_blocks, struct crypt_params_verity *vp); +int dm_integrity_target_set(struct crypt_device *cd, + struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *meta_device, + struct device *data_device, uint64_t tag_size, uint64_t offset, uint32_t sector_size, + struct volume_key *vk, + struct volume_key *journal_crypt_key, struct volume_key *journal_mac_key, + const struct crypt_params_integrity *ip); +int dm_linear_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size, + struct device *data_device, uint64_t data_offset); +int dm_zero_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size); + +int dm_remove_device(struct crypt_device *cd, const char *name, uint32_t flags); +int dm_status_device(struct crypt_device *cd, const char *name); +int dm_status_suspended(struct crypt_device *cd, const char *name); +int dm_status_verity_ok(struct crypt_device *cd, const char *name); +int dm_status_integrity_failures(struct crypt_device *cd, const char *name, uint64_t *count); +int dm_query_device(struct crypt_device *cd, const char *name, + uint32_t get_flags, struct crypt_dm_active_device *dmd); +int dm_device_deps(struct crypt_device *cd, const char *name, const char *prefix, + char **names, size_t names_length); +int dm_create_device(struct crypt_device *cd, const char *name, + const char *type, struct crypt_dm_active_device *dmd); +int dm_reload_device(struct crypt_device *cd, const char *name, + struct crypt_dm_active_device *dmd, uint32_t dmflags, unsigned resume); +int dm_suspend_device(struct crypt_device *cd, const char *name, uint32_t dmflags); +int dm_resume_device(struct crypt_device *cd, const char *name, uint32_t dmflags); +int dm_resume_and_reinstate_key(struct crypt_device *cd, const char *name, + const struct volume_key *vk); +int dm_error_device(struct crypt_device *cd, const char *name); +int dm_clear_device(struct crypt_device *cd, const char *name); + +const char *dm_get_dir(void); + +int lookup_dm_dev_by_uuid(struct crypt_device *cd, const char *uuid, const char *type); + +/* These are DM helpers used only by utils_devpath file */ +int dm_is_dm_device(int major); +int dm_is_dm_kernel_name(const char *name); +char *dm_device_path(const char *prefix, int major, int minor); +char *dm_device_name(const char *path); + +#endif /* _UTILS_DM_H */ diff --git a/lib/utils_fips.c b/lib/utils_fips.c new file mode 100644 index 0000000..4fa22fb --- /dev/null +++ b/lib/utils_fips.c @@ -0,0 +1,46 @@ +/* + * FIPS mode utilities + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include "utils_fips.h" + +#if !ENABLE_FIPS +int crypt_fips_mode(void) { return 0; } +#else +static int kernel_fips_mode(void) +{ + int fd; + char buf[1] = ""; + + if ((fd = open("/proc/sys/crypto/fips_enabled", O_RDONLY)) >= 0) { + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR); + close(fd); + } + + return (buf[0] == '1') ? 1 : 0; +} + +int crypt_fips_mode(void) +{ + return kernel_fips_mode() && !access("/etc/system-fips", F_OK); +} +#endif /* ENABLE_FIPS */ diff --git a/lib/utils_fips.h b/lib/utils_fips.h new file mode 100644 index 0000000..51b110b --- /dev/null +++ b/lib/utils_fips.h @@ -0,0 +1,26 @@ +/* + * FIPS mode utilities + * + * Copyright (C) 2011-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_FIPS_H +#define _UTILS_FIPS_H + +int crypt_fips_mode(void); + +#endif /* _UTILS_FIPS_H */ diff --git a/lib/utils_io.c b/lib/utils_io.c new file mode 100644 index 0000000..2681b8f --- /dev/null +++ b/lib/utils_io.c @@ -0,0 +1,299 @@ +/* + * utils - miscellaneous I/O utilities for cryptsetup + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include + +#include "utils_io.h" + +static ssize_t _read_buffer(int fd, void *buf, size_t length, volatile int *quit) +{ + size_t read_size = 0; + ssize_t r; + + if (fd < 0 || !buf) + return -EINVAL; + + do { + r = read(fd, buf, length - read_size); + if (r == -1 && errno != EINTR) + return r; + if (r > 0) { + read_size += (size_t)r; + buf = (uint8_t*)buf + r; + } + if (r == 0 || (quit && *quit)) + return (ssize_t)read_size; + } while (read_size != length); + + return (ssize_t)length; +} + +ssize_t read_buffer(int fd, void *buf, size_t length) +{ + return _read_buffer(fd, buf, length, NULL); +} + +ssize_t read_buffer_intr(int fd, void *buf, size_t length, volatile int *quit) +{ + return _read_buffer(fd, buf, length, quit); +} + +static ssize_t _write_buffer(int fd, const void *buf, size_t length, volatile int *quit) +{ + size_t write_size = 0; + ssize_t w; + + if (fd < 0 || !buf || !length) + return -EINVAL; + + do { + w = write(fd, buf, length - write_size); + if (w < 0 && errno != EINTR) + return w; + if (w > 0) { + write_size += (size_t) w; + buf = (const uint8_t*)buf + w; + } + if (w == 0 || (quit && *quit)) + return (ssize_t)write_size; + } while (write_size != length); + + return (ssize_t)write_size; +} + +ssize_t write_buffer(int fd, const void *buf, size_t length) +{ + return _write_buffer(fd, buf, length, NULL); +} + +ssize_t write_buffer_intr(int fd, const void *buf, size_t length, volatile int *quit) +{ + return _write_buffer(fd, buf, length, quit); +} + +ssize_t write_blockwise(int fd, size_t bsize, size_t alignment, + void *orig_buf, size_t length) +{ + void *hangover_buf = NULL, *buf = NULL; + size_t hangover, solid; + ssize_t r, ret = -1; + + if (fd == -1 || !orig_buf || !bsize || !alignment) + return -1; + + hangover = length % bsize; + solid = length - hangover; + + if ((size_t)orig_buf & (alignment - 1)) { + if (posix_memalign(&buf, alignment, length)) + return -1; + memcpy(buf, orig_buf, length); + } else + buf = orig_buf; + + if (solid) { + r = write_buffer(fd, buf, solid); + if (r < 0 || r != (ssize_t)solid) + goto out; + } + + if (hangover) { + if (posix_memalign(&hangover_buf, alignment, bsize)) + goto out; + memset(hangover_buf, 0, bsize); + + r = read_buffer(fd, hangover_buf, bsize); + if (r < 0) + goto out; + + if (lseek(fd, -(off_t)r, SEEK_CUR) < 0) + goto out; + + memcpy(hangover_buf, (char*)buf + solid, hangover); + + r = write_buffer(fd, hangover_buf, bsize); + if (r < 0 || r < (ssize_t)hangover) + goto out; + } + ret = length; +out: + free(hangover_buf); + if (buf != orig_buf) + free(buf); + return ret; +} + +ssize_t read_blockwise(int fd, size_t bsize, size_t alignment, + void *orig_buf, size_t length) +{ + void *hangover_buf = NULL, *buf = NULL; + size_t hangover, solid; + ssize_t r, ret = -1; + + if (fd == -1 || !orig_buf || !bsize || !alignment) + return -1; + + hangover = length % bsize; + solid = length - hangover; + + if ((size_t)orig_buf & (alignment - 1)) { + if (posix_memalign(&buf, alignment, length)) + return -1; + } else + buf = orig_buf; + + r = read_buffer(fd, buf, solid); + if (r < 0 || r != (ssize_t)solid) + goto out; + + if (hangover) { + if (posix_memalign(&hangover_buf, alignment, bsize)) + goto out; + r = read_buffer(fd, hangover_buf, bsize); + if (r < 0 || r < (ssize_t)hangover) + goto out; + + memcpy((char *)buf + solid, hangover_buf, hangover); + } + ret = length; +out: + free(hangover_buf); + if (buf != orig_buf) { + if (ret != -1) + memcpy(orig_buf, buf, length); + free(buf); + } + return ret; +} + +/* + * Combines llseek with blockwise write. write_blockwise can already deal with short writes + * but we also need a function to deal with short writes at the start. But this information + * is implicitly included in the read/write offset, which can not be set to non-aligned + * boundaries. Hence, we combine llseek with write. + */ +ssize_t write_lseek_blockwise(int fd, size_t bsize, size_t alignment, + void *buf, size_t length, off_t offset) +{ + void *frontPadBuf = NULL; + size_t frontHang, innerCount = 0; + ssize_t r, ret = -1; + + if (fd == -1 || !buf || !bsize || !alignment) + return -1; + + if (offset < 0) + offset = lseek(fd, offset, SEEK_END); + + if (offset < 0) + return -1; + + frontHang = offset % bsize; + + if (lseek(fd, offset - frontHang, SEEK_SET) < 0) + return -1; + + if (frontHang && length) { + if (posix_memalign(&frontPadBuf, alignment, bsize)) + return -1; + + innerCount = bsize - frontHang; + if (innerCount > length) + innerCount = length; + + r = read_buffer(fd, frontPadBuf, bsize); + if (r < 0 || r < (ssize_t)(frontHang + innerCount)) + goto out; + + memcpy((char*)frontPadBuf + frontHang, buf, innerCount); + + if (lseek(fd, offset - frontHang, SEEK_SET) < 0) + goto out; + + r = write_buffer(fd, frontPadBuf, bsize); + if (r < 0 || r != (ssize_t)bsize) + goto out; + + buf = (char*)buf + innerCount; + length -= innerCount; + } + + ret = length ? write_blockwise(fd, bsize, alignment, buf, length) : 0; + if (ret >= 0) + ret += innerCount; +out: + free(frontPadBuf); + return ret; +} + +ssize_t read_lseek_blockwise(int fd, size_t bsize, size_t alignment, + void *buf, size_t length, off_t offset) +{ + void *frontPadBuf = NULL; + size_t frontHang, innerCount = 0; + ssize_t r, ret = -1; + + if (fd == -1 || !buf || bsize <= 0) + return -1; + + if (offset < 0) + offset = lseek(fd, offset, SEEK_END); + + if (offset < 0) + return -1; + + frontHang = offset % bsize; + + if (lseek(fd, offset - frontHang, SEEK_SET) < 0) + return -1; + + if (frontHang && length) { + if (posix_memalign(&frontPadBuf, alignment, bsize)) + return -1; + + innerCount = bsize - frontHang; + if (innerCount > length) + innerCount = length; + + r = read_buffer(fd, frontPadBuf, bsize); + if (r < 0 || r < (ssize_t)(frontHang + innerCount)) + goto out; + + memcpy(buf, (char*)frontPadBuf + frontHang, innerCount); + + buf = (char*)buf + innerCount; + length -= innerCount; + } + + ret = read_blockwise(fd, bsize, alignment, buf, length); + if (ret >= 0) + ret += innerCount; +out: + free(frontPadBuf); + return ret; +} diff --git a/lib/utils_io.h b/lib/utils_io.h new file mode 100644 index 0000000..3c92549 --- /dev/null +++ b/lib/utils_io.h @@ -0,0 +1,42 @@ +/* + * utils - miscellaneous I/O utilities for cryptsetup + * + * Copyright (C) 2004 Jana Saout + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _CRYPTSETUP_UTILS_IO_H +#define _CRYPTSETUP_UTILS_IO_H + +#include + +ssize_t read_buffer(int fd, void *buf, size_t length); +ssize_t read_buffer_intr(int fd, void *buf, size_t length, volatile int *quit); +ssize_t write_buffer(int fd, const void *buf, size_t length); +ssize_t write_buffer_intr(int fd, const void *buf, size_t length, volatile int *quit); +ssize_t write_blockwise(int fd, size_t bsize, size_t alignment, + void *orig_buf, size_t length); +ssize_t read_blockwise(int fd, size_t bsize, size_t alignment, + void *orig_buf, size_t length); +ssize_t write_lseek_blockwise(int fd, size_t bsize, size_t alignment, + void *buf, size_t length, off_t offset); +ssize_t read_lseek_blockwise(int fd, size_t bsize, size_t alignment, + void *buf, size_t length, off_t offset); + +#endif diff --git a/lib/utils_keyring.c b/lib/utils_keyring.c new file mode 100644 index 0000000..fdef674 --- /dev/null +++ b/lib/utils_keyring.c @@ -0,0 +1,242 @@ +/* + * kernel keyring utilities + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "utils_keyring.h" + +#ifndef HAVE_KEY_SERIAL_T +#define HAVE_KEY_SERIAL_T +typedef int32_t key_serial_t; +#endif + +#ifndef ARRAY_SIZE +# define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0])) +#endif + +#ifdef KERNEL_KEYRING + +static const struct { + key_type_t type; + const char *type_name; +} key_types[] = { + { LOGON_KEY, "logon" }, + { USER_KEY, "user" }, +}; + +#include + +/* request_key */ +static key_serial_t request_key(const char *type, + const char *description, + const char *callout_info, + key_serial_t keyring) +{ + return syscall(__NR_request_key, type, description, callout_info, keyring); +} + +/* add_key */ +static key_serial_t add_key(const char *type, + const char *description, + const void *payload, + size_t plen, + key_serial_t keyring) +{ + return syscall(__NR_add_key, type, description, payload, plen, keyring); +} + +/* keyctl_read */ +static long keyctl_read(key_serial_t key, char *buffer, size_t buflen) +{ + return syscall(__NR_keyctl, KEYCTL_READ, key, buffer, buflen); +} + +/* keyctl_revoke */ +static long keyctl_revoke(key_serial_t key) +{ + return syscall(__NR_keyctl, KEYCTL_REVOKE, key); +} + +/* keyctl_unlink */ +static long keyctl_unlink(key_serial_t key, key_serial_t keyring) +{ + return syscall(__NR_keyctl, KEYCTL_UNLINK, key, keyring); +} +#endif + +int keyring_check(void) +{ +#ifdef KERNEL_KEYRING + /* logon type key descriptions must be in format "prefix:description" */ + return syscall(__NR_request_key, "logon", "dummy", NULL, 0) == -1l && errno != ENOSYS; +#else + return 0; +#endif +} + +int keyring_add_key_in_thread_keyring(key_type_t ktype, const char *key_desc, const void *key, size_t key_size) +{ +#ifdef KERNEL_KEYRING + key_serial_t kid; + const char *type_name = key_type_name(ktype); + + if (!type_name || !key_desc) + return -EINVAL; + + kid = add_key(type_name, key_desc, key, key_size, KEY_SPEC_THREAD_KEYRING); + if (kid < 0) + return -errno; + + return 0; +#else + return -ENOTSUP; +#endif +} + +/* currently used in client utilities only */ +int keyring_add_key_in_user_keyring(key_type_t ktype, const char *key_desc, const void *key, size_t key_size) +{ +#ifdef KERNEL_KEYRING + const char *type_name = key_type_name(ktype); + key_serial_t kid; + + if (!type_name || !key_desc) + return -EINVAL; + + kid = add_key(type_name, key_desc, key, key_size, KEY_SPEC_USER_KEYRING); + if (kid < 0) + return -errno; + + return 0; +#else + return -ENOTSUP; +#endif +} + +/* alias for the same code */ +int keyring_get_key(const char *key_desc, + char **key, + size_t *key_size) +{ + return keyring_get_passphrase(key_desc, key, key_size); +} + +int keyring_get_passphrase(const char *key_desc, + char **passphrase, + size_t *passphrase_len) +{ +#ifdef KERNEL_KEYRING + int err; + key_serial_t kid; + long ret; + char *buf = NULL; + size_t len = 0; + + do + kid = request_key(key_type_name(USER_KEY), key_desc, NULL, 0); + while (kid < 0 && errno == EINTR); + + if (kid < 0) + return -errno; + + /* just get payload size */ + ret = keyctl_read(kid, NULL, 0); + if (ret > 0) { + len = ret; + buf = malloc(len); + if (!buf) + return -ENOMEM; + + /* retrieve actual payload data */ + ret = keyctl_read(kid, buf, len); + } + + if (ret < 0) { + err = errno; + if (buf) + crypt_safe_memzero(buf, len); + free(buf); + return -err; + } + + *passphrase = buf; + *passphrase_len = len; + + return 0; +#else + return -ENOTSUP; +#endif +} + +static int keyring_revoke_and_unlink_key_type(const char *type_name, const char *key_desc) +{ +#ifdef KERNEL_KEYRING + key_serial_t kid; + + if (!type_name || !key_desc) + return -EINVAL; + + do + kid = request_key(type_name, key_desc, NULL, 0); + while (kid < 0 && errno == EINTR); + + if (kid < 0) + return 0; + + if (keyctl_revoke(kid)) + return -errno; + + /* + * best effort only. the key could have been linked + * in some other keyring and its payload is now + * revoked anyway. + */ + keyctl_unlink(kid, KEY_SPEC_THREAD_KEYRING); + keyctl_unlink(kid, KEY_SPEC_PROCESS_KEYRING); + keyctl_unlink(kid, KEY_SPEC_USER_KEYRING); + + return 0; +#else + return -ENOTSUP; +#endif +} + +const char *key_type_name(key_type_t type) +{ +#ifdef KERNEL_KEYRING + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(key_types); i++) + if (type == key_types[i].type) + return key_types[i].type_name; +#endif + return NULL; +} + +int keyring_revoke_and_unlink_key(key_type_t ktype, const char *key_desc) +{ + return keyring_revoke_and_unlink_key_type(key_type_name(ktype), key_desc); +} diff --git a/lib/utils_keyring.h b/lib/utils_keyring.h new file mode 100644 index 0000000..10818e0 --- /dev/null +++ b/lib/utils_keyring.h @@ -0,0 +1,55 @@ +/* + * kernel keyring syscall wrappers + * + * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2016-2021 Ondrej Kozina + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_KEYRING +#define _UTILS_KEYRING + +#include + +typedef enum { LOGON_KEY = 0, USER_KEY } key_type_t; + +const char *key_type_name(key_type_t ktype); + +int keyring_check(void); + +int keyring_get_key(const char *key_desc, + char **key, + size_t *key_size); + +int keyring_get_passphrase(const char *key_desc, + char **passphrase, + size_t *passphrase_len); + +int keyring_add_key_in_thread_keyring( + key_type_t ktype, + const char *key_desc, + const void *key, + size_t key_size); + +int keyring_add_key_in_user_keyring( + key_type_t ktype, + const char *key_desc, + const void *key, + size_t key_size); + +int keyring_revoke_and_unlink_key(key_type_t ktype, const char *key_desc); + +#endif diff --git a/lib/utils_loop.c b/lib/utils_loop.c new file mode 100644 index 0000000..9e68072 --- /dev/null +++ b/lib/utils_loop.c @@ -0,0 +1,277 @@ +/* + * loopback block device utilities + * + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef HAVE_SYS_SYSMACROS_H +# include /* for major, minor */ +#endif +#include + +#include "utils_loop.h" + +#define LOOP_DEV_MAJOR 7 + +#ifndef LO_FLAGS_AUTOCLEAR +#define LO_FLAGS_AUTOCLEAR 4 +#endif + +#ifndef LOOP_CTL_GET_FREE +#define LOOP_CTL_GET_FREE 0x4C82 +#endif + +#ifndef LOOP_SET_CAPACITY +#define LOOP_SET_CAPACITY 0x4C07 +#endif + +static char *crypt_loop_get_device_old(void) +{ + char dev[20]; + int i, loop_fd; + struct loop_info64 lo64 = {0}; + + for (i = 0; i < 256; i++) { + sprintf(dev, "/dev/loop%d", i); + + loop_fd = open(dev, O_RDONLY); + if (loop_fd < 0) + return NULL; + + if (ioctl(loop_fd, LOOP_GET_STATUS64, &lo64) && + errno == ENXIO) { + close(loop_fd); + return strdup(dev); + } + close(loop_fd); + } + + return NULL; +} + +static char *crypt_loop_get_device(void) +{ + char dev[64]; + int i, loop_fd; + struct stat st; + + loop_fd = open("/dev/loop-control", O_RDONLY); + if (loop_fd < 0) + return crypt_loop_get_device_old(); + + i = ioctl(loop_fd, LOOP_CTL_GET_FREE); + if (i < 0) { + close(loop_fd); + return NULL; + } + close(loop_fd); + + if (sprintf(dev, "/dev/loop%d", i) < 0) + return NULL; + + if (stat(dev, &st) || !S_ISBLK(st.st_mode)) + return NULL; + + return strdup(dev); +} + +int crypt_loop_attach(char **loop, const char *file, int offset, + int autoclear, int *readonly) +{ + struct loop_info64 lo64 = {0}; + char *lo_file_name; + int loop_fd = -1, file_fd = -1, r = 1; + + *loop = NULL; + + file_fd = open(file, (*readonly ? O_RDONLY : O_RDWR) | O_EXCL); + if (file_fd < 0 && (errno == EROFS || errno == EACCES) && !*readonly) { + *readonly = 1; + file_fd = open(file, O_RDONLY | O_EXCL); + } + if (file_fd < 0) + goto out; + + while (loop_fd < 0) { + *loop = crypt_loop_get_device(); + if (!*loop) + goto out; + + loop_fd = open(*loop, *readonly ? O_RDONLY : O_RDWR); + if (loop_fd < 0) + goto out; + + if (ioctl(loop_fd, LOOP_SET_FD, file_fd) < 0) { + if (errno != EBUSY) + goto out; + free(*loop); + *loop = NULL; + + close(loop_fd); + loop_fd = -1; + } + } + + lo_file_name = (char*)lo64.lo_file_name; + lo_file_name[LO_NAME_SIZE-1] = '\0'; + strncpy(lo_file_name, file, LO_NAME_SIZE-1); + lo64.lo_offset = offset; + if (autoclear) + lo64.lo_flags |= LO_FLAGS_AUTOCLEAR; + + if (ioctl(loop_fd, LOOP_SET_STATUS64, &lo64) < 0) { + (void)ioctl(loop_fd, LOOP_CLR_FD, 0); + goto out; + } + + /* Verify that autoclear is really set */ + if (autoclear) { + memset(&lo64, 0, sizeof(lo64)); + if (ioctl(loop_fd, LOOP_GET_STATUS64, &lo64) < 0 || + !(lo64.lo_flags & LO_FLAGS_AUTOCLEAR)) { + (void)ioctl(loop_fd, LOOP_CLR_FD, 0); + goto out; + } + } + + r = 0; +out: + if (r && loop_fd >= 0) + close(loop_fd); + if (file_fd >= 0) + close(file_fd); + if (r && *loop) { + free(*loop); + *loop = NULL; + } + return r ? -1 : loop_fd; +} + +int crypt_loop_detach(const char *loop) +{ + int loop_fd = -1, r = 1; + + loop_fd = open(loop, O_RDONLY); + if (loop_fd < 0) + return 1; + + if (!ioctl(loop_fd, LOOP_CLR_FD, 0)) + r = 0; + + close(loop_fd); + return r; +} + +int crypt_loop_resize(const char *loop) +{ + int loop_fd = -1, r = 1; + + loop_fd = open(loop, O_RDONLY); + if (loop_fd < 0) + return 1; + + if (!ioctl(loop_fd, LOOP_SET_CAPACITY, 0)) + r = 0; + + close(loop_fd); + return r; +} + +static char *_ioctl_backing_file(const char *loop) +{ + struct loop_info64 lo64 = {0}; + int loop_fd; + + loop_fd = open(loop, O_RDONLY); + if (loop_fd < 0) + return NULL; + + if (ioctl(loop_fd, LOOP_GET_STATUS64, &lo64) < 0) { + close(loop_fd); + return NULL; + } + + lo64.lo_file_name[LO_NAME_SIZE-2] = '*'; + lo64.lo_file_name[LO_NAME_SIZE-1] = 0; + + close(loop_fd); + + return strdup((char*)lo64.lo_file_name); +} + +static char *_sysfs_backing_file(const char *loop) +{ + struct stat st; + char buf[PATH_MAX]; + size_t len; + int fd; + + if (stat(loop, &st) || !S_ISBLK(st.st_mode)) + return NULL; + + if (snprintf(buf, sizeof(buf), "/sys/dev/block/%d:%d/loop/backing_file", + major(st.st_rdev), minor(st.st_rdev)) < 0) + return NULL; + + fd = open(buf, O_RDONLY); + if (fd < 0) + return NULL; + + len = read(fd, buf, PATH_MAX); + close(fd); + if (len < 2) + return NULL; + + buf[len - 1] = '\0'; + return strdup(buf); +} + +char *crypt_loop_backing_file(const char *loop) +{ + char *bf; + + if (!crypt_loop_device(loop)) + return NULL; + + bf = _sysfs_backing_file(loop); + return bf ?: _ioctl_backing_file(loop); +} + +int crypt_loop_device(const char *loop) +{ + struct stat st; + + if (!loop) + return 0; + + if (stat(loop, &st) || !S_ISBLK(st.st_mode) || + major(st.st_rdev) != LOOP_DEV_MAJOR) + return 0; + + return 1; +} diff --git a/lib/utils_loop.h b/lib/utils_loop.h new file mode 100644 index 0000000..cc445d4 --- /dev/null +++ b/lib/utils_loop.h @@ -0,0 +1,34 @@ +/* + * loopback block device utilities + * + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_LOOP_H +#define _UTILS_LOOP_H + +/* loopback device helpers */ + +char *crypt_loop_backing_file(const char *loop); +int crypt_loop_device(const char *loop); +int crypt_loop_attach(char **loop, const char *file, int offset, + int autoclear, int *readonly); +int crypt_loop_detach(const char *loop); +int crypt_loop_resize(const char *loop); + +#endif /* _UTILS_LOOP_H */ diff --git a/lib/utils_pbkdf.c b/lib/utils_pbkdf.c new file mode 100644 index 0000000..575d841 --- /dev/null +++ b/lib/utils_pbkdf.c @@ -0,0 +1,333 @@ +/* + * utils_pbkdf - PBKDF settings for libcryptsetup + * + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include + +#include "internal.h" + +const struct crypt_pbkdf_type default_pbkdf2 = { + .type = CRYPT_KDF_PBKDF2, + .hash = DEFAULT_LUKS1_HASH, + .time_ms = DEFAULT_LUKS1_ITER_TIME +}; + +const struct crypt_pbkdf_type default_argon2i = { + .type = CRYPT_KDF_ARGON2I, + .hash = DEFAULT_LUKS1_HASH, + .time_ms = DEFAULT_LUKS2_ITER_TIME, + .max_memory_kb = DEFAULT_LUKS2_MEMORY_KB, + .parallel_threads = DEFAULT_LUKS2_PARALLEL_THREADS +}; + +const struct crypt_pbkdf_type default_argon2id = { + .type = CRYPT_KDF_ARGON2ID, + .hash = DEFAULT_LUKS1_HASH, + .time_ms = DEFAULT_LUKS2_ITER_TIME, + .max_memory_kb = DEFAULT_LUKS2_MEMORY_KB, + .parallel_threads = DEFAULT_LUKS2_PARALLEL_THREADS +}; + +const struct crypt_pbkdf_type *crypt_get_pbkdf_type_params(const char *pbkdf_type) +{ + if (!pbkdf_type) + return NULL; + + if (!strcmp(pbkdf_type, CRYPT_KDF_PBKDF2)) + return &default_pbkdf2; + else if (!strcmp(pbkdf_type, CRYPT_KDF_ARGON2I)) + return &default_argon2i; + else if (!strcmp(pbkdf_type, CRYPT_KDF_ARGON2ID)) + return &default_argon2id; + + return NULL; +} + +static uint32_t adjusted_phys_memory(void) +{ + uint64_t memory_kb = crypt_getphysmemory_kb(); + + /* Ignore bogus value */ + if (memory_kb < (128 * 1024) || memory_kb > UINT32_MAX) + return DEFAULT_LUKS2_MEMORY_KB; + + /* + * Never use more than half of physical memory. + * OOM killer is too clever... + */ + memory_kb /= 2; + + return memory_kb; +} + +/* + * PBKDF configuration interface + */ +int verify_pbkdf_params(struct crypt_device *cd, + const struct crypt_pbkdf_type *pbkdf) +{ + struct crypt_pbkdf_limits pbkdf_limits; + const char *pbkdf_type; + int r; + + r = init_crypto(cd); + if (r < 0) + return r; + + if (!pbkdf->type || + (!pbkdf->hash && !strcmp(pbkdf->type, "pbkdf2"))) + return -EINVAL; + + if (!pbkdf->time_ms && !(pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK)) { + log_err(cd, _("Requested PBKDF target time cannot be zero.")); + return -EINVAL; + } + + r = crypt_parse_pbkdf(pbkdf->type, &pbkdf_type); + if (r < 0) { + log_err(cd, _("Unknown PBKDF type %s."), pbkdf->type); + return r; + } + + if (pbkdf->hash && crypt_hash_size(pbkdf->hash) < 0) { + log_err(cd, _("Requested hash %s is not supported."), pbkdf->hash); + return -EINVAL; + } + + r = crypt_pbkdf_get_limits(pbkdf->type, &pbkdf_limits); + if (r < 0) + return r; + + if (crypt_get_type(cd) && + !strcmp(crypt_get_type(cd), CRYPT_LUKS1) && + strcmp(pbkdf_type, CRYPT_KDF_PBKDF2)) { + log_err(cd, _("Requested PBKDF type is not supported for LUKS1.")); + return -EINVAL; + } + + if (!strcmp(pbkdf_type, CRYPT_KDF_PBKDF2)) { + if (pbkdf->max_memory_kb || pbkdf->parallel_threads) { + log_err(cd, _("PBKDF max memory or parallel threads must not be set with pbkdf2.")); + return -EINVAL; + } + if (pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK && + pbkdf->iterations < pbkdf_limits.min_iterations) { + log_err(cd, _("Forced iteration count is too low for %s (minimum is %u)."), + pbkdf_type, pbkdf_limits.min_iterations); + return -EINVAL; + } + return 0; + } + + /* TODO: properly define minimal iterations and also minimal memory values */ + if (pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK) { + if (pbkdf->iterations < pbkdf_limits.min_iterations) { + log_err(cd, _("Forced iteration count is too low for %s (minimum is %u)."), + pbkdf_type, pbkdf_limits.min_iterations); + r = -EINVAL; + } + if (pbkdf->max_memory_kb < pbkdf_limits.min_memory) { + log_err(cd, _("Forced memory cost is too low for %s (minimum is %u kilobytes)."), + pbkdf_type, pbkdf_limits.min_memory); + r = -EINVAL; + } + } + + if (pbkdf->max_memory_kb > pbkdf_limits.max_memory) { + log_err(cd, _("Requested maximum PBKDF memory cost is too high (maximum is %d kilobytes)."), + pbkdf_limits.max_memory); + r = -EINVAL; + } + if (!pbkdf->max_memory_kb) { + log_err(cd, _("Requested maximum PBKDF memory cannot be zero.")); + r = -EINVAL; + } + if (!pbkdf->parallel_threads) { + log_err(cd, _("Requested PBKDF parallel threads cannot be zero.")); + r = -EINVAL; + } + + return r; +} + +int init_pbkdf_type(struct crypt_device *cd, + const struct crypt_pbkdf_type *pbkdf, + const char *dev_type) +{ + struct crypt_pbkdf_type *cd_pbkdf = crypt_get_pbkdf(cd); + struct crypt_pbkdf_limits pbkdf_limits; + const char *hash, *type; + unsigned cpus; + uint32_t old_flags, memory_kb; + int r; + + if (crypt_fips_mode()) { + if (pbkdf && strcmp(pbkdf->type, CRYPT_KDF_PBKDF2)) { + log_err(cd, _("Only PBKDF2 is supported in FIPS mode.")); + return -EINVAL; + } + if (!pbkdf) + pbkdf = crypt_get_pbkdf_type_params(CRYPT_KDF_PBKDF2); + } + + if (!pbkdf && dev_type && !strcmp(dev_type, CRYPT_LUKS2)) + pbkdf = crypt_get_pbkdf_type_params(DEFAULT_LUKS2_PBKDF); + else if (!pbkdf) + pbkdf = crypt_get_pbkdf_type_params(CRYPT_KDF_PBKDF2); + + r = verify_pbkdf_params(cd, pbkdf); + if (r) + return r; + + r = crypt_pbkdf_get_limits(pbkdf->type, &pbkdf_limits); + if (r < 0) + return r; + + type = strdup(pbkdf->type); + hash = pbkdf->hash ? strdup(pbkdf->hash) : NULL; + + if (!type || (!hash && pbkdf->hash)) { + free(CONST_CAST(void*)type); + free(CONST_CAST(void*)hash); + return -ENOMEM; + } + + free(CONST_CAST(void*)cd_pbkdf->type); + free(CONST_CAST(void*)cd_pbkdf->hash); + cd_pbkdf->type = type; + cd_pbkdf->hash = hash; + + old_flags = cd_pbkdf->flags; + cd_pbkdf->flags = pbkdf->flags; + + /* Reset iteration count so benchmark must run again. */ + if (cd_pbkdf->flags & CRYPT_PBKDF_NO_BENCHMARK) + cd_pbkdf->iterations = pbkdf->iterations; + else + cd_pbkdf->iterations = 0; + + if (old_flags & CRYPT_PBKDF_ITER_TIME_SET) + cd_pbkdf->flags |= CRYPT_PBKDF_ITER_TIME_SET; + else + cd_pbkdf->time_ms = pbkdf->time_ms; + + cd_pbkdf->max_memory_kb = pbkdf->max_memory_kb; + cd_pbkdf->parallel_threads = pbkdf->parallel_threads; + + if (cd_pbkdf->parallel_threads > pbkdf_limits.max_parallel) { + log_dbg(cd, "Maximum PBKDF threads is %d (requested %d).", + pbkdf_limits.max_parallel, cd_pbkdf->parallel_threads); + cd_pbkdf->parallel_threads = pbkdf_limits.max_parallel; + } + + if (cd_pbkdf->parallel_threads) { + cpus = crypt_cpusonline(); + if (cd_pbkdf->parallel_threads > cpus) { + log_dbg(cd, "Only %u active CPUs detected, " + "PBKDF threads decreased from %d to %d.", + cpus, cd_pbkdf->parallel_threads, cpus); + cd_pbkdf->parallel_threads = cpus; + } + } + + if (cd_pbkdf->max_memory_kb) { + memory_kb = adjusted_phys_memory(); + if (cd_pbkdf->max_memory_kb > memory_kb) { + log_dbg(cd, "Not enough physical memory detected, " + "PBKDF max memory decreased from %dkB to %dkB.", + cd_pbkdf->max_memory_kb, memory_kb); + cd_pbkdf->max_memory_kb = memory_kb; + } + } + + if (!strcmp(pbkdf->type, CRYPT_KDF_PBKDF2)) + log_dbg(cd, "PBKDF %s-%s, time_ms %u (iterations %u).", + cd_pbkdf->type, cd_pbkdf->hash, cd_pbkdf->time_ms, cd_pbkdf->iterations); + else + log_dbg(cd, "PBKDF %s, time_ms %u (iterations %u), max_memory_kb %u, parallel_threads %u.", + cd_pbkdf->type, cd_pbkdf->time_ms, cd_pbkdf->iterations, + cd_pbkdf->max_memory_kb, cd_pbkdf->parallel_threads); + + return 0; +} + +/* Libcryptsetup API */ + +int crypt_set_pbkdf_type(struct crypt_device *cd, const struct crypt_pbkdf_type *pbkdf) +{ + if (!cd) + return -EINVAL; + + if (!pbkdf) + log_dbg(cd, "Resetting pbkdf type to default"); + + crypt_get_pbkdf(cd)->flags = 0; + + return init_pbkdf_type(cd, pbkdf, crypt_get_type(cd)); +} + +const struct crypt_pbkdf_type *crypt_get_pbkdf_type(struct crypt_device *cd) +{ + if (!cd) + return NULL; + + return crypt_get_pbkdf(cd)->type ? crypt_get_pbkdf(cd) : NULL; +} + +const struct crypt_pbkdf_type *crypt_get_pbkdf_default(const char *type) +{ + if (!type) + return NULL; + + if (!strcmp(type, CRYPT_LUKS1) || crypt_fips_mode()) + return crypt_get_pbkdf_type_params(CRYPT_KDF_PBKDF2); + else if (!strcmp(type, CRYPT_LUKS2)) + return crypt_get_pbkdf_type_params(DEFAULT_LUKS2_PBKDF); + + return NULL; +} + +void crypt_set_iteration_time(struct crypt_device *cd, uint64_t iteration_time_ms) +{ + struct crypt_pbkdf_type *pbkdf; + uint32_t old_time_ms; + + if (!cd || iteration_time_ms > UINT32_MAX) + return; + + pbkdf = crypt_get_pbkdf(cd); + old_time_ms = pbkdf->time_ms; + pbkdf->time_ms = (uint32_t)iteration_time_ms; + + if (pbkdf->type && verify_pbkdf_params(cd, pbkdf)) { + pbkdf->time_ms = old_time_ms; + log_dbg(cd, "Invalid iteration time."); + return; + } + + pbkdf->flags |= CRYPT_PBKDF_ITER_TIME_SET; + + /* iterations must be benchmarked now */ + pbkdf->flags &= ~(CRYPT_PBKDF_NO_BENCHMARK); + pbkdf->iterations = 0; + + log_dbg(cd, "Iteration time set to %" PRIu64 " milliseconds.", iteration_time_ms); +} diff --git a/lib/utils_safe_memory.c b/lib/utils_safe_memory.c new file mode 100644 index 0000000..6137006 --- /dev/null +++ b/lib/utils_safe_memory.c @@ -0,0 +1,104 @@ +/* + * utils_safe_memory - safe memory helpers + * + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include "libcryptsetup.h" + +struct safe_allocation { + size_t size; + char data[0]; +}; + +/* + * Replacement for memset(s, 0, n) on stack that can be optimized out + * Also used in safe allocations for explicit memory wipe. + */ +void crypt_safe_memzero(void *data, size_t size) +{ +#ifdef HAVE_EXPLICIT_BZERO + explicit_bzero(data, size); +#else + volatile uint8_t *p = (volatile uint8_t *)data; + + while(size--) + *p++ = 0; +#endif +} + +/* safe allocations */ +void *crypt_safe_alloc(size_t size) +{ + struct safe_allocation *alloc; + + if (!size || size > (SIZE_MAX - offsetof(struct safe_allocation, data))) + return NULL; + + alloc = malloc(size + offsetof(struct safe_allocation, data)); + if (!alloc) + return NULL; + + alloc->size = size; + crypt_safe_memzero(&alloc->data, size); + + /* coverity[leaked_storage] */ + return &alloc->data; +} + +void crypt_safe_free(void *data) +{ + struct safe_allocation *alloc; + volatile size_t *s; + + if (!data) + return; + + alloc = (struct safe_allocation *) + ((char *)data - offsetof(struct safe_allocation, data)); + + crypt_safe_memzero(data, alloc->size); + + s = (volatile size_t *)&alloc->size; + *s = 0x55aa55aa; + free(alloc); +} + +void *crypt_safe_realloc(void *data, size_t size) +{ + struct safe_allocation *alloc; + void *new_data; + + new_data = crypt_safe_alloc(size); + + if (new_data && data) { + + alloc = (struct safe_allocation *) + ((char *)data - offsetof(struct safe_allocation, data)); + + if (size > alloc->size) + size = alloc->size; + + memcpy(new_data, data, size); + } + + crypt_safe_free(data); + return new_data; +} diff --git a/lib/utils_storage_wrappers.c b/lib/utils_storage_wrappers.c new file mode 100644 index 0000000..80d275b --- /dev/null +++ b/lib/utils_storage_wrappers.c @@ -0,0 +1,394 @@ +/* + * Generic wrapper for storage functions + * (experimental only) + * + * Copyright (C) 2018-2021, Ondrej Kozina + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "utils_storage_wrappers.h" +#include "internal.h" + +struct crypt_storage_wrapper { + crypt_storage_wrapper_type type; + int dev_fd; + int block_size; + size_t mem_alignment; + uint64_t data_offset; + union { + struct { + struct crypt_storage *s; + uint64_t iv_start; + } cb; + struct { + int dmcrypt_fd; + char name[PATH_MAX]; + } dm; + } u; +}; + +static int crypt_storage_backend_init(struct crypt_device *cd, + struct crypt_storage_wrapper *w, + uint64_t iv_start, + int sector_size, + const char *cipher, + const char *cipher_mode, + const struct volume_key *vk, + uint32_t flags) +{ + int r; + struct crypt_storage *s; + + /* iv_start, sector_size */ + r = crypt_storage_init(&s, sector_size, cipher, cipher_mode, vk->key, vk->keylength, flags & LARGE_IV); + if (r) + return r; + + if ((flags & DISABLE_KCAPI) && crypt_storage_kernel_only(s)) { + log_dbg(cd, "Could not initialize userspace block cipher and kernel fallback is disabled."); + crypt_storage_destroy(s); + return -ENOTSUP; + } + + w->type = USPACE; + w->u.cb.s = s; + w->u.cb.iv_start = iv_start; + + return 0; +} + +static int crypt_storage_dmcrypt_init( + struct crypt_device *cd, + struct crypt_storage_wrapper *cw, + struct device *device, + uint64_t device_offset, + uint64_t iv_start, + int sector_size, + const char *cipher_spec, + struct volume_key *vk, + int open_flags) +{ + static int counter = 0; + char path[PATH_MAX]; + struct crypt_dm_active_device dmd = { + .flags = CRYPT_ACTIVATE_PRIVATE, + }; + int mode, r, fd = -1; + + log_dbg(cd, "Using temporary dmcrypt to access data."); + + if (snprintf(cw->u.dm.name, sizeof(cw->u.dm.name), "temporary-cryptsetup-%d-%d", getpid(), counter++) < 0) + return -ENOMEM; + if (snprintf(path, sizeof(path), "%s/%s", dm_get_dir(), cw->u.dm.name) < 0) + return -ENOMEM; + + r = device_block_adjust(cd, device, DEV_OK, + device_offset, &dmd.size, &dmd.flags); + if (r < 0) { + log_err(cd, _("Device %s does not exist or access denied."), + device_path(device)); + return -EIO; + } + + mode = open_flags | O_DIRECT; + if (dmd.flags & CRYPT_ACTIVATE_READONLY) + mode = (open_flags & ~O_ACCMODE) | O_RDONLY; + + if (vk->key_description) + dmd.flags |= CRYPT_ACTIVATE_KEYRING_KEY; + + r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, + device, + vk, + cipher_spec, + iv_start, + device_offset, + NULL, + 0, + sector_size); + if (r) + return r; + + r = dm_create_device(cd, cw->u.dm.name, "TEMP", &dmd); + if (r < 0) { + if (r != -EACCES && r != -ENOTSUP) + log_dbg(cd, "error hint would be nice"); + r = -EIO; + } + + dm_targets_free(cd, &dmd); + + if (r) + return r; + + fd = open(path, mode); + if (fd < 0) { + log_dbg(cd, "Failed to open %s", path); + dm_remove_device(cd, cw->u.dm.name, CRYPT_DEACTIVATE_FORCE); + return -EINVAL; + } + + cw->type = DMCRYPT; + cw->u.dm.dmcrypt_fd = fd; + + return 0; +} + +int crypt_storage_wrapper_init(struct crypt_device *cd, + struct crypt_storage_wrapper **cw, + struct device *device, + uint64_t data_offset, + uint64_t iv_start, + int sector_size, + const char *cipher, + struct volume_key *vk, + uint32_t flags) +{ + int open_flags, r; + char _cipher[MAX_CIPHER_LEN], mode[MAX_CIPHER_LEN]; + struct crypt_storage_wrapper *w; + + /* device-mapper restrictions */ + if (data_offset & ((1 << SECTOR_SHIFT) - 1)) + return -EINVAL; + + if (crypt_parse_name_and_mode(cipher, _cipher, NULL, mode)) + return -EINVAL; + + open_flags = O_CLOEXEC | ((flags & OPEN_READONLY) ? O_RDONLY : O_RDWR); + + w = malloc(sizeof(*w)); + if (!w) + return -ENOMEM; + + memset(w, 0, sizeof(*w)); + w->data_offset = data_offset; + w->mem_alignment = device_alignment(device); + w->block_size = device_block_size(cd, device); + if (!w->block_size || !w->mem_alignment) { + log_dbg(cd, "block size or alignment error."); + r = -EINVAL; + goto err; + } + + w->dev_fd = device_open(cd, device, open_flags); + if (w->dev_fd < 0) { + r = -EINVAL; + goto err; + } + + if (crypt_is_cipher_null(_cipher)) { + log_dbg(cd, "Requested cipher_null, switching to noop wrapper."); + w->type = NONE; + *cw = w; + return 0; + } + + if (!vk) { + log_dbg(cd, "no key passed."); + r = -EINVAL; + goto err; + } + + r = crypt_storage_backend_init(cd, w, iv_start, sector_size, _cipher, mode, vk, flags); + if (!r) { + *cw = w; + return 0; + } + + log_dbg(cd, "Failed to initialize userspace block cipher."); + + if ((r != -ENOTSUP && r != -ENOENT) || (flags & DISABLE_DMCRYPT)) + goto err; + + r = crypt_storage_dmcrypt_init(cd, w, device, data_offset >> SECTOR_SHIFT, iv_start, + sector_size, cipher, vk, open_flags); + if (r) { + log_dbg(cd, "Dm-crypt backend failed to initialize."); + goto err; + } + *cw = w; + return 0; +err: + crypt_storage_wrapper_destroy(w); + /* wrapper destroy */ + return r; +} + +/* offset is relative to sector_start */ +ssize_t crypt_storage_wrapper_read(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + return read_lseek_blockwise(cw->dev_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + cw->data_offset + offset); +} + +ssize_t crypt_storage_wrapper_read_decrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + int r; + ssize_t read; + + if (cw->type == DMCRYPT) + return read_lseek_blockwise(cw->u.dm.dmcrypt_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + offset); + + read = read_lseek_blockwise(cw->dev_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + cw->data_offset + offset); + if (cw->type == NONE || read < 0) + return read; + + r = crypt_storage_decrypt(cw->u.cb.s, + cw->u.cb.iv_start + (offset >> SECTOR_SHIFT), + read, + buffer); + if (r) + return -EINVAL; + + return read; +} + +ssize_t crypt_storage_wrapper_decrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + int r; + ssize_t read; + + if (cw->type == NONE) + return 0; + + if (cw->type == DMCRYPT) { + /* there's nothing we can do, just read/decrypt via dm-crypt */ + read = crypt_storage_wrapper_read_decrypt(cw, offset, buffer, buffer_length); + if (read < 0 || (size_t)read != buffer_length) + return -EINVAL; + return 0; + } + + r = crypt_storage_decrypt(cw->u.cb.s, + cw->u.cb.iv_start + (offset >> SECTOR_SHIFT), + buffer_length, + buffer); + if (r) + return r; + + return 0; +} + +ssize_t crypt_storage_wrapper_write(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + return write_lseek_blockwise(cw->dev_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + cw->data_offset + offset); +} + +ssize_t crypt_storage_wrapper_encrypt_write(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + if (cw->type == DMCRYPT) + return write_lseek_blockwise(cw->u.dm.dmcrypt_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + offset); + + if (cw->type == USPACE && + crypt_storage_encrypt(cw->u.cb.s, + cw->u.cb.iv_start + (offset >> SECTOR_SHIFT), + buffer_length, buffer)) + return -EINVAL; + + return write_lseek_blockwise(cw->dev_fd, + cw->block_size, + cw->mem_alignment, + buffer, + buffer_length, + cw->data_offset + offset); +} + +ssize_t crypt_storage_wrapper_encrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length) +{ + if (cw->type == NONE) + return 0; + + if (cw->type == DMCRYPT) + return -ENOTSUP; + + if (crypt_storage_encrypt(cw->u.cb.s, + cw->u.cb.iv_start + (offset >> SECTOR_SHIFT), + buffer_length, + buffer)) + return -EINVAL; + + return 0; +} + +void crypt_storage_wrapper_destroy(struct crypt_storage_wrapper *cw) +{ + if (!cw) + return; + + if (cw->type == USPACE) + crypt_storage_destroy(cw->u.cb.s); + if (cw->type == DMCRYPT) { + close(cw->u.dm.dmcrypt_fd); + dm_remove_device(NULL, cw->u.dm.name, CRYPT_DEACTIVATE_FORCE); + } + + free(cw); +} + +int crypt_storage_wrapper_datasync(const struct crypt_storage_wrapper *cw) +{ + if (!cw) + return -EINVAL; + if (cw->type == DMCRYPT) + return fdatasync(cw->u.dm.dmcrypt_fd); + else + return fdatasync(cw->dev_fd); +} + +crypt_storage_wrapper_type crypt_storage_wrapper_get_type(const struct crypt_storage_wrapper *cw) +{ + return cw ? cw->type : NONE; +} diff --git a/lib/utils_storage_wrappers.h b/lib/utils_storage_wrappers.h new file mode 100644 index 0000000..ec55ec2 --- /dev/null +++ b/lib/utils_storage_wrappers.h @@ -0,0 +1,75 @@ +/* + * Generic wrapper for storage functions + * (experimental only) + * + * Copyright (C) 2018-2021, Ondrej Kozina + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _UTILS_STORAGE_WRAPPERS_H +#define _UTILS_STORAGE_WRAPPERS_H + +#include +#include + +struct crypt_storage_wrapper; +struct device; +struct volume_key; +struct crypt_device; + +#define DISABLE_USPACE (1 << 0) +#define DISABLE_KCAPI (1 << 1) +#define DISABLE_DMCRYPT (1 << 2) +#define OPEN_READONLY (1 << 3) +#define LARGE_IV (1 << 4) + +typedef enum { + NONE = 0, + USPACE, + DMCRYPT +} crypt_storage_wrapper_type; + +int crypt_storage_wrapper_init(struct crypt_device *cd, + struct crypt_storage_wrapper **cw, + struct device *device, + uint64_t data_offset, + uint64_t iv_start, + int sector_size, + const char *cipher, + struct volume_key *vk, + uint32_t flags); + +void crypt_storage_wrapper_destroy(struct crypt_storage_wrapper *cw); + +/* !!! when doing 'read' or 'write' all offset values are RELATIVE to data_offset !!! */ +ssize_t crypt_storage_wrapper_read(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); +ssize_t crypt_storage_wrapper_read_decrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); +ssize_t crypt_storage_wrapper_decrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); + +ssize_t crypt_storage_wrapper_write(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); +ssize_t crypt_storage_wrapper_encrypt_write(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); +ssize_t crypt_storage_wrapper_encrypt(struct crypt_storage_wrapper *cw, + off_t offset, void *buffer, size_t buffer_length); + +int crypt_storage_wrapper_datasync(const struct crypt_storage_wrapper *cw); + +crypt_storage_wrapper_type crypt_storage_wrapper_get_type(const struct crypt_storage_wrapper *cw); +#endif diff --git a/lib/utils_wipe.c b/lib/utils_wipe.c new file mode 100644 index 0000000..2d84fc0 --- /dev/null +++ b/lib/utils_wipe.c @@ -0,0 +1,266 @@ +/* + * utils_wipe - wipe a device + * + * Copyright (C) 2004-2007 Clemens Fruhwirth + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include "internal.h" + +/* + * Wipe using Peter Gutmann method described in + * https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html + * Note: used only for rotational device (and even there it is not needed today...) + */ +static void wipeSpecial(char *buffer, size_t buffer_size, unsigned int turn) +{ + unsigned int i; + + unsigned char write_modes[][3] = { + {"\x55\x55\x55"}, {"\xaa\xaa\xaa"}, {"\x92\x49\x24"}, + {"\x49\x24\x92"}, {"\x24\x92\x49"}, {"\x00\x00\x00"}, + {"\x11\x11\x11"}, {"\x22\x22\x22"}, {"\x33\x33\x33"}, + {"\x44\x44\x44"}, {"\x55\x55\x55"}, {"\x66\x66\x66"}, + {"\x77\x77\x77"}, {"\x88\x88\x88"}, {"\x99\x99\x99"}, + {"\xaa\xaa\xaa"}, {"\xbb\xbb\xbb"}, {"\xcc\xcc\xcc"}, + {"\xdd\xdd\xdd"}, {"\xee\xee\xee"}, {"\xff\xff\xff"}, + {"\x92\x49\x24"}, {"\x49\x24\x92"}, {"\x24\x92\x49"}, + {"\x6d\xb6\xdb"}, {"\xb6\xdb\x6d"}, {"\xdb\x6d\xb6"} + }; + + for (i = 0; i < buffer_size / 3; ++i) { + memcpy(buffer, write_modes[turn], 3); + buffer += 3; + } +} + +static int crypt_wipe_special(struct crypt_device *cd, int fd, size_t bsize, + size_t alignment, char *buffer, + uint64_t offset, size_t size) +{ + int r = 0; + unsigned int i; + ssize_t written; + + for (i = 0; i < 39; ++i) { + if (i < 5) { + r = crypt_random_get(cd, buffer, size, CRYPT_RND_NORMAL); + } else if (i >= 5 && i < 32) { + wipeSpecial(buffer, size, i - 5); + r = 0; + } else if (i >= 32 && i < 38) { + r = crypt_random_get(cd, buffer, size, CRYPT_RND_NORMAL); + } else if (i >= 38 && i < 39) { + memset(buffer, 0xFF, size); + r = 0; + } + if (r < 0) + return -EIO; + + written = write_lseek_blockwise(fd, bsize, alignment, + buffer, size, offset); + if (written < 0 || written != (ssize_t)size) + return -EIO; + } + + /* Rewrite it finally with random */ + if (crypt_random_get(cd, buffer, size, CRYPT_RND_NORMAL) < 0) + return -EIO; + + written = write_lseek_blockwise(fd, bsize, alignment, buffer, size, offset); + if (written < 0 || written != (ssize_t)size) + return -EIO; + + return 0; +} + +static int wipe_block(struct crypt_device *cd, int devfd, crypt_wipe_pattern pattern, + char *sf, size_t device_block_size, size_t alignment, + size_t wipe_block_size, uint64_t offset, bool *need_block_init) +{ + int r; + + if (pattern == CRYPT_WIPE_SPECIAL) + return crypt_wipe_special(cd, devfd, device_block_size, alignment, + sf, offset, wipe_block_size); + + if (*need_block_init) { + if (pattern == CRYPT_WIPE_ZERO) { + memset(sf, 0, wipe_block_size); + *need_block_init = false; + r = 0; + } else if (pattern == CRYPT_WIPE_RANDOM) { + r = crypt_random_get(cd, sf, wipe_block_size, + CRYPT_RND_NORMAL) ? -EIO : 0; + *need_block_init = true; + } else if (pattern == CRYPT_WIPE_ENCRYPTED_ZERO) { + // FIXME + r = crypt_random_get(cd, sf, wipe_block_size, + CRYPT_RND_NORMAL) ? -EIO : 0; + *need_block_init = true; + } else + r = -EINVAL; + + if (r) + return r; + } + + if (write_blockwise(devfd, device_block_size, alignment, sf, + wipe_block_size) == (ssize_t)wipe_block_size) + return 0; + + return -EIO; +} + +int crypt_wipe_device(struct crypt_device *cd, + struct device *device, + crypt_wipe_pattern pattern, + uint64_t offset, + uint64_t length, + size_t wipe_block_size, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr), + void *usrptr) +{ + int r, devfd; + size_t bsize, alignment; + char *sf = NULL; + uint64_t dev_size; + bool need_block_init = true; + + /* Note: LUKS1 calls it with wipe_block not aligned to multiple of bsize */ + bsize = device_block_size(cd, device); + alignment = device_alignment(device); + if (!bsize || !alignment || !wipe_block_size) + return -EINVAL; + + /* FIXME: if wipe_block_size < bsize, then a wipe is highly ineffective */ + + /* Everything must be aligned to SECTOR_SIZE */ + if (MISALIGNED_512(offset) || MISALIGNED_512(length) || MISALIGNED_512(wipe_block_size)) + return -EINVAL; + + if (device_is_locked(device)) + devfd = device_open_locked(cd, device, O_RDWR); + else + devfd = device_open(cd, device, O_RDWR); + if (devfd < 0) + return errno ? -errno : -EINVAL; + + if (length) + dev_size = offset + length; + else { + r = device_size(device, &dev_size); + if (r) + goto out; + + if (dev_size <= offset) { + r = -EINVAL; + goto out; + } + } + + r = posix_memalign((void **)&sf, alignment, wipe_block_size); + if (r) + goto out; + + if (lseek64(devfd, offset, SEEK_SET) < 0) { + log_err(cd, _("Cannot seek to device offset.")); + r = -EINVAL; + goto out; + } + + if (progress && progress(dev_size, offset, usrptr)) { + r = -EINVAL; /* No change yet, treat this as a parameter error */ + goto out; + } + + if (pattern == CRYPT_WIPE_SPECIAL && !device_is_rotational(device)) { + log_dbg(cd, "Non-rotational device, using random data wipe mode."); + pattern = CRYPT_WIPE_RANDOM; + } + + while (offset < dev_size) { + if ((offset + wipe_block_size) > dev_size) + wipe_block_size = dev_size - offset; + + //log_dbg("Wipe %012" PRIu64 "-%012" PRIu64 " bytes", offset, offset + wipe_block_size); + + r = wipe_block(cd, devfd, pattern, sf, bsize, alignment, + wipe_block_size, offset, &need_block_init); + if (r) { + log_err(cd,_("Device wipe error, offset %" PRIu64 "."), offset); + break; + } + + offset += wipe_block_size; + + if (progress && progress(dev_size, offset, usrptr)) { + r = -EINTR; + break; + } + } + + device_sync(cd, device); +out: + free(sf); + return r; +} + +int crypt_wipe(struct crypt_device *cd, + const char *dev_path, + crypt_wipe_pattern pattern, + uint64_t offset, + uint64_t length, + size_t wipe_block_size, + uint32_t flags, + int (*progress)(uint64_t size, uint64_t offset, void *usrptr), + void *usrptr) +{ + struct device *device; + int r; + + if (!cd) + return -EINVAL; + + if (!dev_path) + device = crypt_data_device(cd); + else { + r = device_alloc_no_check(&device, dev_path); + if (r < 0) + return r; + + if (flags & CRYPT_WIPE_NO_DIRECT_IO) + device_disable_direct_io(device); + } + + if (!wipe_block_size) + wipe_block_size = 1024*1024; + + log_dbg(cd, "Wipe [%u] device %s, offset %" PRIu64 ", length %" PRIu64 ", block %zu.", + (unsigned)pattern, device_path(device), offset, length, wipe_block_size); + + r = crypt_wipe_device(cd, device, pattern, offset, length, + wipe_block_size, progress, usrptr); + + if (dev_path) + device_free(cd, device); + + return r; +} diff --git a/lib/verity/rs.h b/lib/verity/rs.h new file mode 100644 index 0000000..d44a230 --- /dev/null +++ b/lib/verity/rs.h @@ -0,0 +1,63 @@ +/* + * Reed-Solomon codecs, based on libfec + * + * Copyright (C) 2004 Phil Karn, KA9Q + * libcryptsetup modifications + * Copyright (C) 2017-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _LIBFEC_RS_H +#define _LIBFEC_RS_H + +/* Special reserved value encoding zero in index form. */ +#define A0 (rs->nn) + +#define RS_MIN(a, b) ((a) < (b) ? (a) : (b)) + +typedef unsigned char data_t; + +/* Reed-Solomon codec control block */ +struct rs { + int mm; /* Bits per symbol */ + int nn; /* Symbols per block (= (1<= rs->nn) { + x -= rs->nn; + x = (x >> rs->mm) + (x & rs->nn); + } + return x; +} + +struct rs *init_rs_char(int symsize, int gfpoly, int fcr, int prim, int nroots, int pad); +void free_rs_char(struct rs *rs); + +/* General purpose RS codec, 8-bit symbols */ +void encode_rs_char(struct rs *rs, data_t *data, data_t *parity); +int decode_rs_char(struct rs *rs, data_t *data); + +#endif diff --git a/lib/verity/rs_decode_char.c b/lib/verity/rs_decode_char.c new file mode 100644 index 0000000..aa27a64 --- /dev/null +++ b/lib/verity/rs_decode_char.c @@ -0,0 +1,197 @@ +/* + * Reed-Solomon decoder, based on libfec + * + * Copyright (C) 2002, Phil Karn, KA9Q + * libcryptsetup modifications + * Copyright (C) 2017-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include + +#include "rs.h" + +int decode_rs_char(struct rs* rs, data_t* data) +{ + int deg_lambda, el, deg_omega, syn_error, count; + int i, j, r, k; + data_t q, tmp, num1, num2, den, discr_r; + /* FIXME: remove VLAs here */ + data_t lambda[rs->nroots + 1], s[rs->nroots]; /* Err+Eras Locator poly and syndrome poly */ + data_t b[rs->nroots + 1], t[rs->nroots + 1], omega[rs->nroots + 1]; + data_t root[rs->nroots], reg[rs->nroots + 1], loc[rs->nroots]; + + memset(s, 0, rs->nroots * sizeof(data_t)); + memset(b, 0, (rs->nroots + 1) * sizeof(data_t)); + + /* form the syndromes; i.e., evaluate data(x) at roots of g(x) */ + for (i = 0; i < rs->nroots; i++) + s[i] = data[0]; + + for (j = 1; j < rs->nn - rs->pad; j++) { + for (i = 0; i < rs->nroots; i++) { + if (s[i] == 0) { + s[i] = data[j]; + } else { + s[i] = data[j] ^ rs->alpha_to[modnn(rs, rs->index_of[s[i]] + (rs->fcr + i) * rs->prim)]; + } + } + } + + /* Convert syndromes to index form, checking for nonzero condition */ + syn_error = 0; + for (i = 0; i < rs->nroots; i++) { + syn_error |= s[i]; + s[i] = rs->index_of[s[i]]; + } + + /* + * if syndrome is zero, data[] is a codeword and there are no + * errors to correct. So return data[] unmodified + */ + if (!syn_error) + return 0; + + memset(&lambda[1], 0, rs->nroots * sizeof(lambda[0])); + lambda[0] = 1; + + for (i = 0; i < rs->nroots + 1; i++) + b[i] = rs->index_of[lambda[i]]; + + /* + * Begin Berlekamp-Massey algorithm to determine error+erasure + * locator polynomial + */ + r = 0; + el = 0; + while (++r <= rs->nroots) { /* r is the step number */ + /* Compute discrepancy at the r-th step in poly-form */ + discr_r = 0; + for (i = 0; i < r; i++) { + if ((lambda[i] != 0) && (s[r - i - 1] != A0)) { + discr_r ^= rs->alpha_to[modnn(rs, rs->index_of[lambda[i]] + s[r - i - 1])]; + } + } + discr_r = rs->index_of[discr_r]; /* Index form */ + if (discr_r == A0) { + /* 2 lines below: B(x) <-- x*B(x) */ + memmove(&b[1], b, rs->nroots * sizeof(b[0])); + b[0] = A0; + } else { + /* 7 lines below: T(x) <-- lambda(x) - discr_r*x*b(x) */ + t[0] = lambda[0]; + for (i = 0; i < rs->nroots; i++) { + if (b[i] != A0) + t[i + 1] = lambda[i + 1] ^ rs->alpha_to[modnn(rs, discr_r + b[i])]; + else + t[i + 1] = lambda[i + 1]; + } + if (2 * el <= r - 1) { + el = r - el; + /* + * 2 lines below: B(x) <-- inv(discr_r) * + * lambda(x) + */ + for (i = 0; i <= rs->nroots; i++) + b[i] = (lambda[i] == 0) ? A0 : modnn(rs, rs->index_of[lambda[i]] - discr_r + rs->nn); + } else { + /* 2 lines below: B(x) <-- x*B(x) */ + memmove(&b[1], b, rs->nroots * sizeof(b[0])); + b[0] = A0; + } + memcpy(lambda, t, (rs->nroots + 1) * sizeof(t[0])); + } + } + + /* Convert lambda to index form and compute deg(lambda(x)) */ + deg_lambda = 0; + for (i = 0; i < rs->nroots + 1; i++) { + lambda[i] = rs->index_of[lambda[i]]; + if (lambda[i] != A0) + deg_lambda = i; + } + /* Find roots of the error+erasure locator polynomial by Chien search */ + memcpy(®[1], &lambda[1], rs->nroots * sizeof(reg[0])); + count = 0; /* Number of roots of lambda(x) */ + for (i = 1, k = rs->iprim - 1; i <= rs->nn; i++, k = modnn(rs, k + rs->iprim)) { + q = 1; /* lambda[0] is always 0 */ + for (j = deg_lambda; j > 0; j--) { + if (reg[j] != A0) { + reg[j] = modnn(rs, reg[j] + j); + q ^= rs->alpha_to[reg[j]]; + } + } + if (q != 0) + continue; /* Not a root */ + + /* store root (index-form) and error location number */ + root[count] = i; + loc[count] = k; + /* If we've already found max possible roots, abort the search to save time */ + if (++count == deg_lambda) + break; + } + + /* + * deg(lambda) unequal to number of roots => uncorrectable + * error detected + */ + if (deg_lambda != count) + return -1; + + /* + * Compute err+eras evaluator poly omega(x) = s(x)*lambda(x) (modulo + * x**rs->nroots). in index form. Also find deg(omega). + */ + deg_omega = deg_lambda - 1; + for (i = 0; i <= deg_omega; i++) { + tmp = 0; + for (j = i; j >= 0; j--) { + if ((s[i - j] != A0) && (lambda[j] != A0)) + tmp ^= rs->alpha_to[modnn(rs, s[i - j] + lambda[j])]; + } + omega[i] = rs->index_of[tmp]; + } + + /* + * Compute error values in poly-form. num1 = omega(inv(X(l))), num2 = + * inv(X(l))**(rs->fcr-1) and den = lambda_pr(inv(X(l))) all in poly-form + */ + for (j = count - 1; j >= 0; j--) { + num1 = 0; + for (i = deg_omega; i >= 0; i--) { + if (omega[i] != A0) + num1 ^= rs->alpha_to[modnn(rs, omega[i] + i * root[j])]; + } + num2 = rs->alpha_to[modnn(rs, root[j] * (rs->fcr - 1) + rs->nn)]; + den = 0; + + /* lambda[i+1] for i even is the formal derivative lambda_pr of lambda[i] */ + for (i = RS_MIN(deg_lambda, rs->nroots - 1) & ~1; i >= 0; i -= 2) { + if (lambda[i + 1] != A0) + den ^= rs->alpha_to[modnn(rs, lambda[i + 1] + i * root[j])]; + } + + /* Apply error to data */ + if (num1 != 0 && loc[j] >= rs->pad) { + data[loc[j] - rs->pad] ^= rs->alpha_to[modnn(rs, rs->index_of[num1] + + rs->index_of[num2] + rs->nn - rs->index_of[den])]; + } + } + + return count; +} diff --git a/lib/verity/rs_encode_char.c b/lib/verity/rs_encode_char.c new file mode 100644 index 0000000..cab6ae2 --- /dev/null +++ b/lib/verity/rs_encode_char.c @@ -0,0 +1,173 @@ +/* + * Reed-Solomon encoder, based on libfec + * + * Copyright (C) 2002, Phil Karn, KA9Q + * libcryptsetup modifications + * Copyright (C) 2017-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include + +#include "rs.h" + +/* Initialize a Reed-Solomon codec + * symsize = symbol size, bits + * gfpoly = Field generator polynomial coefficients + * fcr = first root of RS code generator polynomial, index form + * prim = primitive element to generate polynomial roots + * nroots = RS code generator polynomial degree (number of roots) + * pad = padding bytes at front of shortened block + */ +struct rs *init_rs_char(int symsize, int gfpoly, int fcr, int prim, int nroots, int pad) +{ + struct rs *rs; + int i, j, sr, root, iprim; + + /* Check parameter ranges */ + if (symsize < 0 || symsize > 8 * (int)sizeof(data_t)) + return NULL; + if (fcr < 0 || fcr >= (1<= (1<= (1<= ((1<mm = symsize; + rs->nn = (1<pad = pad; + + rs->alpha_to = malloc(sizeof(data_t) * (rs->nn + 1)); + if (rs->alpha_to == NULL) { + free(rs); + return NULL; + } + rs->index_of = malloc(sizeof(data_t) * (rs->nn + 1)); + if (rs->index_of == NULL) { + free(rs->alpha_to); + free(rs); + return NULL; + } + memset(rs->index_of, 0, sizeof(data_t) * (rs->nn + 1)); + + /* Generate Galois field lookup tables */ + rs->index_of[0] = A0; /* log(zero) = -inf */ + rs->alpha_to[A0] = 0; /* alpha**-inf = 0 */ + sr = 1; + for (i = 0; i < rs->nn; i++) { + rs->index_of[sr] = i; + rs->alpha_to[i] = sr; + sr <<= 1; + if(sr & (1<nn; + } + if (sr != 1) { + /* field generator polynomial is not primitive! */ + free(rs->alpha_to); + free(rs->index_of); + free(rs); + return NULL; + } + + /* Form RS code generator polynomial from its roots */ + rs->genpoly = malloc(sizeof(data_t) * (nroots + 1)); + if (rs->genpoly == NULL) { + free(rs->alpha_to); + free(rs->index_of); + free(rs); + return NULL; + } + + rs->fcr = fcr; + rs->prim = prim; + rs->nroots = nroots; + + /* Find prim-th root of 1, used in decoding */ + for (iprim = 1; (iprim % prim) != 0; iprim += rs->nn) + ; + rs->iprim = iprim / prim; + + rs->genpoly[0] = 1; + for (i = 0, root = fcr * prim; i < nroots; i++, root += prim) { + rs->genpoly[i + 1] = 1; + + /* Multiply rs->genpoly[] by @**(root + x) */ + for (j = i; j > 0; j--){ + if (rs->genpoly[j] != 0) + rs->genpoly[j] = rs->genpoly[j - 1] ^ rs->alpha_to[modnn(rs, rs->index_of[rs->genpoly[j]] + root)]; + else + rs->genpoly[j] = rs->genpoly[j - 1]; + } + /* rs->genpoly[0] can never be zero */ + rs->genpoly[0] = rs->alpha_to[modnn(rs, rs->index_of[rs->genpoly[0]] + root)]; + } + /* convert rs->genpoly[] to index form for quicker encoding */ + for (i = 0; i <= nroots; i++) + rs->genpoly[i] = rs->index_of[rs->genpoly[i]]; + + return rs; +} + +void free_rs_char(struct rs *rs) +{ + if (!rs) + return; + + free(rs->alpha_to); + free(rs->index_of); + free(rs->genpoly); + free(rs); +} + +void encode_rs_char(struct rs *rs, data_t *data, data_t *parity) +{ + int i, j; + data_t feedback; + + memset(parity, 0, rs->nroots * sizeof(data_t)); + + for (i = 0; i < rs->nn - rs->nroots - rs->pad; i++) { + feedback = rs->index_of[data[i] ^ parity[0]]; + if (feedback != A0) { + /* feedback term is non-zero */ +#ifdef UNNORMALIZED + /* This line is unnecessary when GENPOLY[NROOTS] is unity, as it must + * always be for the polynomials constructed by init_rs() */ + feedback = modnn(rs, rs->nn - rs->genpoly[rs->nroots] + feedback); +#endif + for (j = 1; j < rs->nroots; j++) + parity[j] ^= rs->alpha_to[modnn(rs, feedback + rs->genpoly[rs->nroots - j])]; + } + + /* Shift */ + memmove(&parity[0], &parity[1], sizeof(data_t) * (rs->nroots - 1)); + + if (feedback != A0) + parity[rs->nroots - 1] = rs->alpha_to[modnn(rs, feedback + rs->genpoly[0])]; + else + parity[rs->nroots - 1] = 0; + } +} diff --git a/lib/verity/verity.c b/lib/verity/verity.c new file mode 100644 index 0000000..278f34a --- /dev/null +++ b/lib/verity/verity.c @@ -0,0 +1,354 @@ +/* + * dm-verity volume handling + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "libcryptsetup.h" +#include "verity.h" +#include "internal.h" + +#define VERITY_SIGNATURE "verity\0\0" + +/* https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity#verity-superblock-format */ +struct verity_sb { + uint8_t signature[8]; /* "verity\0\0" */ + uint32_t version; /* superblock version */ + uint32_t hash_type; /* 0 - Chrome OS, 1 - normal */ + uint8_t uuid[16]; /* UUID of hash device */ + uint8_t algorithm[32];/* hash algorithm name */ + uint32_t data_block_size; /* data block in bytes */ + uint32_t hash_block_size; /* hash block in bytes */ + uint64_t data_blocks; /* number of data blocks */ + uint16_t salt_size; /* salt size */ + uint8_t _pad1[6]; + uint8_t salt[256]; /* salt */ + uint8_t _pad2[168]; +} __attribute__((packed)); + +/* Read verity superblock from disk */ +int VERITY_read_sb(struct crypt_device *cd, + uint64_t sb_offset, + char **uuid_string, + struct crypt_params_verity *params) +{ + struct device *device = crypt_metadata_device(cd); + struct verity_sb sb = {}; + ssize_t hdr_size = sizeof(struct verity_sb); + int devfd, sb_version; + + log_dbg(cd, "Reading VERITY header of size %zu on device %s, offset %" PRIu64 ".", + sizeof(struct verity_sb), device_path(device), sb_offset); + + if (params->flags & CRYPT_VERITY_NO_HEADER) { + log_err(cd, _("Verity device %s does not use on-disk header."), + device_path(device)); + return -EINVAL; + } + + if (MISALIGNED_512(sb_offset)) { + log_err(cd, _("Unsupported VERITY hash offset.")); + return -EINVAL; + } + + devfd = device_open(cd, device, O_RDONLY); + if (devfd < 0) { + log_err(cd, _("Cannot open device %s."), device_path(device)); + return -EINVAL; + } + + if (read_lseek_blockwise(devfd, device_block_size(cd, device), + device_alignment(device), &sb, hdr_size, + sb_offset) < hdr_size) + return -EIO; + + if (memcmp(sb.signature, VERITY_SIGNATURE, sizeof(sb.signature))) { + log_err(cd, _("Device %s is not a valid VERITY device."), + device_path(device)); + return -EINVAL; + } + + sb_version = le32_to_cpu(sb.version); + if (sb_version != 1) { + log_err(cd, _("Unsupported VERITY version %d."), sb_version); + return -EINVAL; + } + params->hash_type = le32_to_cpu(sb.hash_type); + if (params->hash_type > VERITY_MAX_HASH_TYPE) { + log_err(cd, _("Unsupported VERITY hash type %d."), params->hash_type); + return -EINVAL; + } + + params->data_block_size = le32_to_cpu(sb.data_block_size); + params->hash_block_size = le32_to_cpu(sb.hash_block_size); + if (VERITY_BLOCK_SIZE_OK(params->data_block_size) || + VERITY_BLOCK_SIZE_OK(params->hash_block_size)) { + log_err(cd, _("Unsupported VERITY block size.")); + return -EINVAL; + } + params->data_size = le64_to_cpu(sb.data_blocks); + + params->hash_name = strndup((const char*)sb.algorithm, sizeof(sb.algorithm)); + if (!params->hash_name) + return -ENOMEM; + if (crypt_hash_size(params->hash_name) <= 0) { + log_err(cd, _("Hash algorithm %s not supported."), + params->hash_name); + free(CONST_CAST(char*)params->hash_name); + params->hash_name = NULL; + return -EINVAL; + } + + params->salt_size = le16_to_cpu(sb.salt_size); + if (params->salt_size > sizeof(sb.salt)) { + log_err(cd, _("VERITY header corrupted.")); + free(CONST_CAST(char*)params->hash_name); + params->hash_name = NULL; + return -EINVAL; + } + params->salt = malloc(params->salt_size); + if (!params->salt) { + free(CONST_CAST(char*)params->hash_name); + params->hash_name = NULL; + return -ENOMEM; + } + memcpy(CONST_CAST(char*)params->salt, sb.salt, params->salt_size); + + if ((*uuid_string = malloc(40))) + uuid_unparse(sb.uuid, *uuid_string); + + params->hash_area_offset = sb_offset; + return 0; +} + +static void _to_lower(char *str) +{ + for(; *str; str++) + if (isupper(*str)) + *str = tolower(*str); +} + +/* Write verity superblock to disk */ +int VERITY_write_sb(struct crypt_device *cd, + uint64_t sb_offset, + const char *uuid_string, + struct crypt_params_verity *params) +{ + struct device *device = crypt_metadata_device(cd); + struct verity_sb sb = {}; + ssize_t hdr_size = sizeof(struct verity_sb); + size_t block_size; + char *algorithm; + uuid_t uuid; + int r, devfd; + + log_dbg(cd, "Updating VERITY header of size %zu on device %s, offset %" PRIu64 ".", + sizeof(struct verity_sb), device_path(device), sb_offset); + + if (!uuid_string || uuid_parse(uuid_string, uuid) == -1) { + log_err(cd, _("Wrong VERITY UUID format provided on device %s."), + device_path(device)); + return -EINVAL; + } + + if (params->flags & CRYPT_VERITY_NO_HEADER) { + log_err(cd, _("Verity device %s does not use on-disk header."), + device_path(device)); + return -EINVAL; + } + + /* Avoid possible increasing of image size - FEC could fail later because of it */ + block_size = device_block_size(cd, device); + if (block_size > params->hash_block_size) { + device_disable_direct_io(device); + block_size = params->hash_block_size; + } + + devfd = device_open(cd, device, O_RDWR); + if (devfd < 0) { + log_err(cd, _("Cannot open device %s."), device_path(device)); + return -EINVAL; + } + + memcpy(&sb.signature, VERITY_SIGNATURE, sizeof(sb.signature)); + sb.version = cpu_to_le32(1); + sb.hash_type = cpu_to_le32(params->hash_type); + sb.data_block_size = cpu_to_le32(params->data_block_size); + sb.hash_block_size = cpu_to_le32(params->hash_block_size); + sb.salt_size = cpu_to_le16(params->salt_size); + sb.data_blocks = cpu_to_le64(params->data_size); + + /* Kernel always use lower-case */ + algorithm = (char *)sb.algorithm; + strncpy(algorithm, params->hash_name, sizeof(sb.algorithm)-1); + algorithm[sizeof(sb.algorithm)-1] = '\0'; + _to_lower(algorithm); + + memcpy(sb.salt, params->salt, params->salt_size); + memcpy(sb.uuid, uuid, sizeof(sb.uuid)); + + r = write_lseek_blockwise(devfd, block_size, device_alignment(device), + (char*)&sb, hdr_size, sb_offset) < hdr_size ? -EIO : 0; + if (r) + log_err(cd, _("Error during update of verity header on device %s."), + device_path(device)); + + device_sync(cd, device); + + return r; +} + +/* Calculate hash offset in hash blocks */ +uint64_t VERITY_hash_offset_block(struct crypt_params_verity *params) +{ + uint64_t hash_offset = params->hash_area_offset; + + if (params->flags & CRYPT_VERITY_NO_HEADER) + return hash_offset / params->hash_block_size; + + hash_offset += sizeof(struct verity_sb); + hash_offset += params->hash_block_size - 1; + + return hash_offset / params->hash_block_size; +} + +int VERITY_UUID_generate(struct crypt_device *cd, char **uuid_string) +{ + uuid_t uuid; + + *uuid_string = malloc(40); + if (!*uuid_string) + return -ENOMEM; + uuid_generate(uuid); + uuid_unparse(uuid, *uuid_string); + return 0; +} + +/* Activate verity device in kernel device-mapper */ +int VERITY_activate(struct crypt_device *cd, + const char *name, + const char *root_hash, + size_t root_hash_size, + const char *signature_description, + struct device *fec_device, + struct crypt_params_verity *verity_hdr, + uint32_t activation_flags) +{ + uint32_t dmv_flags; + unsigned int fec_errors = 0; + int r, v; + struct crypt_dm_active_device dmd = { + .size = verity_hdr->data_size * verity_hdr->data_block_size / 512, + .flags = activation_flags, + .uuid = crypt_get_uuid(cd), + }; + + log_dbg(cd, "Trying to activate VERITY device %s using hash %s.", + name ?: "[none]", verity_hdr->hash_name); + + if (verity_hdr->flags & CRYPT_VERITY_CHECK_HASH) { + if (signature_description) { + log_err(cd, _("Root hash signature verification is not supported.")); + return -EINVAL; + } + + log_dbg(cd, "Verification of data in userspace required."); + r = VERITY_verify(cd, verity_hdr, root_hash, root_hash_size); + + if ((r == -EPERM || r == -EFAULT) && fec_device) { + v = r; + log_dbg(cd, "Verification failed, trying to repair with FEC device."); + r = VERITY_FEC_process(cd, verity_hdr, fec_device, 1, &fec_errors); + if (r < 0) + log_err(cd, _("Errors cannot be repaired with FEC device.")); + else if (fec_errors) { + log_err(cd, _("Found %u repairable errors with FEC device."), + fec_errors); + /* If root hash failed, we cannot be sure it was properly repaired */ + } + if (v == -EFAULT) + r = -EPERM; + } + + if (r < 0) + return r; + } + + if (!name) + return 0; + + r = device_block_adjust(cd, crypt_metadata_device(cd), DEV_OK, + 0, NULL, NULL); + if (r) + return r; + + r = device_block_adjust(cd, crypt_data_device(cd), DEV_EXCL, + 0, &dmd.size, &dmd.flags); + if (r) + return r; + + if (fec_device) { + r = device_block_adjust(cd, fec_device, DEV_OK, + 0, NULL, NULL); + if (r) + return r; + } + + r = dm_verity_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd), + crypt_metadata_device(cd), fec_device, root_hash, + root_hash_size, signature_description, + VERITY_hash_offset_block(verity_hdr), + VERITY_FEC_blocks(cd, fec_device, verity_hdr), verity_hdr); + + if (r) + return r; + + r = dm_create_device(cd, name, CRYPT_VERITY, &dmd); + if (r < 0 && (dm_flags(cd, DM_VERITY, &dmv_flags) || !(dmv_flags & DM_VERITY_SUPPORTED))) { + log_err(cd, _("Kernel does not support dm-verity mapping.")); + r = -ENOTSUP; + } + if (r < 0 && signature_description && !(dmv_flags & DM_VERITY_SIGNATURE_SUPPORTED)) { + log_err(cd, _("Kernel does not support dm-verity signature option.")); + r = -ENOTSUP; + } + if (r < 0) + goto out; + + r = dm_status_verity_ok(cd, name); + if (r < 0) + goto out; + + if (!r) + log_err(cd, _("Verity device detected corruption after activation.")); + + r = 0; +out: + dm_targets_free(cd, &dmd); + return r; +} diff --git a/lib/verity/verity.h b/lib/verity/verity.h new file mode 100644 index 0000000..2269649 --- /dev/null +++ b/lib/verity/verity.h @@ -0,0 +1,80 @@ +/* + * dm-verity volume handling + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#ifndef _VERITY_H +#define _VERITY_H + +#include +#include + +#define VERITY_MAX_HASH_TYPE 1 +#define VERITY_BLOCK_SIZE_OK(x) ((x) % 512 || (x) < 512 || \ + (x) > (512 * 1024) || (x) & ((x)-1)) + +struct crypt_device; +struct crypt_params_verity; +struct device; + +int VERITY_read_sb(struct crypt_device *cd, + uint64_t sb_offset, + char **uuid, + struct crypt_params_verity *params); + +int VERITY_write_sb(struct crypt_device *cd, + uint64_t sb_offset, + const char *uuid_string, + struct crypt_params_verity *params); + +int VERITY_activate(struct crypt_device *cd, + const char *name, + const char *root_hash, + size_t root_hash_size, + const char *signature_description, + struct device *fec_device, + struct crypt_params_verity *verity_hdr, + uint32_t activation_flags); + +int VERITY_verify(struct crypt_device *cd, + struct crypt_params_verity *verity_hdr, + const char *root_hash, + size_t root_hash_size); + +int VERITY_create(struct crypt_device *cd, + struct crypt_params_verity *verity_hdr, + const char *root_hash, + size_t root_hash_size); + +int VERITY_FEC_process(struct crypt_device *cd, + struct crypt_params_verity *params, + struct device *fec_device, + int check_fec, + unsigned int *errors); + +uint64_t VERITY_hash_offset_block(struct crypt_params_verity *params); + +uint64_t VERITY_hash_blocks(struct crypt_device *cd, struct crypt_params_verity *params); + +uint64_t VERITY_FEC_blocks(struct crypt_device *cd, + struct device *fec_device, + struct crypt_params_verity *params); + +int VERITY_UUID_generate(struct crypt_device *cd, char **uuid_string); + +#endif diff --git a/lib/verity/verity_fec.c b/lib/verity/verity_fec.c new file mode 100644 index 0000000..e076c97 --- /dev/null +++ b/lib/verity/verity_fec.c @@ -0,0 +1,316 @@ +/* + * dm-verity Forward Error Correction (FEC) support + * + * Copyright (C) 2015 Google, Inc. All rights reserved. + * Copyright (C) 2017-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include + +#include "verity.h" +#include "internal.h" +#include "rs.h" + +/* ecc parameters */ +#define FEC_RSM 255 +#define FEC_MIN_RSN 231 +#define FEC_MAX_RSN 253 + +#define FEC_INPUT_DEVICES 2 + +/* parameters to init_rs_char */ +#define FEC_PARAMS(roots) \ + 8, /* symbol size in bits */ \ + 0x11d, /* field generator polynomial coefficients */ \ + 0, /* first root of the generator */ \ + 1, /* primitive element to generate polynomial roots */ \ + (roots), /* polynomial degree (number of roots) */ \ + 0 /* padding bytes at the front of shortened block */ + +struct fec_input_device { + struct device *device; + int fd; + uint64_t start; + uint64_t count; +}; + +struct fec_context { + uint32_t rsn; + uint32_t roots; + uint64_t size; + uint64_t blocks; + uint64_t rounds; + uint32_t block_size; + struct fec_input_device *inputs; + size_t ninputs; +}; + +/* computes ceil(x / y) */ +static inline uint64_t FEC_div_round_up(uint64_t x, uint64_t y) +{ + return (x / y) + (x % y > 0 ? 1 : 0); +} + +/* returns a physical offset for the given RS offset */ +static inline uint64_t FEC_interleave(struct fec_context *ctx, uint64_t offset) +{ + return (offset / ctx->rsn) + + (offset % ctx->rsn) * ctx->rounds * ctx->block_size; +} + +/* returns data for a byte at the specified RS offset */ +static int FEC_read_interleaved(struct fec_context *ctx, uint64_t i, + void *output, size_t count) +{ + size_t n; + uint64_t offset = FEC_interleave(ctx, i); + + /* offsets outside input area are assumed to contain zeros */ + if (offset >= ctx->size) { + memset(output, 0, count); + return 0; + } + + /* find the correct input device and read from it */ + for (n = 0; n < ctx->ninputs; ++n) { + if (offset >= ctx->inputs[n].count) { + offset -= ctx->inputs[n].count; + continue; + } + + /* FIXME: read_lseek_blockwise candidate */ + if (lseek(ctx->inputs[n].fd, ctx->inputs[n].start + offset, SEEK_SET) < 0) + return -1; + return (read_buffer(ctx->inputs[n].fd, output, count) == (ssize_t)count) ? 0 : -1; + } + + /* should never be reached */ + return -1; +} + +/* encodes/decode inputs to/from fd */ +static int FEC_process_inputs(struct crypt_device *cd, + struct crypt_params_verity *params, + struct fec_input_device *inputs, + size_t ninputs, int fd, + int decode, unsigned int *errors) +{ + int r = 0; + unsigned int i; + struct fec_context ctx; + uint32_t b; + uint64_t n; + uint8_t rs_block[FEC_RSM]; + uint8_t *buf = NULL; + void *rs; + + /* initialize parameters */ + ctx.roots = params->fec_roots; + ctx.rsn = FEC_RSM - ctx.roots; + ctx.block_size = params->data_block_size; + ctx.inputs = inputs; + ctx.ninputs = ninputs; + + rs = init_rs_char(FEC_PARAMS(ctx.roots)); + if (!rs) { + log_err(cd, _("Failed to allocate RS context.")); + return -ENOMEM; + } + + /* calculate the total area covered by error correction codes */ + ctx.size = 0; + for (n = 0; n < ctx.ninputs; ++n) { + log_dbg(cd, "FEC input %s, offset %" PRIu64 " [bytes], length %" PRIu64 " [bytes]", + device_path(ctx.inputs[n].device), ctx.inputs[n].start, ctx.inputs[n].count); + ctx.size += ctx.inputs[n].count; + } + + /* each byte in a data block is covered by a different code */ + ctx.blocks = FEC_div_round_up(ctx.size, ctx.block_size); + ctx.rounds = FEC_div_round_up(ctx.blocks, ctx.rsn); + + buf = malloc((size_t)ctx.block_size * ctx.rsn); + if (!buf) { + log_err(cd, _("Failed to allocate buffer.")); + r = -ENOMEM; + goto out; + } + + /* encode/decode input */ + for (n = 0; n < ctx.rounds; ++n) { + for (i = 0; i < ctx.rsn; ++i) { + if (FEC_read_interleaved(&ctx, n * ctx.rsn * ctx.block_size + i, + &buf[i * ctx.block_size], ctx.block_size)) { + log_err(cd, _("Failed to read RS block %" PRIu64 " byte %d."), n, i); + r = -EIO; + goto out; + } + } + + for (b = 0; b < ctx.block_size; ++b) { + for (i = 0; i < ctx.rsn; ++i) + rs_block[i] = buf[i * ctx.block_size + b]; + + /* decoding from parity device */ + if (decode) { + if (read_buffer(fd, &rs_block[ctx.rsn], ctx.roots) < 0) { + log_err(cd, _("Failed to read parity for RS block %" PRIu64 "."), n); + r = -EIO; + goto out; + } + + /* coverity[tainted_data] */ + r = decode_rs_char(rs, rs_block); + if (r < 0) { + log_err(cd, _("Failed to repair parity for block %" PRIu64 "."), n); + goto out; + } + /* return number of detected errors */ + if (errors) + *errors += r; + r = 0; + } else { + /* encoding and writing parity data to fec device */ + encode_rs_char(rs, rs_block, &rs_block[ctx.rsn]); + if (write_buffer(fd, &rs_block[ctx.rsn], ctx.roots) < 0) { + log_err(cd, _("Failed to write parity for RS block %" PRIu64 "."), n); + r = -EIO; + goto out; + } + } + } + } +out: + free_rs_char(rs); + free(buf); + return r; +} + +int VERITY_FEC_process(struct crypt_device *cd, + struct crypt_params_verity *params, + struct device *fec_device, int check_fec, + unsigned int *errors) +{ + int r = -EIO, fd = -1; + size_t ninputs = FEC_INPUT_DEVICES; + struct fec_input_device inputs[FEC_INPUT_DEVICES] = { + { + .device = crypt_data_device(cd), + .fd = -1, + .start = 0, + .count = params->data_size * params->data_block_size + },{ + .device = crypt_metadata_device(cd), + .fd = -1, + .start = VERITY_hash_offset_block(params) * params->data_block_size, + .count = (VERITY_FEC_blocks(cd, fec_device, params) - params->data_size) * params->data_block_size + } + }; + + /* validate parameters */ + if (params->data_block_size != params->hash_block_size) { + log_err(cd, _("Block sizes must match for FEC.")); + return -EINVAL; + } + + if (params->fec_roots > FEC_RSM - FEC_MIN_RSN || + params->fec_roots < FEC_RSM - FEC_MAX_RSN) { + log_err(cd, _("Invalid number of parity bytes.")); + return -EINVAL; + } + + if (!inputs[0].count) { + log_err(cd, _("Invalid FEC segment length.")); + return -EINVAL; + } + if (!inputs[1].count) + ninputs--; + + if (check_fec) + fd = open(device_path(fec_device), O_RDONLY); + else + fd = open(device_path(fec_device), O_RDWR); + + if (fd == -1) { + log_err(cd, _("Cannot open device %s."), device_path(fec_device)); + goto out; + } + + if (lseek(fd, params->fec_area_offset, SEEK_SET) < 0) { + log_dbg(cd, "Cannot seek to requested position in FEC device."); + goto out; + } + + /* input devices */ + inputs[0].fd = open(device_path(inputs[0].device), O_RDONLY); + if (inputs[0].fd == -1) { + log_err(cd, _("Cannot open device %s."), device_path(inputs[0].device)); + goto out; + } + inputs[1].fd = open(device_path(inputs[1].device), O_RDONLY); + if (inputs[1].fd == -1) { + log_err(cd, _("Cannot open device %s."), device_path(inputs[1].device)); + goto out; + } + + r = FEC_process_inputs(cd, params, inputs, ninputs, fd, check_fec, errors); +out: + if (inputs[0].fd != -1) + close(inputs[0].fd); + if (inputs[1].fd != -1) + close(inputs[1].fd); + if (fd != -1) + close(fd); + + return r; +} + +uint64_t VERITY_FEC_blocks(struct crypt_device *cd, + struct device *fec_device, + struct crypt_params_verity *params) +{ + uint64_t blocks = 0; + + /* + * FEC covers this data: + * | protected data | hash area | padding (optional foreign metadata) | + * + * If hash device is in a separate image, metadata covers the whole rest of the image after hash area. + * If hash and FEC device is in the image, metadata ends on the FEC area offset. + */ + if (device_is_identical(crypt_metadata_device(cd), fec_device) > 0) { + log_dbg(cd, "FEC and hash device is the same."); + blocks = params->fec_area_offset; + } else { + /* cover the entire hash device starting from hash_offset */ + if (device_size(crypt_metadata_device(cd), &blocks)) { + log_err(cd, _("Failed to determine size for device %s."), + device_path(crypt_metadata_device(cd))); + return 0; + } + } + + blocks /= params->data_block_size; + if (blocks) + blocks -= VERITY_hash_offset_block(params); + + /* Protected data */ + blocks += params->data_size; + + return blocks; +} diff --git a/lib/verity/verity_hash.c b/lib/verity/verity_hash.c new file mode 100644 index 0000000..a493781 --- /dev/null +++ b/lib/verity/verity_hash.c @@ -0,0 +1,410 @@ +/* + * dm-verity volume handling + * + * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved. + * + * This file is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This file is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this file; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include + +#include "verity.h" +#include "internal.h" + +#define VERITY_MAX_LEVELS 63 + +static unsigned get_bits_up(size_t u) +{ + unsigned i = 0; + while ((1U << i) < u) + i++; + return i; +} + +static unsigned get_bits_down(size_t u) +{ + unsigned i = 0; + while ((u >> i) > 1U) + i++; + return i; +} + +static int verify_zero(struct crypt_device *cd, FILE *wr, size_t bytes) +{ + char block[bytes]; + size_t i; + + if (fread(block, bytes, 1, wr) != 1) { + log_dbg(cd, "EIO while reading spare area."); + return -EIO; + } + for (i = 0; i < bytes; i++) + if (block[i]) { + log_err(cd, _("Spare area is not zeroed at position %" PRIu64 "."), + ftello(wr) - bytes); + return -EPERM; + } + return 0; +} + +static int verify_hash_block(const char *hash_name, int version, + char *hash, size_t hash_size, + const char *data, size_t data_size, + const char *salt, size_t salt_size) +{ + struct crypt_hash *ctx = NULL; + int r; + + if (crypt_hash_init(&ctx, hash_name)) + return -EINVAL; + + if (version == 1 && (r = crypt_hash_write(ctx, salt, salt_size))) + goto out; + + if ((r = crypt_hash_write(ctx, data, data_size))) + goto out; + + if (version == 0 && (r = crypt_hash_write(ctx, salt, salt_size))) + goto out; + + r = crypt_hash_final(ctx, hash, hash_size); +out: + crypt_hash_destroy(ctx); + return r; +} + +static int hash_levels(size_t hash_block_size, size_t digest_size, + uint64_t data_file_blocks, uint64_t *hash_position, int *levels, + uint64_t *hash_level_block, uint64_t *hash_level_size) +{ + size_t hash_per_block_bits; + uint64_t s, s_shift; + int i; + + if (!digest_size) + return -EINVAL; + + hash_per_block_bits = get_bits_down(hash_block_size / digest_size); + if (!hash_per_block_bits) + return -EINVAL; + + *levels = 0; + while (hash_per_block_bits * *levels < 64 && + (data_file_blocks - 1) >> (hash_per_block_bits * *levels)) + (*levels)++; + + if (*levels > VERITY_MAX_LEVELS) + return -EINVAL; + + for (i = *levels - 1; i >= 0; i--) { + if (hash_level_block) + hash_level_block[i] = *hash_position; + // verity position of block data_file_blocks at level i + s_shift = (i + 1) * hash_per_block_bits; + if (s_shift > 63) + return -EINVAL; + s = (data_file_blocks + ((uint64_t)1 << s_shift) - 1) >> ((i + 1) * hash_per_block_bits); + if (hash_level_size) + hash_level_size[i] = s; + if ((*hash_position + s) < *hash_position) + return -EINVAL; + *hash_position += s; + } + + return 0; +} + +static int create_or_verify(struct crypt_device *cd, FILE *rd, FILE *wr, + uint64_t data_block, size_t data_block_size, + uint64_t hash_block, size_t hash_block_size, + uint64_t blocks, int version, + const char *hash_name, int verify, + char *calculated_digest, size_t digest_size, + const char *salt, size_t salt_size) +{ + char left_block[hash_block_size]; + char data_buffer[data_block_size]; + char read_digest[digest_size]; + size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size); + size_t digest_size_full = 1 << get_bits_up(digest_size); + uint64_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block; + uint64_t seek_rd, seek_wr; + size_t left_bytes; + unsigned i; + int r; + + if (uint64_mult_overflow(&seek_rd, data_block, data_block_size) || + uint64_mult_overflow(&seek_wr, hash_block, hash_block_size)) { + log_err(cd, _("Device offset overflow.")); + return -EINVAL; + } + + if (fseeko(rd, seek_rd, SEEK_SET)) { + log_dbg(cd, "Cannot seek to requested position in data device."); + return -EIO; + } + + if (wr && fseeko(wr, seek_wr, SEEK_SET)) { + log_dbg(cd, "Cannot seek to requested position in hash device."); + return -EIO; + } + + memset(left_block, 0, hash_block_size); + while (blocks_to_write--) { + left_bytes = hash_block_size; + for (i = 0; i < hash_per_block; i++) { + if (!blocks) + break; + blocks--; + if (fread(data_buffer, data_block_size, 1, rd) != 1) { + log_dbg(cd, "Cannot read data device block."); + return -EIO; + } + + if (verify_hash_block(hash_name, version, + calculated_digest, digest_size, + data_buffer, data_block_size, + salt, salt_size)) + return -EINVAL; + + if (!wr) + break; + if (verify) { + if (fread(read_digest, digest_size, 1, wr) != 1) { + log_dbg(cd, "Cannot read digest form hash device."); + return -EIO; + } + if (memcmp(read_digest, calculated_digest, digest_size)) { + log_err(cd, _("Verification failed at position %" PRIu64 "."), + ftello(rd) - data_block_size); + return -EPERM; + } + } else { + if (fwrite(calculated_digest, digest_size, 1, wr) != 1) { + log_dbg(cd, "Cannot write digest to hash device."); + return -EIO; + } + } + if (version == 0) { + left_bytes -= digest_size; + } else { + if (digest_size_full - digest_size) { + if (verify) { + r = verify_zero(cd, wr, digest_size_full - digest_size); + if (r) + return r; + } else if (fwrite(left_block, digest_size_full - digest_size, 1, wr) != 1) { + log_dbg(cd, "Cannot write spare area to hash device."); + return -EIO; + } + } + left_bytes -= digest_size_full; + } + } + if (wr && left_bytes) { + if (verify) { + r = verify_zero(cd , wr, left_bytes); + if (r) + return r; + } else if (fwrite(left_block, left_bytes, 1, wr) != 1) { + log_dbg(cd, "Cannot write remaining spare area to hash device."); + return -EIO; + } + } + } + + return 0; +} + +static int VERITY_create_or_verify_hash(struct crypt_device *cd, bool verify, + struct crypt_params_verity *params, + char *root_hash, size_t digest_size) +{ + char calculated_digest[digest_size]; + FILE *data_file = NULL; + FILE *hash_file = NULL, *hash_file_2; + uint64_t hash_level_block[VERITY_MAX_LEVELS]; + uint64_t hash_level_size[VERITY_MAX_LEVELS]; + uint64_t data_file_blocks; + uint64_t data_device_offset_max = 0, hash_device_offset_max = 0; + uint64_t hash_position = VERITY_hash_offset_block(params); + uint64_t dev_size; + int levels, i, r; + + log_dbg(cd, "Hash %s %s, data device %s, data blocks %" PRIu64 + ", hash_device %s, offset %" PRIu64 ".", + verify ? "verification" : "creation", params->hash_name, + device_path(crypt_data_device(cd)), params->data_size, + device_path(crypt_metadata_device(cd)), hash_position); + + if (!params->data_size) { + r = device_size(crypt_data_device(cd), &dev_size); + if (r < 0) + return r; + + data_file_blocks = dev_size / params->data_block_size; + } else + data_file_blocks = params->data_size; + + if (uint64_mult_overflow(&data_device_offset_max, params->data_size, params->data_block_size)) { + log_err(cd, _("Device offset overflow.")); + return -EINVAL; + } + log_dbg(cd, "Data device size required: %" PRIu64 " bytes.", data_device_offset_max); + + if (hash_levels(params->hash_block_size, digest_size, data_file_blocks, &hash_position, + &levels, &hash_level_block[0], &hash_level_size[0])) { + log_err(cd, _("Hash area overflow.")); + return -EINVAL; + } + if (uint64_mult_overflow(&hash_device_offset_max, hash_position, params->hash_block_size)) { + log_err(cd, _("Device offset overflow.")); + return -EINVAL; + } + log_dbg(cd, "Hash device size required: %" PRIu64 " bytes.", + hash_device_offset_max - params->hash_area_offset); + log_dbg(cd, "Using %d hash levels.", levels); + + data_file = fopen(device_path(crypt_data_device(cd)), "r"); + if (!data_file) { + log_err(cd, _("Cannot open device %s."), + device_path(crypt_data_device(cd)) + ); + r = -EIO; + goto out; + } + + hash_file = fopen(device_path(crypt_metadata_device(cd)), verify ? "r" : "r+"); + if (!hash_file) { + log_err(cd, _("Cannot open device %s."), + device_path(crypt_metadata_device(cd))); + r = -EIO; + goto out; + } + + memset(calculated_digest, 0, digest_size); + + for (i = 0; i < levels; i++) { + if (!i) { + r = create_or_verify(cd, data_file, hash_file, + 0, params->data_block_size, + hash_level_block[i], params->hash_block_size, + data_file_blocks, params->hash_type, params->hash_name, verify, + calculated_digest, digest_size, params->salt, params->salt_size); + if (r) + goto out; + } else { + hash_file_2 = fopen(device_path(crypt_metadata_device(cd)), "r"); + if (!hash_file_2) { + log_err(cd, _("Cannot open device %s."), + device_path(crypt_metadata_device(cd))); + r = -EIO; + goto out; + } + r = create_or_verify(cd, hash_file_2, hash_file, + hash_level_block[i - 1], params->hash_block_size, + hash_level_block[i], params->hash_block_size, + hash_level_size[i - 1], params->hash_type, params->hash_name, verify, + calculated_digest, digest_size, params->salt, params->salt_size); + fclose(hash_file_2); + if (r) + goto out; + } + } + + if (levels) + r = create_or_verify(cd, hash_file, NULL, + hash_level_block[levels - 1], params->hash_block_size, + 0, params->hash_block_size, + 1, params->hash_type, params->hash_name, verify, + calculated_digest, digest_size, params->salt, params->salt_size); + else + r = create_or_verify(cd, data_file, NULL, + 0, params->data_block_size, + 0, params->hash_block_size, + data_file_blocks, params->hash_type, params->hash_name, verify, + calculated_digest, digest_size, params->salt, params->salt_size); +out: + if (verify) { + if (r) + log_err(cd, _("Verification of data area failed.")); + else { + log_dbg(cd, "Verification of data area succeeded."); + r = memcmp(root_hash, calculated_digest, digest_size) ? -EFAULT : 0; + if (r) + log_err(cd, _("Verification of root hash failed.")); + else + log_dbg(cd, "Verification of root hash succeeded."); + } + } else { + if (r == -EIO) + log_err(cd, _("Input/output error while creating hash area.")); + else if (r) + log_err(cd, _("Creation of hash area failed.")); + else { + fsync(fileno(hash_file)); + memcpy(root_hash, calculated_digest, digest_size); + } + } + + if (data_file) + fclose(data_file); + if (hash_file) + fclose(hash_file); + return r; +} + +/* Verify verity device using userspace crypto backend */ +int VERITY_verify(struct crypt_device *cd, + struct crypt_params_verity *verity_hdr, + const char *root_hash, + size_t root_hash_size) +{ + return VERITY_create_or_verify_hash(cd, 1, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size); +} + +/* Create verity hash */ +int VERITY_create(struct crypt_device *cd, + struct crypt_params_verity *verity_hdr, + const char *root_hash, + size_t root_hash_size) +{ + unsigned pgsize = (unsigned)crypt_getpagesize(); + + if (verity_hdr->salt_size > 256) + return -EINVAL; + + if (verity_hdr->data_block_size > pgsize) + log_err(cd, _("WARNING: Kernel cannot activate device if data " + "block size exceeds page size (%u)."), pgsize); + + return VERITY_create_or_verify_hash(cd, 0, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size); +} + +uint64_t VERITY_hash_blocks(struct crypt_device *cd, struct crypt_params_verity *params) +{ + uint64_t hash_position = 0; + int levels = 0; + + if (hash_levels(params->hash_block_size, crypt_get_volume_key_size(cd), + params->data_size, &hash_position, &levels, NULL, NULL)) + return 0; + + return (uint64_t)hash_position; +} diff --git a/lib/volumekey.c b/lib/volumekey.c new file mode 100644 index 0000000..fafaec6 --- /dev/null +++ b/lib/volumekey.c @@ -0,0 +1,147 @@ +/* + * cryptsetup volume key implementation + * + * Copyright (C) 2004-2006 Clemens Fruhwirth + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include + +#include "internal.h" + +struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key) +{ + struct volume_key *vk; + + if (keylength > (SIZE_MAX - sizeof(*vk))) + return NULL; + + vk = malloc(sizeof(*vk) + keylength); + if (!vk) + return NULL; + + vk->key_description = NULL; + vk->keylength = keylength; + vk->id = -1; + vk->next = NULL; + + /* keylength 0 is valid => no key */ + if (vk->keylength) { + if (key) + memcpy(&vk->key, key, keylength); + else + crypt_safe_memzero(&vk->key, keylength); + } + + return vk; +} + +int crypt_volume_key_set_description(struct volume_key *vk, const char *key_description) +{ + if (!vk) + return -EINVAL; + + free(CONST_CAST(void*)vk->key_description); + vk->key_description = NULL; + if (key_description && !(vk->key_description = strdup(key_description))) + return -ENOMEM; + + return 0; +} + +void crypt_volume_key_set_id(struct volume_key *vk, int id) +{ + if (vk && id >= 0) + vk->id = id; +} + +int crypt_volume_key_get_id(const struct volume_key *vk) +{ + return vk ? vk->id : -1; +} + +struct volume_key *crypt_volume_key_by_id(struct volume_key *vks, int id) +{ + struct volume_key *vk = vks; + + if (id < 0) + return NULL; + + while (vk && vk->id != id) + vk = vk->next; + + return vk; +} + +void crypt_volume_key_add_next(struct volume_key **vks, struct volume_key *vk) +{ + struct volume_key *tmp; + + if (!vks) + return; + + if (!*vks) { + *vks = vk; + return; + } + + tmp = *vks; + + while (tmp->next) + tmp = tmp->next; + + tmp->next = vk; +} + +struct volume_key *crypt_volume_key_next(struct volume_key *vk) +{ + return vk ? vk->next : NULL; +} + +void crypt_free_volume_key(struct volume_key *vk) +{ + struct volume_key *vk_next; + + while (vk) { + crypt_safe_memzero(vk->key, vk->keylength); + vk->keylength = 0; + free(CONST_CAST(void*)vk->key_description); + vk_next = vk->next; + free(vk); + vk = vk_next; + } +} + +struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, size_t keylength) +{ + int r; + struct volume_key *vk; + + vk = crypt_alloc_volume_key(keylength, NULL); + if (!vk) + return NULL; + + r = crypt_random_get(cd, vk->key, keylength, CRYPT_RND_KEY); + if(r < 0) { + crypt_free_volume_key(vk); + return NULL; + } + return vk; +} diff --git a/man/Makemodule.am b/man/Makemodule.am new file mode 100644 index 0000000..3f68441 --- /dev/null +++ b/man/Makemodule.am @@ -0,0 +1,15 @@ +EXTRA_DIST += man/cryptsetup.8 man/integritysetup.8 man/veritysetup.8 man/cryptsetup-reencrypt.8 + +man8_MANS += man/cryptsetup.8 + +if VERITYSETUP +man8_MANS += man/veritysetup.8 +endif + +if REENCRYPT +man8_MANS += man/cryptsetup-reencrypt.8 +endif + +if INTEGRITYSETUP +man8_MANS += man/integritysetup.8 +endif diff --git a/man/cryptsetup-reencrypt.8 b/man/cryptsetup-reencrypt.8 new file mode 100644 index 0000000..333ed58 --- /dev/null +++ b/man/cryptsetup-reencrypt.8 @@ -0,0 +1,295 @@ +.TH CRYPTSETUP-REENCRYPT "8" "January 2021" "cryptsetup-reencrypt" "Maintenance Commands" +.SH NAME +cryptsetup-reencrypt - tool for offline LUKS device re-encryption +.SH SYNOPSIS +.B cryptsetup-reencrypt +.SH DESCRIPTION +.PP +Cryptsetup-reencrypt can be used to change reencryption parameters +which otherwise require full on-disk data change (re-encryption). + +You can regenerate \fBvolume key\fR (the real key used in on-disk encryption +unclocked by passphrase), \fBcipher\fR, \fBcipher mode\fR. + +Cryptsetup-reencrypt reencrypts data on LUKS device in-place. During +reencryption process the LUKS device is marked unavailable. + +\fINOTE\fR: If you're looking for LUKS2 online reencryption manual please read cryptsetup(8) +man page instead (see reencrypt action). This page is for legacy offline reencryption +utility only. + +\fIWARNING\fR: The cryptsetup-reencrypt program is not resistant to hardware +or kernel failures during reencryption (you can lose your data in this case). + +\fIALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL.\fR +.br +The reencryption can be temporarily suspended (by TERM signal or by +using ctrl+c) but you need to retain temporary files named LUKS-.[log|org|new]. +LUKS device is unavailable until reencryption is finished though. + +Current working directory must be writable and temporary +files created during reencryption must be present. + +For more info about LUKS see cryptsetup(8). +.PP +.SH OPTIONS +.TP +To start (or continue) re-encryption for use: +.PP +\fIcryptsetup-reencrypt\fR + +\fB\fR can be [\-\-batch-mode, \-\-block-size, \-\-cipher | \-\-keep-key, +\-\-debug, \-\-device-size, \-\-hash, \-\-header, \-\-iter-time | \-\-pbkdf\-force\-iterations, +\-\-key-file, \-\-key-size, \-\-key-slot, \-\-keyfile-offset, \-\-keyfile-size, +\-\-master\-key\-file, \-\-tries, \-\-pbkdf, \-\-pbkdf\-memory, \-\-pbkdf\-parallel, +\-\-progress-frequency, \-\-use-directio, \-\-use-random | \-\-use-urandom, \-\-use-fsync, +\-\-uuid, \-\-verbose, \-\-write-log] + +To encrypt data on (not yet encrypted) device, use \fI\-\-new\fR in combination +with \fI\-\-reduce-device-size\fR or with \fI\-\-header\fR option for detached header. + +To remove encryption from device, use \fI\-\-decrypt\fR. + +For detailed description of encryption and key file options see \fIcryptsetup(8)\fR +man page. +.TP +.B "\-\-batch-mode, \-q" +Suppresses all warnings and reencryption progress output. +.TP +.B "\-\-block-size, \-B \fIvalue\fR" +Use re-encryption block size of in MiB. + +Values can be between 1 and 64 MiB. +.TP +.B "\-\-cipher, \-c" \fI\fR +Set the cipher specification string. +.TP +.B "\-\-debug" +Run in debug mode with full diagnostic logs. Debug output +lines are always prefixed by '#'. +.TP +.B "\-\-decrypt" +Remove encryption (decrypt already encrypted device and remove LUKS header). + +\fBWARNING:\fR This is destructive operation and cannot be reverted. +.TP +.B "\-\-device-size \fIsize[units]\fR" +Instead of real device size, use specified value. + +It means that only specified area (from the start of the device +to the specified size) will be reencrypted. + +If no unit suffix is specified, the size is in bytes. + +Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB) +for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale). + +\fBWARNING:\fR This is destructive operation. +.TP +.B "\-\-hash, \-h \fI\fR" +Specifies the hash used in the LUKS1 key setup scheme and volume key digest. + +\fBNOTE:\fR if this parameter is not specified, default hash algorithm is always used +for new LUKS1 device header. + +\fBNOTE:\fR with LUKS2 format this option is only relevant when new keyslot pbkdf algorithm +is set to PBKDF2 (see \fI\-\-pbkdf\fR). +.TP +.B "\-\-header\fR \fI\fR" +Use a detached (separated) metadata device or file where the +LUKS header is stored. This option allows one to store ciphertext +and LUKS header on different devices. + +\fBWARNING:\fR There is no check whether the ciphertext device specified +actually belongs to the header given. +If used with \fI\-\-new\fR option, the header file will created (or overwritten). +Use with care. +.TP +.B "\-\-iter-time, \-i \fI\fR" +The number of milliseconds to spend with PBKDF2 passphrase processing for the +new LUKS header. +.TP +.B "\-\-keep-key" +Do not change encryption key, just reencrypt the LUKS header and keyslots. + +This option can be combined only with \fI\-\-hash\fR, \fI\-\-iter-time\fR, +\fI\-\-pbkdf\-force\-iterations\fR, \fI\-\-pbkdf\fR (LUKS2 only), +\fI\-\-pbkdf\-memory\fR (Argon2i/id and LUKS2 only) and \fI\-\-pbkdf\-parallel\fR +(Argon2i/id and LUKS2 only) options. +.TP +.B "\-\-key-file, \-d \fIname\fR" +Read the passphrase from file. + +\fBWARNING:\fR \-\-key-file option can be used only if there is only one active keyslot, +or alternatively, also if \-\-key-slot option is specified (then all other keyslots +will be disabled in new LUKS device). + +If this option is not used, cryptsetup-reencrypt will ask for all active keyslot +passphrases. +.TP +.B "\-\-key-size, \-s \fI\fR" +Set key size in bits. The argument has to be a multiple of 8. + +The possible key-sizes are limited by the cipher and mode used. + +If you are increasing key size, there must be enough space in the LUKS header +for enlarged keyslots (data offset must be large enough) or reencryption +cannot be performed. + +If there is not enough space for keyslots with new key size, +you can destructively shrink device with \-\-reduce-device-size option. +.TP +.B "\-\-key-slot, \-S <0-MAX>" +Specify which key slot is used. For LUKS1, max keyslot number is 7. For LUKS2, it's 31. + +\fBWARNING:\fR All other keyslots will be disabled if this option is used. +.TP +.B "\-\-keyfile-offset \fIvalue\fR" +Skip \fIvalue\fR bytes at the beginning of the key file. +.TP +.B "\-\-keyfile-size, \-l" +Read a maximum of \fIvalue\fR bytes from the key file. +Default is to read the whole file up to the compiled-in +maximum. +.TP +.B "\-\-master\-key\-file" +Use new volume (master) key stored in a file. +.TP +.B "\-\-new, \-N" +Create new header (encrypt not yet encrypted device). + +This option must be used together with \-\-reduce-device-size. + +\fBWARNING:\fR This is destructive operation and cannot be reverted. +.TP +.B "\-\-pbkdf" +Set Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. +The PBKDF can be: \fIpbkdf2\fR, \fIargon2i\fR for Argon2i or \fIargon2id\fR for Argon2id. + +For LUKS1, only \fIpbkdf2\fR is accepted (no need to use this option). +.TP +.B "\-\-pbkdf\-force\-iterations " +Avoid PBKDF benchmark and set time cost (iterations) directly. +.TP +.B "\-\-pbkdf\-memory " +Set the memory cost for PBKDF (for Argon2i/id the number represents kilobytes). +Note that it is maximal value, PBKDF benchmark or available physical memory +can decrease it. +This option is not available for PBKDF2. +.TP +.B "\-\-pbkdf\-parallel " +Set the parallel cost for PBKDF (number of threads, up to 4). +Note that it is maximal value, it is decreased automatically if +CPU online count is lower. +This option is not available for PBKDF2. +.TP +.B "\-\-progress-frequency " +Print separate line every with reencryption progress. +.TP +.B "\-\-reduce-device-size \fIsize[units]\fR" +Enlarge data offset to specified value by shrinking device size. + +This means that last sectors on the original device will be lost, +ciphertext data will be effectively shifted by specified +number of sectors. + +It can be useful if you e.g. added some space to underlying +partition (so last sectors contains no data). + +For units suffix see \-\-device-size parameter description. + +You cannot shrink device more than by 64 MiB (131072 sectors). + +\fBWARNING:\fR This is destructive operation and cannot be reverted. +Use with extreme care - shrunk filesystems are usually unrecoverable. +.TP +.B "\-\-tries, \-T" +Number of retries for invalid passphrase entry. +.TP +.B "\-\-type " +Use only while encrypting not yet encrypted device (see \-\-new). + +Specify LUKS version when performing in-place encryption. If the parameter +is omitted default value (LUKS1) is used. Type may be one of: \fBluks\fR (default), +\fBluks1\fR or \fBluks2\fR. +.TP +.B "\-\-use-directio" +Use direct-io (O_DIRECT) for all read/write data operations related +to block device undergoing reencryption. + +Useful if direct-io operations perform better than normal buffered +operations (e.g. in virtual environments). +.TP +.B "\-\-use-fsync" +Use fsync call after every written block. This applies for reencryption +log files as well. +.TP +.B "\-\-use-random" +.TP +.B "\-\-use-urandom" +Define which kernel random number generator will be used to create the volume key. +.TP +.B "\-\-uuid" \fI\fR +Use only while resuming an interrupted decryption process (see \-\-decrypt). + +To find out what \fI\fR to pass look for temporary files LUKS-.[|log|org|new] +of the interrupted decryption process. +.TP +.B "\-\-verbose, \-v" +Print more information on command execution. +.TP +.B "\-\-version" +Show the program version. +.TP +.B "\-\-write-log" +Update log file after every block write. This can slow down reencryption +but will minimize data loss in the case of system crash. + +.SH RETURN CODES +Cryptsetup-reencrypt returns 0 on success and a non-zero value on error. + +Error codes are: 1 wrong parameters, 2 no permission, +3 out of memory, 4 wrong device specified, 5 device already exists +or device is busy. +.SH EXAMPLES +.TP +Reencrypt /dev/sdb1 (change volume key) +cryptsetup-reencrypt /dev/sdb1 +.TP +Reencrypt and also change cipher and cipher mode +cryptsetup-reencrypt /dev/sdb1 \-c aes-xts-plain64 +.TP +Add LUKS encryption to not yet encrypted device + +First, be sure you have space added to disk. + +Or alternatively shrink filesystem in advance. +.br +Here we need 4096 512-bytes sectors (enough for 2x128 bit key). + +fdisk \-u /dev/sdb # move sdb1 partition end + 4096 sectors +(or use resize2fs or tool for your filesystem and shrink it) + +cryptsetup-reencrypt /dev/sdb1 \-\-new \-\-reduce-device-size 4096S +.TP +Remove LUKS encryption completely + +cryptsetup-reencrypt /dev/sdb1 \-\-decrypt + +.SH REPORTING BUGS +Report bugs, including ones in the documentation, on +the cryptsetup mailing list at +or in the 'Issues' section on LUKS website. +Please attach the output of the failed command with the +\-\-debug option added. +.SH AUTHORS +Cryptsetup-reencrypt was written by Milan Broz . +.SH COPYRIGHT +Copyright \(co 2012-2021 Milan Broz +.br +Copyright \(co 2012-2021 Red Hat, Inc. + +This is free software; see the source for copying conditions. There is NO +warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +.SH SEE ALSO +The project website at \fBhttps://gitlab.com/cryptsetup/cryptsetup\fR diff --git a/man/cryptsetup.8 b/man/cryptsetup.8 new file mode 100644 index 0000000..b9082ee --- /dev/null +++ b/man/cryptsetup.8 @@ -0,0 +1,1777 @@ +.TH CRYPTSETUP "8" "January 2021" "cryptsetup" "Maintenance Commands" +.SH NAME +cryptsetup - manage plain dm-crypt and LUKS encrypted volumes +.SH SYNOPSIS +.B cryptsetup +.SH DESCRIPTION +.PP +cryptsetup is used to conveniently setup dm-crypt managed +device-mapper mappings. These include plain dm-crypt volumes and +LUKS volumes. The difference is that LUKS uses a metadata header +and can hence offer more features than plain dm-crypt. On the other +hand, the header is visible and vulnerable to damage. + +In addition, cryptsetup provides limited support for the use of +loop-AES volumes, TrueCrypt, VeraCrypt and BitLocker compatible volumes. + +.SH PLAIN DM-CRYPT OR LUKS? +.PP +Unless you understand the cryptographic background well, use LUKS. +With plain dm-crypt there are a number of possible user errors +that massively decrease security. While LUKS cannot fix them +all, it can lessen the impact for many of them. +.SH WARNINGS +.PP +A lot of good information on the risks of using encrypted storage, +on handling problems and on security aspects can be found in the +\fICryptsetup FAQ\fR. Read it. Nonetheless, some risks deserve +to be mentioned here. + +\fBBackup:\fR Storage media die. Encryption has no influence on that. +Backup is mandatory for encrypted data as well, if the data has any +worth. See the Cryptsetup FAQ for advice on how to do a backup of an +encrypted volume. + +\fBCharacter encoding:\fR If you enter a +passphrase with special symbols, the passphrase can change +depending on character encoding. Keyboard settings can also change, +which can make blind input hard or impossible. For +example, switching from some ASCII 8-bit variant to UTF-8 +can lead to a different binary encoding and hence different +passphrase seen by cryptsetup, even if what you see on +the terminal is exactly the same. It is therefore highly +recommended to select passphrase characters only from 7-bit +ASCII, as the encoding for 7-bit ASCII stays the same for +all ASCII variants and UTF-8. + +\fBLUKS header:\fR If the header of a LUKS volume gets damaged, +all data is permanently lost unless you have a header-backup. +If a key-slot is damaged, it can only be restored from a header-backup +or if another active key-slot with known passphrase is undamaged. +Damaging the LUKS header is something people manage to do with +surprising frequency. This risk is the result of a trade-off +between security and safety, as LUKS is designed for fast and +secure wiping by just overwriting header and key-slot area. + +\fBPreviously used partitions:\fR If a partition was previously used, +it is a very good idea to wipe filesystem signatures, data, etc. before +creating a LUKS or plain dm-crypt container on it. +For a quick removal of filesystem signatures, use "wipefs". Take care +though that this may not remove everything. In particular, MD RAID +signatures at the end of a device may survive. It also does not +remove data. For a full wipe, overwrite the whole partition before +container creation. If you do not know how to do that, the +cryptsetup FAQ describes several options. + +.SH BASIC ACTIONS +The following are valid actions for all supported device types. + +\fIopen\fR \-\-type +.IP +Opens (creates a mapping with) backed by device . + +Device type can be \fIplain\fR, \fIluks\fR (default), \fIluks1\fR, \fIluks2\fR, +\fIloopaes\fR or \fItcrypt\fR. + +For backward compatibility there are \fBopen\fR command aliases: + +\fBcreate\fR (argument-order ): open \-\-type plain +.br +\fBplainOpen\fR: open \-\-type plain +.br +\fBluksOpen\fR: open \-\-type luks +.br +\fBloopaesOpen\fR: open \-\-type loopaes +.br +\fBtcryptOpen\fR: open \-\-type tcrypt +.br +\fBbitlkOpen\fR: open \-\-type bitlk + +\fB\fR are type specific and are described below +for individual device types. For \fBcreate\fR, the order of the +and options is inverted for historical reasons, all other +aliases use the standard \fB \fR order. +.PP +\fIclose\fR +.IP +Removes the existing mapping and wipes the key from kernel memory. + +For backward compatibility there are \fBclose\fR command aliases: +\fBremove\fR, \fBplainClose\fR, \fBluksClose\fR, \fBloopaesClose\fR, +\fBtcryptClose\fR (all behaves exactly the same, device type is +determined automatically from active device). + +\fB\fR can be [\-\-deferred] + +.PP +\fIstatus\fR +.IP +Reports the status for the mapping . +.PP +\fIresize\fR +.IP +Resizes an active mapping . + +If \-\-size (in 512-bytes sectors) or \-\-device\-size are not specified, +the size is computed from the underlying device. For LUKS it is the size +of the underlying device without the area reserved for LUKS header +(see data payload offset in \fBluksDump\fR command). +For plain crypt device, the whole device size is used. + +Note that this does not change the raw device geometry, it just +changes how many sectors of the raw device are represented +in the mapped device. + +If cryptsetup detected volume key for active device loaded in kernel keyring +service, resize action would first try to retrieve +the key using a token and only if it failed it'd ask for a passphrase +to unlock a keyslot (LUKS) or to derive a volume key again (plain mode). +The kernel keyring is used by default for LUKS2 devices. + +With LUKS2 device additional \fB\fR can be [\-\-token\-id, \-\-token\-only, +\-\-key\-slot, \-\-key\-file, \-\-keyfile\-size, \-\-keyfile\-offset, \-\-timeout, +\-\-disable\-locks, \-\-disable\-keyring]. + +.PP +\fIrefresh\fR +.IP +Refreshes parameters of active mapping . + +Updates parameters of active device without need to deactivate the device +(and umount filesystem). Currently it supports parameters refresh on following +devices: LUKS1, LUKS2 (including authenticated encryption), plain crypt +and loopaes. + +Mandatory parameters are identical to those of an open action for respective +device type. + +You may change following parameters on all devices \-\-perf\-same_cpu_crypt, +\-\-perf\-submit_from_crypt_cpus, \-\-perf-no_read_workqueue, \-\-perf-no_write_workqueue +and \-\-allow\-discards. + +Refreshing device without any optional parameter will refresh the device +with default setting (respective to device type). + +\fBLUKS2 only:\fR + +\-\-integrity\-no\-journal parameter affects only LUKS2 devices with +underlying dm-integrity device. + +Adding option \-\-persistent stores any combination of device parameters +above in LUKS2 metadata (only after successful refresh operation). + +\-\-disable\-keyring parameter refreshes a device with volume key passed +in dm-crypt driver. + +.PP +\fIreencrypt\fR or --active-name [] +.IP +Run resilient reencryption (LUKS2 device only). + +There are 3 basic modes of operation: + +\(bu device reencryption (\fIreencrypt\fR) + +\(bu device encryption (\fIreencrypt\fR \-\-encrypt) + +\(bu device decryption (\fIreencrypt\fR \-\-decrypt) + + or --active-name is mandatory parameter. + +With parameter cryptsetup looks up active dm mapping. +If no active mapping is detected, it starts offline reencryption otherwise online +reencryption takes place. + +Reencryption process may be safely interrupted by a user via SIGTERM signal (ctrl+c). + +To resume already initialized or interrupted reencryption, just run the cryptsetup +\fIreencrypt\fR command again to continue the reencryption operation. +Reencryption may be resumed with different \-\-resilience or \-\-hotzone\-size unless +implicit datashift resilience mode is used (reencrypt \-\-encrypt with \-\-reduce-device-size +option). + +If the reencryption process was interrupted abruptly (reencryption process crash, system crash, poweroff) +it may require recovery. The recovery is currently run automatically on next activation (action \fIopen\fR) +when needed. + +Optional parameter takes effect only with \-\-encrypt option and it activates device +immediately after encryption initialization gets finished. That's useful when device needs to be ready +as soon as possible and mounted (used) before full data area encryption is completed. + +Action supports following additional \fB\fR [\-\-encrypt, \-\-decrypt, \-\-device\-size, +\-\-resilience, \-\-resilience-hash, \-\-hotzone-size, \-\-init\-only, \-\-resume\-only, +\-\-reduce\-device\-size, \-\-master\-key\-file, \-\-key\-size]. + +.SH PLAIN MODE +Plain dm-crypt encrypts the device sector-by-sector with a +single, non-salted hash of the passphrase. No checks +are performed, no metadata is used. There is no formatting operation. +When the raw device is mapped (opened), the usual device operations +can be used on the mapped device, including filesystem creation. +Mapped devices usually reside in /dev/mapper/. + +The following are valid plain device type actions: + +\fIopen\fR \-\-type plain +.br +\fIcreate\fR (\fBOBSOLETE syntax\fR) +.IP +Opens (creates a mapping with) backed by device . + +\fB\fR can be [\-\-hash, \-\-cipher, \-\-verify-passphrase, +\-\-sector\-size, \-\-key-file, \-\-keyfile-offset, \-\-key-size, +\-\-offset, \-\-skip, \-\-size, \-\-readonly, \-\-shared, \-\-allow\-discards, +\-\-refresh] + +Example: 'cryptsetup open \-\-type plain /dev/sda10 e1' maps the raw +encrypted device /dev/sda10 to the mapped (decrypted) device +/dev/mapper/e1, which can then be mounted, fsck-ed or have a +filesystem created on it. +.SH LUKS EXTENSION +LUKS, the Linux Unified Key Setup, is a standard for disk encryption. +It adds a standardized header at the start of the device, +a key-slot area directly behind the header and the bulk +data area behind that. The whole set is called a 'LUKS container'. +The device that a LUKS container resides on is called a 'LUKS device'. +For most purposes, both terms can be used interchangeably. But +note that when the LUKS header is at a nonzero offset +in a device, then the device is not a LUKS device anymore, but +has a LUKS container stored in it at an offset. + +LUKS can manage multiple passphrases that can be individually revoked +or changed and that can be securely scrubbed from persistent +media due to the use of anti-forensic stripes. Passphrases +are protected against brute-force and dictionary +attacks by PBKDF2, which implements hash iteration and salting +in one function. + +LUKS2 is a new version of header format that allows additional +extensions like different PBKDF algorithm or authenticated encryption. +You can format device with LUKS2 header if you specify +\fI\-\-type luks2\fR in \fIluksFormat\fR command. +For activation, the format is already recognized automatically. + +Each passphrase, also called a +.B key +in this document, is associated with one of 8 key-slots. +Key operations that do not specify a slot affect the first slot +that matches the supplied passphrase or the first empty slot if +a new passphrase is added. + +The \fB\fR parameter can also be specified by a LUKS UUID in the +format UUID=. Translation to real device name uses symlinks +in /dev/disk/by-uuid directory. + +To specify a detached header, the \fB\-\-header\fR parameter can be used +in all LUKS commands and always takes precedence over the positional +\fB\fR parameter. + +The following are valid LUKS actions: + +\fIluksFormat\fR [] +.IP +Initializes a LUKS partition and sets the initial passphrase +(for key-slot 0), +either via prompting or via . Note that +if the second argument is present, then the passphrase +is taken from the file given there, without the need +to use the \-\-key-file option. Also note that for both forms +of reading the passphrase from a file you can +give '-' as file name, which results in the passphrase being read +from stdin and the safety-question being skipped. + +You cannot call luksFormat on a device or filesystem that is mapped or in use, +e.g. mounted filesysem, used in LVM, active RAID member etc. +The device or filesystem has to be un-mounted in order to call luksFormat. + +To use LUKS2, specify \fI\-\-type luks2\fR. + +\fB\fR can be [\-\-hash, \-\-cipher, \-\-verify\-passphrase, +\-\-key\-size, \-\-key\-slot, +\-\-key\-file (takes precedence over optional second argument), +\-\-keyfile\-offset, \-\-keyfile\-size, \-\-use\-random | \-\-use\-urandom, +\-\-uuid, \-\-master\-key\-file, \-\-iter\-time, \-\-header, +\-\-pbkdf\-force\-iterations, +\-\-force\-password, \-\-disable-locks]. + +For LUKS2, additional \fB\fR can be +[\-\-integrity, \-\-integrity\-no\-wipe, \-\-sector\-size, +\-\-label, \-\-subsystem, +\-\-pbkdf, \-\-pbkdf\-memory, \-\-pbkdf\-parallel, +\-\-disable\-locks, \-\-disable\-keyring, +\-\-luks2\-metadata\-size, \-\-luks2\-keyslots\-size, +\-\-keyslot\-cipher, \-\-keyslot\-key\-size]. + +\fBWARNING:\fR Doing a luksFormat on an existing LUKS container will +make all data the old container permanently irretrievable unless +you have a header backup. +.PP +\fIopen\fR \-\-type luks +.br +\fIluksOpen\fR (\fBold syntax\fR) +.IP +Opens the LUKS device and sets up a mapping after +successful verification of the supplied passphrase. + +First, the passphrase is searched in LUKS tokens. If it's not +found in any token and also the passphrase is not supplied via \-\-key-file, +the command prompts for it interactively. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-readonly, \-\-test\-passphrase, +\-\-allow\-discards, \-\-header, \-\-key-slot, \-\-master\-key\-file, \-\-token\-id, +\-\-token\-only, \-\-disable\-keyring, \-\-disable\-locks, \-\-type, \-\-refresh, +\-\-serialize\-memory\-hard\-pbkdf]. +.PP +\fIluksSuspend\fR +.IP +Suspends an active device (all IO operations will block +and accesses to the device will wait indefinitely) +and wipes the encryption +key from kernel memory. Needs kernel 2.6.19 or later. + +After this operation you have to use \fIluksResume\fR to reinstate +the encryption key and unblock the device or \fIclose\fR to remove +the mapped device. + +\fBWARNING:\fR never suspend the device on which the cryptsetup binary resides. + +\fB\fR can be [\-\-header, \-\-disable\-locks]. +.PP +\fIluksResume\fR +.IP +Resumes a suspended device and reinstates the encryption key. +Prompts interactively for a passphrase if \-\-key-file is not given. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-size, \-\-header, +\-\-disable\-keyring, \-\-disable\-locks, \-\-type] +.PP +\fIluksAddKey\fR [] +.IP +Adds a new passphrase. An existing passphrase must be supplied +interactively or via \-\-key-file. +The new passphrase to be added can be specified interactively +or read from the file given as positional argument. + +\fBNOTE:\fR with \-\-unbound option the action creates new unbound +LUKS2 keyslot. The keyslot cannot be used for device activation. +If you don't pass new key via \-\-master\-key\-file option, +new random key is generated. Existing passphrase for any active keyslot +is not required. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-new\-keyfile\-offset, +\-\-new\-keyfile\-size, \-\-key\-slot, \-\-master\-key\-file, +\-\-force\-password, \-\-header, \-\-disable\-locks, +\-\-iter-time, \-\-pbkdf, \-\-pbkdf\-force\-iterations, +\-\-unbound, \-\-type, \-\-keyslot\-cipher, \-\-keyslot\-key\-size]. +.PP +\fIluksRemoveKey\fR [] +.IP +Removes the supplied passphrase from the LUKS device. The +passphrase to be removed can be specified interactively, +as the positional argument or via \-\-key-file. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-header, \-\-disable\-locks, \-\-type] + +\fBWARNING:\fR If you read the passphrase from stdin +(without further argument or with '-' as an argument +to \-\-key\-file), batch-mode (\-q) will be implicitly +switched on and no warning will be given when you remove the +last remaining passphrase from a LUKS container. Removing +the last passphrase makes the LUKS container permanently +inaccessible. +.PP +\fIluksChangeKey\fR [] +.IP +Changes an existing passphrase. The passphrase +to be changed must be supplied interactively or via \-\-key\-file. +The new passphrase can be supplied interactively or in +a file given as positional argument. + +If a key-slot is specified (via \-\-key-slot), the passphrase +for that key-slot must be given and the new passphrase +will overwrite the specified key-slot. If no key-slot +is specified and there is still a free key-slot, then +the new passphrase will be put into a free key-slot before the +key-slot containing the old passphrase is purged. If there is +no free key-slot, then the key-slot with the old passphrase is +overwritten directly. + +\fBWARNING:\fR If a key-slot is overwritten, a media failure +during this operation can cause the overwrite to fail after +the old passphrase has been wiped and make the LUKS container +inaccessible. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-new\-keyfile\-offset, +\-\-iter-time, \-\-pbkdf, \-\-pbkdf\-force\-iterations, +\-\-new\-keyfile\-size, \-\-key\-slot, \-\-force\-password, \-\-header, +\-\-disable\-locks, \-\-type, \-\-keyslot\-cipher, \-\-keyslot\-key\-size]. +.PP +.PP +\fIluksConvertKey\fR +.IP +Converts an existing LUKS2 keyslot to new pbkdf parameters. The +passphrase for keyslot to be converted must be supplied interactively +or via \-\-key\-file. If no \-\-pbkdf parameters are specified LUKS2 +default pbkdf values will apply. + +If a keyslot is specified (via \-\-key\-slot), the passphrase for that +keyslot must be given. If no keyslot is specified and there is still +a free keyslot, then the new parameters will be put into a free +keyslot before the keyslot containing the old parameters is +purged. If there is no free keyslot, then the keyslot with the old +parameters is overwritten directly. + +\fBWARNING:\fR If a keyslot is overwritten, a media failure during +this operation can cause the overwrite to fail after the old +parameters have been wiped and make the LUKS container inaccessible. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-key\-slot, \-\-header, \-\-disable\-locks, +\-\-iter-time, \-\-pbkdf, \-\-pbkdf\-force\-iterations, +\-\-pbkdf\-memory, \-\-pbkdf\-parallel, +\-\-keyslot\-cipher, \-\-keyslot\-key\-size]. +.PP +\fIluksKillSlot\fR +.IP +Wipe the key-slot number from the LUKS device. Except running +in batch-mode (\-q) a remaining passphrase must be supplied, +either interactively or via \-\-key-file. +This command can remove the last remaining key-slot, but requires +an interactive confirmation when doing so. Removing the last +passphrase makes a LUKS container permanently inaccessible. + +\fB\fR can be [\-\-key\-file, \-\-keyfile\-offset, +\-\-keyfile\-size, \-\-header, \-\-disable\-locks, \-\-type]. + +\fBWARNING:\fR If you read the passphrase from stdin +(without further argument or with '-' as an argument +to \-\-key-file), batch-mode (\-q) will be implicitly +switched on and no warning will be given when you remove the +last remaining passphrase from a LUKS container. Removing +the last passphrase makes the LUKS container permanently +inaccessible. + +\fBNOTE:\fR If there is no passphrase provided (on stdin or through +\-\-key-file argument) and batch-mode (\-q) is active, the +key-slot is removed without any other warning. + +.PP +\fIerase\fR +.br +\fIluksErase\fR +.IP +Erase all keyslots and make the LUKS container permanently inaccessible. +You do not need to provide any password for this operation. + +\fBWARNING:\fR This operation is irreversible. +.PP +\fIluksUUID\fR +.IP +Print the UUID of a LUKS device. +.br +Set new UUID if \fI\-\-uuid\fR option is specified. +.PP +\fIisLuks\fR +.IP +Returns true, if is a LUKS device, false otherwise. +Use option \-v to get human-readable feedback. 'Command successful.' +means the device is a LUKS device. + +By specifying \-\-type you may query for specific LUKS version. +.PP +\fIluksDump\fR +.IP +Dump the header information of a LUKS device. + +If the \-\-dump\-master\-key option is used, the LUKS device master key is +dumped instead of the keyslot info. Together with \-\-master\-key\-file option, +master key is dumped to a file instead of standard output. Beware that the +master key cannot be changed without reencryption and can be used to decrypt +the data stored in the LUKS container without a passphrase and even without the +LUKS header. This means that if the master key is compromised, the whole device +has to be erased or reencrypted to prevent further access. Use this option carefully. + +To dump the master key, a passphrase has to be supplied, +either interactively or via \-\-key\-file. + +To dump unbound key (LUKS2 format only), \-\-unbound parameter, specific \-\-key-slot +id and proper passphrase has to be supplied, either interactively or via \-\-key\-file. +Optional \-\-master\-key\-file parameter enables unbound keyslot dump to a file. + +\fB\fR can be [\-\-dump\-master\-key, \-\-key\-file, +\-\-keyfile\-offset, \-\-keyfile\-size, \-\-header, \-\-disable\-locks, +\-\-master\-key\-file, \-\-type, \-\-unbound, \-\-key-slot]. + +\fBWARNING:\fR If \-\-dump\-master\-key is used with \-\-key\-file +and the argument to \-\-key\-file is '-', no validation question +will be asked and no warning given. +.PP +\fIluksHeaderBackup\fR \-\-header\-backup\-file +.IP +Stores a binary backup of the LUKS header and keyslot area. +.br +Note: Using '-' as filename writes the header backup to a file named '-'. + +\fBWARNING:\fR This backup file and a passphrase valid +at the time of backup allows decryption of the +LUKS data area, even if the passphrase was later changed or +removed from the LUKS device. Also note that with a header +backup you lose the ability to securely wipe the LUKS +device by just overwriting the header and key-slots. You +either need to securely erase all header backups in +addition or overwrite the encrypted data area as well. +The second option is less secure, as some sectors +can survive, e.g. due to defect management. +.PP +\fIluksHeaderRestore\fR \-\-header\-backup\-file +.IP +Restores a binary backup of the LUKS header and keyslot area +from the specified file. +.br +Note: Using '-' as filename reads the header backup from a file named '-'. + +\fBWARNING:\fR Header and keyslots will be replaced, only +the passphrases from the backup will work afterward. + +This command requires that the master key size and data offset +of the LUKS header already on the device and of the header backup +match. Alternatively, if there is no LUKS header on the device, +the backup will also be written to it. +.PP +\fItoken\fR +.IP +Action \fIadd\fR creates new keyring token to enable auto-activation of the device. +For the auto-activation, the passphrase must be stored in keyring with the specified +description. Usually, the passphrase should be stored in \fIuser\fR or +\fIuser-session\fR keyring. +The \fItoken\fR command is supported only for LUKS2. + +For adding new keyring token, option \-\-key\-description is mandatory. +Also, new token is assigned to key slot specified with \-\-key\-slot option or to all +active key slots in the case \-\-key\-slot option is omitted. + +To remove existing token, specify the token ID which should be removed with +\-\-token\-id option. + +\fBWARNING:\fR The action \fItoken remove\fR removes any token type, not just \fIkeyring\fR +type from token slot specified by \-\-token\-id option. + +Action \fIimport\fR can store arbitrary valid token json in LUKS2 header. It may be passed via +standard input or via file passed in \-\-json\-file option. If you specify \-\-key\-slot then +successfully imported token is also assigned to the key slot. + +Action \fIexport\fR writes requested token json to a file passed with \-\-json\-file or +to standard output. + +\fB\fR can be [\-\-header, \-\-token\-id, \-\-key\-slot, \-\-key\-description, +\-\-disable\-locks, \-\-disable\-keyring, \-\-json\-file]. +.PP +\fIconvert\fR \-\-type +.IP +Converts the device between LUKS1 and LUKS2 format (if possible). +The conversion will not be performed if there is an additional LUKS2 feature or LUKS1 has +unsupported header size. + +Conversion (both directions) must be performed on inactive device. There must not be active +dm-crypt mapping established for LUKS header requested for conversion. + +\fB\-\-type\fR option is mandatory with following accepted values: \fIluks1\fR or \fIluks2\fR. + +\fBWARNING:\fR The \fIconvert\fR action can destroy the LUKS header in the case of a crash +during conversion or if a media error occurs. +Always create a header backup before performing this operation! + +\fB\fR can be [\-\-header, \-\-type]. +.PP +\fIconfig\fR +.IP +Set permanent configuration options (store to LUKS header). +The \fIconfig\fR command is supported only for LUKS2. + +The permanent options can be \fI\-\-priority\fR to set priority (normal, prefer, ignore) +for keyslot (specified by \fI\-\-key\-slot\fR) or \fI\-\-label\fR and \fI\-\-subsystem\fR. + +\fB\fR can be [\-\-priority, \-\-label, \-\-subsystem, \-\-key\-slot, \-\-header]. + +.SH loop-AES EXTENSION +cryptsetup supports mapping loop-AES encrypted partition using +a compatibility mode. +.PP +\fIopen\fR \-\-type loopaes \-\-key\-file +.br +\fIloopaesOpen\fR \-\-key\-file (\fBold syntax\fR) +.IP +Opens the loop-AES and sets up a mapping . + +If the key file is encrypted with GnuPG, then you have to use +\-\-key\-file=\- and decrypt it before use, e.g. like this: +.br +gpg \-\-decrypt | cryptsetup loopaesOpen \-\-key\-file=\- + + +\fBWARNING:\fR The loop-AES extension cannot use the direct input of key file +on real terminal because the keys are separated by end-of-line and only part +of the multi-key file would be read. +.br +If you need it in script, just use the pipe redirection: +.br +echo $keyfile | cryptsetup loopaesOpen \-\-key\-file=\- + +Use \fB\-\-keyfile\-size\fR to specify the proper key length if needed. + +Use \fB\-\-offset\fR to specify device offset. Note that the units +need to be specified in number of 512 byte sectors. + +Use \fB\-\-skip\fR to specify the IV offset. If the original device +used an offset and but did not use it in IV sector calculations, +you have to explicitly use \fB\-\-skip 0\fR in addition to the offset +parameter. + +Use \fB\-\-hash\fR to override the default hash function for +passphrase hashing (otherwise it is detected according to key +size). + +\fB\fR can be [\-\-key\-file, \-\-key\-size, \-\-offset, \-\-skip, +\-\-hash, \-\-readonly, \-\-allow\-discards, \-\-refresh]. +.PP +See also section 7 of the FAQ and \fBhttp://loop-aes.sourceforge.net\fR +for more information regarding loop-AES. +.SH TCRYPT (TrueCrypt-compatible and VeraCrypt) EXTENSION +cryptsetup supports mapping of TrueCrypt, tcplay or VeraCrypt +(with \fB\-\-veracrypt\fR option) encrypted partition +using a native Linux kernel API. +Header formatting and TCRYPT header change is not supported, cryptsetup +never changes TCRYPT header on-device. + +TCRYPT extension requires kernel userspace +crypto API to be available (introduced in Linux kernel 2.6.38). +If you are configuring kernel yourself, enable +"User-space interface for symmetric key cipher algorithms" in +"Cryptographic API" section (CRYPTO_USER_API_SKCIPHER .config option). + +Because TCRYPT header is encrypted, you have to always provide valid +passphrase and keyfiles. + +Cryptsetup should recognize all header variants, except legacy cipher chains +using LRW encryption mode with 64 bits encryption block (namely Blowfish +in LRW mode is not recognized, this is limitation of kernel crypto API). + +To recognize a VeraCrypt device use the \fB\-\-veracrypt\fR option. +VeraCrypt is just extension of TrueCrypt header with increased +iteration count so unlocking can take quite a lot of time (in comparison +with TCRYPT device). + +To open a VeraCrypt device with a custom Personal Iteration Multiplier (PIM) +value, \fBadditionally to \-\-veracrypt \fR use either the +\fB\-\-veracrypt\-pim=\fR option to directly specify the PIM on the command- +line or use \fB\-\-veracrypt\-query\-pim\fR to be prompted for the PIM. + +The PIM value affects the number of iterations applied during key derivation. Please refer to +\fBhttps://www.veracrypt.fr/en/Personal%20Iterations%20Multiplier%20%28PIM%29.html\fR +for more detailed information. + +\fBNOTE:\fR Activation with \fBtcryptOpen\fR is supported only for cipher chains +using LRW or XTS encryption modes. + +The \fBtcryptDump\fR command should work for all recognized TCRYPT devices +and doesn't require superuser privilege. + +To map system device (device with boot loader where the whole encrypted +system resides) use \fB\-\-tcrypt\-system\fR option. +You can use partition device as the parameter (parameter must be real partition +device, not an image in a file), then only this partition is mapped. + +If you have the whole TCRYPT device as a file image and you want to map multiple +partition encrypted with system encryption, please create loopback mapping +with partitions first (\fBlosetup \-P\fR, see \fPlosetup(8)\fR man page for more info), +and use loop partition as the device parameter. + +If you use the whole base device as a parameter, one device for the whole system +encryption is mapped. This mode is available only for backward compatibility +with older cryptsetup versions which mapped TCRYPT system encryption +using the whole device. + +To use hidden header (and map hidden device, if available), +use \fB\-\-tcrypt\-hidden\fR option. + +To explicitly use backup (secondary) header, use \fB\-\-tcrypt\-backup\fR +option. + +\fBNOTE:\fR There is no protection for a hidden volume if +the outer volume is mounted. The reason is that if there +were any protection, it would require some metadata describing +what to protect in the outer volume and the hidden volume would +become detectable. + +.PP +\fIopen\fR \-\-type tcrypt +.br +\fItcryptOpen\fR (\fBold syntax\fR) +.IP +Opens the TCRYPT (a TrueCrypt-compatible) and sets up +a mapping . + +\fB\fR can be [\-\-key\-file, \-\-tcrypt\-hidden, +\-\-tcrypt\-system, \-\-tcrypt\-backup, \-\-readonly, \-\-test\-passphrase, +\-\-allow-discards, \-\-veracrypt, \-\-veracrypt\-pim, \-\-veracrypt\-query\-pim, +\-\-header]. + +The keyfile parameter allows a combination of file content with the +passphrase and can be repeated. Note that using keyfiles is compatible +with TCRYPT and is different from LUKS keyfile logic. + +If you use \fB\-\-header\fR in combination with hidden or system options, +the header file must contain specific headers on the same positions as the original +encrypted container. + +\fBWARNING:\fR Option \fB\-\-allow\-discards\fR cannot be combined with +option \fB\-\-tcrypt\-hidden\fR. For normal mapping, it can cause +the \fBdestruction of hidden volume\fR (hidden volume appears as unused space +for outer volume so this space can be discarded). + +.PP +\fItcryptDump\fR +.IP +Dump the header information of a TCRYPT device. + +If the \-\-dump\-master\-key option is used, the TCRYPT device master key +is dumped instead of TCRYPT header info. Beware that the master key +(or concatenated master keys if cipher chain is used) +can be used to decrypt the data stored in the TCRYPT container without +a passphrase. +This means that if the master key is compromised, the whole device has +to be erased to prevent further access. Use this option carefully. + +\fB\fR can be [\-\-dump\-master\-key, \-\-key\-file, +\-\-tcrypt\-hidden, \-\-tcrypt\-system, \-\-tcrypt\-backup]. + +The keyfile parameter allows a combination of file content with the +passphrase and can be repeated. +.PP +See also \fBhttps://en.wikipedia.org/wiki/TrueCrypt\fR for more information regarding +TrueCrypt. + +Please note that cryptsetup does not use TrueCrypt code, please report +all problems related to this compatibility extension to the cryptsetup project. + +.SH BITLK (Windows BitLocker-compatible) EXTENSION (EXPERIMENTAL) +cryptsetup supports mapping of BitLocker and BitLocker to Go encrypted partition +using a native Linux kernel API. +Header formatting and BITLK header changes are not supported, cryptsetup +never changes BITLK header on-device. + +\fBWARNING:\fR This extension is EXPERIMENTAL. + +BITLK extension requires kernel userspace crypto API to be available +(for details see TCRYPT section). + +Cryptsetup should recognize all BITLK header variants, except legacy +header used in Windows Vista systems and partially decrypted BitLocker devices. +Activation of legacy devices encrypted in CBC mode requires at least +Linux kernel version 5.3 and for devices using Elephant diffuser kernel 5.6. + +The \fBbitlkDump\fR command should work for all recognized BITLK devices +and doesn't require superuser privilege. + +For unlocking with the \fBopen\fR a password or a recovery passphrase must +be provided. Other unlocking methods (TPM, SmartCard) are not supported. + +.PP +\fIopen\fR \-\-type bitlk +.br +\fIbitlkOpen\fR (\fBold syntax\fR) +.IP +Opens the BITLK (a BitLocker-compatible) and sets up +a mapping . + +\fB\fR can be [\-\-key\-file, \-\-readonly, \-\-test\-passphrase, +\-\-allow-discards]. + +.PP +\fIbitlkDump\fR +.IP +Dump the header information of a BITLK device. + +Please note that cryptsetup does not use any Windows BitLocker code, please report +all problems related to this compatibility extension to the cryptsetup project. +.SH MISCELLANEOUS +.PP +\fIrepair\fR +.IP +Tries to repair the device metadata if possible. Currently supported only +for LUKS device type. + +This command is useful to fix some known benign LUKS metadata +header corruptions. Only basic corruptions of unused keyslot +are fixable. This command will only change the LUKS header, not +any key-slot data. You may enforce LUKS version by adding \-\-type +option. + +It also repairs (upgrades) LUKS2 reencryption metadata by adding +metadata digest that protects it against malicious changes. + +If LUKS2 reencryption was interrupted in the middle of writting +reencryption segment the repair command can be used to perform +reencryption recovery so that reencryption can continue later. + +\fBWARNING:\fR Always create a binary backup of the original +header before calling this command. +.PP +\fIbenchmark\fR +.IP +Benchmarks ciphers and KDF (key derivation function). +Without parameters, it tries to measure few common configurations. + +To benchmark other ciphers or modes, you need to specify \fB\-\-cipher\fR +and \fB\-\-key\-size\fR options or \fB\-\-hash\fR for KDF test. + +\fBNOTE:\fR This benchmark is using memory only and is only informative. +You cannot directly predict real storage encryption speed from it. + +For testing block ciphers, this benchmark requires kernel userspace +crypto API to be available (introduced in Linux kernel 2.6.38). +If you are configuring kernel yourself, enable +"User-space interface for symmetric key cipher algorithms" in +"Cryptographic API" section (CRYPTO_USER_API_SKCIPHER .config option). + +\fB\fR can be [\-\-cipher, \-\-key\-size, \-\-hash]. +.SH OPTIONS +.TP +.B "\-\-verbose, \-v" +Print more information on command execution. +.TP +.B "\-\-debug or \-\-debug\-json" +Run in debug mode with full diagnostic logs. Debug output +lines are always prefixed by '#'. +If \-\-debug\-json is used, additional LUKS2 JSON data structures are printed. +.TP +.B "\-\-type +Specifies required device type, for more info read \fIBASIC ACTIONS\fR section. +.TP +.B "\-\-hash, \-h \fI\fR" +Specifies the passphrase hash for \fIopen\fR (for plain and +loopaes device types). + +Specifies the hash used in the LUKS key setup scheme and volume key digest +for \fIluksFormat\fR. The specified hash is used as hash-parameter +for PBKDF2 and for the AF splitter. + +The specified hash name is passed to the compiled-in crypto backend. +Different backends may support different hashes. +For \fIluksFormat\fR, the hash +algorithm must provide at least 160 bits of output, which +excludes, e.g., MD5. Do not use a non-crypto hash like +\fB"crc32"\fR as this breaks security. + +Values compatible with old version of cryptsetup are +\fB"ripemd160"\fR for \fIopen \-\-type plain\fR and +\fB"sha1"\fR for \fIluksFormat\fR. + +Use \fIcryptsetup \-\-help\fR to show the defaults. +.TP +.B "\-\-cipher, \-c \fI\fR" +Set the cipher specification string. + +\fIcryptsetup \-\-help\fR shows the compiled-in defaults. +The current default in the distributed sources is +"aes-cbc-essiv:sha256" for plain dm-crypt and +"aes-xts-plain64" for LUKS. + +If a hash is part of the cipher specification, then it is +used as part of the IV generation. For example, ESSIV +needs a hash function, while "plain64" does not and +hence none is specified. + +For XTS mode you can optionally set a key size of +512 bits with the \-s option. Key size for XTS +mode is twice that for other modes for the same +security level. + +XTS mode requires kernel 2.6.24 or later and plain64 requires +kernel 2.6.33 or later. More information can be found in the FAQ. +.TP +.B "\-\-verify-passphrase, \-y" +When interactively asking for a passphrase, ask for it twice +and complain if both inputs do not match. Advised when creating +a regular mapping for the first time, or when running +\fIluksFormat\fR. Ignored on input from file or stdin. +.TP +.B "\-\-key-file, \-d \fIname\fR" +Read the passphrase from file. + +If the name given is "-", then the passphrase will be read from stdin. +In this case, reading will not stop at newline characters. + +With LUKS, passphrases supplied via \-\-key\-file are always +the existing passphrases requested by a command, except in +the case of \fIluksFormat\fR where \-\-key\-file is equivalent +to the positional key file argument. + +If you want to set a new passphrase via key file, you have to +use a positional argument to \fIluksAddKey\fR. + +See section \fBNOTES ON PASSPHRASE PROCESSING\fR for more information. +.TP +.B "\-\-keyfile\-offset \fIvalue\fR" +Skip \fIvalue\fR bytes at the beginning of the key file. +Works with all commands that accept key files. +.TP +.B "\-\-keyfile\-size, \-l \fIvalue\fR" +Read a maximum of \fIvalue\fR bytes from the key file. +The default is to read the whole file up to the compiled-in +maximum that can be queried with \-\-help. Supplying more +data than the compiled-in maximum aborts the operation. + +This option is useful +to cut trailing newlines, for example. If \-\-keyfile\-offset +is also given, the size count starts after the offset. +Works with all commands that accept key files. +.TP +.B "\-\-new\-keyfile\-offset \fIvalue\fR" +Skip \fIvalue\fR bytes at the start when +adding a new passphrase from key file with +\fIluksAddKey\fR. +.TP +.B "\-\-new\-keyfile\-size \fIvalue\fR" +Read a maximum of \fIvalue\fR bytes when adding +a new passphrase from key file with \fIluksAddKey\fR. +The default is to read the whole file up to the compiled-in +maximum length that can be queried with \-\-help. +Supplying more than the compiled in maximum aborts the +operation. +When \-\-new\-keyfile\-offset is also given, reading starts +after the offset. +.TP +.B "\-\-master\-key\-file" +Use a master key stored in a file. + +For \fIluksFormat\fR this +allows creating a LUKS header with this specific +master key. If the master key was taken from an existing +LUKS header and all other parameters are the same, +then the new header decrypts the data encrypted with the +header the master key was taken from. + +Action \fIluksDump\fR together with \-\-dump\-master\-key +option: The volume (master) key is stored in a file instead of +being printed out to standard output. + +\fBWARNING:\fR If you create your own master key, you +need to make sure to do it right. Otherwise, you can end +up with a low-entropy or otherwise partially predictable +master key which will compromise security. + +For \fIluksAddKey\fR this allows adding a new passphrase +without having to know an existing one. + +For \fIopen\fR this allows one to open the LUKS device +without giving a passphrase. +.TP +.B "\-\-dump\-master\-key" +For \fIluksDump\fR this option includes the master key in the displayed +information. Use with care, as the master key can be used to +bypass the passphrases, see also option \-\-master\-key\-file. +.TP +.B "\-\-json\-file" +Read token json from a file or write token to it. See \fItoken\fR action for more +information. \-\-json\-file=- reads json from standard input or writes it to +standard output respectively. +.TP +.B "\-\-use\-random" +.TP +.B "\-\-use\-urandom" +For \fIluksFormat\fR these options define which kernel random number +generator will be used to create the master key (which is a +long-term key). + +See \fBNOTES ON RANDOM NUMBER GENERATORS\fR for more +information. Use \fIcryptsetup \-\-help\fR +to show the compiled-in default random number generator. + +\fBWARNING:\fR In a low-entropy situation (e.g. in an +embedded system), both selections are problematic. +Using /dev/urandom can lead to weak keys. +Using /dev/random can block a long time, potentially +forever, if not enough entropy can be harvested by +the kernel. +.TP +.B "\-\-key\-slot, \-S <0\-7>" +For LUKS operations that add key material, this options allows you +to specify which key slot is selected for the new key. +This option can be used for \fIluksFormat\fR, +and \fIluksAddKey\fR. +.br +In addition, for \fIopen\fR, this option selects a +specific key-slot to compare the passphrase against. +If the given passphrase would only match a different key-slot, +the operation fails. +.TP +.B "\-\-key\-size, \-s " +Sets key size in bits. The argument has to be a multiple of +8. The possible key-sizes are limited by the cipher and +mode used. + +See /proc/crypto for more information. Note that key-size +in /proc/crypto is stated in bytes. + +This option can be used for \fIopen \-\-type plain\fR or \fIluksFormat\fR. +All other LUKS actions will use the key-size specified in the LUKS header. +Use \fIcryptsetup \-\-help\fR to show the compiled-in defaults. +.TP +.B "\-\-size, \-b " +Set the size of the device in sectors of 512 bytes. +This option is only relevant for the \fIopen\fR and \fIresize\fR +actions. +.TP +.B "\-\-offset, \-o " +Start offset in the backend device in 512-byte sectors. +This option is only relevant for the \fIopen\fR action with plain +or loopaes device types or for LUKS devices in \fIluksFormat\fR. + +For LUKS, the \-\-offset option sets the data offset (payload) of data +device and must be be aligned to 4096-byte sectors (must be multiple of 8). +This option cannot be combined with \-\-align\-payload option. +.TP +.B "\-\-skip, \-p " +Start offset used in IV calculation in 512-byte sectors +(how many sectors of the encrypted data to skip at the beginning). +This option is only relevant for the \fIopen\fR action with plain +or loopaes device types. + +Hence, if \-\-offset \fIn\fR, and \-\-skip \fIs\fR, sector \fIn\fR +(the first sector of the encrypted device) will get a sector number +of \fIs\fR for the IV calculation. +.TP +.B "\-\-device\-size \fIsize[units]\fR" +Instead of real device size, use specified value. + +With \fIreencrypt\fR action it means that only specified area +(from the start of the device to the specified size) will be +reencrypted. + +With \fIresize\fR action it sets new size of the device. + +If no unit suffix is specified, the size is in bytes. + +Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB) +for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale). + +\fBWARNING:\fR This is destructive operation when used with reencrypt command. +.TP +.B "\-\-readonly, \-r" +set up a read-only mapping. +.TP +.B "\-\-shared" +Creates an additional mapping for one common +ciphertext device. Arbitrary mappings are supported. +This option is only relevant for the +\fIopen \-\-type plain\fR action. Use \-\-offset, \-\-size and \-\-skip to +specify the mapped area. +.TP +.B "\-\-pbkdf " +Set Password-Based Key Derivation Function (PBKDF) algorithm for LUKS keyslot. +The PBKDF can be: \fIpbkdf2\fR (for PBKDF2 according to RFC2898), +\fIargon2i\fR for Argon2i or \fIargon2id\fR for Argon2id +(see https://www.cryptolux.org/index.php/Argon2 for more info). + +For LUKS1, only PBKDF2 is accepted (no need to use this option). +The default PBKDF2 for LUKS2 is set during compilation time +and is available in \fIcryptsetup \-\-help\fR output. + +A PBKDF is used for increasing dictionary and brute-force attack cost +for keyslot passwords. The parameters can be time, memory and parallel cost. + +For PBKDF2, only time cost (number of iterations) applies. +For Argon2i/id, there is also memory cost (memory required during +the process of key derivation) and parallel cost (number of threads +that run in parallel during the key derivation. + +Note that increasing memory cost also increases time, so the final +parameter values are measured by a benchmark. The benchmark +tries to find iteration time (\fI\-\-iter\-time\fR) with required +memory cost \fI\-\-pbkdf\-memory\fR. If it is not possible, +the memory cost is decreased as well. +The parallel cost \fI\-\-pbkdf\-parallel\fR is constant, is is checked +against available CPU cores (if not available, it is decreased) and the maximum +parallel cost is 4. + +You can see all PBKDF parameters for particular LUKS2 keyslot with +\fIluksDump\fR command. + +\fBNOTE:\fR If you do not want to use benchmark and want to specify +all parameters directly, use \fI\-\-pbkdf\-force\-iterations\fR with +\fI\-\-pbkdf\-memory\fR and \fI\-\-pbkdf\-parallel\fR. +This will override the values without benchmarking. +Note it can cause extremely long unlocking time. Use only in specific +cases, for example, if you know that the formatted device will +be used on some small embedded system. +In this case, the LUKS PBKDF2 digest will be set to the minimum iteration count. +.TP +.B "\-\-iter\-time, \-i " +The number of milliseconds to spend with PBKDF passphrase processing. +This option is only relevant for LUKS operations that set or change +passphrases, such as \fIluksFormat\fR or \fIluksAddKey\fR. +Specifying 0 as parameter selects the compiled-in default. +.TP +.B "\-\-pbkdf\-memory " +Set the memory cost for PBKDF (for Argon2i/id the number represents kilobytes). +Note that it is maximal value, PBKDF benchmark or available physical memory +can decrease it. +This option is not available for PBKDF2. +.TP +.B "\-\-pbkdf\-parallel " +Set the parallel cost for PBKDF (number of threads, up to 4). +Note that it is maximal value, it is decreased automatically if +CPU online count is lower. +This option is not available for PBKDF2. +.TP +.B "\-\-pbkdf\-force\-iterations " +Avoid PBKDF benchmark and set time cost (iterations) directly. +It can be used for LUKS/LUKS2 device only. +See \fI\-\-pbkdf\fR option for more info. +.TP +.B "\-\-batch\-mode, \-q" +Suppresses all confirmation questions. Use with care! + +If the \-y option is not specified, this option also switches off +the passphrase verification for \fIluksFormat\fR. +.TP +.B "\-\-progress-frequency " +Print separate line every with wipe progress. +.TP +.B "\-\-timeout, \-t " +The number of seconds to wait before timeout on passphrase input +via terminal. It is relevant every time a passphrase is asked, +for example for \fIopen\fR, \fIluksFormat\fR or \fIluksAddKey\fR. +It has no effect if used in conjunction with \-\-key-file. +.br +This option is useful when the system +should not stall if the user does not input a passphrase, +e.g. during boot. The default is a value of 0 seconds, +which means to wait forever. +.TP +.B "\-\-tries, \-T" +How often the input of the passphrase shall be retried. +This option is relevant +every time a passphrase is asked, for example for +\fIopen\fR, \fIluksFormat\fR or \fIluksAddKey\fR. +The default is 3 tries. +.TP +.B "\-\-align\-payload " +Align payload at a boundary of \fIvalue\fR 512-byte sectors. +This option is relevant for \fIluksFormat\fR. + +If not specified, cryptsetup tries to use the topology info +provided by the kernel for the underlying device to get the optimal alignment. +If not available (or the calculated value is a multiple of the default) +data is by default aligned to a 1MiB boundary (i.e. 2048 512-byte sectors). + +For a detached LUKS header, this option specifies the offset on the +data device. See also the \-\-header option. + +\fBWARNING:\fR This option is DEPRECATED and has often unexpected impact +to the data offset and keyslot area size (for LUKS2) due to the complex rounding. +For fixed data device offset use \fI\-\-offset\fR option instead. + +.TP +.B "\-\-uuid=\fIUUID\fR" +Use the provided \fIUUID\fR for the \fIluksFormat\fR command +instead of generating a new one. Changes the existing UUID when +used with the \fIluksUUID\fR command. + +The UUID must be provided in the standard UUID format, +e.g. 12345678-1234-1234-1234-123456789abc. +.TP +.B "\-\-allow\-discards\fR" +Allow the use of discard (TRIM) requests for the device. +This option is only relevant for \fIopen\fR action. +This is also not supported for LUKS2 devices with data integrity protection. + +\fBWARNING:\fR This command can have a negative security impact +because it can make filesystem-level operations visible on +the physical device. For example, information leaking +filesystem type, used space, etc. may be extractable from +the physical device if the discarded blocks can be located +later. If in doubt, do not use it. + +A kernel version of 3.1 or later is needed. For earlier kernels, +this option is ignored. +.TP +.B "\-\-perf\-same_cpu_crypt\fR" +Perform encryption using the same cpu that IO was submitted on. +The default is to use an unbound workqueue so that encryption work +is automatically balanced between available CPUs. +This option is only relevant for \fIopen\fR action. + +\fBNOTE:\fR This option is available only for low-level dm-crypt +performance tuning, use only if you need a change to default dm-crypt +behaviour. Needs kernel 4.0 or later. +.TP +.B "\-\-perf\-submit_from_crypt_cpus\fR" +Disable offloading writes to a separate thread after encryption. +There are some situations where offloading write bios from the +encryption threads to a single thread degrades performance +significantly. The default is to offload write bios to the same +thread. +This option is only relevant for \fIopen\fR action. + +\fBNOTE:\fR This option is available only for low-level dm-crypt +performance tuning, use only if you need a change to default dm-crypt +behaviour. Needs kernel 4.0 or later. +.TP +.B "\-\-perf\-no_read_workqueue, \-\-perf\-no_write_workqueue\fR" +Bypass dm-crypt internal workqueue and process read or write requests +synchronously. +This option is only relevant for \fIopen\fR action. + +\fBNOTE:\fR These options are available only for low-level dm-crypt +performance tuning, use only if you need a change to default dm-crypt +behaviour. Needs kernel 5.9 or later. +.TP +.B "\-\-test\-passphrase\fR" +Do not activate the device, just verify passphrase. +This option is only relevant for \fIopen\fR action (the device +mapping name is not mandatory if this option is used). +.TP +.B "\-\-header\fR " +Use a detached (separated) metadata device or file where the +LUKS header is stored. This option allows one to store ciphertext +and LUKS header on different devices. + +This option is only relevant for LUKS devices and can be +used with the \fIluksFormat\fR, \fIopen\fR, \fIluksSuspend\fR, +\fIluksResume\fR, \fIstatus\fR and \fIresize\fR commands. + +For \fIluksFormat\fR with a file name as the argument to \-\-header, +the file will be automatically created if it does not exist. +See the cryptsetup FAQ for header size calculation. + +For other commands that change the LUKS header (e.g. \fIluksAddKey\fR), +specify the device or file with the LUKS header directly as the +LUKS device. + +If used with \fIluksFormat\fR, the \-\-align\-payload option is taken +as absolute sector alignment on ciphertext device and can be zero. + +\fBWARNING:\fR There is no check whether the ciphertext device specified +actually belongs to the header given. In fact, you can specify an +arbitrary device as the ciphertext device for \fIopen\fR +with the \-\-header option. Use with care. +.TP +.B "\-\-header\-backup\-file " +Specify file with header backup for \fIluksHeaderBackup\fR or +\fIluksHeaderRestore\fR actions. +.TP +.B "\-\-force\-password" +Do not use password quality checking for new LUKS passwords. + +This option applies only to \fIluksFormat\fR, \fIluksAddKey\fR and +\fIluksChangeKey\fR and is ignored if cryptsetup is built without +password quality checking support. + +For more info about password quality check, see the manual page +for \fBpwquality.conf(5)\fR and \fBpasswdqc.conf(5)\fR. +.TP +.B "\-\-deferred" +Defers device removal in \fIclose\fR command until the last user closes it. +.TP +.B "\-\-disable\-locks" +Disable lock protection for metadata on disk. +This option is valid only for LUKS2 and ignored for other formats. + +\fBWARNING:\fR Do not use this option unless you run cryptsetup in +a restricted environment where locking is impossible to perform +(where /run directory cannot be used). +.TP +.B "\-\-disable\-keyring" +Do not load volume key in kernel keyring and store it directly +in the dm-crypt target instead. +This option is supported only for the LUKS2 format. +.TP +.B "\-\-key\-description " +Set key description in keyring for use with \fItoken\fR command. +.TP +.B "\-\-priority " +Set a priority for LUKS2 keyslot. +The \fIprefer\fR priority marked slots are tried before \fInormal\fR priority. +The \fIignored\fR priority means, that slot is never used, if not explicitly +requested by \fI\-\-key\-slot\fR option. +.TP +.B "\-\-token\-id" +Specify what token to use in actions \fItoken\fR, \fIopen\fR or \fIresize\fR. +If omitted, all available tokens will be checked before proceeding further with +passphrase prompt. +.TP +.B "\-\-token\-only" +Do not proceed further with action (any of \fItoken\fR, \fIopen\fR or +\fIresize\fR) if token activation failed. Without the option, +action asks for passphrase to proceed further. +.TP +.B "\-\-sector\-size " +Set sector size for use with disk encryption. It must be power of two +and in range 512 - 4096 bytes. The default is 512 bytes sectors. +This option is available only in the LUKS2 mode. + +Note that if sector size is higher than underlying device hardware sector +and there is not integrity protection that uses data journal, using +this option can increase risk on incomplete sector writes during a power fail. + +If used together with \fI\-\-integrity\fR option and dm-integrity journal, +the atomicity of writes is guaranteed in all cases (but it cost write +performance - data has to be written twice). + +Increasing sector size from 512 bytes to 4096 bytes can provide better +performance on most of the modern storage devices and also with some +hw encryption accelerators. +.TP +.B "\-\-iv-large-sectors" +Count Initialization Vector (IV) in larger sector size (if set) instead +of 512 bytes sectors. This option can be used only for \fIopen\fR command +and \fIplain\fR encryption type. + +\fBNOTE:\fR This option does not have any performance or security impact, +use it only for accessing incompatible existing disk images from other systems +that require this option. +.TP +.B "\-\-persistent" +If used with LUKS2 devices and activation commands like \fIopen\fR or \fIrefresh\fR, +the specified activation flags are persistently written into metadata +and used next time automatically even for normal activation. +(No need to use cryptab or other system configuration files.) + +If you need to remove a persistent flag, use \fI\-\-persistent\fR without +the flag you want to remove (e.g. to disable persistently stored discard flag, +use \fI\-\-persistent\fR without \fI\-\-allow-discards\fR). + +Only \fI\-\-allow-discards\fR, \fI\-\-perf\-same_cpu_crypt\fR, +\fI\-\-perf\-submit_from_crypt_cpus\fR, \fI\-\-perf\-no_read_workqueue\fR, +\fI\-\-perf\-no_write_workqueue\fR and \fI\-\-integrity\-no\-journal\fR +can be stored persistently. +.TP +.B "\-\-refresh" +Refreshes an active device with new set of parameters. See action \fIrefresh\fR description +for more details. +.TP +.B "\-\-label /dev/null || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 3: DISABLED" || fail +# remove key0 / slot 0 +echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail +# last keyslot, in batch mode no passphrase needed... +$CRYPTSETUP luksKillSlot -q $LOOPDEV 1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail + +prepare "[19] create & status & resize" wipe +echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash xxx 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --cipher aes-cbc-essiv:sha256 --offset 3 --skip 4 --readonly || fail +$CRYPTSETUP -q status $DEV_NAME | grep "offset:" | grep -q "3 sectors" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "skipped:" | grep -q "4 sectors" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "mode:" | grep -q "readonly" || fail +$CRYPTSETUP -q resize $DEV_NAME --size 100 || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP -q resize $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "19997 sectors" || fail +$CRYPTSETUP -q resize $DEV_NAME --device-size 1M || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +$CRYPTSETUP -q resize $DEV_NAME --device-size 512k --size 1023 >/dev/null 2>&1 && fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +$CRYPTSETUP -q resize $DEV_NAME --device-size 513 >/dev/null 2>&1 && fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +# Resize underlying loop device as well +truncate -s 16M $IMG || fail +$CRYPTSETUP -q resize $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "32765 sectors" || fail +$CRYPTSETUP -q remove $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME >/dev/null && fail +echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail +$CRYPTSETUP -q remove $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 $LOOPDEV || fail +$CRYPTSETUP -q remove $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q create $DEV_NAME --hash sha1 --size 100 $LOOPDEV || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP -q remove $DEV_NAME || fail +# 4k sector resize (if kernel supports it) +echo $PWD1 | $CRYPTSETUP -q open --type plain $LOOPDEV $DEV_NAME --sector-size 4096 --size 8 >/dev/null 2>&1 +if [ $? -eq 0 ] ; then + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "8 sectors" || fail + $CRYPTSETUP -q resize $DEV_NAME --size 16 || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "16 sectors" || fail + $CRYPTSETUP -q resize $DEV_NAME --size 9 2>/dev/null && fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "16 sectors" || fail + $CRYPTSETUP -q resize $DEV_NAME --device-size 4608 2>/dev/null && fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "16 sectors" || fail + $CRYPTSETUP -q remove $DEV_NAME || fail +fi +# Resize not aligned to logical block size +add_scsi_device dev_size_mb=32 sector_size=4096 +echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $DEV || fail +OLD_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/') +$CRYPTSETUP resize $DEV_NAME -b 7 2> /dev/null && fail +dmsetup info $DEV_NAME | grep -q SUSPENDED && fail +NEW_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/') +test $OLD_SIZE -eq $NEW_SIZE || fail +$CRYPTSETUP close $DEV_NAME || fail +# Add check for unaligned plain crypt activation +echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $DEV -b 7 2>/dev/null && fail +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 && fail +# verify is ignored on non-tty input +echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase 2>/dev/null || fail +$CRYPTSETUP -q remove $DEV_NAME || fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size 255 2>/dev/null && fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size -1 2>/dev/null && fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 -l -1 2>/dev/null && fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d blah 2>/dev/null && fail +$CRYPTSETUP -q remove $DEV_NAME || fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d /dev/urandom || fail +$CRYPTSETUP -q remove $DEV_NAME || fail + +prepare "[20] Disallow open/create if already mapped." wipe +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 2>/dev/null && fail +$CRYPTSETUP create $DEV_NAME2 $LOOPDEV -d $KEY1 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV 2>/dev/null && fail +$CRYPTSETUP remove $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail +$CRYPTSETUP luksClose $DEV_NAME || fail + +prepare "[21] luksDump" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT --uuid $TEST_UUID $LOOPDEV $KEY1 || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail +echo $PWDW | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key | grep -q "MK dump:" || fail +$CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key -d $KEY1 | grep -q "MK dump:" || fail +echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE > /dev/null || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $LOOPDEV || fail + +prepare "[22] remove disappeared device" wipe +dmsetup create $DEV_NAME --table "0 5000 linear $LOOPDEV 2" || fail +echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat --type luks1 /dev/mapper/$DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail +# underlying device now returns error but node is still present +dmsetup load $DEV_NAME --table "0 5000 error" || fail +dmsetup resume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME2 || fail +dmsetup remove --retry $DEV_NAME || fail + +prepare "[23] ChangeKey passphrase and keyfile" wipe +# [0]$KEY1 [1]key0 +$CRYPTSETUP -q luksFormat --type luks1 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 --key-slot 1 || fail +# keyfile [0] / keyfile [0] +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 0 || fail +# passphrase [1] / passphrase [1] +echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT --key-slot 1 || fail +# keyfile [0] / keyfile [new] +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: DISABLED" || fail +# passphrase [1] / passphrase [new] +echo -e "$PWD2\n$PWD1\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail +# use all slots +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +# still allows replace +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 || fail +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 2>/dev/null && fail + +prepare "[24] Keyfile limit" wipe +$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail +$CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 14 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l -1 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 --new-keyfile-size 12 || fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 2>/dev/null && fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 -l 12 || fail +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT 2>/dev/null && fail +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 14 2>/dev/null && fail +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 || fail +# -l is ignored for stdin if _only_ passphrase is used +echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 $FAST_PBKDF_OPT || fail +# this is stupid, but expected +echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail +echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail +echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail +# offset +$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail +$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail +$CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +# large device with keyfile +echo -e '0 10000000 error'\\n'10000000 1000000 zero' | dmsetup create $DEV_NAME2 || fail +$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV /dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 || fail +$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5119999999 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=/dev/mapper/$DEV_NAME2 -l 13 --keyfile-offset 5120000000 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d /dev/mapper/$DEV_NAME2 \ + --keyfile-offset 5120000000 -l 13 /dev/mapper/$DEV_NAME2 --new-keyfile-offset 5120000001 --new-keyfile-size 15 || fail +dmsetup remove --retry $DEV_NAME2 + +prepare "[25] Create shared segments" wipe +echo $PWD1 | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --offset 0 --size 256 || fail +echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 --shared || fail +$CRYPTSETUP -q remove $DEV_NAME2 || fail +$CRYPTSETUP -q remove $DEV_NAME || fail + +prepare "[26] Suspend/Resume" wipe +# only LUKS is supported +echo $PWD1 | $CRYPTSETUP create $DEV_NAME --hash sha1 $LOOPDEV || fail +$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP -q remove $DEV_NAME || fail +$CRYPTSETUP luksSuspend $DEV_NAME 2>/dev/null && fail +# LUKS +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep -q "(suspended)" || fail +$CRYPTSETUP -q resize $DEV_NAME 2>/dev/null && fail +echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksResume should return EPERM exit code" +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +echo | $CRYPTSETUP -q luksFormat -c null $FAST_PBKDF_OPT --type luks1 $LOOPDEV || fail +echo | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep -q "(suspended)" || fail +echo | $CRYPTSETUP luksResume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail + +prepare "[27] luksOpen with specified key slot number" wipe +# first, let's try passphrase option +echo $PWD3 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT -S 5 $LOOPDEV || fail +check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5 +echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD3 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME || fail +check_exists +$CRYPTSETUP luksClose $DEV_NAME || fail +echo -e "$PWD3\n$PWD1" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 0 $LOOPDEV || fail +check $LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0 +echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +# second, try it with keyfiles +$CRYPTSETUP luksFormat --type luks1 -q -S 5 -d $KEY5 $LOOPDEV || fail +check $LUKS_HEADER $KEY_SLOT5 $KEY_MATERIAL5 +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail +check $LUKS_HEADER $KEY_SLOT1 $KEY_MATERIAL1 +$CRYPTSETUP luksOpen -S 5 -d $KEY5 $LOOPDEV $DEV_NAME || fail +check_exists +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +$CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail + +prepare "[28] Detached LUKS header" wipe +echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG || fail +echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --align-payload 8192 --offset 8192 >/dev/null 2>&1 && fail +truncate -s 4096 $HEADER_IMG +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG -S7 >/dev/null 2>&1 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --offset 80000 >/dev/null 2>&1 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --offset 8192 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV --header $HEADER_IMG --offset 0 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV-missing --header $HEADER_IMG $DEV_NAME 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail +$CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail +$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "type:" | grep -q "n/a" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 5 _fakedev_ --header $HEADER_IMG $KEY5 || fail +$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "Key Slot 5: ENABLED" || fail +$CRYPTSETUP luksKillSlot -q _fakedev_ --header $HEADER_IMG 5 || fail +$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "Key Slot 5: DISABLED" || fail +echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_IMG || fail + +prepare "[29] Repair metadata" wipe +$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 0 || fail +# second sector overwrite should corrupt keyslot 6+7 +dd if=/dev/urandom of=$LOOPDEV bs=512 seek=1 count=1 >/dev/null 2>&1 +$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME >/dev/null 2>&1 && fail +$CRYPTSETUP -q repair $LOOPDEV >/dev/null 2>&1 || fail +$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail + +prepare "[30] LUKS erase" wipe +$CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_OPT $LOOPDEV $KEY5 --key-slot 5 || fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail +$CRYPTSETUP luksErase -q $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: DISABLED" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: DISABLED" || fail + +prepare "[31] Deferred removal of device" wipe +echo $PWD1 | $CRYPTSETUP open --type plain --hash sha256 $LOOPDEV $DEV_NAME || fail +echo $PWD2 | $CRYPTSETUP open --type plain --hash sha256 /dev/mapper/$DEV_NAME $DEV_NAME2 || fail +$CRYPTSETUP close $DEV_NAME >/dev/null 2>&1 && fail +$CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 || fail +$CRYPTSETUP close --deferred $DEV_NAME >/dev/null 2>&1 +if [ $? -eq 0 ] ; then + dmsetup info $DEV_NAME | grep -q "DEFERRED REMOVE" || fail + $CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 || fail + $CRYPTSETUP close $DEV_NAME2 || fail + $CRYPTSETUP -q status $DEV_NAME >/dev/null 2>&1 && fail +else + $CRYPTSETUP close $DEV_NAME2 >/dev/null 2>&1 + $CRYPTSETUP close $DEV_NAME >/dev/null 2>&1 +fi + +# Interactive tests +# Do not remove sleep 0.1 below, the password query flushes TTY buffer (so the code is racy). +which expect >/dev/null 2>&1 || skip "WARNING: expect tool missing, interactive test will be skipped." 0 + +prepare "[32] Interactive password retry from terminal." new +EXPECT_DEV=$(losetup $LOOPDEV | sed -e "s/.*(\(.*\))/\1/") +EXPECT_TIMEOUT=10 +[ -n "$VALG" ] && EXPECT_TIMEOUT=60 + +expect_run - >/dev/null </dev/null </dev/null </dev/null </dev/null </dev/null </dev/null </dev/null <$KEYE + +expect_run - >/dev/null </dev/null) +[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME3 ] && dmsetup remove --retry $DEV_NAME3 + [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2 + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + losetup -d $LOOPDEV >/dev/null 2>&1 + rm -f $ORIG_IMG $IMG $IMG10 $KEY1 $KEY2 $KEY5 $KEYE $HEADER_IMG $HEADER_KEYU $VK_FILE $HEADER_LUKS2_PV missing-file $TOKEN_FILE0 $TOKEN_FILE1 test_image_* $KEY_FILE0 $KEY_FILE1 >/dev/null 2>&1 + + # unlink whole test keyring + [ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null + unset TEST_KEYRING + + rmmod scsi_debug 2> /dev/null + scsi_debug_teardown $DEV +} + +function force_uevent() +{ + DNAME=$(echo $LOOPDEV | cut -f3 -d /) + echo "change" >/sys/block/$DNAME/uevent +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + exit 2 +} + +function fips_mode() +{ + [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ] +} + +function can_fail_fips() +{ + # Ignore this fail if running in FIPS mode + fips_mode || fail $1 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + exit 77 +} + +function prepare() +{ + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + + case "$2" in + wipe) + remove_mapping + dd if=/dev/zero of=$IMG bs=1M count=40 >/dev/null 2>&1 + sync + losetup $LOOPDEV $IMG + ;; + new) + remove_mapping + xz -cd compatimage.img.xz > $IMG + xz -dk $HEADER_KEYU.xz + # FIXME: switch to internal loop (no losetup at all) + echo "bad" | $CRYPTSETUP luksOpen --key-slot 0 --test-passphrase $IMG 2>&1 | \ + grep "autoclear flag" && skip "WARNING: Too old kernel, test skipped." + losetup $LOOPDEV $IMG + xz -cd compatv10image.img.xz > $IMG10 + ;; + reuse | *) + if [ ! -e $IMG ]; then + xz -cd compatimage.img.xz > $IMG + losetup $LOOPDEV $IMG + fi + [ ! -e $IMG10 ] && xz -cd compatv10image.img.xz > $IMG10 + ;; + esac + + if [ ! -e $KEY1 ]; then + #dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + echo -n $'\x48\xc6\x74\x4f\x41\x4e\x50\xc0\x79\xc2\x2d\x5b\x5f\x68\x84\x17' >$KEY1 + echo -n $'\x9c\x03\x5e\x1b\x4d\x0f\x9a\x75\xb3\x90\x70\x32\x0a\xf8\xae\xc4'>>$KEY1 + fi + + if [ ! -e $KEY2 ]; then + dd if=/dev/urandom of=$KEY2 count=1 bs=16 >/dev/null 2>&1 + fi + + if [ ! -e $KEY5 ]; then + dd if=/dev/urandom of=$KEY5 count=1 bs=16 >/dev/null 2>&1 + fi + + if [ ! -e $KEYE ]; then + touch $KEYE + fi + + cp $IMG $ORIG_IMG + [ -n "$1" ] && echo "CASE: $1" +} + +function check_exists() +{ + [ -b /dev/mapper/$DEV_NAME ] || fail +} + +function valgrind_setup() +{ + which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind." + [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable." + export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@" +} + +function dm_crypt_keyring_support() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PTC=$(echo $VER_STR | cut -f 3 -d.) + + test -d /proc/sys/kernel/keys || return 1 + + [ $VER_MAJ -gt 1 ] && return 0 + [ $VER_MAJ -eq 1 -a $VER_MIN -gt 18 ] && return 0 + [ $VER_MAJ -eq 1 -a $VER_MIN -eq 18 -a $VER_PTC -ge 1 ] && return 0 + return 1 +} + +function dm_crypt_keyring_flawed() +{ + dm_crypt_keyring_support && return 1; + + [ $VER_MAJ -gt 1 ] && return 0 + [ $VER_MAJ -eq 1 -a $VER_MIN -ge 15 ] && return 0 + return 1 +} + +function dm_crypt_keyring_new_kernel() +{ + KER_STR=$(uname -r) + [ -z "$KER_STR" ] && fail "Failed to parse kernel version." + KER_MAJ=$(echo $KER_STR | cut -f 1 -d.) + KER_MIN=$(echo $KER_STR | cut -f 2 -d.) + + [ $KER_MAJ -ge 5 ] && return 0 + [ $KER_MAJ -eq 4 -a $KER_MIN -ge 15 ] && return 0 + return 1 +} + +function dm_crypt_sector_size_support() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PTC=$(echo $VER_STR | cut -f 3 -d.) + + if [ $VER_MIN -ge 17 -o \( $VER_MIN -eq 14 -a $VER_PTC -ge 5 \) ]; then + return 0 + fi + + return 1 +} + +function test_and_prepare_keyring() { + which keyctl > /dev/null 2>&1 || skip "Cannot find keyctl, test skipped" + keyctl list "@s" > /dev/null || skip "Current session keyring is unreachable, test skipped" + TEST_KEYRING=$(keyctl newring $TEST_KEYRING_NAME "@u" 2> /dev/null) + test -n "$TEST_KEYRING" || skip "Failed to create keyring in user keyring" + keyctl search "@s" keyring "$TEST_KEYRING" > /dev/null 2>&1 || keyctl link "@u" "@s" > /dev/null 2>&1 + load_key user test_key test_data "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped." +} + +# $1 type +# $2 description +# $3 payload +# $4 keyring +function load_key() +{ + keyctl add $@ >/dev/null +} + +function setup_luks2_env() { + echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_OPT $LOOPDEV || fail + $CRYPTSETUP luksDump $LOOPDEV >/dev/null || fail + echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME || fail + HAVE_KEYRING=$($CRYPTSETUP status $DEV_NAME | grep "keyring") + if [ -n "$HAVE_KEYRING" ]; then + HAVE_KEYRING=1 + else + HAVE_KEYRING=0 + fi + $CRYPTSETUP close $DEV_NAME || fail +} + +# $1 path to scsi debug bdev +scsi_debug_teardown() { + local _tries=15; + + while [ -b "$1" -a $_tries -gt 0 ]; do + rmmod scsi_debug 2> /dev/null + if [ -b "$1" ]; then + sleep .1 + _tries=$((_tries-1)) + fi + done + + test ! -b "$1" || rmmod scsi_debug 2> /dev/null +} + +function add_scsi_device() { + scsi_debug_teardown $DEV + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 1 + DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + [ -b $DEV ] || fail "Cannot find $DEV." +} + +export LANG=C + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ -z "$LOOPDEV" ] && skip "WARNING: Cannot find free loop device, test skipped." + +prepare "[0] Detect LUKS2 environment" wipe +setup_luks2_env + +[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run + +prepare "[1] Data offset" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 1 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 16385 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 32 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --align-payload 16384 --offset 16384 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --offset 16384 || fail +$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "offset: $((512 * 16384)) \[bytes\]" || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 1024 --offset 16384 >/dev/null || fail +$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "offset: $((512 * 16384)) \[bytes\]" || fail +truncate -s 4096 $HEADER_IMG +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG -q --offset 80000 >/dev/null 2>&1 || fail + +prepare "[2] Sector size and old payload alignment" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 511 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 256 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 8192 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 512 || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --align-payload 5 || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 512 --align-payload 5 || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 --align-payload 32 >/dev/null || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 4096 >/dev/null || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 --align-payload 32768 >/dev/null || fail +$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "offset: $((512 * 32768)) \[bytes\]" || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 2048 >/dev/null || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -q --sector-size 4096 --align-payload 32768 >/dev/null || fail +$CRYPTSETUP -q luksDump $LOOPDEV | grep -q "offset: $((512 * 32768)) \[bytes\]" || fail + +prepare "[3] format" wipe +echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV || fail +prepare "[4] format using hash sha512" wipe +echo $PWD1 | $CRYPTSETUP $FAST_PBKDF_OPT -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV || fail +$CRYPTSETUP -q luksDump $LOOPDEV | grep "0: pbkdf2" -A2 | grep "Hash:" | grep -qe sha512 || fail + +prepare "[5] open" +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase || fail +echo $PWDW | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code" +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail +check_exists + +# Key Slot 1 and key material section 1 must change, the rest must not. +prepare "[6] add key" +echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT || fail +echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail + +# Unsuccessful Key Delete - nothing may change +prepare "[7] unsuccessful delete" +echo $PWDW | $CRYPTSETUP luksKillSlot $LOOPDEV 1 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksKillSlot should return EPERM exit code" +#FIXME +#$CRYPTSETUP -q luksKillSlot $LOOPDEV 8 2>/dev/null && fail +#$CRYPTSETUP -q luksKillSlot $LOOPDEV 7 2>/dev/null && fail + +# Delete Key Test +# Key Slot 1 and key material section 1 must change, the rest must not +prepare "[8] successful delete" +$CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail +echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2> /dev/null && fail +[ $? -ne 2 ] && fail "luksOpen should return EPERM exit code" +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail + +# Key Slot 1 and key material section 1 must change, the rest must not +prepare "[9] add key test for key files" +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 || fail +$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail + +# Key Slot 1 and key material section 1 must change, the rest must not +prepare "[10] delete key test with key1 as remaining key" +$CRYPTSETUP -d $KEY1 luksKillSlot $LOOPDEV 0 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail + +# Delete last slot +prepare "[11] delete last key" wipe +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $LOOPDEV $FAST_PBKDF_OPT || fail +echo $PWD1 | $CRYPTSETUP luksKillSlot $LOOPDEV 0 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail + +# Format test for ESSIV, and some other parameters. +prepare "[12] parameter variation test" wipe +$CRYPTSETUP -q $FAST_PBKDF_OPT -c aes-cbc-essiv:sha256 -s 128 luksFormat --type luks2 $LOOPDEV $KEY1 || fail +$CRYPTSETUP -d $KEY1 luksOpen $LOOPDEV $DEV_NAME || fail + +prepare "[13] open/close - stacked devices" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $FAST_PBKDF_OPT || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 /dev/mapper/$DEV_NAME $FAST_PBKDF_OPT || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail +$CRYPTSETUP -q luksClose $DEV_NAME2 || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail + +prepare "[14] format/open - passphrase on stdin & new line" wipe +# stdin defined by "-" must take even newline +#echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksFormat $LOOPDEV - || fail +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q --key-file=- luksFormat --type luks2 $LOOPDEV || fail +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +# now also try --key-file +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks2 $LOOPDEV --key-file=- || fail +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP -q --key-file=- luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +# process newline if from stdin +echo -n -e "$PWD1\n$PWD2" | $CRYPTSETUP $FAST_PBKDF_OPT -q luksFormat --type luks2 $LOOPDEV || fail +echo "$PWD1" | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail + +prepare "[15] UUID - use and report provided UUID" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid blah --type luks2 $LOOPDEV 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --uuid $TEST_UUID --type luks2 $LOOPDEV || fail +tst=$($CRYPTSETUP -q luksUUID $LOOPDEV) +[ "$tst"x = "$TEST_UUID"x ] || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +$CRYPTSETUP -q luksUUID --uuid $TEST_UUID $LOOPDEV || fail +tst=$($CRYPTSETUP -q luksUUID $LOOPDEV) +[ "$tst"x = "$TEST_UUID"x ] || fail + +prepare "[16] luksFormat" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom --type luks2 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom --type luks2 $LOOPDEV -d $KEY1 || fail +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID --type luks2 $LOOPDEV $KEY1 || fail +$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +# open by UUID +force_uevent # some systems do not update loop by-uuid +$CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +# empty keyfile +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEYE || fail +$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +# open by volume key +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT -s 256 --master-key-file $KEY1 --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail + +prepare "[17] AddKey volume key, passphrase and keyfile" wipe +# masterkey +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --master-key-file /dev/zero --key-slot 3 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail +echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 4 || fail +echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 4 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail +echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/null --key-slot 5 2>/dev/null && fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --master-key-file /dev/zero --key-slot 5 $KEY1 || fail +$CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 5 -d $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail + +# special "-" handling +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 3 || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 - || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - --test-passphrase || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d - $KEY2 || fail +$CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d - -d $KEY1 --test-passphrase 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV -d $KEY1 -d $KEY1 --test-passphrase 2>/dev/null && fail + +# [0]PWD1 [1]PWD2 [2]$KEY1/1 [3]$KEY1 [4]$KEY2 +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 3 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail +$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 3 2>/dev/null && fail +# keyfile/keyfile +$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 4 || fail +$CRYPTSETUP luksOpen $LOOPDEV -d $KEY2 --test-passphrase --key-slot 4 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail +# passphrase/keyfile +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 --key-slot 0 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 || fail +# passphrase/passphrase +echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --key-slot 1 || fail +echo $PWD2 | $CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail +# keyfile/passphrase +echo -e "$PWD2\n" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV $KEY1 --key-slot 2 --new-keyfile-size 3 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" || fail + +prepare "[18] RemoveKey passphrase and keyfile" reuse +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" || fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2" && fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY1 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksRemoveKey should return EPERM exit code" +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 --keyfile-size 1 2>/dev/null && fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" || fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "4: luks2" && fail +# if password or keyfile is provided, batch mode must not suppress it +echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 2>/dev/null && fail +echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 -q 2>/dev/null && fail +echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- 2>/dev/null && fail +echo "badpw" | $CRYPTSETUP luksKillSlot $LOOPDEV 2 --key-file=- -q 2>/dev/null && fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" || fail +# kill slot using passphrase from 1 +echo $PWD2 | $CRYPTSETUP luksKillSlot $LOOPDEV 2 2>/dev/null || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2" && fail +# remove key0 / slot 0 +echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" && fail +# last keyslot, in batch mode no passphrase needed... +$CRYPTSETUP luksKillSlot -q $LOOPDEV 1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail + +prepare "[19] create & status & resize" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail +if dm_crypt_keyring_support; then + echo | $CRYPTSETUP -q resize --size 100 $DEV_NAME 2>/dev/null && fail + if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then + test_and_prepare_keyring + load_key user $TEST_TOKEN2 $PWD1 "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped." + $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN2 --token-id 1 || fail + $CRYPTSETUP -q resize --size 99 $DEV_NAME <&- || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "99 sectors" || fail + #replace kernel key with wrong pass + load_key user $TEST_TOKEN2 $PWD2 "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped." + # must fail due to --token-only + echo $PWD1 | $CRYPTSETUP -q resize --token-only --size 100 $DEV_NAME && fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" && fail + fi +fi +echo $PWD1 | $CRYPTSETUP -q resize --size 100 $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +echo $PWD1 | $CRYPTSETUP -q resize --device-size 51200 $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +echo $PWD1 | $CRYPTSETUP -q resize --device-size 1M $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +echo $PWD1 | $CRYPTSETUP -q resize --device-size 512k --size 1024 $DEV_NAME > /dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q resize --device-size 4097 $DEV_NAME > /dev/null 2>&1 && fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +$CRYPTSETUP close $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksOpen --disable-keyring $LOOPDEV $DEV_NAME || fail +echo | $CRYPTSETUP -q resize --size 100 $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP close $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail +if dm_crypt_keyring_support; then + $CRYPTSETUP -q resize --disable-keyring --size 100 $DEV_NAME 2>/dev/null && fail +fi +if dm_crypt_sector_size_support; then + $CRYPTSETUP close $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 4096 $LOOPDEV > /dev/null || fail + echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP -q resize --device-size 1M $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail + echo $PWD1 | $CRYPTSETUP -q resize --device-size 2049s $DEV_NAME > /dev/null 2>&1 && fail + echo $PWD1 | $CRYPTSETUP -q resize --size 2049 $DEV_NAME > /dev/null 2>&1 && fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "2048 sectors" || fail +fi +$CRYPTSETUP close $DEV_NAME || fail +# Resize not aligned to logical block size +add_scsi_device dev_size_mb=32 sector_size=4096 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_OPT $DEV || fail +echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail +OLD_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/') +echo $PWD1 | $CRYPTSETUP resize $DEV_NAME -b 7 2> /dev/null && fail +dmsetup info $DEV_NAME | grep -q SUSPENDED && fail +NEW_SIZE=$($CRYPTSETUP status $DEV_NAME | grep "^ \+size:" | sed 's/.* \([0-9]\+\) .*/\1/') +test $OLD_SIZE -eq $NEW_SIZE || fail +$CRYPTSETUP close $DEV_NAME || fail + +prepare "[20] Disallow open/create if already mapped." wipe +$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV 2>/dev/null && fail +$CRYPTSETUP remove $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME2 2>/dev/null && fail +$CRYPTSETUP luksClose $DEV_NAME || fail + +prepare "[21] luksDump" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat --key-size 256 $FAST_PBKDF_OPT --uuid $TEST_UUID --type luks2 $LOOPDEV $KEY1 || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -d $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q $TEST_UUID || fail +echo $PWDW | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksDump $LOOPDEV --dump-master-key | grep -q "MK dump:" || fail +$CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key -d $KEY1 | grep -q "MK dump:" || fail +echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE >/dev/null || fail +echo $PWD1 | $CRYPTSETUP luksDump -q $LOOPDEV --dump-master-key --master-key-file $VK_FILE 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE $LOOPDEV || fail +# Use volume key file without keyslots +$CRYPTSETUP luksErase -q $LOOPDEV || fail +$CRYPTSETUP luksOpen --master-key-file $VK_FILE --key-size 256 --test-passphrase $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --master-key-file $VK_FILE --key-size 256 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP luksOpen --test-passphrase $LOOPDEV || fail + +prepare "[22] remove disappeared device" wipe +dmsetup create $DEV_NAME --table "0 39998 linear $LOOPDEV 2" || fail +echo $PWD1 | $CRYPTSETUP -q $FAST_PBKDF_OPT luksFormat --type luks2 /dev/mapper/$DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen /dev/mapper/$DEV_NAME $DEV_NAME2 || fail +# underlying device now returns error but node is still present +dmsetup load $DEV_NAME --table "0 40000 error" || fail +dmsetup resume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME2 || fail +dmsetup remove --retry $DEV_NAME || fail + +prepare "[23] ChangeKey passphrase and keyfile" wipe +# [0]$KEY1 [1]key0 +$CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 --key-slot 1 || fail +# keyfile [0] / keyfile [0] +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 --key-slot 0 || fail +# passphrase [1] / passphrase [1] +echo -e "$PWD1\n$PWD2\n" | $CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT --key-slot 1 || fail +# keyfile [0] / keyfile [new] +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "0: luks2" && fail +# passphrase [1] / passphrase [new] +echo -e "$PWD2\n$PWD1\n" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail +# use all slots +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT || fail +# still allows replace +#FIXME +#$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 || fail +#$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 $KEY2 2>/dev/null && fail + +prepare "[24] Keyfile limit" wipe +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 0 -l 13 || fail +$CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 -l -1 2>/dev/null && fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 --new-keyfile-size 12 || fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 2>/dev/null && fail +$CRYPTSETUP luksRemoveKey $LOOPDEV $KEY2 -l 12 || fail +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksChangeKey should return EPERM exit code" +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 -l 14 2>/dev/null && fail +$CRYPTSETUP luksChangeKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT -l 13 || fail +# -l is ignored for stdin if _only_ passphrase is used +echo $PWD1 | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 $FAST_PBKDF_OPT || fail +# this is stupid, but expected +echo $PWD1 | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 11 2>/dev/null && fail +echo $PWDW"0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 12 2>/dev/null && fail +echo -e "$PWD1\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 12 || fail +# offset +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail +$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail +$CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksClose $DEV_NAME || fail + +prepare "[26] Suspend/Resume" wipe +# LUKS +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep -q "(suspended)" || fail +$CRYPTSETUP -q resize $DEV_NAME 2>/dev/null && fail +echo $PWDW | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail +[ $? -ne 2 ] && fail "luksResume should return EPERM exit code" +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat -c null $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +echo $PWD1 | $CRYPTSETUP -q luksOpen $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +$CRYPTSETUP -q status $DEV_NAME | grep -q "(suspended)" || fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME || fail +$CRYPTSETUP -q luksClose $DEV_NAME || fail + +prepare "[27] luksOpen with specified key slot number" wipe +# first, let's try passphrase option +echo $PWD3 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT -S 5 --type luks2 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP luksOpen -S 4 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD3 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME || fail +check_exists +$CRYPTSETUP luksClose $DEV_NAME || fail +echo -e "$PWD3\n$PWD1" | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 0 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP luksOpen -S 0 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD1 | $CRYPTSETUP luksOpen -S 5 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +# second, try it with keyfiles +$CRYPTSETUP -q luksFormat -q -S 5 $FAST_PBKDF_OPT -d $KEY5 --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail +$CRYPTSETUP luksOpen -S 5 -d $KEY5 $LOOPDEV $DEV_NAME || fail +check_exists +$CRYPTSETUP luksClose $DEV_NAME || fail +$CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +$CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +# test keyslot not assigned to segment is unable to unlock volume +# otoh it should be allowed to test for proper passphrase +prepare "" new +echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail +echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail +echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD1 | $CRYPTSETUP open $HEADER_KEYU $DEV_NAME 2>/dev/null && fail +[ -b /dev/mapper/$DEV_NAME ] && fail +echo $PWD0 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP luksKillSlot -q $HEADER_KEYU 0 +$CRYPTSETUP luksDump $HEADER_KEYU | grep -q "0: luks2" && fail +echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail +echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail +echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail + +prepare "[28] Detached LUKS header" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 1 >/dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 8192 || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 4096 >/dev/null || fail +$CRYPTSETUP luksDump $HEADER_IMG | grep -e "0: crypt" -A1 | grep -qe $((4096*512)) || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV-missing --header $HEADER_IMG $DEV_NAME 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail +$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "type:" | grep -q "n/a" || fail +$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail +$CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail +$CRYPTSETUP luksSuspend $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail +$CRYPTSETUP luksClose $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 5 _fakedev_ --header $HEADER_IMG $KEY5 || fail +$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "5: luks2" || fail +$CRYPTSETUP luksKillSlot -q _fakedev_ --header $HEADER_IMG 5 || fail +$CRYPTSETUP luksDump _fakedev_ --header $HEADER_IMG | grep -q "5: luks2" && fail +echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_IMG || fail +rm $HEADER_IMG || fail +# create exactly 16 MiBs LUKS2 header +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG --luks2-keyslots-size 16352k --luks2-metadata-size 16k --offset 131072 >/dev/null || fail +SIZE=$(stat --printf=%s $HEADER_IMG) +test $SIZE -eq 16777216 || fail +$CRYPTSETUP -q luksDump $HEADER_IMG | grep -q "offset: $((512 * 131072)) \[bytes\]" || fail + +prepare "[29] Repair metadata" wipe +xz -dk $HEADER_LUKS2_PV.xz +$CRYPTSETUP isLuks --disable-locks $HEADER_LUKS2_PV && fail +$CRYPTSETUP isLuks $HEADER_LUKS2_PV && fail +$CRYPTSETUP isLuks --disable-locks --type luks2 $HEADER_LUKS2_PV && fail +$CRYPTSETUP isLuks --type luks2 $HEADER_LUKS2_PV && fail +$CRYPTSETUP -q repair $HEADER_LUKS2_PV || fail +$CRYPTSETUP isLuks $HEADER_LUKS2_PV || fail +$CRYPTSETUP isLuks --type luks2 $HEADER_LUKS2_PV || fail +$CRYPTSETUP isLuks --type luks1 $HEADER_LUKS2_PV && fail + +prepare "[30] LUKS erase" wipe +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY5 --key-slot 5 || fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail +$CRYPTSETUP luksErase -q $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" && fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" && fail + +prepare "[31] LUKS convert" wipe +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --key-slot 5 || fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 || fail +$CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 1: ENABLED" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 5: ENABLED" || fail +$CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail +$CRYPTSETUP -q convert --type luks1 $LOOPDEV || fail +# hash test +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 512 $LOOPDEV $KEY5 -S 0 --hash sha1 || fail +$CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 1 -d $KEY5 $LOOPDEV $KEY1 --hash sha256 || fail +$CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail +$CRYPTSETUP -q luksKillSlot $LOOPDEV 1 || fail +$CRYPTSETUP -q convert --type luks1 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "Key Slot 0: ENABLED" || fail +$CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 -d $KEY5 || fail +# sector size test +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 --sector-size 1024 $LOOPDEV $KEY5 || fail +$CRYPTSETUP -q convert --type luks1 $LOOPDEV >/dev/null 2>&1 && fail + +# create LUKS1 with data offset not aligned to 4KiB +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --align-payload 4097 || fail +$CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail +$CRYPTSETUP isLuks --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksOpen $LOOPDEV --test-passphrase --key-slot 0 -d $KEY5 || fail + +if dm_crypt_keyring_flawed; then + prepare "[32a] LUKS2 keyring dm-crypt bug" wipe + echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail + $CRYPTSETUP close $DEV_NAME || fail + # key must not load in kernel key even when dm-crypt module is missing + if rmmod dm-crypt > /dev/null 2>&1; then + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail + $CRYPTSETUP close $DEV_NAME || fail + fi +fi + +if dm_crypt_keyring_support && dm_crypt_keyring_new_kernel; then + prepare "[32] LUKS2 key in keyring" wipe + echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --header $HEADER_IMG || fail + + # check keyring support detection works as expected + rmmod dm-crypt > /dev/null 2>&1 || true + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "keyring" || fail + $CRYPTSETUP close $DEV_NAME || fail + + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --disable-keyring --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail + $CRYPTSETUP close $DEV_NAME || fail + + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --disable-keyring --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP luksSuspend $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "keyring" || fail + $CRYPTSETUP close $DEV_NAME || fail + + echo $PWD1 | $CRYPTSETUP open $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail + $CRYPTSETUP luksSuspend $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP luksResume --disable-keyring $DEV_NAME --header $HEADER_IMG || fail + $CRYPTSETUP -q status $DEV_NAME | grep "key location:" | grep -q "dm-crypt" || fail + $CRYPTSETUP close $DEV_NAME || fail +fi + +# FIXME: candidate for non-root tests +prepare "[33] tokens" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then + + test_and_prepare_keyring + + $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN0 --token-id 3 || fail + $CRYPTSETUP luksDump $LOOPDEV | grep -q -e "3: luks2-keyring" || fail + # keyslot 5 is inactive + $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN1 --key-slot 5 2> /dev/null && fail + # key description is not reachable + $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase && fail + # wrong passphrase + load_key user $TEST_TOKEN0 "blabla" "$TEST_KEYRING" || fail "Cannot load 32 byte user key type" + $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase 2>/dev/null && fail + load_key user $TEST_TOKEN0 $PWD1 "$TEST_KEYRING" || fail "Cannot load 32 byte user key type" + $CRYPTSETUP open --token-only $LOOPDEV --test-passphrase || fail + $CRYPTSETUP open --token-only $LOOPDEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME > /dev/null || fail + $CRYPTSETUP close $DEV_NAME || fail + $CRYPTSETUP token remove --token-id 3 $LOOPDEV || fail + $CRYPTSETUP luksDump $LOOPDEV | grep -q -e "3: luks2-keyring" && fail + + # test we can remove keyslot with token + echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey -S4 $FAST_PBKDF_OPT $LOOPDEV || fail + $CRYPTSETUP token add $LOOPDEV --key-description $TEST_TOKEN1 --key-slot 4 || fail + $CRYPTSETUP -q luksKillSlot $LOOPDEV 4 || fail +fi +echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import $LOOPDEV --token-id 10 || fail +echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import $LOOPDEV --token-id 11 --json-file - || fail +echo -n "$IMPORT_TOKEN" > $TOKEN_FILE0 +$CRYPTSETUP token import $LOOPDEV --token-id 12 --json-file $TOKEN_FILE0 || fail +$CRYPTSETUP token import $LOOPDEV --token-id 12 --json-file $TOKEN_FILE0 2>/dev/null && fail +$CRYPTSETUP token export $LOOPDEV --token-id 10 | diff --from-file - $TOKEN_FILE0 || fail +$CRYPTSETUP token export $LOOPDEV --token-id 11 | diff --from-file - $TOKEN_FILE0 || fail +$CRYPTSETUP token export $LOOPDEV --token-id 12 | diff --from-file - $TOKEN_FILE0 || fail +$CRYPTSETUP token export $LOOPDEV --token-id 12 --json-file $TOKEN_FILE1 || fail +diff $TOKEN_FILE0 $TOKEN_FILE1 || fail +$CRYPTSETUP token export $LOOPDEV --token-id 12 > $TOKEN_FILE1 || fail +diff $TOKEN_FILE0 $TOKEN_FILE1 || fail + +prepare "[34] LUKS keyslot priority" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV -S 1 || fail +echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $LOOPDEV $FAST_PBKDF_OPT -S 5 || fail +$CRYPTSETUP config $LOOPDEV -S 0 --priority prefer && fail +$CRYPTSETUP config $LOOPDEV -S 1 --priority bla >/dev/null 2>&1 && fail +$CRYPTSETUP config $LOOPDEV -S 1 --priority ignore || fail +echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase -S 1 || fail +echo $PWD2 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail +$CRYPTSETUP config $LOOPDEV -S 1 --priority normal || fail +echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail +$CRYPTSETUP config $LOOPDEV -S 1 --priority ignore || fail +echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase 2>/dev/null && fail + +prepare "[35] LUKS label and subsystem" wipe +echo $PWD1 | $CRYPTSETUP luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "(no subsystem)" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "(no label)" || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --subsystem SatelliteTwo --label TheLabel || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteTwo" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "TheLabel" || fail +$CRYPTSETUP config $LOOPDEV --subsystem SatelliteThree +$CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteThree" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "(no label)" || fail +$CRYPTSETUP config $LOOPDEV --subsystem SatelliteThree --label TheLabel +$CRYPTSETUP luksDump $LOOPDEV | grep "Subsystem:" | grep -q "SatelliteThree" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Label:" | grep -q "TheLabel" || fail + +prepare "[36] LUKS PBKDF setting" wipe +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 --pbkdf bla $LOOPDEV >/dev/null 2>&1 && fail +# Force setting, no benchmark. PBKDF2 has 1000 iterations as a minimum +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 --pbkdf pbkdf2 --pbkdf-force-iterations 999 $LOOPDEV 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf pbkdf2 --pbkdf-force-iterations 1234 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Iterations:" | grep -q "1234" || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2id --pbkdf-force-iterations 3 $LOOPDEV 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2id --pbkdf-force-iterations 4 --pbkdf-memory 100000 $LOOPDEV || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "argon2id" || can_fail_fips +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2i --pbkdf-force-iterations 4 \ + --pbkdf-memory 1234 --pbkdf-parallel 1 $LOOPDEV || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "argon2i" || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep "Time cost:" | grep -q "4" || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep "Memory:" | grep -q "1234" || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep "Threads:" | grep -q "1" || can_fail_fips +# Benchmark +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf argon2i -i 500 --pbkdf-memory 1234 --pbkdf-parallel 1 $LOOPDEV || can_fail_fips +[ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep "Time cost:" | cut -d: -f 2 | sed -e 's/\ //g')" -gt 0 ] || can_fail_fips +[ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep "Memory:" | cut -d: -f 2 | sed -e 's/\ //g')" -gt 0 ] || can_fail_fips +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf pbkdf2 -i 500 $LOOPDEV || fail +[ 0"$($CRYPTSETUP luksDump $LOOPDEV | grep -m1 "Iterations:" | cut -d' ' -f 2 | sed -e 's/\ //g')" -gt 1000 ] || fail + +prepare "[37] LUKS Keyslot convert" wipe +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV $KEY5 --key-slot 5 || fail +$CRYPTSETUP -q luksConvertKey $LOOPDEV --key-file $KEY5 2>/dev/null && fail +$CRYPTSETUP -q convert --type luks2 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "pbkdf2" || fail +$CRYPTSETUP -q luksConvertKey $LOOPDEV -S 5 --key-file $KEY5 --pbkdf argon2i -i1 --pbkdf-memory 32 || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep -q "5: luks2" || can_fail_fips +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV -S 1 --key-file $KEY5 || fail +$CRYPTSETUP -q luksKillSlot $LOOPDEV 5 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "PBKDF:" | grep -q "pbkdf2" || fail +echo $PWD1 | $CRYPTSETUP -q luksConvertKey $LOOPDEV -S 1 --pbkdf argon2i -i1 --pbkdf-memory 32 || can_fail_fips +$CRYPTSETUP luksDump $LOOPDEV | grep -q "1: luks2" || can_fail_fips +echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT -S 21 --unbound -s 16 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP luksConvertKey --pbkdf-force-iterations 1001 --pbkdf pbkdf2 -S 21 $LOOPDEV || fail + +prepare "[38] luksAddKey unbound tests" wipe +$CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV $KEY5 --key-slot 5 || fail +# unbound key may have arbitrary size +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 16 $LOOPDEV || fail +echo $PWD2 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 32 -S 2 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2 (unbound)" || fail +dd if=/dev/urandom of=$KEY_FILE0 bs=64 count=1 > /dev/null 2>&1 || fail +echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --unbound -s 512 -S 3 --master-key-file $KEY_FILE0 $LOOPDEV || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2 (unbound)" || fail +# unbound key size is required +echo $PWD1 | $CRYPTSETUP -q luksAddKey --unbound $LOOPDEV 2>/dev/null && fail +echo $PWD3 | $CRYPTSETUP -q luksAddKey --unbound --master-key-file /dev/urandom $LOOPDEV 2> /dev/null && fail +# do not allow to replace keyslot by unbound slot +echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail +echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail +echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail +echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail +echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV --test-passphrase || fail +echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail +echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail +# check we're able to change passphrase for unbound keyslot +echo -e "$PWD2\n$PWD3" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP open --test-passphrase $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP -q open -S 2 $LOOPDEV $DEV_NAME 2> /dev/null && fail +# do not allow adding keyslot by unbound keyslot +echo -e "$PWD3\n$PWD1" | $CRYPTSETUP -q luksAddKey $LOOPDEV 2> /dev/null && fail +# check adding keyslot works when there's unbound keyslot +echo $PWD1 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT $LOOPDEV --key-file $KEY5 -S8 || fail +echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME || fail +$CRYPTSETUP close $DEV_NAME || fail +$CRYPTSETUP luksKillSlot -q $LOOPDEV 2 +$CRYPTSETUP luksDump $LOOPDEV | grep -q "2: luks2 (unbound)" && fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 $LOOPDEV 2> /dev/null && fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound 2> /dev/null $LOOPDEV 2> /dev/null && fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV > /dev/null || fail +diff $KEY_FILE0 $KEY_FILE1 || fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV 2> /dev/null && fail +diff $KEY_FILE0 $KEY_FILE1 || fail +rm $KEY_FILE1 || fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound --master-key-file $KEY_FILE1 -S3 $LOOPDEV | grep -q "Unbound Key:" && fail +echo $PWD3 | $CRYPTSETUP luksDump --unbound -S3 $LOOPDEV | grep -q "Unbound Key:" || fail +$CRYPTSETUP luksKillSlot -q $LOOPDEV 3 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2 (unbound)" && fail + +prepare "[39] LUKS2 metadata variants" wipe +tar xJf luks2_mda_images.tar.xz +echo -n "$IMPORT_TOKEN" > $TOKEN_FILE0 +for mda in 16 32 64 128 256 512 1024 2048 4096 ; do + echo -n "[$mda KiB]" + echo $PWD4 | $CRYPTSETUP open test_image_$mda $DEV_NAME || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -e "$PWD4\n$PWD3" | $CRYPTSETUP luksAddKey -S9 $FAST_PBKDF_OPT test_image_$mda || fail + echo $PWD4 | $CRYPTSETUP open --test-passphrase test_image_$mda || fail + echo $PWD3 | $CRYPTSETUP open -S9 --test-passphrase test_image_$mda || fail + echo -n "$IMPORT_TOKEN" | $CRYPTSETUP token import test_image_$mda --token-id 10 || fail + $CRYPTSETUP token export test_image_$mda --token-id 10 | diff --from-file - $TOKEN_FILE0 || fail + echo -n "[OK]" +done +echo + +prepare "[40] LUKS2 metadata areas" wipe +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV 2> /dev/null || fail +DEFAULT_OFFSET=$($CRYPTSETUP luksDump $LOOPDEV | grep "offset: " | cut -f 2 -d ' ') +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks1 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128k 2> /dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=127k 2> /dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=127k --luks2-keyslots-size=128k 2> /dev/null && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128M >/dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k --luks2-keyslots-size=128k >/dev/null || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "131072 \[bytes\]" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "131072 \[bytes\]" || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-metadata-size=128k || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "131072 \[bytes\]" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "$((DEFAULT_OFFSET-2*131072)) \[bytes\]" || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --luks2-keyslots-size=128k >/dev/null || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "16384 \[bytes\]" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "131072 \[bytes\]" || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset 16384 || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Metadata area:" | grep -q "16384 \[bytes\]" || fail +$CRYPTSETUP luksDump $LOOPDEV | grep "Keyslots area:" | grep -q "8355840 \[bytes\]" || fail +# data offset vs area size +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset 64 --luks2-keyslots-size=8192 >/dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset $((256+56)) >/dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP -q luksFormat $FAST_PBKDF_OPT --type luks2 $LOOPDEV --key-size 256 --offset $((256+64)) >/dev/null || fail + +prepare "[41] Per-keyslot encryption parameters" wipe +KEYSLOT_CIPHER="aes-cbc-plain64" +$CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --key-slot 0 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Cipher:" | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT --key-slot 1 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "1: luks2" | grep "Cipher:" | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "1: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail +$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 $FAST_PBKDF_OPT --key-slot 2 || fail +$CRYPTSETUP luksChangeKey $LOOPDEV $FAST_PBKDF_OPT -d $KEY2 $KEY1 --key-slot 2 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "2: luks2" | grep "Cipher:" | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "2: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail +# unbound keyslot +echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --key-slot 21 --unbound -s 32 --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 $LOOPDEV || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "21: luks2" | grep "Cipher:" | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "21: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail +echo $PWD3 | $CRYPTSETUP luksAddKey $FAST_PBKDF_OPT --key-slot 22 --unbound -s 32 $LOOPDEV || fail +echo $PWD3 | $CRYPTSETUP luksConvertKey --key-slot 22 $LOOPDEV --keyslot-cipher $KEYSLOT_CIPHER --keyslot-key-size 128 $LOOPDEV || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "22: luks2" | grep "Cipher:" | sed -e 's/[[:space:]]\+Cipher:\ \+//g')" = $KEYSLOT_CIPHER ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "22: luks2" | grep "Cipher key:"| sed -e 's/[[:space:]]\+Cipher\ key:\ \+//g')" = "128 bits" ] || fail + +prepare "[42] Some encryption compatibility mode tests" wipe +CIPHERS="aes-ecb aes-cbc-null aes-cbc-plain64 aes-cbc-essiv:sha256 aes-xts-plain64" +key_size=256 +for cipher in $CIPHERS ; do + echo -n "[$cipher/$key_size]" + $CRYPTSETUP -q luksFormat --type luks2 $LOOPDEV $KEY1 $FAST_PBKDF_OPT --cipher $cipher --key-size $key_size || fail +done +echo + +remove_mapping +exit 0 diff --git a/tests/compatimage.img.xz b/tests/compatimage.img.xz new file mode 100644 index 0000000..37fe163 Binary files /dev/null and b/tests/compatimage.img.xz differ diff --git a/tests/compatimage2.img.xz b/tests/compatimage2.img.xz new file mode 100644 index 0000000..ceaeafc Binary files /dev/null and b/tests/compatimage2.img.xz differ diff --git a/tests/compatv10image.img.xz b/tests/compatv10image.img.xz new file mode 100644 index 0000000..2203626 Binary files /dev/null and b/tests/compatv10image.img.xz differ diff --git a/tests/conversion_imgs.tar.xz b/tests/conversion_imgs.tar.xz new file mode 100644 index 0000000..cdeb961 Binary files /dev/null and b/tests/conversion_imgs.tar.xz differ diff --git a/tests/crypto-vectors.c b/tests/crypto-vectors.c new file mode 100644 index 0000000..004e426 --- /dev/null +++ b/tests/crypto-vectors.c @@ -0,0 +1,1272 @@ +/* + * cryptsetup crypto backend test vectors + * + * Copyright (C) 2018-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include + +#include "crypto_backend.h" + +#ifndef ARRAY_SIZE +# define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0])) +#endif + +static void printhex(const char *s, const char *buf, size_t len) +{ + size_t i; + + printf("%s: ", s); + for (i = 0; i < len; i++) + printf(" %02x", (unsigned char)buf[i]); + printf("\n"); + fflush(stdout); +} + +/* + * KDF tests + */ +struct kdf_test_vector { + const char *type; + const char *hash; + unsigned int hash_block_length; + unsigned int iterations; + unsigned int memory; + unsigned int parallelism; + const char *password; + unsigned int password_length; + const char *salt; + unsigned int salt_length; +// const char *key; +// unsigned int key_length; +// const char *ad; +// unsigned int ad_length; + const char *output; + unsigned int output_length; +}; + +static struct kdf_test_vector kdf_test_vectors[] = { + /* Argon2 RFC (without key and ad values) */ + { + "argon2i", NULL, 0, 3, 32, 4, + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01", 32, + "\x02\x02\x02\x02\x02\x02\x02\x02" + "\x02\x02\x02\x02\x02\x02\x02\x02", 16, +// "\x03\x03\x03\x03\x03\x03\x03\x03", 8, +// "\x04\x04\x04\x04\x04\x04\x04\x04" +// "\x04\x04\x04\x04", 12, + "\xa9\xa7\x51\x0e\x6d\xb4\xd5\x88" + "\xba\x34\x14\xcd\x0e\x09\x4d\x48" + "\x0d\x68\x3f\x97\xb9\xcc\xb6\x12" + "\xa5\x44\xfe\x8e\xf6\x5b\xa8\xe0", 32 +// "\xc8\x14\xd9\xd1\xdc\x7f\x37\xaa" +// "\x13\xf0\xd7\x7f\x24\x94\xbd\xa1" +// "\xc8\xde\x6b\x01\x6d\xd3\x88\xd2" +// "\x99\x52\xa4\xc4\x67\x2b\x6c\xe8", 32 + }, + { + "argon2id", NULL, 0, 3, 32, 4, + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01" + "\x01\x01\x01\x01\x01\x01\x01\x01", 32, + "\x02\x02\x02\x02\x02\x02\x02\x02" + "\x02\x02\x02\x02\x02\x02\x02\x02", 16, +// "\x03\x03\x03\x03\x03\x03\x03\x03", 8, +// "\x04\x04\x04\x04\x04\x04\x04\x04" +// "\x04\x04\x04\x04", 12, + "\x03\xaa\xb9\x65\xc1\x20\x01\xc9" + "\xd7\xd0\xd2\xde\x33\x19\x2c\x04" + "\x94\xb6\x84\xbb\x14\x81\x96\xd7" + "\x3c\x1d\xf1\xac\xaf\x6d\x0c\x2e", 32 +// "\x0d\x64\x0d\xf5\x8d\x78\x76\x6c" +// "\x08\xc0\x37\xa3\x4a\x8b\x53\xc9" +// "\xd0\x1e\xf0\x45\x2d\x75\xb6\x5e" +// "\xb5\x25\x20\xe9\x6b\x01\xe6\x59", 32 + }, + /* RFC 3962 */ + { + "pbkdf2", "sha1", 64, 1, 0, 0, + "password", 8, + "ATHENA.MIT.EDUraeburn", 21, + "\xcd\xed\xb5\x28\x1b\xb2\xf8\x01" + "\x56\x5a\x11\x22\xb2\x56\x35\x15" + "\x0a\xd1\xf7\xa0\x4b\xb9\xf3\xa3" + "\x33\xec\xc0\xe2\xe1\xf7\x08\x37", 32 + }, { + "pbkdf2", "sha1", 64, 2, 0, 0, + "password", 8, + "ATHENA.MIT.EDUraeburn", 21, + "\x01\xdb\xee\x7f\x4a\x9e\x24\x3e" + "\x98\x8b\x62\xc7\x3c\xda\x93\x5d" + "\xa0\x53\x78\xb9\x32\x44\xec\x8f" + "\x48\xa9\x9e\x61\xad\x79\x9d\x86", 32 + }, { + "pbkdf2", "sha1", 64, 1200, 0, 0, + "password", 8, + "ATHENA.MIT.EDUraeburn", 21, + "\x5c\x08\xeb\x61\xfd\xf7\x1e\x4e" + "\x4e\xc3\xcf\x6b\xa1\xf5\x51\x2b" + "\xa7\xe5\x2d\xdb\xc5\xe5\x14\x2f" + "\x70\x8a\x31\xe2\xe6\x2b\x1e\x13", 32 + }, { + "pbkdf2", "sha1", 64, 5, 0, 0, + "password", 8, + "\0224VxxV4\022", 8, // "\x1234567878563412 + "\xd1\xda\xa7\x86\x15\xf2\x87\xe6" + "\xa1\xc8\xb1\x20\xd7\x06\x2a\x49" + "\x3f\x98\xd2\x03\xe6\xbe\x49\xa6" + "\xad\xf4\xfa\x57\x4b\x6e\x64\xee", 32 + }, { + "pbkdf2", "sha1", 64, 1200, 0, 0, + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 64, + "pass phrase equals block size", 29, + "\x13\x9c\x30\xc0\x96\x6b\xc3\x2b" + "\xa5\x5f\xdb\xf2\x12\x53\x0a\xc9" + "\xc5\xec\x59\xf1\xa4\x52\xf5\xcc" + "\x9a\xd9\x40\xfe\xa0\x59\x8e\xd1", 32 + }, { + "pbkdf2", "sha1", 64, 1200, 0, 0, + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 65, + "pass phrase exceeds block size", 30, + "\x9c\xca\xd6\xd4\x68\x77\x0c\xd5" + "\x1b\x10\xe6\xa6\x87\x21\xbe\x61" + "\x1a\x8b\x4d\x28\x26\x01\xdb\x3b" + "\x36\xbe\x92\x46\x91\x5e\xc8\x2a", 32 + }, { + "pbkdf2", "sha1", 64, 50, 0, 0, + "\360\235\204\236", 4, // g-clef ("\xf09d849e) + "EXAMPLE.COMpianist", 18, + "\x6b\x9c\xf2\x6d\x45\x45\x5a\x43" + "\xa5\xb8\xbb\x27\x6a\x40\x3b\x39" + "\xe7\xfe\x37\xa0\xc4\x1e\x02\xc2" + "\x81\xff\x30\x69\xe1\xe9\x4f\x52", 32 + }, { + /* RFC-6070 */ + "pbkdf2", "sha1", 64, 1, 0, 0, + "password", 8, + "salt", 4, + "\x0c\x60\xc8\x0f\x96\x1f\x0e\x71\xf3\xa9" + "\xb5\x24\xaf\x60\x12\x06\x2f\xe0\x37\xa6", 20 + }, { + "pbkdf2", "sha1", 64, 2, 0, 0, + "password", 8, + "salt", 4, + "\xea\x6c\x01\x4d\xc7\x2d\x6f\x8c\xcd\x1e" + "\xd9\x2a\xce\x1d\x41\xf0\xd8\xde\x89\x57", 20 + }, { + "pbkdf2", "sha1", 64, 4096, 0, 0, + "password", 8, + "salt", 4, + "\x4b\x00\x79\x01\xb7\x65\x48\x9a\xbe\xad" + "\x49\xd9\x26\xf7\x21\xd0\x65\xa4\x29\xc1", 20 + }, { + "pbkdf2", "sha1", 64, 16777216, 0, 0, + "password", 8, + "salt", 4, + "\xee\xfe\x3d\x61\xcd\x4d\xa4\xe4\xe9\x94" + "\x5b\x3d\x6b\xa2\x15\x8c\x26\x34\xe9\x84", 20 + }, { + "pbkdf2", "sha1", 64, 4096, 0, 0, + "passwordPASSWORDpassword", 24, + "saltSALTsaltSALTsaltSALTsaltSALTsalt", 36, + "\x3d\x2e\xec\x4f\xe4\x1c\x84\x9b\x80\xc8" + "\xd8\x36\x62\xc0\xe4\x4a\x8b\x29\x1a\x96" + "\x4c\xf2\xf0\x70\x38", 25 + }, { + "pbkdf2", "sha1", 64, 4096, 0, 0, + "pass\0word", 9, + "sa\0lt", 5, + "\x56\xfa\x6a\xa7\x55\x48\x09\x9d\xcc\x37" + "\xd7\xf0\x34\x25\xe0\xc3", 16 + }, { + /* empty password test */ + "pbkdf2", "sha1", 64, 2, 0, 0, + "", 0, + "salt", 4, + "\x13\x3a\x4c\xe8\x37\xb4\xd2\x52\x1e\xe2" + "\xbf\x03\xe1\x1c\x71\xca\x79\x4e\x07\x97", 20 + }, { + /* Password exceeds block size test */ + "pbkdf2", "sha256", 64, 1200, 0, 0, + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 65, + "pass phrase exceeds block size", 30, + "\x22\x34\x4b\xc4\xb6\xe3\x26\x75" + "\xa8\x09\x0f\x3e\xa8\x0b\xe0\x1d" + "\x5f\x95\x12\x6a\x2c\xdd\xc3\xfa" + "\xcc\x4a\x5e\x6d\xca\x04\xec\x58", 32 + }, { + "pbkdf2", "sha512", 128, 1200, 0, 0, + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 129, + "pass phrase exceeds block size", 30, + "\x0f\xb2\xed\x2c\x0e\x6e\xfb\x7d" + "\x7d\x8e\xdd\x58\x01\xb4\x59\x72" + "\x99\x92\x16\x30\x5e\xa4\x36\x8d" + "\x76\x14\x80\xf3\xe3\x7a\x22\xb9", 32 + }, { + "pbkdf2", "whirlpool", 64, 1200, 0, 0, + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" + "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 65, + "pass phrase exceeds block size", 30, + "\x9c\x1c\x74\xf5\x88\x26\xe7\x6a" + "\x53\x58\xf4\x0c\x39\xe7\x80\x89" + "\x07\xc0\x31\x19\x9a\x50\xa2\x48" + "\xf1\xd9\xfe\x78\x64\xe5\x84\x50", 32 + } +}; + +/* + * Hash tests + */ +struct hash_test_vector { + const char *data; + unsigned int data_length; + struct { + const char *name; + unsigned int length; + const char *out; + } out[8]; +}; + +static struct hash_test_vector hash_test_vectors[] = { +{ + "", 0, { + { "crc32", 4, "\x00\x00\x00\x00" }, + { "sha1", 20, "\xda\x39\xa3\xee\x5e\x6b\x4b\x0d\x32\x55\xbf\xef\x95\x60\x18\x90\xaf\xd8\x07\x09" }, + { "sha256", 32, "\xe3\xb0\xc4\x42\x98\xfc\x1c\x14\x9a\xfb\xf4\xc8\x99\x6f\xb9\x24" + "\x27\xae\x41\xe4\x64\x9b\x93\x4c\xa4\x95\x99\x1b\x78\x52\xb8\x55" }, + { "sha512", 64, "\xcf\x83\xe1\x35\x7e\xef\xb8\xbd\xf1\x54\x28\x50\xd6\x6d\x80\x07" + "\xd6\x20\xe4\x05\x0b\x57\x15\xdc\x83\xf4\xa9\x21\xd3\x6c\xe9\xce" + "\x47\xd0\xd1\x3c\x5d\x85\xf2\xb0\xff\x83\x18\xd2\x87\x7e\xec\x2f" + "\x63\xb9\x31\xbd\x47\x41\x7a\x81\xa5\x38\x32\x7a\xf9\x27\xda\x3e" }, + { "ripemd160", 20, "\x9c\x11\x85\xa5\xc5\xe9\xfc\x54\x61\x28\x08\x97\x7e\xe8\xf5\x48\xb2\x25\x8d\x31" }, + { "whirlpool", 64, "\x19\xfa\x61\xd7\x55\x22\xa4\x66\x9b\x44\xe3\x9c\x1d\x2e\x17\x26" + "\xc5\x30\x23\x21\x30\xd4\x07\xf8\x9a\xfe\xe0\x96\x49\x97\xf7\xa7" + "\x3e\x83\xbe\x69\x8b\x28\x8f\xeb\xcf\x88\xe3\xe0\x3c\x4f\x07\x57" + "\xea\x89\x64\xe5\x9b\x63\xd9\x37\x08\xb1\x38\xcc\x42\xa6\x6e\xb3" }, + { "blake2b-512",64,"\x78\x6a\x02\xf7\x42\x01\x59\x03\xc6\xc6\xfd\x85\x25\x52\xd2\x72" + "\x91\x2f\x47\x40\xe1\x58\x47\x61\x8a\x86\xe2\x17\xf7\x1f\x54\x19" + "\xd2\x5e\x10\x31\xaf\xee\x58\x53\x13\x89\x64\x44\x93\x4e\xb0\x4b" + "\x90\x3a\x68\x5b\x14\x48\xb7\x55\xd5\x6f\x70\x1a\xfe\x9b\xe2\xce" }, + { "blake2s-256",32,"\x69\x21\x7a\x30\x79\x90\x80\x94\xe1\x11\x21\xd0\x42\x35\x4a\x7c" + "\x1f\x55\xb6\x48\x2c\xa1\xa5\x1e\x1b\x25\x0d\xfd\x1e\xd0\xee\xf9" }, +}},{ + "a", 1, { + { "crc32", 4, "\xe8\xb7\xbe\x43" }, + { "sha1", 20, "\x86\xf7\xe4\x37\xfa\xa5\xa7\xfc\xe1\x5d\x1d\xdc\xb9\xea\xea\xea\x37\x76\x67\xb8" }, + { "sha256", 32, "\xca\x97\x81\x12\xca\x1b\xbd\xca\xfa\xc2\x31\xb3\x9a\x23\xdc\x4d" + "\xa7\x86\xef\xf8\x14\x7c\x4e\x72\xb9\x80\x77\x85\xaf\xee\x48\xbb" }, + { "sha512", 64, "\x1f\x40\xfc\x92\xda\x24\x16\x94\x75\x09\x79\xee\x6c\xf5\x82\xf2" + "\xd5\xd7\xd2\x8e\x18\x33\x5d\xe0\x5a\xbc\x54\xd0\x56\x0e\x0f\x53" + "\x02\x86\x0c\x65\x2b\xf0\x8d\x56\x02\x52\xaa\x5e\x74\x21\x05\x46" + "\xf3\x69\xfb\xbb\xce\x8c\x12\xcf\xc7\x95\x7b\x26\x52\xfe\x9a\x75" }, + { "ripemd160", 20, "\x0b\xdc\x9d\x2d\x25\x6b\x3e\xe9\xda\xae\x34\x7b\xe6\xf4\xdc\x83\x5a\x46\x7f\xfe" }, + { "whirlpool", 64, "\x8a\xca\x26\x02\x79\x2a\xec\x6f\x11\xa6\x72\x06\x53\x1f\xb7\xd7" + "\xf0\xdf\xf5\x94\x13\x14\x5e\x69\x73\xc4\x50\x01\xd0\x08\x7b\x42" + "\xd1\x1b\xc6\x45\x41\x3a\xef\xf6\x3a\x42\x39\x1a\x39\x14\x5a\x59" + "\x1a\x92\x20\x0d\x56\x01\x95\xe5\x3b\x47\x85\x84\xfd\xae\x23\x1a" }, + { "blake2b-512",64,"\x33\x3f\xcb\x4e\xe1\xaa\x7c\x11\x53\x55\xec\x66\xce\xac\x91\x7c" + "\x8b\xfd\x81\x5b\xf7\x58\x7d\x32\x5a\xec\x18\x64\xed\xd2\x4e\x34" + "\xd5\xab\xe2\xc6\xb1\xb5\xee\x3f\xac\xe6\x2f\xed\x78\xdb\xef\x80" + "\x2f\x2a\x85\xcb\x91\xd4\x55\xa8\xf5\x24\x9d\x33\x08\x53\xcb\x3c" }, + { "blake2s-256",32,"\x4a\x0d\x12\x98\x73\x40\x30\x37\xc2\xcd\x9b\x90\x48\x20\x36\x87" + "\xf6\x23\x3f\xb6\x73\x89\x56\xe0\x34\x9b\xd4\x32\x0f\xec\x3e\x90" }, +}},{ + "abc", 3, { + { "crc32", 4, "\x35\x24\x41\xc2" }, + { "sha1", 20, "\xa9\x99\x3e\x36\x47\x06\x81\x6a\xba\x3e\x25\x71\x78\x50\xc2\x6c\x9c\xd0\xd8\x9d" }, + { "sha256", 32, "\xba\x78\x16\xbf\x8f\x01\xcf\xea\x41\x41\x40\xde\x5d\xae\x22\x23" + "\xb0\x03\x61\xa3\x96\x17\x7a\x9c\xb4\x10\xff\x61\xf2\x00\x15\xad" }, + { "sha512", 64, "\xdd\xaf\x35\xa1\x93\x61\x7a\xba\xcc\x41\x73\x49\xae\x20\x41\x31" + "\x12\xe6\xfa\x4e\x89\xa9\x7e\xa2\x0a\x9e\xee\xe6\x4b\x55\xd3\x9a" + "\x21\x92\x99\x2a\x27\x4f\xc1\xa8\x36\xba\x3c\x23\xa3\xfe\xeb\xbd" + "\x45\x4d\x44\x23\x64\x3c\xe8\x0e\x2a\x9a\xc9\x4f\xa5\x4c\xa4\x9f" }, + { "ripemd160", 20, "\x8e\xb2\x08\xf7\xe0\x5d\x98\x7a\x9b\x04\x4a\x8e\x98\xc6\xb0\x87\xf1\x5a\x0b\xfc" }, + { "whirlpool", 64, "\x4e\x24\x48\xa4\xc6\xf4\x86\xbb\x16\xb6\x56\x2c\x73\xb4\x02\x0b" + "\xf3\x04\x3e\x3a\x73\x1b\xce\x72\x1a\xe1\xb3\x03\xd9\x7e\x6d\x4c" + "\x71\x81\xee\xbd\xb6\xc5\x7e\x27\x7d\x0e\x34\x95\x71\x14\xcb\xd6" + "\xc7\x97\xfc\x9d\x95\xd8\xb5\x82\xd2\x25\x29\x20\x76\xd4\xee\xf5" }, + { "blake2b-512",64,"\xba\x80\xa5\x3f\x98\x1c\x4d\x0d\x6a\x27\x97\xb6\x9f\x12\xf6\xe9" + "\x4c\x21\x2f\x14\x68\x5a\xc4\xb7\x4b\x12\xbb\x6f\xdb\xff\xa2\xd1" + "\x7d\x87\xc5\x39\x2a\xab\x79\x2d\xc2\x52\xd5\xde\x45\x33\xcc\x95" + "\x18\xd3\x8a\xa8\xdb\xf1\x92\x5a\xb9\x23\x86\xed\xd4\x00\x99\x23" }, + { "blake2s-256",32,"\x50\x8c\x5e\x8c\x32\x7c\x14\xe2\xe1\xa7\x2b\xa3\x4e\xeb\x45\x2f" + "\x37\x45\x8b\x20\x9e\xd6\x3a\x29\x4d\x99\x9b\x4c\x86\x67\x59\x82" }, +}},{ + "abcdefghijklmnopqrstuvwxyz", 26, { + { "crc32", 4, "\x4c\x27\x50\xbd" }, + { "sha1", 20, "\x32\xd1\x0c\x7b\x8c\xf9\x65\x70\xca\x04\xce\x37\xf2\xa1\x9d\x84\x24\x0d\x3a\x89" }, + { "sha256", 32, "\x71\xc4\x80\xdf\x93\xd6\xae\x2f\x1e\xfa\xd1\x44\x7c\x66\xc9\x52" + "\x5e\x31\x62\x18\xcf\x51\xfc\x8d\x9e\xd8\x32\xf2\xda\xf1\x8b\x73" }, + { "sha512", 64, "\x4d\xbf\xf8\x6c\xc2\xca\x1b\xae\x1e\x16\x46\x8a\x05\xcb\x98\x81" + "\xc9\x7f\x17\x53\xbc\xe3\x61\x90\x34\x89\x8f\xaa\x1a\xab\xe4\x29" + "\x95\x5a\x1b\xf8\xec\x48\x3d\x74\x21\xfe\x3c\x16\x46\x61\x3a\x59" + "\xed\x54\x41\xfb\x0f\x32\x13\x89\xf7\x7f\x48\xa8\x79\xc7\xb1\xf1" }, + { "ripemd160", 20, "\xf7\x1c\x27\x10\x9c\x69\x2c\x1b\x56\xbb\xdc\xeb\x5b\x9d\x28\x65\xb3\x70\x8d\xbc" }, + { "whirlpool", 64, "\xf1\xd7\x54\x66\x26\x36\xff\xe9\x2c\x82\xeb\xb9\x21\x2a\x48\x4a" + "\x8d\x38\x63\x1e\xad\x42\x38\xf5\x44\x2e\xe1\x3b\x80\x54\xe4\x1b" + "\x08\xbf\x2a\x92\x51\xc3\x0b\x6a\x0b\x8a\xae\x86\x17\x7a\xb4\xa6" + "\xf6\x8f\x67\x3e\x72\x07\x86\x5d\x5d\x98\x19\xa3\xdb\xa4\xeb\x3b" }, + { "blake2b-512",64,"\xc6\x8e\xde\x14\x3e\x41\x6e\xb7\xb4\xaa\xae\x0d\x8e\x48\xe5\x5d" + "\xd5\x29\xea\xfe\xd1\x0b\x1d\xf1\xa6\x14\x16\x95\x3a\x2b\x0a\x56" + "\x66\xc7\x61\xe7\xd4\x12\xe6\x70\x9e\x31\xff\xe2\x21\xb7\xa7\xa7" + "\x39\x08\xcb\x95\xa4\xd1\x20\xb8\xb0\x90\xa8\x7d\x1f\xbe\xdb\x4c" }, + { "blake2s-256",32,"\xbd\xf8\x8e\xb1\xf8\x6a\x0c\xdf\x0e\x84\x0b\xa8\x8f\xa1\x18\x50" + "\x83\x69\xdf\x18\x6c\x73\x55\xb4\xb1\x6c\xf7\x9f\xa2\x71\x0a\x12" }, +}},{ + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789", 62, { + { "crc32", 4, "\x1f\xc2\xe6\xd2" }, + { "sha1", 20, "\x76\x1c\x45\x7b\xf7\x3b\x14\xd2\x7e\x9e\x92\x65\xc4\x6f\x4b\x4d\xda\x11\xf9\x40" }, + { "sha256", 32, "\xdb\x4b\xfc\xbd\x4d\xa0\xcd\x85\xa6\x0c\x3c\x37\xd3\xfb\xd8\x80" + "\x5c\x77\xf1\x5f\xc6\xb1\xfd\xfe\x61\x4e\xe0\xa7\xc8\xfd\xb4\xc0" }, + { "sha512", 64, "\x1e\x07\xbe\x23\xc2\x6a\x86\xea\x37\xea\x81\x0c\x8e\xc7\x80\x93" + "\x52\x51\x5a\x97\x0e\x92\x53\xc2\x6f\x53\x6c\xfc\x7a\x99\x96\xc4" + "\x5c\x83\x70\x58\x3e\x0a\x78\xfa\x4a\x90\x04\x1d\x71\xa4\xce\xab" + "\x74\x23\xf1\x9c\x71\xb9\xd5\xa3\xe0\x12\x49\xf0\xbe\xbd\x58\x94" }, + { "ripemd160", 20, "\xb0\xe2\x0b\x6e\x31\x16\x64\x02\x86\xed\x3a\x87\xa5\x71\x30\x79\xb2\x1f\x51\x89" }, + { "whirlpool", 64, "\xdc\x37\xe0\x08\xcf\x9e\xe6\x9b\xf1\x1f\x00\xed\x9a\xba\x26\x90" + "\x1d\xd7\xc2\x8c\xde\xc0\x66\xcc\x6a\xf4\x2e\x40\xf8\x2f\x3a\x1e" + "\x08\xeb\xa2\x66\x29\x12\x9d\x8f\xb7\xcb\x57\x21\x1b\x92\x81\xa6" + "\x55\x17\xcc\x87\x9d\x7b\x96\x21\x42\xc6\x5f\x5a\x7a\xf0\x14\x67" }, + { "blake2b-512",64,"\x99\x96\x48\x02\xe5\xc2\x5e\x70\x37\x22\x90\x5d\x3f\xb8\x00\x46" + "\xb6\xbc\xa6\x98\xca\x9e\x2c\xc7\xe4\x9b\x4f\xe1\xfa\x08\x7c\x2e" + "\xdf\x03\x12\xdf\xbb\x27\x5c\xf2\x50\xa1\xe5\x42\xfd\x5d\xc2\xed" + "\xd3\x13\xf9\xc4\x91\x12\x7c\x2e\x8c\x0c\x9b\x24\x16\x8e\x2d\x50" }, + { "blake2s-256",32,"\xc7\x54\x39\xea\x17\xe1\xde\x6f\xa4\x51\x0c\x33\x5d\xc3\xd3\xf3" + "\x43\xe6\xf9\xe1\xce\x27\x73\xe2\x5b\x41\x74\xf1\xdf\x8b\x11\x9b" }, +}},{ + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq", 56, { + { "crc32", 4, "\x17\x1a\x3f\x5f" }, + { "sha1", 20, "\x84\x98\x3e\x44\x1c\x3b\xd2\x6e\xba\xae\x4a\xa1\xf9\x51\x29\xe5\xe5\x46\x70\xf1" }, + { "sha256", 32, "\x24\x8d\x6a\x61\xd2\x06\x38\xb8\xe5\xc0\x26\x93\x0c\x3e\x60\x39" + "\xa3\x3c\xe4\x59\x64\xff\x21\x67\xf6\xec\xed\xd4\x19\xdb\x06\xc1" }, + { "sha512", 64, "\x20\x4a\x8f\xc6\xdd\xa8\x2f\x0a\x0c\xed\x7b\xeb\x8e\x08\xa4\x16" + "\x57\xc1\x6e\xf4\x68\xb2\x28\xa8\x27\x9b\xe3\x31\xa7\x03\xc3\x35" + "\x96\xfd\x15\xc1\x3b\x1b\x07\xf9\xaa\x1d\x3b\xea\x57\x78\x9c\xa0" + "\x31\xad\x85\xc7\xa7\x1d\xd7\x03\x54\xec\x63\x12\x38\xca\x34\x45" }, + { "ripemd160", 20, "\x12\xa0\x53\x38\x4a\x9c\x0c\x88\xe4\x05\xa0\x6c\x27\xdc\xf4\x9a\xda\x62\xeb\x2b" }, + { "whirlpool", 64, "\x52\x6b\x23\x94\xd8\x56\x83\xe2\x4b\x29\xac\xd0\xfd\x37\xf7\xd5" + "\x02\x7f\x61\x36\x6a\x14\x07\x26\x2d\xc2\xa6\xa3\x45\xd9\xe2\x40" + "\xc0\x17\xc1\x83\x3d\xb1\xe6\xdb\x6a\x46\xbd\x44\x4b\x0c\x69\x52" + "\x0c\x85\x6e\x7c\x6e\x9c\x36\x6d\x15\x0a\x7d\xa3\xae\xb1\x60\xd1" }, + { "blake2b-512",64,"\x72\x85\xff\x3e\x8b\xd7\x68\xd6\x9b\xe6\x2b\x3b\xf1\x87\x65\xa3" + "\x25\x91\x7f\xa9\x74\x4a\xc2\xf5\x82\xa2\x08\x50\xbc\x2b\x11\x41" + "\xed\x1b\x3e\x45\x28\x59\x5a\xcc\x90\x77\x2b\xdf\x2d\x37\xdc\x8a" + "\x47\x13\x0b\x44\xf3\x3a\x02\xe8\x73\x0e\x5a\xd8\xe1\x66\xe8\x88" }, + { "blake2s-256",32,"\x6f\x4d\xf5\x11\x6a\x6f\x33\x2e\xda\xb1\xd9\xe1\x0e\xe8\x7d\xf6" + "\x55\x7b\xea\xb6\x25\x9d\x76\x63\xf3\xbc\xd5\x72\x2c\x13\xf1\x89" }, +}},{ + "message digest", 14, { + { "crc32", 4, "\x20\x15\x9d\x7f" }, + { "sha1", 20, "\xc1\x22\x52\xce\xda\x8b\xe8\x99\x4d\x5f\xa0\x29\x0a\x47\x23\x1c\x1d\x16\xaa\xe3" }, + { "sha256", 32, "\xf7\x84\x6f\x55\xcf\x23\xe1\x4e\xeb\xea\xb5\xb4\xe1\x55\x0c\xad" + "\x5b\x50\x9e\x33\x48\xfb\xc4\xef\xa3\xa1\x41\x3d\x39\x3c\xb6\x50" }, + { "sha512", 64, "\x10\x7d\xbf\x38\x9d\x9e\x9f\x71\xa3\xa9\x5f\x6c\x05\x5b\x92\x51" + "\xbc\x52\x68\xc2\xbe\x16\xd6\xc1\x34\x92\xea\x45\xb0\x19\x9f\x33" + "\x09\xe1\x64\x55\xab\x1e\x96\x11\x8e\x8a\x90\x5d\x55\x97\xb7\x20" + "\x38\xdd\xb3\x72\xa8\x98\x26\x04\x6d\xe6\x66\x87\xbb\x42\x0e\x7c" }, + { "ripemd160", 20, "\x5d\x06\x89\xef\x49\xd2\xfa\xe5\x72\xb8\x81\xb1\x23\xa8\x5f\xfa\x21\x59\x5f\x36" }, + { "whirlpool", 64, "\x37\x8c\x84\xa4\x12\x6e\x2d\xc6\xe5\x6d\xcc\x74\x58\x37\x7a\xac" + "\x83\x8d\x00\x03\x22\x30\xf5\x3c\xe1\xf5\x70\x0c\x0f\xfb\x4d\x3b" + "\x84\x21\x55\x76\x59\xef\x55\xc1\x06\xb4\xb5\x2a\xc5\xa4\xaa\xa6" + "\x92\xed\x92\x00\x52\x83\x8f\x33\x62\xe8\x6d\xbd\x37\xa8\x90\x3e" }, + { "blake2b-512",64,"\x3c\x26\xce\x48\x7b\x1c\x0f\x06\x23\x63\xaf\xa3\xc6\x75\xeb\xdb" + "\xf5\xf4\xef\x9b\xdc\x02\x2c\xfb\xef\x91\xe3\x11\x1c\xdc\x28\x38" + "\x40\xd8\x33\x1f\xc3\x0a\x8a\x09\x06\xcf\xf4\xbc\xdb\xcd\x23\x0c" + "\x61\xaa\xec\x60\xfd\xfa\xd4\x57\xed\x96\xb7\x09\xa3\x82\x35\x9a" }, + { "blake2s-256",32,"\xfa\x10\xab\x77\x5a\xcf\x89\xb7\xd3\xc8\xa6\xe8\x23\xd5\x86\xf6" + "\xb6\x7b\xdb\xac\x4c\xe2\x07\xfe\x14\x5b\x7d\x3a\xc2\x5c\xd2\x8c" }, +}}}; + +/* + * HMAC tests + */ +// RFC 4231 - HMAC test vectors for SHA-256, SHA-512 +// RFC 2202 - HMAC test vectors for SHA-1 + +struct hmac_test_vector { + const char *key; + unsigned int key_length; + const char *data; + unsigned int data_length; + struct { + const char *name; + unsigned int length; + const char *out; + } out[3]; +}; + +static struct hmac_test_vector hmac_test_vectors[] = { +{ + "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20, + "\x48\x69\x20\x54\x68\x65\x72\x65", 8, /* "Hi There" */ { + { "sha1", 20, "\xb6\x17\x31\x86\x55\x05\x72\x64\xe2\x8b\xc0\xb6\xfb\x37\x8c\x8e\xf1\x46\xbe\x00" }, + { "sha256", 32, "\xb0\x34\x4c\x61\xd8\xdb\x38\x53\x5c\xa8\xaf\xce\xaf\x0b\xf1\x2b" + "\x88\x1d\xc2\x00\xc9\x83\x3d\xa7\x26\xe9\x37\x6c\x2e\x32\xcf\xf7" }, + { "sha512", 64, "\x87\xaa\x7c\xde\xa5\xef\x61\x9d\x4f\xf0\xb4\x24\x1a\x1d\x6c\xb0" + "\x23\x79\xf4\xe2\xce\x4e\xc2\x78\x7a\xd0\xb3\x05\x45\xe1\x7c\xde" + "\xda\xa8\x33\xb7\xd6\xb8\xa7\x02\x03\x8b\x27\x4e\xae\xa3\xf4\xe4" + "\xbe\x9d\x91\x4e\xeb\x61\xf1\x70\x2e\x69\x6c\x20\x3a\x12\x68\x54" }, +}},{ + "\x4a\x65\x66\x65", 4, /* "Jefe" */ + "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74\x20" + "\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f", 28, /* "what do ya want for nothing?" */ { + { "sha1", 20, "\xef\xfc\xdf\x6a\xe5\xeb\x2f\xa2\xd2\x74\x16\xd5\xf1\x84\xdf\x9c\x25\x9a\x7c\x79" }, + { "sha256", 32, "\x5b\xdc\xc1\x46\xbf\x60\x75\x4e\x6a\x04\x24\x26\x08\x95\x75\xc7" + "\x5a\x00\x3f\x08\x9d\x27\x39\x83\x9d\xec\x58\xb9\x64\xec\x38\x43" }, + { "sha512", 64, "\x16\x4b\x7a\x7b\xfc\xf8\x19\xe2\xe3\x95\xfb\xe7\x3b\x56\xe0\xa3" + "\x87\xbd\x64\x22\x2e\x83\x1f\xd6\x10\x27\x0c\xd7\xea\x25\x05\x54" + "\x97\x58\xbf\x75\xc0\x5a\x99\x4a\x6d\x03\x4f\x65\xf8\xf0\xe6\xfd" + "\xca\xea\xb1\xa3\x4d\x4a\x6b\x4b\x63\x6e\x07\x0a\x38\xbc\xe7\x37" }, +}},{ + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20, + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd" + "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd", 50, { + { "sha1", 20, "\x12\x5d\x73\x42\xb9\xac\x11\xcd\x91\xa3\x9a\xf4\x8a\xa1\x7b\x4f\x63\xf1\x75\xd3" }, + { "sha256", 32, "\x77\x3e\xa9\x1e\x36\x80\x0e\x46\x85\x4d\xb8\xeb\xd0\x91\x81\xa7" + "\x29\x59\x09\x8b\x3e\xf8\xc1\x22\xd9\x63\x55\x14\xce\xd5\x65\xfe" }, + { "sha512", 64, "\xfa\x73\xb0\x08\x9d\x56\xa2\x84\xef\xb0\xf0\x75\x6c\x89\x0b\xe9" + "\xb1\xb5\xdb\xdd\x8e\xe8\x1a\x36\x55\xf8\x3e\x33\xb2\x27\x9d\x39" + "\xbf\x3e\x84\x82\x79\xa7\x22\xc8\x06\xb4\x85\xa4\x7e\x67\xc8\x07" + "\xb9\x46\xa3\x37\xbe\xe8\x94\x26\x74\x27\x88\x59\xe1\x32\x92\xfb" }, +}},{ + "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19", 25, + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd" + "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd", 50, { + { "sha1", 20, "\x4c\x90\x07\xf4\x02\x62\x50\xc6\xbc\x84\x14\xf9\xbf\x50\xc8\x6c\x2d\x72\x35\xda" }, + { "sha256", 32, "\x82\x55\x8a\x38\x9a\x44\x3c\x0e\xa4\xcc\x81\x98\x99\xf2\x08\x3a" + "\x85\xf0\xfa\xa3\xe5\x78\xf8\x07\x7a\x2e\x3f\xf4\x67\x29\x66\x5b" }, + { "sha512", 64, "\xb0\xba\x46\x56\x37\x45\x8c\x69\x90\xe5\xa8\xc5\xf6\x1d\x4a\xf7" + "\xe5\x76\xd9\x7f\xf9\x4b\x87\x2d\xe7\x6f\x80\x50\x36\x1e\xe3\xdb" + "\xa9\x1c\xa5\xc1\x1a\xa2\x5e\xb4\xd6\x79\x27\x5c\xc5\x78\x80\x63" + "\xa5\xf1\x97\x41\x12\x0c\x4f\x2d\xe2\xad\xeb\xeb\x10\xa2\x98\xdd" }, +}},{ + // Long key + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131, + "\x54\x65\x73\x74\x20\x55\x73\x69\x6e\x67\x20\x4c\x61\x72\x67\x65" + "\x72\x20\x54\x68\x61\x6e\x20\x42\x6c\x6f\x63\x6b\x2d\x53\x69\x7a" + "\x65\x20\x4b\x65\x79\x20\x2d\x20\x48\x61\x73\x68\x20\x4b\x65\x79" + "\x20\x46\x69\x72\x73\x74", 54, /* "Test Using Larger Than Block-Size Key - Hash Key First" */ { + { "sha1", 20, "\x90\xd0\xda\xce\x1c\x1b\xdc\x95\x73\x39\x30\x78\x03\x16\x03\x35\xbd\xe6\xdf\x2b" }, + { "sha256", 32, "\x60\xe4\x31\x59\x1e\xe0\xb6\x7f\x0d\x8a\x26\xaa\xcb\xf5\xb7\x7f" + "\x8e\x0b\xc6\x21\x37\x28\xc5\x14\x05\x46\x04\x0f\x0e\xe3\x7f\x54" }, + { "sha512", 64, "\x80\xb2\x42\x63\xc7\xc1\xa3\xeb\xb7\x14\x93\xc1\xdd\x7b\xe8\xb4" + "\x9b\x46\xd1\xf4\x1b\x4a\xee\xc1\x12\x1b\x01\x37\x83\xf8\xf3\x52" + "\x6b\x56\xd0\x37\xe0\x5f\x25\x98\xbd\x0f\xd2\x21\x5d\x6a\x1e\x52" + "\x95\xe6\x4f\x73\xf6\x3f\x0a\xec\x8b\x91\x5a\x98\x5d\x78\x65\x98" }, +}},{ + // Long key and long data + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa" + "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131, + "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x20\x75" + "\x73\x69\x6e\x67\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20\x74\x68" + "\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x6b\x65" + "\x79\x20\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20\x74" + "\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64" + "\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b\x65\x79\x20\x6e\x65\x65" + "\x64\x73\x20\x74\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65\x64\x20" + "\x62\x65\x66\x6f\x72\x65\x20\x62\x65\x69\x6e\x67\x20\x75\x73\x65" + "\x64\x20\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68\x6d\x2e", 152, { + { "sha1", 20, "\x21\x7e\x44\xbb\x08\xb6\xe0\x6a\x2d\x6c\x30\xf3\xcb\x9f\x53\x7f\x97\xc6\x33\x56" }, + { "sha256", 32, "\x9b\x09\xff\xa7\x1b\x94\x2f\xcb\x27\x63\x5f\xbc\xd5\xb0\xe9\x44" + "\xbf\xdc\x63\x64\x4f\x07\x13\x93\x8a\x7f\x51\x53\x5c\x3a\x35\xe2" }, + { "sha512", 64, "\xe3\x7b\x6a\x77\x5d\xc8\x7d\xba\xa4\xdf\xa9\xf9\x6e\x5e\x3f\xfd" + "\xde\xbd\x71\xf8\x86\x72\x89\x86\x5d\xf5\xa3\x2d\x20\xcd\xc9\x44" + "\xb6\x02\x2c\xac\x3c\x49\x82\xb1\x0d\x5e\xeb\x55\xc3\xe4\xde\x15" + "\x13\x46\x76\xfb\x6d\xe0\x44\x60\x65\xc9\x74\x40\xfa\x8c\x6a\x58" }, +}}}; + +/* + * Block cipher tests + */ +struct cipher_test_vector { + const char *key; + unsigned int key_length; + const char *iv; + unsigned int iv_length; + const char *plaintext; + unsigned int data_length; + struct { + const char *name; + const char *mode; + const char *ciphertext; + } out[2]; +}; + +static struct cipher_test_vector cipher_test_vectors[] = { +{ // NIST SP 800-38A + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + NULL, 0, + "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 64, { + { + "aes", "ecb", + "\x3a\xd7\x7b\xb4\x0d\x7a\x36\x60\xa8\x9e\xca\xf3\x24\x66\xef\x97" + "\xf5\xd3\xd5\x85\x03\xb9\x69\x9d\xe7\x85\x89\x5a\x96\xfd\xba\xaf" + "\x43\xb1\xcd\x7f\x59\x8e\xce\x23\x88\x1b\x00\xe3\xed\x03\x06\x88" + "\x7b\x0c\x78\x5e\x27\xe8\xad\x3f\x82\x23\x20\x71\x04\x72\x5d\xd4" + },{ + "serpent", "ecb", + "\xf7\xa7\x21\xe6\xc7\x56\xb6\x55\xcb\xdf\x53\x3f\xc3\xb3\x1a\xc4" + "\x4b\xc6\x04\x29\x3a\x81\xa6\xa6\xe4\xcb\xa7\x8d\x1a\x32\xa2\x9e" + "\xcf\xc2\x8e\x50\x97\xdd\x6b\x49\xa9\x38\xb1\x51\x5e\xbc\x5a\xac" + "\xfe\xd2\xc4\x95\x92\xf9\x1c\x0c\x9f\x17\xcd\x86\x38\x65\x29\xeb" + }, +}},{ // NIST SP 800-38A + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", 16, + "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 64, { + { + "aes", "cbc", + "\x76\x49\xab\xac\x81\x19\xb2\x46\xce\xe9\x8e\x9b\x12\xe9\x19\x7d" + "\x50\x86\xcb\x9b\x50\x72\x19\xee\x95\xdb\x11\x3a\x91\x76\x78\xb2" + "\x73\xbe\xd6\xb8\xe3\xc1\x74\x3b\x71\x16\xe6\x9e\x22\x22\x95\x16" + "\x3f\xf1\xca\xa1\x68\x1f\xac\x09\x12\x0e\xca\x30\x75\x86\xe1\xa7" + },{ + "serpent", "cbc", + "\xdd\x73\x69\x1a\xb5\x66\xb6\x38\xe3\xb9\x62\x36\xc8\xc8\xa1\xdd" + "\xa9\xb5\xd9\xdb\x20\xfb\x8b\x82\x51\x40\xbf\xe6\x4d\xf2\x1c\xa8" + "\x5f\x48\xbc\x29\xff\x62\x27\xda\x09\x7c\xaa\x22\x75\x6f\x43\xff" + "\x31\xd8\x3e\x83\x4d\x92\x48\xeb\x49\x1c\xf8\x26\x80\x4e\xb9\x02" + }, +}},{ // NIST SP 800-38A + "\x60\x3d\xeb\x10\x15\xca\x71\xbe\x2b\x73\xae\xf0\x85\x7d\x77\x81" + "\x1f\x35\x2c\x07\x3b\x61\x08\xd7\x2d\x98\x10\xa3\x09\x14\xdf\xf4", 32, + NULL, 0, + "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 64, { + { + "aes", "ecb", + "\xf3\xee\xd1\xbd\xb5\xd2\xa0\x3c\x06\x4b\x5a\x7e\x3d\xb1\x81\xf8" + "\x59\x1c\xcb\x10\xd4\x10\xed\x26\xdc\x5b\xa7\x4a\x31\x36\x28\x70" + "\xb6\xed\x21\xb9\x9c\xa6\xf4\xf9\xf1\x53\xe7\xb1\xbe\xaf\xed\x1d" + "\x23\x30\x4b\x7a\x39\xf9\xf3\xff\x06\x7d\x8d\x8f\x9e\x24\xec\xc7" + },{ + "serpent", "ecb", + "\x78\xe5\x84\x8e\xd9\xd5\xde\x2d\x4d\xb0\x2f\x53\x61\x6a\xfd\xf2" + "\x50\x5d\xf1\x68\x92\x40\x8e\xf6\x9c\x3b\x9e\xa6\x67\xd9\xdd\xb8" + "\xb9\x5f\xc8\x20\x76\x52\x1d\xce\x60\xe4\xfc\xac\xe3\xd3\x91\x51" + "\x09\x22\x62\xde\x62\x6d\xc5\x7b\x4c\x87\x0c\x65\xe7\x1f\xc7\x13" + }, +}},{ // NIST SP 800-38A + "\x60\x3d\xeb\x10\x15\xca\x71\xbe\x2b\x73\xae\xf0\x85\x7d\x77\x81" + "\x1f\x35\x2c\x07\x3b\x61\x08\xd7\x2d\x98\x10\xa3\x09\x14\xdf\xf4", 32, + "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", 16, + "\x6b\xc1\xbe\xe2\x2e\x40\x9f\x96\xe9\x3d\x7e\x11\x73\x93\x17\x2a" + "\xae\x2d\x8a\x57\x1e\x03\xac\x9c\x9e\xb7\x6f\xac\x45\xaf\x8e\x51" + "\x30\xc8\x1c\x46\xa3\x5c\xe4\x11\xe5\xfb\xc1\x19\x1a\x0a\x52\xef" + "\xf6\x9f\x24\x45\xdf\x4f\x9b\x17\xad\x2b\x41\x7b\xe6\x6c\x37\x10", 64, { + { + "aes", "cbc", + "\xf5\x8c\x4c\x04\xd6\xe5\xf1\xba\x77\x9e\xab\xfb\x5f\x7b\xfb\xd6" + "\x9c\xfc\x4e\x96\x7e\xdb\x80\x8d\x67\x9f\x77\x7b\xc6\x70\x2c\x7d" + "\x39\xf2\x33\x69\xa9\xd9\xba\xcf\xa5\x30\xe2\x63\x04\x23\x14\x61" + "\xb2\xeb\x05\xe2\xc3\x9b\xe9\xfc\xda\x6c\x19\x07\x8c\x6a\x9d\x1b" + },{ + "serpent", "cbc", + "\xb8\x93\xc8\xde\xc5\xc8\x5f\x03\x01\xac\x32\x74\xdf\xc6\x71\x9d" + "\x37\x61\xc5\xf8\x34\x4d\xe9\x10\x91\xd3\x87\x80\x42\xcc\x70\x95" + "\x40\x95\xa3\x2c\xdb\x38\xe2\x6f\x03\x91\xf5\xd3\x51\x7e\x52\xb0" + "\x8a\x1c\x2d\x7f\x04\x59\x13\x93\x31\xa9\x82\xc9\x4e\xd9\x11\x0c" + }, +}},{ // CAVS XTSGenAES128,101 + "\xb7\xb9\x3f\x51\x6a\xef\x29\x5e\xff\x3a\x29\xd8\x37\xcf\x1f\x13" + "\x53\x47\xe8\xa2\x1d\xae\x61\x6f\xf5\x06\x2b\x2e\x8d\x78\xce\x5e", 32, + "\x87\x3e\xde\xa6\x53\xb6\x43\xbd\x8b\xcf\x51\x40\x31\x97\xed\x14", 16, + "\x23\x6f\x8a\x5b\x58\xdd\x55\xf6\x19\x4e\xd7\x0c\x4a\xc1\xa1\x7f" + "\x1f\xe6\x0e\xc9\xa6\xc4\x54\xd0\x87\xcc\xb7\x7d\x6b\x63\x8c\x47", 32, { + { + "aes", "xts", + "\x22\xe6\xa3\xc6\x37\x9d\xcf\x75\x99\xb0\x52\xb5\xa7\x49\xc7\xf7" + "\x8a\xd8\xa1\x1b\x9f\x1a\xa9\x43\x0c\xf3\xae\xf4\x45\x68\x2e\x19" + },{ + "serpent", "xts", + "\x6d\xa2\xa4\x2b\x18\x71\x57\xdc\x03\xaf\x8b\x82\x28\x66\x3d\xf1" + "\x70\x8b\x75\x98\xd2\xdd\xbf\x72\x9e\xb3\xb4\xc2\x3f\x18\xdf\xa1" + }, +}},{ // CAVS XTSGenAES256,101 + "\x26\x6c\x33\x6b\x3b\x01\x48\x9f\x32\x67\xf5\x28\x35\xfd\x92\xf6" + "\x74\x37\x4b\x88\xb4\xe1\xeb\xd2\xd3\x6a\x5f\x45\x75\x81\xd9\xd0" + "\x42\xc3\xee\xf7\xb0\xb7\xe5\x13\x7b\x08\x64\x96\xb4\xd9\xe6\xac" + "\x65\x8d\x71\x96\xa2\x3f\x23\xf0\x36\x17\x2f\xdb\x8f\xae\xe5\x27", 64, + "\x06\xb2\x09\xa7\xa2\x2f\x48\x6e\xcb\xfa\xdb\x0f\x31\x37\xba\x42", 16, + "\xca\x7d\x65\xef\x8d\x3d\xfa\xd3\x45\xb6\x1c\xcd\xdc\xa1\xad\x81" + "\xde\x83\x0b\x9e\x86\xc7\xb4\x26\xd7\x6c\xb7\xdb\x76\x68\x52\xd9" + "\x81\xc6\xb2\x14\x09\x39\x9d\x78\xf4\x2c\xc0\xb3\x3a\x7b\xbb\x06", 48, { + { + "aes", "xts", + "\xc7\x32\x56\x87\x0c\xc2\xf4\xdd\x57\xac\xc7\x4b\x54\x56\xdb\xd7" + "\x76\x91\x2a\x12\x8b\xc1\xf7\x7d\x72\xcd\xeb\xbf\x27\x00\x44\xb7" + "\xa4\x3c\xee\xd2\x90\x25\xe1\xe8\xbe\x21\x1f\xa3\xc3\xed\x00\x2d" + },{ + "serpent", "xts", + "\x37\xe4\xc0\xa9\xf1\x49\xe5\x3e\x73\xb9\x1f\xec\xdc\xe0\xbd\xc5" + "\x31\xd7\xef\x08\x65\x20\xe3\xad\xd9\x84\x60\xdc\x61\x6f\x26\x86" + "\xb8\xd5\x29\x4b\x04\x41\x52\x59\x05\x00\xb0\xc2\x9b\x30\xda\x48" + }, +}},{ + "\xa5\x28\x24\x34\x1a\x3c\xd8\xf7\x05\x91\x8f\xee\x85\x1f\x35\x7f" + "\x80\x3d\xfc\x9b\x94\xf6\xfc\x9e\x19\x09\x00\xa9\x04\x31\x4f\x11", 32, + "\xa1\xba\x49\x95\xff\x34\x6d\xb8\xcd\x87\x5d\x5e\xfd\xea\x85\xdb" + "\x8a\x7b\x5e\xb2\x5d\x57\xdd\x62\xac\xa9\x8c\x41\x42\x94\x75\xb7", 32, + "\x69\xb4\xe8\x8c\x37\xe8\x67\x82\xf1\xec\x5d\x04\xe5\x14\x91\x13" + "\xdf\xf2\x87\x1b\x69\x81\x1d\x71\x70\x9e\x9c\x3b\xde\x49\x70\x11" + "\xa0\xa3\xdb\x0d\x54\x4f\x66\x69\xd7\xdb\x80\xa7\x70\x92\x68\xce" + "\x81\x04\x2c\xc6\xab\xae\xe5\x60\x15\xe9\x6f\xef\xaa\x8f\xa7\xa7" + "\x63\x8f\xf2\xf0\x77\xf1\xa8\xea\xe1\xb7\x1f\x9e\xab\x9e\x4b\x3f" + "\x07\x87\x5b\x6f\xcd\xa8\xaf\xb9\xfa\x70\x0b\x52\xb8\xa8\xa7\x9e" + "\x07\x5f\xa6\x0e\xb3\x9b\x79\x13\x79\xc3\x3e\x8d\x1c\x2c\x68\xc8" + "\x51\x1d\x3c\x7b\x7d\x79\x77\x2a\x56\x65\xc5\x54\x23\x28\xb0\x03", 128, { + { + "xchacha12,aes", "adiantum", + "\x9e\x16\xab\xed\x4b\xa7\x42\x5a\xc6\xfb\x4e\x76\xff\xbe\x03\xa0" + "\x0f\xe3\xad\xba\xe4\x98\x2b\x0e\x21\x48\xa0\xb8\x65\x48\x27\x48" + "\x84\x54\x54\xb2\x9a\x94\x7b\xe6\x4b\x29\xe9\xcf\x05\x91\x80\x1a" + "\x3a\xf3\x41\x96\x85\x1d\x9f\x74\x51\x56\x63\xfa\x7c\x28\x85\x49" + "\xf7\x2f\xf9\xf2\x18\x46\xf5\x33\x80\xa3\x3c\xce\xb2\x57\x93\xf5" + "\xae\xbd\xa9\xf5\x7b\x30\xc4\x93\x66\xe0\x30\x77\x16\xe4\xa0\x31" + "\xba\x70\xbc\x68\x13\xf5\xb0\x9a\xc1\xfc\x7e\xfe\x55\x80\x5c\x48" + "\x74\xa6\xaa\xa3\xac\xdc\xc2\xf5\x8d\xde\x34\x86\x78\x60\x75\x8d", + },{ + "xchacha20,aes", "adiantum", + "\xb1\x8b\xa0\x05\x77\xa8\x4d\x59\x1b\x8e\x21\xfc\x3a\x49\xfa\xd4" + "\xeb\x36\xf3\xc4\xdf\xdc\xae\x67\x07\x3f\x70\x0e\xe9\x66\xf5\x0c" + "\x30\x4d\x66\xc9\xa4\x2f\x73\x9c\x13\xc8\x49\x44\xcc\x0a\x90\x9d" + "\x7c\xdd\x19\x3f\xea\x72\x8d\x58\xab\xe7\x09\x2c\xec\xb5\x44\xd2" + "\xca\xa6\x2d\x7a\x5c\x9c\x2b\x15\xec\x2a\xa6\x69\x91\xf9\xf3\x13" + "\xf7\x72\xc1\xc1\x40\xd5\xe1\x94\xf4\x29\xa1\x3e\x25\x02\xa8\x3e" + "\x94\xc1\x91\x14\xa1\x14\xcb\xbe\x67\x4c\xb9\x38\xfe\xa7\xaa\x32" + "\x29\x62\x0d\xb2\xf6\x3c\x58\x57\xc1\xd5\x5a\xbb\xd6\xa6\x2a\xe5" + }, +}}}; + +/* + * Cipher IV tests + */ +struct cipher_iv_test_vector { + const char *cipher_name; + const char *cipher_mode; + const char *key; + unsigned int key_length; + const char *iv_name; + uint64_t iv_offset; + unsigned int data_length; + const char in_sha256[32]; + struct { + size_t sector_size; + bool large_iv; + const char out_sha256[32]; + } out[7]; +}; + +static struct cipher_iv_test_vector cipher_iv_test_vectors[] = { +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "null", UINT32_MAX-7, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\xfd\x05\xd0\x4d\x51\xb9\xd4\x87\xa4\x57\x9a\x62\x07\x39\xc9\x4a" + "\x00\x90\x3e\xaf\xe8\xb2\xac\x12\xca\xeb\x58\xf9\x48\xf6\xef\x08" + },{ 1024, false, + "\x55\x87\x5c\xde\x86\x6a\x8b\xab\x08\xbe\x5b\x38\x17\x53\xdf\xe5" + "\x7e\xb9\x5f\x59\xaf\x07\xa4\xca\x6a\x24\xd1\x12\xa9\x15\x25\xf4" + },{ 1024, true, + "\x55\x87\x5c\xde\x86\x6a\x8b\xab\x08\xbe\x5b\x38\x17\x53\xdf\xe5" + "\x7e\xb9\x5f\x59\xaf\x07\xa4\xca\x6a\x24\xd1\x12\xa9\x15\x25\xf4" + },{ 2048, false, + "\x55\x5b\x8e\x74\x90\x9d\x0d\x4b\x74\x8c\x16\x7e\x29\xcf\xa9\xa3" + "\xf3\x42\x8b\x62\xda\x2d\x8c\xda\xc9\x32\xc8\x78\xe2\x7e\xd2\x70" + },{ 2048, true, + "\x55\x5b\x8e\x74\x90\x9d\x0d\x4b\x74\x8c\x16\x7e\x29\xcf\xa9\xa3" + "\xf3\x42\x8b\x62\xda\x2d\x8c\xda\xc9\x32\xc8\x78\xe2\x7e\xd2\x70" + },{ 4096, false, + "\xc6\x45\xba\xe0\x40\x3a\x96\x09\x5e\x46\x0d\x19\x9d\x58\x4b\x93" + "\x78\xc5\x3f\xa4\x2e\x9e\xb0\x19\x04\x4b\x73\x26\xf4\xa6\xb5\xc3" + },{ 4096, true, + "\xc6\x45\xba\xe0\x40\x3a\x96\x09\x5e\x46\x0d\x19\x9d\x58\x4b\x93" + "\x78\xc5\x3f\xa4\x2e\x9e\xb0\x19\x04\x4b\x73\x26\xf4\xa6\xb5\xc3" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "plain", UINT32_MAX-7, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\x43\xfd\x6e\x25\x80\xb2\x13\xf5\xca\x71\x79\x18\xe4\x12\x91\xe0" + "\x6e\x37\x24\x32\xfd\x40\x4b\x42\xcb\xc1\x72\x1a\xc7\x5a\x19\xc8" + },{ 1024, false, + "\x18\x79\x8d\xad\xf2\x7b\x38\x03\x27\xa5\x76\x19\x07\xcd\x12\x62" + "\x03\x36\x57\x85\x88\x50\xd0\x6c\xf6\xdf\xf1\xcf\xb8\xcf\x01\x77" + },{ 1024, true, + "\xd0\x21\xcf\xb2\x7a\x01\xa8\x94\xb2\x87\x49\xc4\x9f\x9c\xb2\x3a" + "\x7c\xc4\x0d\x50\x08\xea\x4d\xfb\x87\xe4\x49\x8c\x1a\xd6\xec\x16" + },{ 2048, false, + "\xa4\x89\x72\xb9\xcf\x78\x0c\x2a\xc8\x20\x4f\xd5\x13\xcb\x75\x30" + "\x90\xd2\x4a\xfd\xd3\xb2\xe8\xf0\xd2\xb7\x9d\x07\xbd\xa9\x70\x97" + },{ 2048, true, + "\x2a\xcf\x07\x57\xc8\xea\x64\xc7\xd0\xd5\x28\xe6\xd1\x9a\xb5\x7d" + "\xe4\xb9\x63\xa2\x66\x5a\x3d\x14\xbd\x27\xc7\x09\xc0\x3c\xd9\x00" + },{ 4096, false, + "\x12\x1b\x00\x54\x6e\x2d\x08\xc1\x15\x8b\x15\x57\xc5\x11\x30\x8b" + "\x63\x33\x64\xa0\xd1\x45\xd6\xcb\xdd\x49\x91\x04\x29\xe6\x93\x08" + },{ 4096, true, + "\x44\xaa\xf1\x23\x0c\x34\x32\x2a\xfa\xe3\xf7\x95\x7a\x7c\xa8\x8b" + "\x34\x78\xbd\x12\x5c\xae\x4a\x65\x23\x8a\x6f\x3a\x96\x05\xfa\xae" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "plain64", UINT32_MAX-7, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\xb3\x65\x7e\x6c\xba\xe0\x39\xcd\x1e\x1d\xaf\x65\xae\xb7\xda\x20" + "\x25\x17\x6a\x38\x75\x79\x68\x4c\x9a\x75\xc7\xfb\x2b\xa2\x17\xd2" + },{ 1024, false, + "\x0a\xa3\x23\x72\x80\xd3\x76\x33\x8b\x2b\xae\x01\x03\x99\xa5\xca" + "\xcd\x95\x27\x40\x27\xec\x14\x90\xfd\x58\xb0\x08\x9b\x99\x27\xe2" + },{ 1024, true, + "\xd0\x21\xcf\xb2\x7a\x01\xa8\x94\xb2\x87\x49\xc4\x9f\x9c\xb2\x3a" + "\x7c\xc4\x0d\x50\x08\xea\x4d\xfb\x87\xe4\x49\x8c\x1a\xd6\xec\x16" + },{ 2048, false, + "\x67\x87\xeb\xed\xe1\x16\x85\x0a\x3f\xb2\x5c\xbc\x27\x61\x99\x52" + "\xfe\x64\xb9\xab\x24\xdd\x2c\x1a\x2c\xff\xcd\x7e\x2e\x74\xb5\xd4" + },{ 2048, true, + "\x2a\xcf\x07\x57\xc8\xea\x64\xc7\xd0\xd5\x28\xe6\xd1\x9a\xb5\x7d" + "\xe4\xb9\x63\xa2\x66\x5a\x3d\x14\xbd\x27\xc7\x09\xc0\x3c\xd9\x00" + },{ 4096, false, + "\xb2\xf1\x0e\x66\xd4\x58\x4e\x93\xe7\x98\xae\x9c\x3e\xa7\xad\xf2" + "\x93\x1a\xaa\x3c\xc4\x90\x12\x05\x00\x58\x25\x8f\x1f\x5d\xc6\x67" + },{ 4096, true, + "\x44\xaa\xf1\x23\x0c\x34\x32\x2a\xfa\xe3\xf7\x95\x7a\x7c\xa8\x8b" + "\x34\x78\xbd\x12\x5c\xae\x4a\x65\x23\x8a\x6f\x3a\x96\x05\xfa\xae" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "plain64be", UINT32_MAX-7, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\x28\xbf\x09\xe1\x68\xcc\x05\x1b\x20\xaf\x8d\x01\x36\x21\x8a\x8d" + "\x7a\x94\x98\xa8\x99\xe9\xf4\x66\xd8\xb7\x99\xca\x04\x58\x83\x90" + },{ 1024, false, + "\x9b\x74\xf7\xd5\x5a\x6b\xb2\x3a\xd2\x09\xdd\x80\x59\x28\x70\x8f" + "\x3a\x61\xf2\x14\xc3\x0d\xa8\xd7\xd9\xcb\x57\x26\x73\x88\x93\xd2" + },{ 1024, true, + "\x36\xb5\x68\x08\x29\x55\xb9\xe9\x01\xc1\xa8\xcf\x3e\x5b\x00\x28" + "\xb6\xd1\x35\xc5\xf7\x0c\xf6\x59\xb5\x8f\xb9\xa2\x00\x43\x29\x48" + },{ 2048, false, + "\x94\x4f\xc8\xb4\xfe\xad\xdc\x56\xf0\x62\x00\x8d\x52\x0b\x2d\x58" + "\xc0\x05\xd6\x1d\x47\x35\xc6\x6a\x42\xec\x98\xee\x21\x74\x7b\xe5" + },{ 2048, true, + "\x14\x6b\xaa\x2f\xf4\xa8\x24\x3f\x4e\x92\x97\x1a\xca\x1c\xbb\x46" + "\xa7\x08\xbb\xc5\x95\xac\x73\x81\x25\x34\x33\x41\x95\x71\xd9\xe7" + },{ 4096, false, + "\xa8\x17\x5d\x84\xc8\x16\x06\x7f\xa2\x68\xdd\x1e\x7d\x63\x34\x93" + "\x7b\x45\x2d\xf4\x10\x0b\x90\xfa\x14\x8b\x73\x86\xbc\x09\x4a\xe3" + },{ 4096, true, + "\xe2\xc3\x30\xd8\xa1\xb3\xa8\xeb\xde\xdc\xfe\x9b\xe0\x0b\x62\x4e" + "\x38\x2f\xa1\x45\x0e\x8f\x6c\xf0\x4e\x88\x58\x17\x13\xb5\x10\x98" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "essiv:sha256", 0, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\xa5\x3e\x74\xc4\x1a\x5c\xf3\x6b\x63\x49\xd5\xd9\xbb\x7a\x89\x5a" + "\xd5\x3e\x76\x6f\x4c\x2d\x0b\xd3\x8b\x5e\x0e\x91\xa3\x8c\x2a\xde" + },{ 1024, false, + "\x41\x6b\xc6\x75\x2e\x99\x76\xa1\x83\xea\xd5\x97\x64\x0e\x24\x8c" + "\x91\x17\x03\x38\xe7\xd8\x66\x64\xaa\xd7\x27\x50\x2a\xd3\x0b\xe6" + },{ 1024, true, + "\x02\x3c\xbe\xe6\x1e\x9a\xf3\x14\xab\x16\xff\x6f\xb6\xa2\x3e\x03" + "\xa1\xbd\xe9\xe4\xfa\x44\x5b\x22\xc6\x53\xe8\x60\x58\x15\x99\xea" + },{ 2048, false, + "\x84\xdc\x45\xd3\x61\x03\xa8\x51\x85\x5b\xef\xf8\x92\x6b\x12\x06" + "\x2c\xfe\x75\x3e\xcf\x28\xd1\x8b\x4d\xcb\x88\x9e\x31\xb0\x0b\x92" + },{ 2048, true, + "\x4b\x9d\xe4\x3c\xe2\x4e\x7a\x13\x72\x02\x48\xf8\x7a\x7e\x15\xe8" + "\x3a\xc3\x92\x0b\xe8\x30\xac\xb7\x9a\xe0\xcf\xf9\xb1\xf5\x61\x5b" + },{ 4096, false, + "\xbb\x1b\xa3\xa9\x41\xbf\x17\xd8\x76\x19\x08\x8e\x3f\x50\xed\xfd" + "\x57\x1d\xd2\xc2\x8a\x32\x01\xb9\xd9\x8a\xcc\x0d\xa0\x65\x8b\x6d" + },{ 4096, true, + "\xa6\xdc\x7d\xc8\xc4\x9b\x78\x81\x72\xe9\xdd\x35\x6c\x07\xeb\x7b" + "\xd6\x56\x9e\xe4\xdf\xf5\xdd\x2e\x2c\x19\x8f\x63\x58\xdb\xa7\xd0" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "benbi", 0, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\x3c\xe3\x94\xe3\x6d\x68\x5b\xdb\x5a\x8d\x71\xbf\xd3\xa6\x68\xb9" + "\x1f\x33\x0f\x97\xe2\xd6\xe8\xe2\xe1\xfc\x7e\x80\x28\xf1\x73\xbd" + },{ 1024, false, + "\x0f\x27\xa7\xae\x31\x9e\x71\x02\x12\x16\x44\x5f\xbb\xc6\xcb\x78" + "\xd4\x84\x49\xe0\x88\x85\x04\xbf\x6d\xea\x60\x76\x98\x34\x0a\x7e" + },{ 1024, true, + "\x3e\xf3\x08\x8d\x3b\x20\x4b\x51\x54\xde\x7f\x77\x5b\xcf\x02\x8b" + "\x0e\xb0\x74\x2e\x8e\x29\xfa\x5e\x86\xb4\xab\x65\x18\x59\x48\xb1" + },{ 2048, false, + "\xb0\x9a\xe5\x31\x5f\x2e\x9d\x13\x04\x08\x2a\x02\x71\x3d\xdb\x5d" + "\xb2\xc9\x68\x5b\xdc\xd1\x38\xc2\x96\xb3\x3b\x72\xda\x9d\xcb\xe6" + },{ 2048, true, + "\x6f\x34\xf0\xc1\xea\x72\xe4\xdc\x91\x91\x78\xb3\x7c\xb0\x9d\x41" + "\x94\xf6\xb8\xad\x05\xc4\x0e\x49\x05\x31\x90\xf0\x56\xfe\x21\x3f" + },{ 4096, false, + "\xaa\x74\x7d\xd6\x73\xa7\x77\xe1\x7f\xb9\x76\xf7\x5c\xcf\xc0\xb7" + "\xfa\x7b\xed\x15\xc2\x32\x7c\x27\xbb\x35\xfc\xfe\x12\xee\x14\x2d" + },{ 4096, true, + "\x71\x1b\x3d\x26\xf4\x44\x82\x72\x1b\x7a\x65\x0b\x37\x8c\x94\x5b" + "\x1c\xd3\x30\x2f\xf6\xce\xa4\x24\x25\xeb\x9b\xb9\x83\xe5\x71\xbb" + }, +}}, +{ + "aes", "cbc", + "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c", 16, + "eboiv", 0, 8192, + "\x9f\x1d\xcb\xc3\x5c\x35\x0d\x60\x27\xf9\x8b\xe0\xf5\xc8\xb4\x3b" + "\x42\xca\x52\xb7\x60\x44\x59\xc0\xc4\x2b\xe3\xaa\x88\x91\x3d\x47", { + { 512, false, + "\x04\x4e\x92\x9f\x79\x66\xfe\x93\x1b\xa5\xb8\x02\xfe\x7e\xf9\x26" + "\x7b\x64\x39\xe7\xb3\xca\xc4\x6e\xca\x27\xa0\x2f\xe2\xea\x91\x16" + },{ 1024, false, + "\xb0\x4a\xa4\xb5\xd6\x45\x7a\x86\xe9\x43\x3d\xd6\x01\xf7\x68\x8e" + "\xe6\x81\x8d\x50\x55\x18\x8e\x4b\xb6\xa7\x89\xdf\xe2\x4b\x94\xe2" + },{ 1024, true, + "\x95\x08\x4d\x4e\x89\xab\x91\x4e\xae\x56\x5d\xec\xf2\x78\x13\xb1" + "\x82\xf7\xc8\xb5\x03\xd6\xfa\xb0\xe3\xf9\xc1\x01\xc0\x0c\x35\xa4" + },{ 2048, false, + "\xd4\x00\x1f\x26\x18\xd1\x6d\xd5\xc4\xbf\x4a\x13\x30\xae\xd7\x4b" + "\x33\x1e\xd5\xe8\x43\x2d\x95\x84\x67\x39\x04\x51\x5f\x1f\x49\xe4" + },{ 2048, true, + "\x89\x8d\xa2\xec\x45\x7f\xf0\xac\xfc\x70\xb6\x36\xf0\x89\xca\x86" + "\x6b\xbf\x09\xd2\x54\xa0\x7c\xbc\x17\xd3\x4e\xb8\x10\x8a\x3f\x5d" + },{ 4096, false, + "\xd1\xd7\x4f\x70\x9a\xa0\x22\x27\x60\xdb\x40\x5a\x84\xce\x89\x2c" + "\x4f\x98\x55\xd2\x2d\xd1\xea\x9e\x47\xae\x8a\x83\xb5\x90\xbb\x49" + },{ 4096, true, + "\xdb\xe7\xd2\x25\xb0\x4f\x5d\x36\x20\xc4\xc2\xb4\xe8\x7e\xae\xe9" + "\x95\x10\x45\x5d\xdd\xc4\xcd\x33\xad\xbd\x39\x49\xf2\x85\x82\x4c" + }, +}}}; + +static int pbkdf_test_vectors(void) +{ + char result[256]; + unsigned int i; + const struct kdf_test_vector *vec; + + for (i = 0; i < (sizeof(kdf_test_vectors) / sizeof(*kdf_test_vectors)); i++) { + crypt_backend_memzero(result, sizeof(result)); + vec = &kdf_test_vectors[i]; + printf("PBKDF vector %02d %s ", i, vec->type); + if (vec->hash && crypt_hmac_size(vec->hash) < 0) { + printf("[%s N/A]\n", vec->hash); + continue; + } + if (crypt_pbkdf(vec->type, vec->hash, + vec->password, vec->password_length, + vec->salt, vec->salt_length, + result, vec->output_length, + vec->iterations, vec->memory, vec->parallelism) < 0) { + printf("[%s-%s N/A]\n", vec->type, vec->hash); + continue; + } + if (memcmp(result, vec->output, vec->output_length)) { + printf("[FAILED]\n"); + printhex(" got", result, vec->output_length); + printhex("want", vec->output, vec->output_length); + return EXIT_FAILURE; + } + printf("[OK]\n"); + } + return EXIT_SUCCESS; +} + +static int crc32_test(const struct hash_test_vector *vector, unsigned int i) +{ + uint32_t crc32; + + if (vector->out[i].length != sizeof(uint32_t)) + return EXIT_FAILURE; + + crc32 = crypt_crc32(~0, (const unsigned char*)vector->data, vector->data_length) ^ ~0; + + if ((unsigned char)vector->out[i].out[0] != ((crc32 >> 24) & 0xFF) || + (unsigned char)vector->out[i].out[1] != ((crc32 >> 16) & 0xFF) || + (unsigned char)vector->out[i].out[2] != ((crc32 >> 8) & 0xFF) || + (unsigned char)vector->out[i].out[3] != ((crc32 >> 0) & 0xFF)) { + printf("[FAILED]\n"); + printhex(" got", (const char *)&crc32, sizeof(crc32)); + printhex("want", vector->out[i].out, vector->out[i].length); + return EXIT_FAILURE; + } + + return EXIT_SUCCESS; +} + +static int hash_test(void) +{ + const struct hash_test_vector *vector; + unsigned int i, j; + int r; + struct crypt_hash *h; + char result[64]; + + for (i = 0; i < ARRAY_SIZE(hash_test_vectors); i++) { + vector = &hash_test_vectors[i]; + printf("Hash vector %02d: ", i); + + for (j = 0; j < ARRAY_SIZE(vector->out); j++) { + + // CRC32 vector test is special + if (!strcmp("crc32", vector->out[j].name)) { + if (crc32_test(vector, j) < 0) + return EXIT_FAILURE; + printf("[%s]", vector->out[j].name); + continue; + } + + if (crypt_hash_size(vector->out[j].name) < 0) { + printf("[%s N/A]", vector->out[j].name); + continue; + } + + if (crypt_hash_size(vector->out[j].name) != (int)vector->out[j].length) + return EXIT_FAILURE; + + if (sizeof(result) < vector->out[j].length) + return EXIT_FAILURE; + + crypt_backend_memzero(result, sizeof(result)); + printf("[%s]", vector->out[j].name); + + if (crypt_hash_init(&h, vector->out[j].name)) { + printf("[%s N/A (init)]", vector->out[j].name); + continue; + } + + r = crypt_hash_write(h, vector->data, vector->data_length); + if (!r) + r = crypt_hash_final(h, result, vector->out[j].length); + + crypt_hash_destroy(h); + + if (r) + return EXIT_FAILURE; + + if (memcmp(result, vector->out[j].out, vector->out[j].length)) { + printf("[FAILED]\n"); + printhex(" got", result, vector->out[j].length); + printhex("want", vector->out[j].out, vector->out[j].length); + return EXIT_FAILURE; + } + } + printf("\n"); + } + + return EXIT_SUCCESS; +} + +static int hmac_test(void) +{ + const struct hmac_test_vector *vector; + struct crypt_hmac *hmac; + unsigned int i, j; + int r; + char result[64]; + + for (i = 0; i < ARRAY_SIZE(hmac_test_vectors); i++) { + vector = &hmac_test_vectors[i]; + printf("HMAC vector %02d: ", i); + + for(j = 0; j < ARRAY_SIZE(vector->out); j++) { + + if (crypt_hmac_size(vector->out[j].name) < 0) { + printf("[%s N/A]", vector->out[j].name); + continue; + } + + if (crypt_hmac_size(vector->out[j].name) != (int)vector->out[j].length) + return EXIT_FAILURE; + + if (sizeof(result) < vector->out[j].length) + return EXIT_FAILURE; + + crypt_backend_memzero(result, sizeof(result)); + printf("[%s]", vector->out[j].name); + + if (crypt_hmac_init(&hmac, vector->out[j].name, vector->key, vector->key_length)) + return EXIT_FAILURE; + + r = crypt_hmac_write(hmac, vector->data, vector->data_length); + if (!r) + r = crypt_hmac_final(hmac, result, vector->out[j].length); + + crypt_hmac_destroy(hmac); + + if (r) + return EXIT_FAILURE; + + if (memcmp(result, vector->out[j].out, vector->out[j].length)) { + printf("[FAILED]\n"); + printhex(" got", result, vector->out[j].length); + printhex("want", vector->out[j].out, vector->out[j].length); + return EXIT_FAILURE; + } + } + printf("\n"); + } + + return EXIT_SUCCESS; +} + +static int cipher_test(void) +{ + const struct cipher_test_vector *vector; + struct crypt_cipher *cipher; + unsigned int i, j; + char result[256]; + int r; + + for (i = 0; i < ARRAY_SIZE(cipher_test_vectors); i++) { + vector = &cipher_test_vectors[i]; + printf("CIPHER vector %02d: ", i); + + for (j = 0; j < ARRAY_SIZE(vector->out); j++) { + if (vector->iv_length && + crypt_cipher_ivsize(vector->out[j].name, vector->out[j].mode) != (int)vector->iv_length) + return EXIT_FAILURE; + if (vector->data_length > sizeof(result)) + return EXIT_FAILURE; + + r = crypt_cipher_init(&cipher, vector->out[j].name, vector->out[j].mode, + vector->key, vector->key_length); + if (r == -ENOENT || r == -ENOTSUP) { + printf("[%s-%s N/A]", vector->out[j].name, vector->out[j].mode); + continue; + } else { + printf("[%s-%s,%dbits]", vector->out[j].name, vector->out[j].mode, vector->key_length * 8); + if (r) + return EXIT_FAILURE; + } + + crypt_backend_memzero(result, sizeof(result)); + if (crypt_cipher_encrypt(cipher, vector->plaintext, result, vector->data_length, + vector->iv, vector->iv_length)) { + crypt_cipher_destroy(cipher); + return EXIT_FAILURE; + } + + if (memcmp(vector->out[j].ciphertext, result, vector->data_length)) { + printf("[ENCRYPTION FAILED]\n"); + printhex(" got", result, vector->data_length); + printhex("want", vector->out[j].ciphertext, vector->data_length); + crypt_cipher_destroy(cipher); + return EXIT_FAILURE; + } + + crypt_backend_memzero(result, sizeof(result)); + if (crypt_cipher_decrypt(cipher, vector->out[j].ciphertext, result, vector->data_length, + vector->iv, vector->iv_length)) { + crypt_cipher_destroy(cipher); + return EXIT_FAILURE; + } + + if (memcmp(vector->plaintext, result, vector->data_length)) { + printf("[DECRYPTION FAILED]\n"); + printhex(" got", result, vector->data_length); + printhex("want", vector->plaintext, vector->data_length); + crypt_cipher_destroy(cipher); + return EXIT_FAILURE; + } + + crypt_cipher_destroy(cipher); + } + printf("\n"); + } + + return EXIT_SUCCESS; +} + +static void get_sha256(const char *in, size_t length, char out[32]) +{ + struct crypt_hash *h; + + crypt_backend_memzero(out, 32); + if (crypt_hash_init(&h, "sha256")) + return; + + if (!crypt_hash_write(h, in, length)) + crypt_hash_final(h, out, 32); + + crypt_hash_destroy(h); +} + +static int cipher_iv_test(void) +{ + const struct cipher_iv_test_vector *vector; + struct crypt_storage *storage; + unsigned int i, j; + char mode_iv[256]; + char result[8192], hash[32]; + int r; + + for (i = 0; i < ARRAY_SIZE(cipher_iv_test_vectors); i++) { + vector = &cipher_iv_test_vectors[i]; + printf("IV vector %02d: [%s-%s-%s]", i, vector->cipher_name, vector->cipher_mode, vector->iv_name); + + for (j = 0; j < ARRAY_SIZE(vector->out); j++) { + if (vector->data_length > sizeof(result)) + return EXIT_FAILURE; + + snprintf(mode_iv, sizeof(mode_iv)-2, "%s-%s", vector->cipher_mode, vector->iv_name); + r = crypt_storage_init(&storage, vector->out[j].sector_size, vector->cipher_name, mode_iv, + vector->key, vector->key_length, vector->out[j].large_iv); + if (r == -ENOENT || r == -ENOTSUP) { + printf("[N/A]"); + continue; + } else { + printf("[%i%s]", (int)vector->out[j].sector_size, vector->out[j].large_iv ? "L" : ""); + if (r) + return EXIT_FAILURE; + } + + crypt_backend_memzero(result, sizeof(result)); + if (crypt_storage_encrypt(storage, vector->iv_offset, vector->data_length, result)) { + crypt_storage_destroy(storage); + return EXIT_FAILURE; + } + + get_sha256(result, vector->data_length, hash); + if (memcmp(vector->out[j].out_sha256, hash, sizeof(hash))) { + printf("[ENCRYPTION FAILED]\n"); + printhex(" got", hash, sizeof(hash)); + printhex("want", vector->out[j].out_sha256, sizeof(vector->out[j].out_sha256)); + crypt_storage_destroy(storage); + return EXIT_FAILURE; + } + + if (crypt_storage_decrypt(storage, vector->iv_offset, vector->data_length, result)) { + crypt_storage_destroy(storage); + return EXIT_FAILURE; + } + + get_sha256(result, vector->data_length, hash); + if (memcmp(vector->in_sha256, hash, sizeof(hash))) { + printf("[DECRYPTION FAILED]\n"); + printhex(" got", hash, sizeof(hash)); + printhex("want", vector->in_sha256, sizeof(vector->in_sha256)); + crypt_storage_destroy(storage); + return EXIT_FAILURE; + } + + crypt_storage_destroy(storage); + } + printf("\n"); + } + + return EXIT_SUCCESS; +} + +static void __attribute__((noreturn)) exit_test(const char *msg, int r) +{ + if (msg) + printf("%s\n", msg); + crypt_backend_destroy(); + exit(r); +} + +int main(__attribute__ ((unused)) int argc, __attribute__ ((unused))char *argv[]) +{ + setvbuf(stdout, NULL, _IONBF, 0); + + if (getenv("CRYPTSETUP_PATH")) { + printf("Cannot run this test with CRYPTSETUP_PATH set.\n"); + exit(77); + } + + if (crypt_backend_init()) + exit_test("Crypto backend init error.", EXIT_FAILURE); + + printf("Test vectors using %s crypto backend.\n", crypt_backend_version()); + + if (pbkdf_test_vectors()) + exit_test("PBKDF test failed.", EXIT_FAILURE); + + if (hash_test()) + exit_test("HASH test failed.", EXIT_FAILURE); + + if (hmac_test()) + exit_test("HMAC test failed.", EXIT_FAILURE); + + if (cipher_test()) + exit_test("CIPHER test failed.", EXIT_FAILURE); + + if (cipher_iv_test()) + exit_test("IV test failed.", EXIT_FAILURE); + + exit_test(NULL, EXIT_SUCCESS); +} diff --git a/tests/cryptsetup-valg-supps b/tests/cryptsetup-valg-supps new file mode 100644 index 0000000..493e125 --- /dev/null +++ b/tests/cryptsetup-valg-supps @@ -0,0 +1,14 @@ +# Suppresion file for valgrind + +# known problem in libgcrypt +{ + leak_in_libgcrypt_00 + Memcheck:Leak + fun:malloc + obj:/lib64/libgcrypt.so* + ... + obj:/lib64/libgcrypt.so* + fun:crypt_backend_init + fun:init_crypto + ... +} diff --git a/tests/device-test b/tests/device-test new file mode 100755 index 0000000..617f16a --- /dev/null +++ b/tests/device-test @@ -0,0 +1,328 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +MNT_DIR="./mnt_luks" +DEV_NAME="dummy" +DEV_NAME2="ymmud" +PWD1="93R4P4pIqAH8" +PWD2="mymJeD8ivEhE" +FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000" +SKIP_COUNT=0 + +cleanup() { + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + udevadm settle >/dev/null 2>&1 + if [ -d "$MNT_DIR" ] ; then + umount -f $MNT_DIR 2>/dev/null + rmdir $MNT_DIR 2>/dev/null + fi + rmmod scsi_debug 2>/dev/null +} + +fail() +{ + [ -n "$1" ] && echo "FAIL $1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup + exit 100 +} + +skip() +{ + echo "TEST SKIPPED: $1" + cleanup + exit 77 +} + +add_device() { + modprobe scsi_debug $@ delay=0 + [ $? -ne 0 ] && skip "This kernel seems to not support proper scsi_debug module." + + sleep 1 + SCSI_DEV=$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + + [ -b "/dev/$SCSI_DEV" ] || fail "Cannot find $SCSI_DEV." +} + +function dm_crypt_features() +{ + modprobe dm-crypt || fail "dm-crypt failed to load" + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PTC=$(echo $VER_STR | cut -f 3 -d.) + + [ $VER_MAJ -lt 1 ] && return + [ $VER_MAJ -gt 1 ] && { + DM_PERF_CPU=1 + DM_SECTOR_SIZE=1 + test -d /proc/sys/kernel/keys && DM_KEYRING=1 + return + } + + [ $VER_MIN -lt 14 ] && return + DM_PERF_CPU=1 + if [ $VER_MIN -ge 17 -o \( $VER_MIN -eq 14 -a $VER_PTC -ge 5 \) ]; then + DM_SECTOR_SIZE=1 + fi + if [ $VER_MIN -gt 18 -o \( $VER_MIN -eq 18 -a $VER_PTC -ge 1 \) ]; then + test -d /proc/sys/kernel/keys && DM_KEYRING=1 + fi + + [ $VER_MIN -lt 22 ] && return + DM_PERF_NO_WORKQUEUE=1 +} + +function dm_crypt_keyring_support() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + # run the test with dm-crypt v1.15.0+ on purpose + # the fix is in dm-crypt v1.18.1+ + [ $VER_MAJ -gt 1 ] && return 0 + [ $VER_MAJ -lt 1 ] && return 1 + [ $VER_MIN -ge 15 ] +} + +format() # format +{ + dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1 + + echo $PWD1 | $CRYPTSETUP luksFormat --type $1 $DEV -q $FAST_PBKDF_OPT -c aes-cbc-essiv:sha256 + [ $? -ne 0 ] && fail "Format failed." + + # test some operation, just in case + echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey $DEV -i1 --key-slot 1 + [ $? -ne 0 ] && fail "Keyslot add failed." + + $CRYPTSETUP -q luksKillSlot $DEV 1 + [ $? -ne 0 ] && fail "Keyslot removal failed." +} + +check_sector_size() # $1 expected sector size +{ + $CRYPTSETUP status $DEV_NAME | grep "sector size" | grep -q $1 || fail + if [ $S -gt 512 ]; then + dmsetup table $DEV_NAME | grep -q "sector_size:$1" || fail + fi +} + +if [ $(id -u) != 0 ]; then + skip "You must be root to run this test, test skipped." +fi + +dm_crypt_features + +[ ! -d $MNT_DIR ] && mkdir $MNT_DIR + +echo "[1] Using tmpfs for image" +DEV="$MNT_DIR/test.img" +mount -t tmpfs none $MNT_DIR || skip "Mounting tmpfs not available." +format luks1 + +echo "[2] Kernel dmcrypt performance options" +if [ -z "$DM_PERF_CPU" ]; then + echo "TEST SKIPPED: dmcrypt options not available" + SKIP_COUNT=$((SKIP_COUNT+1)) +else + echo -n "PLAIN: same_cpu_crypt submit_from_cpus " + echo -e "$PWD1" | $CRYPTSETUP open -q --type plain --hash sha256 $DEV $DEV_NAME --perf-same_cpu_crypt --perf-submit_from_crypt_cpus || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -n "allow_discards " + echo -e "$PWD1" | $CRYPTSETUP open -q --type plain --hash sha256 $DEV $DEV_NAME --perf-same_cpu_crypt --allow-discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP open -q --type plain --hash sha256 $DEV $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP refresh --hash sha256 -q $DEV_NAME --perf-same_cpu_crypt --allow-discards || fail + # Hash affects volume key for plain device. Check we can detect it + echo -e "$PWD1" | $CRYPTSETUP refresh -q $DEV_NAME --hash sha512 --perf-same_cpu_crypt --allow-discards 2>/dev/null && fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + echo -e "$PWD1" | $CRYPTSETUP refresh --hash sha256 -q $DEV_NAME --allow-discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + echo -e "$PWD1" | $CRYPTSETUP refresh --hash sha256 -q $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards && fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + echo -e "$PWD1" | $CRYPTSETUP refresh --hash sha256 $DEV $DEV_NAME2 2>/dev/null && fail + if [ -n "$DM_PERF_NO_WORKQUEUE" ]; then + echo -n "no_read_workqueue no_write_workqueue" + echo -e "$PWD1" | $CRYPTSETUP refresh --hash sha256 -q $DEV_NAME --perf-no_read_workqueue --perf-no_write_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_read_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_write_workqueue || fail + fi + $CRYPTSETUP close $DEV_NAME || fail + echo + + echo -n "LUKS: same_cpu_crypt submit_from_cpus " + echo -e "$PWD1" | $CRYPTSETUP open --type luks1 $DEV $DEV_NAME --perf-same_cpu_crypt --perf-submit_from_crypt_cpus || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -n "allow_discards " + echo -e "$PWD1" | $CRYPTSETUP open --type luks1 $DEV $DEV_NAME --perf-same_cpu_crypt --allow-discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME --allow-discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME --allow-discards --perf-same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards && fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME2 2>/dev/null && fail + if [ -n "$DM_PERF_NO_WORKQUEUE" ]; then + echo -n "no_read_workqueue no_write_workqueue" + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME --perf-no_read_workqueue --perf-no_write_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_read_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_write_workqueue || fail + fi + $CRYPTSETUP close $DEV_NAME || fail + echo + + format luks2 + echo -n "LUKS2: same_cpu_crypt submit_from_cpus " + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME --perf-same_cpu_crypt --perf-submit_from_crypt_cpus --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + $CRYPTSETUP close $DEV_NAME || fail + # Stored in metadata + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -n "allow_discards [persistent flags] " + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME --perf-same_cpu_crypt --allow-discards --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP close $DEV_NAME || fail + + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + $CRYPTSETUP status $DEV_NAME | grep -q discards && fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --perf-same_cpu_crypt --perf-submit_from_crypt_cpus --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --perf-same_cpu_crypt --allow-discards --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --perf-submit_from_crypt_cpus || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt || fail + $CRYPTSETUP status $DEV_NAME | grep -q discards || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus || fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus && fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q same_cpu_crypt && fail + $CRYPTSETUP status $DEV_NAME | grep -q discards && fail + $CRYPTSETUP status $DEV_NAME | grep -q submit_from_crypt_cpus && fail + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --disable-keyring || fail + $CRYPTSETUP status $DEV_NAME | grep -q keyring && fail + if [ -n "$DM_KEYRING" ]; then + echo -n "keyring " + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q keyring || fail + fi + if [ -n "$DM_PERF_NO_WORKQUEUE" ]; then + echo -n "no_read_workqueue no_write_workqueue" + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME --perf-no_read_workqueue --perf-no_write_workqueue --persistent || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_read_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_write_workqueue || fail + $CRYPTSETUP close $DEV_NAME || fail + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_read_workqueue || fail + $CRYPTSETUP status $DEV_NAME | grep -q no_write_workqueue || fail + fi + echo -e "$PWD1" | $CRYPTSETUP refresh $DEV $DEV_NAME2 2>/dev/null && fail + $CRYPTSETUP close $DEV_NAME || fail + echo +fi + +echo "[3] Kernel dmcrypt sector size options" +echo -e "$PWD1" | $CRYPTSETUP open --type plain --hash sha256 $DEV $DEV_NAME --sector-size 4096 >/dev/null 2>&1 +ret=$? +[ -z "$DM_SECTOR_SIZE" -a $ret -eq 0 ] && fail "cryptsetup activated device with --sector-size option on incompatible kernel!" +if [ $ret -ne 0 ] ; then + SKIP_COUNT=$((SKIP_COUNT+1)) + if [ $SKIP_COUNT -ge 2 ]; then + skip "dmcrypt sector-size option not available" + fi + echo "TEST SKIPPED: dmcrypt sector-size option not available" +else + $CRYPTSETUP close $DEV_NAME || fail + + echo -n "PLAIN sector size:" + echo -e "$PWD1" | $CRYPTSETUP open --type plain --hash sha256 $DEV $DEV_NAME --sector-size 1234 >/dev/null 2>&1 && fail + for S in 512 1024 2048 4096; do + echo -n "[$S]" + echo -e "$PWD1" | $CRYPTSETUP open -q --type plain --hash sha256 $DEV $DEV_NAME --sector-size $S || fail + check_sector_size $S + $CRYPTSETUP close $DEV_NAME || fail + done + + echo -e "$PWD1" | $CRYPTSETUP open --type plain --hash sha256 $DEV $DEV_NAME --iv-large-sectors >/dev/null 2>&1 && fail + for S in 1024 2048 4096; do + echo -n "[$S/IV]" + echo -e "$PWD1" | $CRYPTSETUP open -q --type plain --hash sha256 $DEV $DEV_NAME --sector-size $S --iv-large-sectors || fail + check_sector_size $S + dmsetup table $DEV_NAME | grep -q "iv_large_sectors" || fail + $CRYPTSETUP close $DEV_NAME || fail + done + echo + + echo -n "LUKS2 sector size:" + echo -e "$PWD1" | $CRYPTSETUP luksFormat --type luks2 -$DEV --sector-size 1234 >/dev/null 2>&1 && fail + for S in 512 1024 2048 4096; do + echo -n "[$S]" + echo -e "$PWD1" | $CRYPTSETUP -q luksFormat --type luks2 --pbkdf pbkdf2 --pbkdf-force-iterations 1000 $DEV --sector-size $S || fail + echo -e "$PWD1" | $CRYPTSETUP open $DEV $DEV_NAME || fail + check_sector_size $S + $CRYPTSETUP close $DEV_NAME || fail + done + echo +fi + +echo "[4] Disappeared device test:" +KEY="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001" +for F in LUKS1 LUKS2 BITLK TCRYPT; do + echo -n "$F" + add_device dev_size_mb=1 sector_size=512 num_tgts=1 lbpu=1 + # Fake CRYPT UUID to force code to parse type-specific path + dmsetup create $DEV_NAME --uuid CRYPT-$F-$DEV_NAME --table "0 1024 crypt aes-xts-plain64 $KEY 16 /dev/$SCSI_DEV 16" + $CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail + echo 1 > /sys/block/$SCSI_DEV/device/delete + udevadm settle >/dev/null 2>&1 + $CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail + dmsetup remove $DEV_NAME --retry || fail + rmmod scsi_debug + echo -n "[OK] " +done +echo + +cleanup +exit 0 diff --git a/tests/differ.c b/tests/differ.c new file mode 100644 index 0000000..ec811a4 --- /dev/null +++ b/tests/differ.c @@ -0,0 +1,166 @@ +/* + * cryptsetup file differ check (rewritten Clemens' fileDiffer in Python) + * + * Copyright (C) 2010-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +struct ffile { + char *name; + int fd; + unsigned char *addr; + size_t size; +}; + +enum df { OK , FAIL }; + +static void print_diff(off_t from, int max, + const unsigned char *o, + const unsigned char *n) +{ + int i, len = max; + + if (len > 16) + len = 16; + + printf("OLD:"); + for (i = 0; i < len; i++) + printf(" %02x", o[from + i]); + printf("%s\n ", max != len ? " ..." : ""); + for (i = 0; i < len; i++) + printf(" %2c", o[from + i] > ' ' ? o[from + i]: '.'); + printf("\nNEW:"); + for (i = 0; i < len; i++) + printf(" %02x", n[from + i]); + printf("%s\n ", max != len ? " ..." : ""); + for (i = 0; i < len; i++) + printf(" %2c", n[from + i] > ' ' ? n[from + i]: '.'); + printf("\n"); +} + +/* + * Xfrom-to (e.g. R10-15) + * A - change allowed + * S - change required, semantic + * R - change required, random + * F - change forbidden + */ +static enum df check(const char *range, unsigned char *o, unsigned char *n) +{ + char strict; + unsigned long long from, to; + enum df ret; + + if (sscanf(range, "%c%llu-%llu", &strict, &from, &to) != 3) { + printf("Unknown range format %s.\n", range); + return FAIL; + } + + switch (toupper(strict)) { + case 'A': + ret = OK; + break; + case 'S': + ret = memcmp(&o[from], &n[from], to - from + 1) != 0 ? OK : FAIL; + break; + case 'R': /* FIXME - random test */ + ret = memcmp(&o[from], &n[from], to - from + 1) != 0 ? OK : FAIL; + break; + case 'F': + ret = memcmp(&o[from], &n[from], to - from + 1) == 0 ? OK : FAIL; + break; + default: + ret = FAIL; + break; + } + + if (ret == FAIL) + print_diff(from, to - from + 1, o, n); + + return ret; +} + +static int open_mmap(struct ffile *f) +{ + struct stat st; + + f->fd = open(f->name, O_RDONLY); + if (f->fd == -1 || fstat(f->fd, &st) == -1) + return 0; + + f->size = st.st_size; + f->addr = mmap(NULL, f->size, PROT_READ, MAP_PRIVATE, f->fd, 0); + + return (f->addr == MAP_FAILED) ? 0 : 1; +} + +static void close_mmap(struct ffile *f) +{ + if (f->addr != MAP_FAILED && !munmap(f->addr, f->size)) + f->addr = MAP_FAILED; + + if (f->fd != -1 && !close(f->fd)) + f->fd = -1; +} + +int main(int argc, char *argv[]) +{ + int i, r = 1; + struct ffile file_old = { + .fd = -1, + .addr = MAP_FAILED, + }; + struct ffile file_new = { + .fd = -1, + .addr = MAP_FAILED, + }; + + if (argc < 3) { + printf("Use: differ old_file new_file change_list.\n"); + goto bad; + } + + file_old.name = argv[1]; + if (!open_mmap(&file_old)) + goto bad; + + file_new.name = argv[2]; + if (!open_mmap(&file_new)) + goto bad; + + for (i = 3; i < argc; i++) + if (check(argv[i], file_old.addr, file_new.addr) == FAIL) { + printf ("FAILED for %s\n", argv[i]); + r = 1; + goto bad; + } + + r = 0; +bad: + close_mmap(&file_new); + close_mmap(&file_old); + + return r; +} diff --git a/tests/discards-test b/tests/discards-test new file mode 100755 index 0000000..8a838e6 --- /dev/null +++ b/tests/discards-test @@ -0,0 +1,86 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +DEV_NAME="discard-t3st" +DEV="" +PWD1="93R4P4pIqAH8" + +cleanup() { + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + udevadm settle >/dev/null 2>&1 + rmmod scsi_debug 2>/dev/null + sleep 2 +} + +fail() +{ + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup + exit 100 +} + +add_device() { + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 2 + DEV=$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + + DEV="/dev/$DEV" + [ -b $DEV ] || fail "Cannot find $DEV." +} + +function check_version() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f 2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + # option supported in 1.11 + test $VER_MAJ -gt 1 && return 0 + test $VER_MIN -ge 11 && return 0 + return 1 +} + +if [ $(id -u) != 0 ]; then + echo "WARNING: You must be root to run this test, test skipped." + exit 77 +fi + +modprobe --dry-run scsi_debug || exit 77 +modprobe dm-crypt >/dev/null 2>&1 +if ! check_version ; then + echo "Probably old kernel, test skipped." + exit 77 +fi + +add_device dev_size_mb=16 sector_size=512 num_tgts=1 lbpu=1 + +# FIXME test hash of device (unmap -> zero) +# for now just check that flag is enabled + +echo "[1] Allowing discards for LUKS device" +echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $DEV -q -i1 || fail +echo $PWD1 | $CRYPTSETUP luksOpen $DEV $DEV_NAME --allow-discards || fail +$CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail +$CRYPTSETUP resize $DEV_NAME --size 100 || fail +$CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail +dmsetup table $DEV_NAME | grep allow_discards >/dev/null || fail +$CRYPTSETUP luksClose $DEV_NAME || fail + +echo "[2] Allowing discards for plain device" +echo $PWD1 | $CRYPTSETUP create -q $DEV_NAME $DEV --hash sha1 --allow-discards || fail +$CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail +$CRYPTSETUP resize $DEV_NAME --size 100 || fail +$CRYPTSETUP status $DEV_NAME | grep flags | grep discards >/dev/null || fail +dmsetup table $DEV_NAME | grep allow_discards >/dev/null || fail +$CRYPTSETUP remove $DEV_NAME || fail + +cleanup diff --git a/tests/evil_hdr-keyslot_overlap.xz b/tests/evil_hdr-keyslot_overlap.xz new file mode 100644 index 0000000..6d56368 Binary files /dev/null and b/tests/evil_hdr-keyslot_overlap.xz differ diff --git a/tests/evil_hdr-luks_hdr_damage.xz b/tests/evil_hdr-luks_hdr_damage.xz new file mode 100644 index 0000000..b0b5254 Binary files /dev/null and b/tests/evil_hdr-luks_hdr_damage.xz differ diff --git a/tests/evil_hdr-payload_overwrite.xz b/tests/evil_hdr-payload_overwrite.xz new file mode 100644 index 0000000..b9e0e68 Binary files /dev/null and b/tests/evil_hdr-payload_overwrite.xz differ diff --git a/tests/evil_hdr-small_luks_device.xz b/tests/evil_hdr-small_luks_device.xz new file mode 100644 index 0000000..700392d Binary files /dev/null and b/tests/evil_hdr-small_luks_device.xz differ diff --git a/tests/evil_hdr-stripes_payload_dmg.xz b/tests/evil_hdr-stripes_payload_dmg.xz new file mode 100644 index 0000000..dc91556 Binary files /dev/null and b/tests/evil_hdr-stripes_payload_dmg.xz differ diff --git a/tests/generators/generate-luks2-area-in-json-hdr-space-json0.img.sh b/tests/generators/generate-luks2-area-in-json-hdr-space-json0.img.sh new file mode 100755 index 0000000..3938f7b --- /dev/null +++ b/tests/generators/generate-luks2-area-in-json-hdr-space-json0.img.sh @@ -0,0 +1,72 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with one area accessing luks +# header space +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # make area 7 access the luks2 header space + OFFS=$((2*LUKS2_HDR_SIZE*512-1)) + LEN=1 + json_str=$(jq -c --arg off $OFFS --arg len $LEN \ + '.keyslots."0".area.offset = $off | .keyslots."0".area.size = $len' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c --arg off $OFFS --arg len $LEN \ + 'if (.keyslots."0".area.offset != $off) or (.keyslots."0".area.size != $len) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-argon2-leftover-params.img.sh b/tests/generators/generate-luks2-argon2-leftover-params.img.sh new file mode 100755 index 0000000..7f003a0 --- /dev/null +++ b/tests/generators/generate-luks2-argon2-leftover-params.img.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with luks2 keyslot kdf object +# having left over params. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # add keyslot 1 to second digest + obj_len=$(jq -c -M '.keyslots."1".kdf | length' $TMPDIR/json0) + json_str=$(jq -r -c -M '.keyslots."1".kdf.type = "pbkdf2" | .keyslots."1".kdf.iterations = 1001 | .keyslots."1".kdf.hash = "sha256"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_obj_len=$(jq -c -M '.keyslots."1".kdf | length' $TMPDIR/json_res0) + test $((obj_len+2)) -eq $new_obj_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-correct-full-json0.img.sh b/tests/generators/generate-luks2-correct-full-json0.img.sh new file mode 100755 index 0000000..f32f84b --- /dev/null +++ b/tests/generators/generate-luks2-correct-full-json0.img.sh @@ -0,0 +1,87 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with correct json of maximal size in primary slot. +# Secondary header is broken on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +PATTERN="\"config\":{" +KEY="\"config_key\":\"" + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_len=${#json_str} + pindex=$(strindex $json_str $PATTERN) + test $pindex -gt 0 || exit 2 + + offset=${#PATTERN} + offset=$((offset+pindex)) + key_len=${#KEY} + remain=$((LUKS2_JSON_SIZE*512-json_len-key_len-2)) # -2: closing '"' and terminating '\0' + if [ ${json_str:offset:1} = "}" ]; then + format_str="%s%s%s" + else + format_str="%s%s,%s" + remain=$((remain-1)) # also count with separating ',' + fi + test $remain -gt 0 || exit 2 + + fill=$(repeat_str "X" $remain)"\"" + + printf $format_str $KEY $fill ${json_str:$offset} | _dd of=$TMPDIR/json0 bs=1 seek=$offset conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + #json_str_res0=$(< $TMPDIR/json_res0) + read -r json_str_res0 < $TMPDIR/json_res0 + test ${#json_str_res0} -eq $((LUKS2_JSON_SIZE*512-1)) || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-corrupted-hdr0-with-correct-chks.img.sh b/tests/generators/generate-luks2-corrupted-hdr0-with-correct-chks.img.sh new file mode 100755 index 0000000..3d4f729 --- /dev/null +++ b/tests/generators/generate-luks2-corrupted-hdr0-with-correct-chks.img.sh @@ -0,0 +1,65 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with malformed json but correct checksum in primary header +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_len=${#json_str} + json_len=$((json_len-1)) # to replace json closing '}' + json_new_str="${json_str:0:json_len},\"" + + while [ ${#json_new_str} -le $((LUKS2_JSON_SIZE*512)) ]; do + json_new_str=$json_new_str"all_work_and_no_play_makes_Jack_a_dull_boy_" + done + + printf "%s" $json_new_str | _dd of=$TMPDIR/json0 bs=512 count=$LUKS2_JSON_SIZE + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG +} + +function check() +{ + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + read -r json_str_res0 < $TMPDIR/json_res0 + test ${#json_str_res0} -eq $((LUKS2_JSON_SIZE*512)) || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-corrupted-hdr1-with-correct-chks.img.sh b/tests/generators/generate-luks2-corrupted-hdr1-with-correct-chks.img.sh new file mode 100755 index 0000000..026393c --- /dev/null +++ b/tests/generators/generate-luks2-corrupted-hdr1-with-correct-chks.img.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with malformed json but correct checksum in secondary header +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json1 $TGT_IMG $TMPDIR/json1 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json1 + json_len=${#json_str} + json_len=$((json_len-1)) # to replace json closing '}' + json_new_str="${json_str:0:json_len},\"" + + while [ ${#json_new_str} -le $((LUKS2_JSON_SIZE*512)) ]; do + json_new_str=$json_new_str"all_work_and_no_play_makes_Jack_a_dull_boy_" + done + + printf "%s" $json_new_str | _dd of=$TMPDIR/json1 bs=512 count=$LUKS2_JSON_SIZE + + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json1 $TMPDIR/area1 + erase_checksum $TMPDIR/area1 + chks1=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks1 $TMPDIR/area1 + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + chks_res1=$(read_sha256_checksum $TMPDIR/hdr_res1) + test "$chks1" = "$chks_res1" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 + read -r json_str_res1 < $TMPDIR/json_res1 + test ${#json_str_res1} -eq $((LUKS2_JSON_SIZE*512)) || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-checksum-both-hdrs.img.sh b/tests/generators/generate-luks2-invalid-checksum-both-hdrs.img.sh new file mode 100755 index 0000000..be98722 --- /dev/null +++ b/tests/generators/generate-luks2-invalid-checksum-both-hdrs.img.sh @@ -0,0 +1,52 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with bad checksum in both binary headerer +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + chks0=$(echo "Arbitrary chosen string: D'oh!" | calc_sha256_checksum_stdin) + chks1=$(echo "D'oh!: arbitrary chosen string" | calc_sha256_checksum_stdin) + write_checksum $chks0 $TGT_IMG + write_checksum $chks1 $TMPDIR/hdr1 + write_luks2_bin_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + chks_res0=$(read_sha256_checksum $TGT_IMG) + chks_res1=$(read_sha256_checksum $TMPDIR/hdr1) + test "$chks0" = "$chks_res0" || exit 2 + test "$chks1" = "$chks_res1" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-checksum-hdr0.img.sh b/tests/generators/generate-luks2-invalid-checksum-hdr0.img.sh new file mode 100755 index 0000000..ac75ccb --- /dev/null +++ b/tests/generators/generate-luks2-invalid-checksum-hdr0.img.sh @@ -0,0 +1,43 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with bad checksum in primary binary header +# + +# 1 full target dir +# 2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG +} + +function generate() +{ + chks=$(echo "Arbitrary chosen string: D'oh!" | calc_sha256_checksum_stdin) + write_checksum $chks $TGT_IMG +} + +function check() +{ + chks_res=$(read_sha256_checksum $TGT_IMG) + test "$chks" = "$chks_res" || exit 2 +} + +#function cleanup() +#{ +#} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +#cleanup diff --git a/tests/generators/generate-luks2-invalid-checksum-hdr1.img.sh b/tests/generators/generate-luks2-invalid-checksum-hdr1.img.sh new file mode 100755 index 0000000..f0ca01a --- /dev/null +++ b/tests/generators/generate-luks2-invalid-checksum-hdr1.img.sh @@ -0,0 +1,48 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate header with bad checksum in secondary binary header +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + chks=$(echo "Arbitrary chosen string: D'oh!" | calc_sha256_checksum_stdin) + write_checksum $chks $TMPDIR/hdr1 + write_luks2_bin_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + chks_res=$(read_sha256_checksum $TMPDIR/hdr1) + test "$chks" = "$chks_res" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-json-size-c0.img.sh b/tests/generators/generate-luks2-invalid-json-size-c0.img.sh new file mode 100755 index 0000000..2866b0b --- /dev/null +++ b/tests/generators/generate-luks2-invalid-json-size-c0.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with invalid json_size in config section +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + JS=$(((LUKS2_HDR_SIZE-LUKS2_BIN_HDR_SIZE)*512+4096)) + json_str=$(jq -c --arg js $JS '.config.json_size = ($js | tostring)' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c --arg js $JS 'if .config.json_size != ($js | tostring ) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-json-size-c1.img.sh b/tests/generators/generate-luks2-invalid-json-size-c1.img.sh new file mode 100755 index 0000000..dcab9bc --- /dev/null +++ b/tests/generators/generate-luks2-invalid-json-size-c1.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with invalid json_size in config section +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + JS=$(((LUKS2_HDR_SIZE-LUKS2_BIN_HDR_SIZE)*512-4096)) + json_str=$(jq -c --arg js $JS '.config.json_size = ($js | tostring)' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c --arg js $JS 'if .config.json_size != ($js | tostring ) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-json-size-c2.img.sh b/tests/generators/generate-luks2-invalid-json-size-c2.img.sh new file mode 100755 index 0000000..6de411a --- /dev/null +++ b/tests/generators/generate-luks2-invalid-json-size-c2.img.sh @@ -0,0 +1,85 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with config json size mismatching +# value in binary header +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + JS=$(((LUKS2_HDR_SIZE-LUKS2_BIN_HDR_SIZE)*512)) + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_32K + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + + json_str=$(jq -c '.' $TMPDIR/json0) + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 + local str_res1=$(head -c 4 $TMPDIR/hdr_res0) + test "$str_res1" = "LUKS" || exit 2 + + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 4 $TMPDIR/hdr_res1) + test "$str_res1" = "SKUL" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c --arg js $JS 'if .config.json_size != ( $js | tostring ) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-keyslots-size-c0.img.sh b/tests/generators/generate-luks2-invalid-keyslots-size-c0.img.sh new file mode 100755 index 0000000..c4f002f --- /dev/null +++ b/tests/generators/generate-luks2-invalid-keyslots-size-c0.img.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with too large keyslots_size set in config section +# (iow config.keyslots_size = data_offset - keyslots_offset + 512) +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # make area 7 being included in area 6 + OFFS=$((2*LUKS2_HDR_SIZE*512)) + json_str=$(jq -c --arg off $OFFS '.config.keyslots_size = (.segments."0".offset | tonumber - ($off | tonumber) + 4096 | tostring)' $TMPDIR/json0) + test -n "$json_str" || exit 2 + # [.keyslots[].area.offset | tonumber] | max | tostring ---> max offset in keyslot areas + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c --arg off $OFFS 'if .config.keyslots_size != ( .segments."0".offset | tonumber - ($off | tonumber) + 4096 | tostring ) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-keyslots-size-c1.img.sh b/tests/generators/generate-luks2-invalid-keyslots-size-c1.img.sh new file mode 100755 index 0000000..eff2064 --- /dev/null +++ b/tests/generators/generate-luks2-invalid-keyslots-size-c1.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with unaligned keyslots_size config section +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + json_str=$(jq -c '.config.keyslots_size = (.config.keyslots_size | tonumber - 1 | tostring)' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if (.config.keyslots_size | tonumber % 4096) == 0 + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-keyslots-size-c2.img.sh b/tests/generators/generate-luks2-invalid-keyslots-size-c2.img.sh new file mode 100755 index 0000000..f70f39f --- /dev/null +++ b/tests/generators/generate-luks2-invalid-keyslots-size-c2.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with keyslots_size less than sum of all keyslots area +# in json +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + json_str=$(jq '.config.keyslots_size = ([.keyslots[].area.size] | map(tonumber) | add - 4096 | tostring )' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .config.keyslots_size != ([.keyslots[].area.size ] | map(tonumber) | add - 4096 | tostring) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-object-type-json0.img.sh b/tests/generators/generate-luks2-invalid-object-type-json0.img.sh new file mode 100755 index 0000000..1063864 --- /dev/null +++ b/tests/generators/generate-luks2-invalid-object-type-json0.img.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with well-formed json format +# where top level value is not of type object. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_str="[$json_str]" # make top level value an array + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + printf "%s" "$json_str" | _dd of=$TMPDIR/json0 bs=1 conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + read -r json_str_res0 < $TMPDIR/json_res0 + test "$json_str" = "$json_str_res0" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-invalid-opening-char-json0.img.sh b/tests/generators/generate-luks2-invalid-opening-char-json0.img.sh new file mode 100755 index 0000000..996d997 --- /dev/null +++ b/tests/generators/generate-luks2-invalid-opening-char-json0.img.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with well-formed json prefixed +# with useless whitespace. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_str=" $json_str" # add useless opening whitespace + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + printf "%s" "$json_str" | _dd of=$TMPDIR/json0 bs=1 conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + IFS= read -r json_str_res0 < $TMPDIR/json_res0 + test "$json_str" = "$json_str_res0" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-keyslot-missing-digest.img.sh b/tests/generators/generate-luks2-keyslot-missing-digest.img.sh new file mode 100755 index 0000000..1914581 --- /dev/null +++ b/tests/generators/generate-luks2-keyslot-missing-digest.img.sh @@ -0,0 +1,72 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with luks2 keyslot not assigned +# to any digest. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str_orig < $TMPDIR/json0 + arr_len=$(jq -c -M '.digests."0".keyslots | length' $TMPDIR/json0) + # remove first element from digests."0".keyslots array + json_str=$(jq -r -c -M 'del(.digests."0".keyslots[0])' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_arr_len=$(jq -c -M '.digests."0".keyslots | length' $TMPDIR/json_res0) + test $((arr_len-1)) -eq $new_arr_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-keyslot-too-many-digests.img.sh b/tests/generators/generate-luks2-keyslot-too-many-digests.img.sh new file mode 100755 index 0000000..5e1d6ef --- /dev/null +++ b/tests/generators/generate-luks2-keyslot-too-many-digests.img.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with luks2 keyslot assigned +# to more than 1 digest. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # add keyslot 1 to second digest + json_str=$(jq -r -c -M '.digests."1" = .digests."0" | .digests."1".keyslots = ["1"]' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_arr_len=$(jq -c -M '.digests."1".keyslots | length' $TMPDIR/json_res0) + test 1 -eq $new_arr_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-128k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-128k-secondary.img.sh new file mode 100755 index 0000000..ca6b0c8 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-128k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 128 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_128K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-128k.img.sh b/tests/generators/generate-luks2-metadata-size-128k.img.sh new file mode 100755 index 0000000..fe76598 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-128k.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 128KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_128K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-16k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-16k-secondary.img.sh new file mode 100755 index 0000000..14a6613 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-16k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 16 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-1m-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-1m-secondary.img.sh new file mode 100755 index 0000000..fdcd715 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-1m-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 1 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_1M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-1m.img.sh b/tests/generators/generate-luks2-metadata-size-1m.img.sh new file mode 100755 index 0000000..25722dd --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-1m.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 1 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_1M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-256k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-256k-secondary.img.sh new file mode 100755 index 0000000..0ed66e1 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-256k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 256 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_256K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-256k.img.sh b/tests/generators/generate-luks2-metadata-size-256k.img.sh new file mode 100755 index 0000000..aa5df05 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-256k.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 256KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_256K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-2m-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-2m-secondary.img.sh new file mode 100755 index 0000000..4773c94 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-2m-secondary.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 2 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_2M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-2m.img.sh b/tests/generators/generate-luks2-metadata-size-2m.img.sh new file mode 100755 index 0000000..ae9bc30 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-2m.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 2 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_2M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-32k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-32k-secondary.img.sh new file mode 100755 index 0000000..af18f43 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-32k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 32 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_32K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-32k.img.sh b/tests/generators/generate-luks2-metadata-size-32k.img.sh new file mode 100755 index 0000000..40c921e --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-32k.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with non-default metadata json_size. +# There's only limited set of values allowed as json size in +# config section of LUKS2 metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 32KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_32K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-4m-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-4m-secondary.img.sh new file mode 100755 index 0000000..332d67e --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-4m-secondary.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 4 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_4M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-4m.img.sh b/tests/generators/generate-luks2-metadata-size-4m.img.sh new file mode 100755 index 0000000..21715fb --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-4m.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 4 MiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_4M + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-512k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-512k-secondary.img.sh new file mode 100755 index 0000000..581dea0 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-512k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 512 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_512K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-512k.img.sh b/tests/generators/generate-luks2-metadata-size-512k.img.sh new file mode 100755 index 0000000..8b196e6 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-512k.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 512KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_512K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh new file mode 100755 index 0000000..16e2078 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c0.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with non-default metadata json_size +# and keyslots area trespassing in json area. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024-1)) + # overlap in json area by exactly one byte + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024-1)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh new file mode 100755 index 0000000..7ff670b --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-area-c1.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with non-default metadata json_size +# and keyslot area overflowing out of keyslots area. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .keyslots."7".area.offset = ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots."7".area.size | tonumber) + 1) | tostring ) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE +# .keyslots.7.area.offset = ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots.7.area.size | tonumber) + 1) | tostring ) | + jq -c --arg mda $((2*TEST_MDA_SIZE_BYTES)) --arg jsize $JSON_SIZE \ + 'if (.keyslots."7".area.offset != ( ((.config.keyslots_size | tonumber) + ($mda | tonumber) - (.keyslots."7".area.size | tonumber) + 1) | tostring )) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh b/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh new file mode 100755 index 0000000..8f3d8d7 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-inv-keyslots-size-c0.img.sh @@ -0,0 +1,96 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size where keyslots size +# overflows in data area (segment offset) +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .config.keyslots_size = (((($off | tonumber) - ($mda | tonumber) + 4096)) | tostring ) | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE --arg off $DATA_OFFSET --arg mda $((2*TEST_MDA_SIZE_BYTES)) \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) or + (.config.keyslots_size != (((($off | tonumber) - ($mda | tonumber) + 4096)) | tostring )) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k-secondary.img.sh b/tests/generators/generate-luks2-metadata-size-64k-secondary.img.sh new file mode 100755 index 0000000..1b246cc --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k-secondary.img.sh @@ -0,0 +1,97 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate secondary header with one of allowed json area +# size values. Test whether auto-recovery code is able +# to validate secondary header with non-default json area +# size. +# +# primary header is corrupted on purpose. +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64 KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + write_bin_hdr_offset $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area0 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr_res0 $TEST_MDA_SIZE + local str_res0=$(head -c 6 $TMPDIR/hdr_res0) + test "$str_res0" = "VACUUM" || exit 2 + read_luks2_json1 $TGT_IMG $TMPDIR/json_res1 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res1 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-metadata-size-64k.img.sh b/tests/generators/generate-luks2-metadata-size-64k.img.sh new file mode 100755 index 0000000..4e320f2 --- /dev/null +++ b/tests/generators/generate-luks2-metadata-size-64k.img.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary with predefined json_size. There's only limited +# set of values allowed as json size in config section of LUKS2 +# metadata +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # 64KiB metadata + TEST_MDA_SIZE=$LUKS2_HDR_SIZE_64K + + TEST_MDA_SIZE_BYTES=$((TEST_MDA_SIZE*512)) + TEST_JSN_SIZE=$((TEST_MDA_SIZE-LUKS2_BIN_HDR_SIZE)) + KEYSLOTS_OFFSET=$((TEST_MDA_SIZE*1024)) + JSON_DIFF=$(((TEST_MDA_SIZE-LUKS2_HDR_SIZE)*1024)) + JSON_SIZE=$((TEST_JSN_SIZE*512)) + DATA_OFFSET=16777216 + + json_str=$(jq -c --arg jdiff $JSON_DIFF --arg jsize $JSON_SIZE --arg off $DATA_OFFSET \ + '.keyslots[].area.offset |= ( . | tonumber + ($jdiff | tonumber) | tostring) | + .config.json_size = $jsize | + .segments."0".offset = $off' $TMPDIR/json0) + test -n "$json_str" || exit 2 + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 $TEST_JSN_SIZE + + write_bin_hdr_size $TMPDIR/hdr0 $TEST_MDA_SIZE_BYTES + write_bin_hdr_size $TMPDIR/hdr1 $TEST_MDA_SIZE_BYTES + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 $TEST_JSN_SIZE + merge_bin_hdr_with_json $TMPDIR/hdr1 $TMPDIR/json0 $TMPDIR/area1 $TEST_JSN_SIZE + + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + + erase_checksum $TMPDIR/area1 + chks0=$(calc_sha256_checksum_file $TMPDIR/area1) + write_checksum $chks0 $TMPDIR/area1 + + kill_bin_hdr $TMPDIR/area1 + + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG $TEST_MDA_SIZE + write_luks2_hdr1 $TMPDIR/area1 $TGT_IMG $TEST_MDA_SIZE +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 $TEST_MDA_SIZE + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 $TEST_JSN_SIZE + jq -c --arg koff $KEYSLOTS_OFFSET --arg jsize $JSON_SIZE \ + 'if ([.keyslots[].area.offset] | map(tonumber) | min | tostring != $koff) or + (.config.json_size != $jsize) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-missing-keyslot-referenced-in-digest.img.sh b/tests/generators/generate-luks2-missing-keyslot-referenced-in-digest.img.sh new file mode 100755 index 0000000..d6ebe3d --- /dev/null +++ b/tests/generators/generate-luks2-missing-keyslot-referenced-in-digest.img.sh @@ -0,0 +1,74 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with missing keyslot object referenced +# in digest object +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str_orig < $TMPDIR/json0 + arr_len=$(jq -c -M '.digests."0".keyslots | length' $TMPDIR/json0) + # add missing keyslot reference in keyslots array of digest '0' + json_str=$(jq -r -c -M 'def arr: ["digests", "0", "keyslots"]; + def missks: getpath(["keyslots"]) | keys | max | tonumber + 1 | tostring; + setpath(arr; getpath(arr) + [ missks ])' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_arr_len=$(jq -c -M '.digests."0".keyslots | length' $TMPDIR/json_res0) + test $((arr_len+1)) -eq $new_arr_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-missing-keyslot-referenced-in-token.img.sh b/tests/generators/generate-luks2-missing-keyslot-referenced-in-token.img.sh new file mode 100755 index 0000000..85798e5 --- /dev/null +++ b/tests/generators/generate-luks2-missing-keyslot-referenced-in-token.img.sh @@ -0,0 +1,72 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with missing keyslot object referenced +# in token object +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str_orig < $TMPDIR/json0 + # add missing keyslot reference in keyslots array of token '0' + json_str=$(jq -r -c -M 'def missks: getpath(["keyslots"]) | keys | max | tonumber + 1 | tostring; + .tokens += {"0":{"type":"dummy","keyslots":[ "0", missks ]}}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_arr_len=$(jq -c -M '.tokens."0".keyslots | length' $TMPDIR/json_res0) + test $new_arr_len -eq 2 || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-missing-segment-referenced-in-digest.img.sh b/tests/generators/generate-luks2-missing-segment-referenced-in-digest.img.sh new file mode 100755 index 0000000..333462b --- /dev/null +++ b/tests/generators/generate-luks2-missing-segment-referenced-in-digest.img.sh @@ -0,0 +1,74 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with missing segment object referenced +# in digest object +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str_orig < $TMPDIR/json0 + arr_len=$(jq -c -M '.digests."0".segments | length' $TMPDIR/json0) + # add missing keyslot reference in keyslots array of digest '0' + json_str=$(jq -c 'def arr: ["digests", "0", "segments"]; + def missseg: getpath(["segments"]) | keys | max | tonumber + 1 | tostring; + setpath(arr; getpath(arr) + [ missseg ])' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_arr_len=$(jq -c -M '.digests."0".segments | length' $TMPDIR/json_res0) + test $((arr_len+1)) -eq $new_arr_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-missing-trailing-null-byte-json0.img.sh b/tests/generators/generate-luks2-missing-trailing-null-byte-json0.img.sh new file mode 100755 index 0000000..916cff7 --- /dev/null +++ b/tests/generators/generate-luks2-missing-trailing-null-byte-json0.img.sh @@ -0,0 +1,89 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with well-formed json but missing +# trailing null byte. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +PATTERN="\"config\":{" +KEY="\"config_key\":\"" + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_len=${#json_str} + pindex=$(strindex $json_str $PATTERN) + test $pindex -gt 0 || exit 2 + + offset=${#PATTERN} + offset=$((offset+pindex)) + key_len=${#KEY} + remain=$((LUKS2_JSON_SIZE*512-key_len-json_len-1)) # -1: closing '"' + if [ ${json_str:offset:1} = "}" ]; then + format_str="%s%s%s" + else + format_str="%s%s,%s" + remain=$((remain-1)) # also count with separating ',' + fi + test $remain -gt 0 || exit 2 + + fill=$(repeat_str "X" $remain) + fill=$(repeat_str "X" $remain)"\"" + + printf $format_str $KEY $fill ${json_str:$offset} | _dd of=$TMPDIR/json0 bs=1 seek=$offset conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + read -r json_str_res0 < $TMPDIR/json_res0 + test ${#json_str_res0} -eq $((LUKS2_JSON_SIZE*512)) || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-non-null-byte-beyond-json0.img.sh b/tests/generators/generate-luks2-non-null-byte-beyond-json0.img.sh new file mode 100755 index 0000000..fbd8cd6 --- /dev/null +++ b/tests/generators/generate-luks2-non-null-byte-beyond-json0.img.sh @@ -0,0 +1,72 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with json area concluded with illegal +# byte beyond terminating '}' character. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_str="$json_str"X # add illegal 'X' beyond json format + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + printf '%s' $json_str | _dd of=$TMPDIR/json0 bs=1 conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + read -r json_str_res0 < $TMPDIR/json_res0 + local len=${#json_str_res0} + len=$((len-1)) + test ${json_str_res0:len:1} = "X" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-non-null-bytes-beyond-json0.img.sh b/tests/generators/generate-luks2-non-null-bytes-beyond-json0.img.sh new file mode 100755 index 0000000..7d46628 --- /dev/null +++ b/tests/generators/generate-luks2-non-null-bytes-beyond-json0.img.sh @@ -0,0 +1,76 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with json area containing illegal bytes +# beyond well-formed json format. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +QUOTE="[Homer J. Simpson]: Keep looking shocked and move slowly towards the cake." +SPACE=20 + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + read -r json_str < $TMPDIR/json0 + json_len_orig=${#json_str} + json_len=$((json_len_orig+${#QUOTE}+SPACE)) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + printf '%s' "$QUOTE" | _dd of=$TMPDIR/json0 seek=$((json_len_orig+SPACE)) bs=1 conv=notrunc + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + + _dd if=$TMPDIR/json_res0 of=$TMPDIR/quote skip=$((json_len_orig+SPACE)) count=${#QUOTE} bs=1 + json_str_res0=$(head -c ${#QUOTE} $TMPDIR/quote) + test "$json_str_res0" = "$QUOTE" || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-overlapping-areas-c0-json0.img.sh b/tests/generators/generate-luks2-overlapping-areas-c0-json0.img.sh new file mode 100755 index 0000000..c319ca3 --- /dev/null +++ b/tests/generators/generate-luks2-overlapping-areas-c0-json0.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with two exactly same areas in terms of 'offset' and 'length'. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # copy area 6 offset and length into area 7 + json_str=$(jq -c '.keyslots."7".area.offset = .keyslots."6".area.offset | + .keyslots."7".area.size = .keyslots."6".area.size' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if (.keyslots."6".area.offset != .keyslots."7".area.offset) or (.keyslots."6".area.size != .keyslots."7".area.size) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-overlapping-areas-c1-json0.img.sh b/tests/generators/generate-luks2-overlapping-areas-c1-json0.img.sh new file mode 100755 index 0000000..39f0c6a --- /dev/null +++ b/tests/generators/generate-luks2-overlapping-areas-c1-json0.img.sh @@ -0,0 +1,70 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with one area included within another one (in terms of 'offset' + 'length') +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # make area 7 being included in area 6 + json_str=$(jq -c '.keyslots."7".area.offset = (.keyslots."6".area.offset | tonumber + 1 | tostring ) | + .keyslots."7".area.size = ( .keyslots."6".area.size | tonumber - 1 | tostring)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if (.keyslots."7".area.offset != (.keyslots."6".area.offset | tonumber + 1 | tostring)) or + (.keyslots."7".area.size != (.keyslots."6".area.size | tonumber - 1 | tostring)) or + (.keyslots."7".area.size | tonumber <= 0) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-overlapping-areas-c2-json0.img.sh b/tests/generators/generate-luks2-overlapping-areas-c2-json0.img.sh new file mode 100755 index 0000000..4c02008 --- /dev/null +++ b/tests/generators/generate-luks2-overlapping-areas-c2-json0.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with one area slightly cross the boundary of another one +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # make area 7 being included in area 6 + json_str=$(jq -c '.keyslots."7".area.offset = ([ .keyslots."6".area.offset, .keyslots."6".area.size ] | map(tonumber) | add - 1 | tostring)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .keyslots."7".area.offset != ([.keyslots."6".area.offset, .keyslots."6".area.size ] | map(tonumber) | add - 1 | tostring) + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-pbkdf2-leftover-params-0.img.sh b/tests/generators/generate-luks2-pbkdf2-leftover-params-0.img.sh new file mode 100755 index 0000000..1517ed6 --- /dev/null +++ b/tests/generators/generate-luks2-pbkdf2-leftover-params-0.img.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with luks2 keyslot kdf object +# having left over params. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # add keyslot 1 to second digest + obj_len=$(jq -c -M '.keyslots."2".kdf | length' $TMPDIR/json0) + json_str=$(jq -r -c -M '.keyslots."2".kdf.type = "argon2i" | .keyslots."2".kdf.iterations = 1001 | .keyslots."2".kdf.hash = "sha256"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_obj_len=$(jq -c -M '.keyslots."2".kdf | length' $TMPDIR/json_res0) + test $((obj_len+2)) -eq $new_obj_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-pbkdf2-leftover-params-1.img.sh b/tests/generators/generate-luks2-pbkdf2-leftover-params-1.img.sh new file mode 100755 index 0000000..c6aa5bf --- /dev/null +++ b/tests/generators/generate-luks2-pbkdf2-leftover-params-1.img.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with luks2 keyslot kdf object +# having left over params. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # add keyslot 1 to second digest + obj_len=$(jq -c -M '.keyslots."2".kdf | length' $TMPDIR/json0) + json_str=$(jq -r -c -M '.keyslots."2".kdf.type = "argon2id" | .keyslots."2".kdf.iterations = 1001 | .keyslots."2".kdf.hash = "sha256"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + chks_res0=$(read_sha256_checksum $TGT_IMG) + test "$chks0" = "$chks_res0" || exit 2 + new_obj_len=$(jq -c -M '.keyslots."2".kdf | length' $TMPDIR/json_res0) + test $((obj_len+2)) -eq $new_obj_len || exit 2 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-missing-encryption.img.sh b/tests/generators/generate-luks2-segment-crypt-missing-encryption.img.sh new file mode 100755 index 0000000..bcd648a --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-missing-encryption.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment encryption field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".encryption)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".encryption + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-missing-ivoffset.img.sh b/tests/generators/generate-luks2-segment-crypt-missing-ivoffset.img.sh new file mode 100755 index 0000000..e64feef --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-missing-ivoffset.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment iv_tweak field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".iv_tweak)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".iv_tweak + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-missing-sectorsize.img.sh b/tests/generators/generate-luks2-segment-crypt-missing-sectorsize.img.sh new file mode 100755 index 0000000..de757db --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-missing-sectorsize.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment sector_size field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".sector_size)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".sector_size + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-wrong-encryption.img.sh b/tests/generators/generate-luks2-segment-crypt-wrong-encryption.img.sh new file mode 100755 index 0000000..59c7345 --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-wrong-encryption.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment wrong encryption field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".encryption = {}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".encryption | type != "object" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-wrong-ivoffset.img.sh b/tests/generators/generate-luks2-segment-crypt-wrong-ivoffset.img.sh new file mode 100755 index 0000000..ca9461e --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-wrong-ivoffset.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment iv_tweak field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".iv_tweak = "dynamic"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".iv_tweak != "dynamic" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-0.img.sh b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-0.img.sh new file mode 100755 index 0000000..4ca05eb --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-0.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment sector_size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".sector_size = 1023' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".sector_size != 1023 + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-1.img.sh b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-1.img.sh new file mode 100755 index 0000000..f8d251c --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-1.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment sector_size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".sector_size = "4096"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".sector_size != "4096" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-2.img.sh b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-2.img.sh new file mode 100755 index 0000000..87566ec --- /dev/null +++ b/tests/generators/generate-luks2-segment-crypt-wrong-sectorsize-2.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment sector_size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".sector_size = -1024' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".sector_size != -1024 + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-missing-offset.img.sh b/tests/generators/generate-luks2-segment-missing-offset.img.sh new file mode 100755 index 0000000..6652288 --- /dev/null +++ b/tests/generators/generate-luks2-segment-missing-offset.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment offset field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".offset)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".offset + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-missing-size.img.sh b/tests/generators/generate-luks2-segment-missing-size.img.sh new file mode 100755 index 0000000..616d8b3 --- /dev/null +++ b/tests/generators/generate-luks2-segment-missing-size.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment size field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".size)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-missing-type.img.sh b/tests/generators/generate-luks2-segment-missing-type.img.sh new file mode 100755 index 0000000..d0014a2 --- /dev/null +++ b/tests/generators/generate-luks2-segment-missing-type.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment type field missing +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c 'del(.segments."0".type)' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".type + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-two.img.sh b/tests/generators/generate-luks2-segment-two.img.sh new file mode 100755 index 0000000..743bbbb --- /dev/null +++ b/tests/generators/generate-luks2-segment-two.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with two segments +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".size = "512" | .segments."1" = {type:"some", offset: (.segments."0".offset | tonumber + 512 | tostring), size: "dynamic"}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."1" | type != "object" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-unknown-type.img.sh b/tests/generators/generate-luks2-segment-unknown-type.img.sh new file mode 100755 index 0000000..a6ef8ad --- /dev/null +++ b/tests/generators/generate-luks2-segment-unknown-type.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with generic (unknown) segment type. +# It should pass the validation. +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0" = {type:"some_type", offset: .segments."0".offset, size: .segments."0".size, a_field:0}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".type != "some_type" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-backup-key-0.img.sh b/tests/generators/generate-luks2-segment-wrong-backup-key-0.img.sh new file mode 100755 index 0000000..2499a5e --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-backup-key-0.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong backup segment id +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # create illegal backup segment key (used to be bug in 32bit implementations) + json_str=$(jq -c '.segments[(.segments | length + 1 | tostring)] = { "type" : "linear", "offset" : "512", "size" : "512", "flags":["backup-x"]}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments | length < 2 + then error("Unexpected segments count") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-backup-key-1.img.sh b/tests/generators/generate-luks2-segment-wrong-backup-key-1.img.sh new file mode 100755 index 0000000..702fe71 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-backup-key-1.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong backup segment id +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # create illegal backup segment key (used to be bug in 32bit implementations) + json_str=$(jq -c '(.segments."0".offset | tonumber) as $i | .segments[range(1;65) | tostring] = { "type" : "linear", "offset" : ($i + 512 | tostring), "size" : "512" } | .segments."268435472" = { "type":"linear","offset":"512","size":"512","flags":["backup-x"]}' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments | length < 64 + then error("Unexpected segments count") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-flags-element.img.sh b/tests/generators/generate-luks2-segment-wrong-flags-element.img.sh new file mode 100755 index 0000000..5359954 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-flags-element.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment flags containing invalid type +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".flags = [ "hello", 1 ]' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".flags != [ "hello", 1 ] + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-flags.img.sh b/tests/generators/generate-luks2-segment-wrong-flags.img.sh new file mode 100755 index 0000000..3ceddbf --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-flags.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment flags field of invalid type +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".flags = "hello"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".flags != "hello" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-offset.img.sh b/tests/generators/generate-luks2-segment-wrong-offset.img.sh new file mode 100755 index 0000000..9efc756 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-offset.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment offset field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".offset = "-42"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".offset != "-42" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-size-0.img.sh b/tests/generators/generate-luks2-segment-wrong-size-0.img.sh new file mode 100755 index 0000000..58b12ef --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-size-0.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".size = 4096' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != 4096 + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-size-1.img.sh b/tests/generators/generate-luks2-segment-wrong-size-1.img.sh new file mode 100755 index 0000000..8171445 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-size-1.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".size = "automatic"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != "automatic" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-size-2.img.sh b/tests/generators/generate-luks2-segment-wrong-size-2.img.sh new file mode 100755 index 0000000..f694cf7 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-size-2.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment size field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".size = "511"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != "511" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-segment-wrong-type.img.sh b/tests/generators/generate-luks2-segment-wrong-type.img.sh new file mode 100755 index 0000000..4f7fd64 --- /dev/null +++ b/tests/generators/generate-luks2-segment-wrong-type.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with wrong segment type field +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # remove mandatory encryption field + json_str=$(jq -c '.segments."0".type = 42' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".type != 42 + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-uint64-max-segment-size.img.sh b/tests/generators/generate-luks2-uint64-max-segment-size.img.sh new file mode 100755 index 0000000..27d7fd2 --- /dev/null +++ b/tests/generators/generate-luks2-uint64-max-segment-size.img.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment size set to UINT64_MAX - 511 +# (512 sector aligned value) +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # UINT64_MAX - 511 (so that it's sector aligned) + json_str=$(jq -c '.segments."0".size = "18446744073709551104"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != "18446744073709551104" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-uint64-overflow-segment-size.img.sh b/tests/generators/generate-luks2-uint64-overflow-segment-size.img.sh new file mode 100755 index 0000000..01657d6 --- /dev/null +++ b/tests/generators/generate-luks2-uint64-overflow-segment-size.img.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment size set to UINT64_MAX + 1 +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + json_str=$(jq -c '.segments."0".size = "18446744073709551616"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != "18446744073709551616" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/generate-luks2-uint64-signed-segment-size.img.sh b/tests/generators/generate-luks2-uint64-signed-segment-size.img.sh new file mode 100755 index 0000000..0a45a05 --- /dev/null +++ b/tests/generators/generate-luks2-uint64-signed-segment-size.img.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +. lib.sh + +# +# *** Description *** +# +# generate primary header with segment size set to -512 +# +# secondary header is corrupted on purpose as well +# + +# $1 full target dir +# $2 full source luks2 image + +function prepare() +{ + cp $SRC_IMG $TGT_IMG + test -d $TMPDIR || mkdir $TMPDIR + read_luks2_json0 $TGT_IMG $TMPDIR/json0 + read_luks2_bin_hdr0 $TGT_IMG $TMPDIR/hdr0 + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr1 +} + +function generate() +{ + # UINT64_MAX + 1 (it's 512 sector aligned) + json_str=$(jq -c '.segments."0".size = "-512"' $TMPDIR/json0) + test ${#json_str} -lt $((LUKS2_JSON_SIZE*512)) || exit 2 + + write_luks2_json "$json_str" $TMPDIR/json0 + + merge_bin_hdr_with_json $TMPDIR/hdr0 $TMPDIR/json0 $TMPDIR/area0 + erase_checksum $TMPDIR/area0 + chks0=$(calc_sha256_checksum_file $TMPDIR/area0) + write_checksum $chks0 $TMPDIR/area0 + write_luks2_hdr0 $TMPDIR/area0 $TGT_IMG + kill_bin_hdr $TMPDIR/hdr1 + write_luks2_hdr1 $TMPDIR/hdr1 $TGT_IMG +} + +function check() +{ + read_luks2_bin_hdr1 $TGT_IMG $TMPDIR/hdr_res1 + local str_res1=$(head -c 6 $TMPDIR/hdr_res1) + test "$str_res1" = "VACUUM" || exit 2 + + read_luks2_json0 $TGT_IMG $TMPDIR/json_res0 + jq -c 'if .segments."0".size != "-512" + then error("Unexpected value in result json") else empty end' $TMPDIR/json_res0 || exit 5 +} + +function cleanup() +{ + rm -f $TMPDIR/* + rm -fd $TMPDIR +} + +test $# -eq 2 || exit 1 + +TGT_IMG=$1/$(test_img_name $0) +SRC_IMG=$2 + +prepare +generate +check +cleanup diff --git a/tests/generators/lib.sh b/tests/generators/lib.sh new file mode 100644 index 0000000..9686148 --- /dev/null +++ b/tests/generators/lib.sh @@ -0,0 +1,180 @@ +#!/bin/bash + +# all in 512 bytes blocks (including binary hdr (4KiB)) +LUKS2_HDR_SIZE=32 # 16 KiB +LUKS2_HDR_SIZE_32K=64 # 32 KiB +LUKS2_HDR_SIZE_64K=128 # 64 KiB +LUKS2_HDR_SIZE_128K=256 # 128 KiB +LUKS2_HDR_SIZE_256K=512 # 256 KiB +LUKS2_HDR_SIZE_512K=1024 # 512 KiB +LUKS2_HDR_SIZE_1M=2048 # 1 MiB +LUKS2_HDR_SIZE_2M=4096 # 2 MiB +LUKS2_HDR_SIZE_4M=8192 # 4 MiB + +LUKS2_BIN_HDR_SIZE=8 # 4 KiB +LUKS2_JSON_SIZE=$((LUKS2_HDR_SIZE-LUKS2_BIN_HDR_SIZE)) + +LUKS2_BIN_HDR_CHKS_OFFSET=0x1C0 +LUKS2_BIN_HDR_CHKS_LENGTH=64 + +[ -z "$srcdir" ] && srcdir="." +TMPDIR=$srcdir/tmp + +repeat_str() { + printf "$1"'%.0s' $(eval "echo {1.."$(($2))"}"); +} + +function strindex() +{ + local x="${1%%$2*}" + [[ $x = $1 ]] && echo -1 || echo ${#x} +} + +function test_img_name() +{ + local str=$(basename $1) + str=${str#generate-} + str=${str%%.sh} + echo $str +} + +# read primary bin hdr +# 1:from 2:to +function read_luks2_bin_hdr0() +{ + _dd if=$1 of=$2 bs=512 count=$LUKS2_BIN_HDR_SIZE +} + +# read primary json area +# 1:from 2:to 3:[json only size (defaults to 12KiB)] +function read_luks2_json0() +{ + local _js=${4:-$LUKS2_JSON_SIZE} + local _js=$((_js*512/4096)) + _dd if=$1 of=$2 bs=4096 skip=1 count=$_js +} + +# read secondary bin hdr +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function read_luks2_bin_hdr1() +{ + _dd if=$1 of=$2 skip=${3:-$LUKS2_HDR_SIZE} bs=512 count=$LUKS2_BIN_HDR_SIZE +} + +# read secondary json area +# 1:from 2:to 3:[json only size (defaults to 12KiB)] +function read_luks2_json1() +{ + local _js=${3:-$LUKS2_JSON_SIZE} + _dd if=$1 of=$2 bs=512 skip=$((2*LUKS2_BIN_HDR_SIZE+_js)) count=$_js +} + +# read primary metadata area (bin + json) +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function read_luks2_hdr_area0() +{ + local _as=${3:-$LUKS2_HDR_SIZE} + local _as=$((_as*512)) + _dd if=$1 of=$2 bs=$_as count=1 +} + +# read secondary metadata area (bin + json) +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function read_luks2_hdr_area1() +{ + local _as=${3:-$LUKS2_HDR_SIZE} + local _as=$((_as*512)) + _dd if=$1 of=$2 bs=$_as skip=1 count=1 +} + +# write secondary bin hdr +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function write_luks2_bin_hdr1() +{ + _dd if=$1 of=$2 bs=512 seek=${3:-$LUKS2_HDR_SIZE} count=$LUKS2_BIN_HDR_SIZE conv=notrunc +} + +# write primary metadata area (bin + json) +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function write_luks2_hdr0() +{ + local _as=${3:-$LUKS2_HDR_SIZE} + local _as=$((_as*512)) + _dd if=$1 of=$2 bs=$_as count=1 conv=notrunc +} + +# write secondary metadata area (bin + json) +# 1:from 2:to 3:[metadata size (defaults to 16KiB)] +function write_luks2_hdr1() +{ + local _as=${3:-$LUKS2_HDR_SIZE} + local _as=$((_as*512)) + _dd if=$1 of=$2 bs=$_as seek=1 count=1 conv=notrunc +} + +# write json (includes padding) +# 1:json_string 2:to 3:[json size (defaults to 12KiB)] +function write_luks2_json() +{ + local _js=${3:-$LUKS2_JSON_SIZE} + local len=${#1} + echo -n -E "$1" > $2 + truncate -s $((_js*512)) $2 +} + +function kill_bin_hdr() +{ + printf "VACUUM" | _dd of=$1 bs=1 conv=notrunc +} + +function erase_checksum() +{ + _dd if=/dev/zero of=$1 bs=1 seek=$(printf %d $LUKS2_BIN_HDR_CHKS_OFFSET) count=$LUKS2_BIN_HDR_CHKS_LENGTH conv=notrunc +} + +function read_sha256_checksum() +{ + _dd if=$1 bs=1 skip=$(printf %d $LUKS2_BIN_HDR_CHKS_OFFSET) count=32 | xxd -c 32 -p +} + +# 1 - string with checksum +function write_checksum() +{ + test $# -eq 2 || return 1 + test $((${#1}/2)) -le $LUKS2_BIN_HDR_CHKS_LENGTH || { echo "too long"; return 1; } + + echo $1 | xxd -r -p | _dd of=$2 bs=1 seek=$(printf %d $LUKS2_BIN_HDR_CHKS_OFFSET) conv=notrunc +} + +function calc_sha256_checksum_file() +{ + sha256sum $1 | cut -d ' ' -f 1 +} + +function calc_sha256_checksum_stdin() +{ + sha256sum - | cut -d ' ' -f 1 +} + +# merge bin hdr with json to form metadata area +# 1:bin_hdr 2:json 3:to 4:[json size (defaults to 12KiB)] +function merge_bin_hdr_with_json() +{ + local _js=${4:-$LUKS2_JSON_SIZE} + local _js=$((_js*512/4096)) + _dd if=$1 of=$3 bs=4096 count=1 + _dd if=$2 of=$3 bs=4096 seek=1 count=$_js +} + +function _dd() +{ + dd $@ status=none +} + +function write_bin_hdr_size() { + printf '%016x' $2 | xxd -r -p -l 16 | _dd of=$1 bs=8 count=1 seek=1 conv=notrunc +} + +function write_bin_hdr_offset() { + printf '%016x' $2 | xxd -r -p -l 16 | _dd of=$1 bs=8 count=1 seek=32 conv=notrunc +} diff --git a/tests/img_fs_ext4.img.xz b/tests/img_fs_ext4.img.xz new file mode 100644 index 0000000..de688f0 Binary files /dev/null and b/tests/img_fs_ext4.img.xz differ diff --git a/tests/img_fs_vfat.img.xz b/tests/img_fs_vfat.img.xz new file mode 100644 index 0000000..5ecfa67 Binary files /dev/null and b/tests/img_fs_vfat.img.xz differ diff --git a/tests/img_fs_xfs.img.xz b/tests/img_fs_xfs.img.xz new file mode 100644 index 0000000..a7034a7 Binary files /dev/null and b/tests/img_fs_xfs.img.xz differ diff --git a/tests/integrity-compat-test b/tests/integrity-compat-test new file mode 100755 index 0000000..a3d3b8c --- /dev/null +++ b/tests/integrity-compat-test @@ -0,0 +1,484 @@ +#!/bin/bash +# +# Test integritysetup compatibility. +# +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +INTSETUP=$CRYPTSETUP_PATH/integritysetup + +INTSETUP_VALGRIND=../.libs/integritysetup +INTSETUP_LIB_VALGRIND=../.libs + +DEV_NAME=dmc_test +DEV_NAME_BIG=dmc_fake +DEV_LOOP="" +DEV=test123.img +DEV2=test124.img +KEY_FILE=key.img +KEY_FILE2=key2.img + +dmremove() { # device + udevadm settle >/dev/null 2>&1 + dmsetup remove --retry $1 >/dev/null 2>&1 +} + +cleanup() { + [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME + [ -b /dev/mapper/$DEV_NAME_BIG ] && dmremove $DEV_NAME_BIG + [ -n "$DEV_LOOP" ] && losetup -d "$DEV_LOOP" + DEV_LOOP="" + rm -f $DEV $DEV2 $KEY_FILE $KEY_FILE2 >/dev/null 2>&1 +} + +fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup + exit 100 +} + +skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function dm_integrity_features() +{ + VER_STR=$(dmsetup targets | grep integrity | cut -f2 -dv) + [ -z "$VER_STR" ] && skip "Cannot find dm-integrity target, test skipped." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PTC=$(echo $VER_STR | cut -f 3 -d.) + + [ $VER_MAJ -lt 1 ] && return + [ $VER_MIN -gt 1 ] && { + DM_INTEGRITY_META=1 + DM_INTEGRITY_RECALC=1 + } + [ $VER_MIN -gt 2 ] && { + DM_INTEGRITY_BITMAP=1 + } + [ $VER_MIN -gt 6 ] && { + DM_INTEGRITY_HMAC_FIX=1 + } +} + +add_device() { + cleanup + dd if=/dev/urandom of=$KEY_FILE bs=4096 count=1 >/dev/null 2>&1 + dd if=/dev/urandom of=$KEY_FILE2 bs=1 count=32 >/dev/null 2>&1 + dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1 + dd if=/dev/zero of=$DEV2 bs=1M count=32 >/dev/null 2>&1 + sync +} + +status_check() # name value +{ + X=$($INTSETUP status $DEV_NAME | grep "$1" | sed 's/.*: //' | sed 's/^[[:space:]]*//') + if [ "$X" != "$2" ] ; then + echo "[status FAIL]" + echo " Expecting $1:$2 got \"$X\"." + fail + fi +} + +dump_check() # name value +{ + X=$($INTSETUP dump $DEV | grep "$1" | cut -d' ' -f 2) + if [ "$X" != "$2" ] ; then + echo "[dump FAIL]" + echo " Expecting $1:$2 got \"$X\"." + fail + fi +} + +kernel_param_check() # number value +{ + X=$(dmsetup table $DEV_NAME | cut -d " " -f $1) + if [ "$X" != $2 ] ; then + echo "[param_check FAIL]" + echo "Expecting $2 got \"$X\"." + fail + fi +} + +function valgrind_setup() +{ + which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind." + [ ! -f $INTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable." + export LD_LIBRARY_PATH="$INTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${INTSETUP_VALGRIND} "$@" +} + +int_check_sum_only() # checksum +{ + VSUM=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1) + if [ "$VSUM" = "$1" ] ; then + echo -n "[CHECKSUM OK]" + else + echo "[FAIL]" + echo " Expecting $1 got $VSUM." + fail + fi +} + +int_check_sum() # alg checksum [keyfile keysize] +{ + if [ -n "$4" ] ; then + KEY_PARAMS="--integrity-key-file $3 --integrity-key-size $4" + else + KEY_PARAMS="" + fi + + # Fill device with zeroes and reopen it + dd if=/dev/zero of=/dev/mapper/$DEV_NAME bs=1M oflag=direct >/dev/null 2>&1 + dmremove $DEV_NAME + + $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device." + + int_check_sum_only $2 +} + +intformat() # alg alg_out tagsize outtagsize sector_size csum [keyfile keysize] +{ + if [ -n "$8" ] ; then + KEY_PARAMS="--integrity-key-file $7 --integrity-key-size $8" + else + KEY_PARAMS="" + fi + + if [ $3 -ne 0 ] ; then + TAG_PARAMS="--tag-size $3" + else + TAG_PARAMS="" + fi + + echo -n "[INTEGRITY:$2:$4:$5]" + [ -n "$8" ] && echo -n "[KEYFILE:$8]" + echo -n "[FORMAT]" + $INTSETUP format --integrity-legacy-padding -q --integrity $1 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV >/dev/null 2>&1 + if [ $? -ne 0 ] ; then + ALG=$(echo $1 | sed -e 's/hmac-//') + if ! grep -q $ALG /proc/crypto ; then + echo "[N/A]" + return + fi + fail "Cannot format device." + fi + + dump_check "tag_size" $4 + dump_check "sector_size" $5 + echo -n "[ACTIVATE]" + $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device." + if [ -n "$8" ]; then + KEY_HEX=$(xxd -c 4096 -l $8 -p $7) + [ -z "$KEY_HEX" ] && fail "Cannot decode key." + dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch." + fi + status_check "tag size" $4 + status_check "integrity" $2 + status_check "sector size" "$5 bytes" + int_check_sum $1 $6 $7 $8 + echo -n "[REMOVE]" + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +} + +int_error_detection() # mode alg tagsize outtagsize sector_size key_file key_size +{ + if [ "$1" == "B" ] ; then + INT_MODE="-B" + else + INT_MODE="" + fi + if [ -n "$7" ] ; then + KEY_PARAMS="--integrity-key-file $6 --integrity-key-size $7" + else + KEY_PARAMS="" + fi + if [ $3 -ne 0 ] ; then + TAG_PARAMS="--tag-size $3" + else + TAG_PARAMS="" + fi + dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1 + + echo -n "[INTEGRITY:$1:$2:$4:$5]" + echo -n "[FORMAT]" + $INTSETUP format -q --integrity $2 $TAG_PARAMS --sector-size $5 $KEY_PARAMS $DEV $INT_MODE >/dev/null || fail "Cannot format device." + echo -n "[ACTIVATE]" + $INTSETUP open $DEV $DEV_NAME --integrity $2 --integrity-no-journal $KEY_PARAMS $INT_MODE || fail "Cannot activate device." + + if [ -n "$6" -a -n "$7" ]; then + echo -n "[KEYED HASH]" + KEY_HEX=$(xxd -c 256 -l $7 -p $6) + [ -z "$KEY_HEX" ] && fail "Cannot decode key." + dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch." + fi + + echo -n "[WRITE DATA]" + echo -n "EXAMPLE TEXT" | dd of=/dev/mapper/$DEV_NAME >/dev/null 2>&1 || fail "Cannot write to device." + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + + # find offset of data area + ARR=($(dd if=$DEV bs=512 2>/dev/null | hexdump -C | grep 'EXAMPLE TEXT')) + OFF_HEX=${ARR[0]} + OFF_DEC=$((16#$OFF_HEX)) + + echo -n "[CORRUPT DATA:$OFF_DEC]" + echo -n "Z" | dd of=$DEV bs=1 seek=$OFF_DEC conv=notrunc >/dev/null 2>&1 || fail "Cannot write to device." + + echo -n "[DETECT ERROR]" + $INTSETUP open $DEV $DEV_NAME --integrity $2 $KEY_PARAMS $INT_MODE || fail "Cannot activate device." + dd if=/dev/mapper/$DEV_NAME >/dev/null 2>&1 && fail "Error detection failed." + echo -n "[REMOVE]" + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +} + +int_journal() # 1 alg, 2 tagsize, 3 sector_size, 4 watermark, 5 commit_time, 6 journal_integrity, 7 key-file, 8 key-size, 9 journal_integrity_out +{ + echo -n "[INTEGRITY JOURNAL:$6:${4}%:${5}ms:$8]" + echo -n "[FORMAT]" + ARGS="--integrity $1 --journal-watermark $4 --journal-commit-time $5 --journal-integrity $6 --journal-integrity-key-file $7 --journal-integrity-key-size $8" + $INTSETUP format -q --tag-size $2 --sector-size $3 $ARGS $DEV || fail "Cannot format device." + + echo -n "[ACTIVATE]" + + $INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device." + + echo -n "[KEYED HASH]" + KEY_HEX=$(xxd -c 4096 -l $8 -p $7) + [ -z "$KEY_HEX" ] && fail "Cannot decode key." + dmsetup table --showkeys $DEV_NAME | grep -q $KEY_HEX || fail "Key mismatch." + + status_check "journal watermark" "${4}%" + status_check "journal commit time" "${5} ms" + status_check "journal integrity MAC" $9 + + echo -n "[REMOVE]" + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +} + + +int_journal_crypt() # crypt_alg crypt_alg_kernel crypt_key crypt_key_size +{ + echo -n "[JOURNAL CRYPT:$1:${4}B]" + + echo -n "[FORMAT]" + ARGS="--journal-crypt $1 --journal-crypt-key-file $3 --journal-crypt-key-size $4" + $INTSETUP format -q $ARGS $DEV || fail "Cannot format device." + + echo -n "[ACTIVATE]" + $INTSETUP open $DEV $DEV_NAME $ARGS || fail "Cannot activate device." + + KEY_HEX=$(xxd -c 256 -l $4 -p $3) + [ -z "$KEY_HEX" ] && fail "Cannot decode key." + dmsetup table --showkeys $DEV_NAME | grep -q "journal_crypt:$2:$KEY_HEX" || fail "Key mismatch." + + $INTSETUP close $DEV_NAME + echo "[OK]" +} + +int_mode() # alg tag_size sector_size [keyfile keysize] +{ + if [ -n "$5" ] ; then + KEY_PARAMS="--integrity-key-file $4 --integrity-key-size $5" + else + KEY_PARAMS="" + fi + + echo -n "[MODE TESTS:$1:$2:$3]" + ARGS="--tag-size $2 --sector-size $3" + + $INTSETUP format -q $ARGS $KEY_PARAMS $DEV --integrity $1 || fail "Cannot format device." + + echo -n "[JOURNALED WRITES]" + $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS || fail "Cannot activate device with journal." + status_check "mode" "read/write" + kernel_param_check 7 "J" + + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + + echo -n "[DIRECT WRITES]" + $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-no-journal || fail "Cannot activate device without journal." + status_check "mode" "read/write" + status_check "journal" "not active" + kernel_param_check 7 "D" + + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + + echo -n "[RECOVERY MODE]" + $INTSETUP open $DEV $DEV_NAME --integrity $1 $KEY_PARAMS --integrity-recovery-mode || fail "Cannot activate device in recovery mode." + status_check "mode" "read/write recovery" + kernel_param_check 7 "R" + + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + + echo "[OK]" +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$INTSETUP" ] && skip "Cannot find $INTSETUP, test skipped." +which blockdev >/dev/null || skip "Cannot find blockdev utility, test skipped." + +[ -n "$VALG" ] && valgrind_setup && INTSETUP=valgrind_run +which hexdump >/dev/null 2>&1 || skip "WARNING: hexdump tool required." +modprobe dm-integrity >/dev/null 2>&1 +dm_integrity_features + +add_device +intformat blake2s-256 blake2s-256 32 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 +intformat blake2b-256 blake2b-256 32 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 +intformat crc32c crc32c 0 4 512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7 +intformat crc32 crc32 0 4 512 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7 +intformat sha1 sha1 0 20 512 6eedd6344dab8875cd185fcd6565dfc869ab36bc57e577f40c685290b1fa7fe7 +intformat sha1 sha1 16 16 4096 e152ec88227b539cd9cafd8bdb587a1072d720cd6bcebe1398d4136c9e7f337b +intformat sha256 sha256 0 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 +intformat hmac-sha256 hmac\(sha256\) 0 32 512 8e5fe4119558e117bfc40e3b0f13ade3abe497b52604d4c7cca0cfd6c7f4cf11 $KEY_FILE 32 +intformat sha256 sha256 0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 +intformat hmac-sha256 hmac\(sha256\) 0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 $KEY_FILE 32 +intformat hmac-sha256 hmac\(sha256\) 0 32 4096 33f7dfa5163ca9f740383fb8b0919574e38a7b20a94a4170fde4238196b7c4b4 $KEY_FILE 4096 + +echo "Error detection tests:" +int_error_detection J crc32c 0 4 512 +int_error_detection J crc32c 0 4 4096 +int_error_detection J crc32 0 4 512 +int_error_detection J crc32 0 4 4096 +int_error_detection J sha1 0 20 512 +int_error_detection J sha1 16 16 512 +int_error_detection J sha1 0 20 4096 +int_error_detection J sha256 0 32 512 +int_error_detection J sha256 0 32 4096 + +which xxd >/dev/null 2>&1 || skip "WARNING: xxd tool required." +int_error_detection J hmac-sha256 0 32 512 $KEY_FILE 32 +int_error_detection J hmac-sha256 0 32 4096 $KEY_FILE 32 + +echo "Journal parameters tests:" +# Watermark is calculated in kernel, so it can be rounded down/up +int_journal crc32 4 512 66 1000 hmac-sha256 $KEY_FILE 32 hmac\(sha256\) +int_journal sha256 32 4096 34 5000 hmac-sha1 $KEY_FILE 16 hmac\(sha1\) +int_journal sha1 20 512 75 9999 hmac-sha256 $KEY_FILE 32 hmac\(sha256\) +int_journal sha1 20 512 75 9999 hmac-sha256 $KEY_FILE 4096 hmac\(sha256\) + +echo "Journal encryption tests:" +int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 32 +int_journal_crypt cbc-aes cbc\(aes\) $KEY_FILE 16 +int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 32 +int_journal_crypt ctr-aes ctr\(aes\) $KEY_FILE 16 + +echo "Mode tests:" +int_mode crc32c 4 512 +int_mode crc32 4 512 +int_mode sha1 20 512 +int_mode sha256 32 512 +int_mode hmac-sha256 32 512 $KEY_FILE 32 +int_mode hmac-sha256 32 4096 $KEY_FILE 32 + +echo -n "Recalculate tags in-kernel:" +add_device +if [ -n "$DM_INTEGRITY_RECALC" ] ; then + $INTSETUP format -q $DEV --no-wipe || fail "Cannot format device." + $INTSETUP open $DEV $DEV_NAME --integrity-recalculate || fail "Cannot activate device." + dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=1M 2>/dev/null || fail "Cannot recalculate tags in-kernel" + int_check_sum_only 08f63eb27fb9ce2ce903b0a56429c68ce5e209253ba42154841ef045a53839d7 + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +else + echo "[N/A]" +fi + +echo -n "Separate metadata device:" +if [ -n "$DM_INTEGRITY_META" ] ; then + add_device + $INTSETUP format -q $DEV --data-device $DEV2 || fail "Cannot format device." + $INTSETUP open $DEV --data-device $DEV2 $DEV_NAME || fail "Cannot activate device." + int_check_sum_only 83ee47245398adee79bd9c0a8bc57b821e92aba10f5f9ade8a5d1fae4d8c4302 + $INTSETUP status $DEV_NAME | grep -q 'metadata device:' || fail + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +else + echo "[N/A]" +fi + +echo -n "Bitmap mode parameters:" +if [ -n "$DM_INTEGRITY_BITMAP" ] ; then + add_device + $INTSETUP format -q $DEV --integrity-bitmap-mode $DEV2 || fail "Cannot format device." + $INTSETUP open $DEV --integrity-bitmap-mode --bitmap-sectors-per-bit 65536 --bitmap-flush-time 5000 $DEV_NAME || fail "Cannot activate device." + $INTSETUP status $DEV_NAME | grep -q 'bitmap 512-byte sectors per bit: 65536' || fail + $INTSETUP status $DEV_NAME | grep -q 'bitmap flush interval: 5000 ms' || fail + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" + echo "Bitmap error detection tests:" + int_error_detection B crc32c 0 4 512 + int_error_detection B crc32c 0 4 4096 + int_error_detection B sha256 0 32 512 + int_error_detection B sha256 0 32 4096 + int_error_detection B hmac-sha256 0 32 512 $KEY_FILE 32 + int_error_detection B hmac-sha256 0 32 4096 $KEY_FILE 32 +else + echo "[N/A]" +fi + +echo -n "Big device:" +add_device +DEV_LOOP=$(losetup -f $DEV --show) +if [ -n "$DEV_LOOP" ] ; then +dmsetup create $DEV_NAME_BIG </dev/null 2>&1 && fail "Cannot activate device." + $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device." + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + # New version - must fail (no journal HMAC) + $INTSETUP format -q $DEV --no-wipe --tag-size 32 $ARGS || fail "Cannot format device." + $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS >/dev/null 2>&1 && fail "Cannot activate device." + $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device." + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + + # data and journal HMAC + ARGS="$ARGS --journal-integrity hmac-sha256 --journal-integrity-key-file $KEY_FILE2 --journal-integrity-key-size 32" + $INTSETUP format -q $DEV --integrity-legacy-hmac --no-wipe --tag-size 32 $ARGS || fail "Cannot format device." + $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS >/dev/null 2>&1 && fail "Cannot activate device." + $INTSETUP open $DEV $DEV_NAME --integrity-legacy-recalculate $ARGS || fail "Cannot activate device." + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + # New fixed version + $INTSETUP format -q $DEV --no-wipe --tag-size 32 $ARGS || fail "Cannot format device." + $INTSETUP dump $DEV | grep "flags" | grep -q "fix_hmac" || fail "Flag for HMAC not set." + $INTSETUP open $DEV $DEV_NAME --integrity-recalculate $ARGS || fail "Cannot activate device." + $INTSETUP close $DEV_NAME || fail "Cannot deactivate device." + echo "[OK]" +else + echo "[N/A]" +fi + +cleanup diff --git a/tests/keyring-compat-test b/tests/keyring-compat-test new file mode 100755 index 0000000..7a49936 --- /dev/null +++ b/tests/keyring-compat-test @@ -0,0 +1,211 @@ +#!/bin/bash + +CIPHER_XTS_PLAIN="aes-xts-plain64" +CIPHER_CBC_ESSIV="aes-cbc-essiv:sha256" +CIPHER_CBC_TCW="serpent-cbc-tcw" +# TODO: mode with LMK + +TEST_KEYRING_NAME="keyringtest_keyring" + +LOGON_KEY_16_OK="dmtst:lkey_16" +LOGON_KEY_32_OK="dmtst:lkey_32" +LOGON_KEY_64_OK="dmtst:lkey_64" + +HEXKEY_16="be21aa8c733229347bd4e681891e213d"; +HEXKEY_32="bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a"; +HEXKEY_64="34f95b96abff946b64f1339ff8653cc77c38697c93b797a496f3786e86eed7781850d5112bbae17d209b8310a8f3a034f1cd297667bc0cd1438fad28d87ef6a1" + +DEVSIZEMB=16 +DEVSECTORS=$((DEVSIZEMB*1024*1024/512)) +NAME=testcryptdev +CHKS_DMCRYPT=vk_in_dmcrypt.chk +CHKS_KEYRING=vk_in_keyring.chk + +PWD="aaa" + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup + +[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) + +function remove_mapping() +{ + [ -b /dev/mapper/$NAME ] && dmsetup remove --retry $NAME + + # unlink whole test keyring + [ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null + + rmmod scsi_debug 2>/dev/null + + rm -f $CHKS_DMCRYPT $CHKS_KEYRING +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + exit 77 +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +# $1 hexbyte key +# $2 type +# $3 description +# $4 keyring +function load_key() +{ + local tmp="$1" + shift + echo -n "$tmp" | xxd -r -p | keyctl padd $@ >/dev/null +} + +function dm_crypt_keyring_support() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + # run the test with dm-crypt v1.15.0+ on purpose + # the fix is in dm-crypt v1.18.1+ + [ $VER_MAJ -gt 1 ] && return 0 + [ $VER_MAJ -lt 1 ] && return 1 + [ $VER_MIN -ge 15 ] +} + +function test_and_prepare_keyring() { + keyctl list "@s" > /dev/null || skip "Current session keyring is unreachable, test skipped" + TEST_KEYRING=$(keyctl newring $TEST_KEYRING_NAME "@u" 2> /dev/null) + test -n "$TEST_KEYRING" || skip "Failed to create keyring in user keyring" + keyctl search "@s" keyring "$TEST_KEYRING" > /dev/null 2>&1 || keyctl link "@u" "@s" > /dev/null 2>&1 + load_key "$HEXKEY_16" user test_key "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped." +} + +function fips_mode() +{ + [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ] +} + +add_device() { + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 2 + DEV=$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + + DEV="/dev/$DEV" + [ -b $DEV ] || fail "Cannot find $DEV." +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +which dmsetup >/dev/null 2>&1 || skip "Cannot find dmsetup, test skipped" +which keyctl >/dev/null 2>&1 || skip "Cannot find keyctl, test skipped" +which xxd >/dev/null 2>&1 || skip "Cannot find xxd, test skipped" +which sha1sum > /dev/null 2>&1 || skip "Cannot find sha1sum, test skipped" +modprobe dm-crypt || fail "dm-crypt failed to load" +dm_crypt_keyring_support || skip "dm-crypt doesn't support kernel keyring, test skipped." + +test_and_prepare_keyring + +add_device dev_size_mb=$DEVSIZEMB + +dd if=/dev/urandom of=$DEV bs=1M count=$DEVSIZEMB oflag=direct > /dev/null 2>&1 || fail + +#test aes cipher with xts mode, plain IV +echo -n "Testing $CIPHER_XTS_PLAIN..." +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +load_key "$HEXKEY_32" logon $LOGON_KEY_32_OK "$TEST_KEYRING" || fail "Cannot load 32 byte logon key type" +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN :32:logon:$LOGON_KEY_32_OK 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" +# same test using message +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_XTS_PLAIN $HEXKEY_32 0 $DEV 0" || fail +dmsetup suspend $NAME || fail +dmsetup message $NAME 0 key wipe || fail +dmsetup message $NAME 0 "key set :32:logon:$LOGON_KEY_32_OK" || fail +dmsetup resume $NAME || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" +echo "OK" + +#test aes cipher, xts mode, essiv IV +echo -n "Testing $CIPHER_CBC_ESSIV..." +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +load_key "$HEXKEY_16" logon $LOGON_KEY_16_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type" +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV :16:logon:$LOGON_KEY_16_OK 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" +# same test using message +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_ESSIV $HEXKEY_16 0 $DEV 0" || fail +dmsetup suspend $NAME || fail +dmsetup message $NAME 0 key wipe || fail +dmsetup message $NAME 0 "key set :16:logon:$LOGON_KEY_16_OK" || fail +dmsetup resume $NAME || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" +echo "OK" + +#test serpent cipher, cbc mode, tcw IV +fips_mode || { +echo -n "Testing $CIPHER_CBC_TCW..." +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +load_key "$HEXKEY_64" logon $LOGON_KEY_64_OK "$TEST_KEYRING" || fail "Cannot load 16 byte logon key type" +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW :64:logon:$LOGON_KEY_64_OK 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)" +# same test using message +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail +sha1sum /dev/mapper/$NAME > $CHKS_DMCRYPT || fail +dmsetup remove --retry $NAME || fail +dmsetup create $NAME --table "0 $DEVSECTORS crypt $CIPHER_CBC_TCW $HEXKEY_64 0 $DEV 0" || fail +dmsetup suspend $NAME || fail +dmsetup message $NAME 0 key wipe || fail +dmsetup message $NAME 0 "key set :64:logon:$LOGON_KEY_64_OK" || fail +dmsetup resume $NAME || fail +sha1sum /dev/mapper/$NAME > $CHKS_KEYRING || fail +dmsetup remove --retry $NAME || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksums mismatch (corruption)" +echo "OK" +} + +echo -n "Test LUKS2 key refresh..." +echo $PWD | $CRYPTSETUP luksFormat --type luks2 --luks2-metadata-size 16k --luks2-keyslots-size 4064k --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --force-password $DEV || fail +echo $PWD | $CRYPTSETUP open $DEV $NAME || fail +$CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" || skip "LUKS2 can't use keyring. Test skipped." +dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_KEYRING || fail +echo $PWD | $CRYPTSETUP refresh $NAME --disable-keyring || fail +$CRYPTSETUP status $NAME | grep -q -i "location:.*keyring" && fail "Key is still in keyring" +dd if=/dev/mapper/$NAME bs=1M iflag=direct status=none | sha1sum > $CHKS_DMCRYPT || fail +diff $CHKS_DMCRYPT $CHKS_KEYRING || fail "Plaintext checksum mismatch (corruption)" +echo "OK" + +remove_mapping diff --git a/tests/keyring-test b/tests/keyring-test new file mode 100755 index 0000000..3ed3aff --- /dev/null +++ b/tests/keyring-test @@ -0,0 +1,238 @@ +#!/bin/bash + +DEV_ZERO="dmtst-zero" +DEV_CRYPT="dmtst-crypt" + +CIPHER="aes-xts-plain64" + +TEST_KEYRING_NAME="keyringtest_keyring" + +USER_KEY_32_OK="dmtst:ukey_32_ok" +USER_KEY_32_WRONG="dmtst:ukey_32_wrong_size" + +LOGON_KEY_32_OK="dmtst:lkey_32_ok" +LOGON_KEY_32_WRONG="dmtst:lkey_32_wrong_size" + +PAYLOAD_32="bb21158c733229347bd4e681891e213d" +PAYLOAD_31="bb21158c733229347bd4e681891e213" + +HEXKEY_32="bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a"; +HEXKEY_32_BAD="bb21158c733229347bd4e68189XXXX3d94c685be6a5b84818afe7a78a6de7a1a" +HEXKEY_31="bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a" + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_CRYPT ] && dmsetup remove --retry $DEV_CRYPT + [ -b /dev/mapper/$DEV_ZERO ] && dmsetup remove --retry $DEV_ZERO + + # unlink whole test keyring + [ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + exit 77 +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +# $1 type +# $2 description +# $3 payload +# $4 keyring +function load_key() +{ + keyctl add $@ >/dev/null +} + +function dm_crypt_keyring_support() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + [ $VER_MAJ -gt 1 ] && return 0 + [ $VER_MAJ -lt 1 ] && return 1 + [ $VER_MIN -ge 15 ] +} + +function test_and_prepare_keyring() { + keyctl list "@s" > /dev/null || skip "Current session keyring is unreachable, test skipped" + TEST_KEYRING=$(keyctl newring $TEST_KEYRING_NAME "@u" 2> /dev/null) + test -n "$TEST_KEYRING" || skip "Failed to create keyring in user keyring" + keyctl search "@s" keyring "$TEST_KEYRING" > /dev/null 2>&1 || keyctl link "@u" "@s" > /dev/null 2>&1 + load_key user test_key test_data "$TEST_KEYRING" || skip "Kernel keyring service is useless on this system, test skipped." +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +which dmsetup >/dev/null 2>&1 || skip "Cannot find dmsetup, test skipped" +which keyctl >/dev/null 2>&1 || skip "Cannot find keyctl, test skipped" +modprobe dm-crypt || fail "dm-crypt failed to load" +dm_crypt_keyring_support || skip "dm-crypt doesn't support kernel keyring, test skipped." + +test_and_prepare_keyring + +load_key logon $LOGON_KEY_32_OK $PAYLOAD_32 "$TEST_KEYRING" || fail "Cannot load 32 byte logon key type" +load_key user $USER_KEY_32_OK $PAYLOAD_32 "$TEST_KEYRING" || fail "Cannot load 32 byte user key type" +load_key logon $LOGON_KEY_32_WRONG $PAYLOAD_31 "$TEST_KEYRING" || fail "Cannot load 31 byte logon key type" +load_key user $USER_KEY_32_WRONG $PAYLOAD_31 "$TEST_KEYRING" || fail "Cannot load 31 byte user key type" + +dmsetup create $DEV_ZERO --table "0 100 zero" || fail + +echo "[1] Valid keyring keys" + +# load logon type kernel key +KEY=":32:logon:$LOGON_KEY_32_OK" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER $KEY 0" || fail +dmsetup remove --retry $DEV_CRYPT || fail + +# load user type kernel key +KEY=":32:user:$USER_KEY_32_OK" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER $KEY 0" || fail +dmsetup remove --retry $DEV_CRYPT || fail + +# load logon type kernel key... +KEY=":32:logon:$LOGON_KEY_32_OK" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" || fail +dmsetup suspend $DEV_CRYPT || fail +dmsetup message $DEV_CRYPT 0 "key wipe" || fail +# ...replace the key with hexkey... +dmsetup message $DEV_CRYPT 0 "key set $HEXKEY_32" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER $HEXKEY_32 0" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup suspend $DEV_CRYPT || fail +# ...and replace it again with user type kernel key... +dmsetup message $DEV_CRYPT 0 "key set :32:user:$USER_KEY_32_OK" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER :32:user:$USER_KEY_32_OK 0" || fail +dmsetup message $DEV_CRYPT 0 "key set $HEXKEY_32" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER $HEXKEY_32 0" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup remove --retry $DEV_CRYPT || fail + +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $HEXKEY_32 0 /dev/mapper/$DEV_ZERO 0" || fail +dmsetup suspend $DEV_CRYPT || fail +dmsetup message $DEV_CRYPT 0 "key wipe" || fail +dmsetup message $DEV_CRYPT 0 "key set :32:user:$USER_KEY_32_OK" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup suspend $DEV_CRYPT || fail +dmsetup message $DEV_CRYPT 0 "key set :32:logon:$LOGON_KEY_32_OK" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup remove --retry $DEV_CRYPT || fail + +echo "[2] message ioctl" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $HEXKEY_32 0 /dev/mapper/$DEV_ZERO 0" || fail +dmsetup suspend $DEV_CRYPT || fail +dmsetup message $DEV_CRYPT 0 "key set :32:logon:$LOGON_KEY_32_WRONG" 2> /dev/null && fail +# old key should be intact and valid +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER $HEXKEY_32 0" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup suspend $DEV_CRYPT || fail +# now the key gets destroyed by invalid input +dmsetup message $DEV_CRYPT 0 "key set $HEXKEY_32_BAD" 2> /dev/null && fail +dmsetup resume $DEV_CRYPT 2> /dev/null && fail +# hmm... see the output. don't like it +# dmsetup table --showkeys $DEV_CRYPT + +dmsetup message $DEV_CRYPT 0 "key set :32:user:$USER_KEY_32_OK" || fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER :32:user:$USER_KEY_32_OK 0" || fail +dmsetup message $DEV_CRYPT 0 "key set :31:logon:$LOGON_KEY_32_OK" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set ::::" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :0:logon:$LOGON_KEY_32_OK" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :32" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :32:" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :32:logon" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :32:logo" 2> /dev/null && fail +dmsetup message $DEV_CRYPT 0 "key set :32:logon:" 2> /dev/null && fail +dmsetup table --showkeys $DEV_CRYPT | grep -q "crypt $CIPHER :32:user:$USER_KEY_32_OK 0" || fail +dmsetup message $DEV_CRYPT 0 "key set :32:user:$USER_KEY_32_OK" || fail +dmsetup resume $DEV_CRYPT || fail +dmsetup remove --retry $DEV_CRYPT || fail + +echo "[3] bOrked keys" +# declare the key having 32 bytes but load key which has in fact 31 bytes only +KEY=":32:logon:$LOGON_KEY_32_WRONG" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" 2> /dev/null && fail "dm-crypt accepted wrong key size" + +# declare the key having 31 bytes (incompatible with cipher) and load key with 32 bytes in real +KEY=":31:logon:$LOGON_KEY_32_WRONG" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" 2> /dev/null && fail "dm-crypt accepted wrong key size" + +# declare the key being user type but try to load logon one +KEY=":32:user:$LOGON_KEY_32" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" 2> /dev/null && fail "dm-crypt accepted key description for invalid key type" + +# now the other way +KEY=":32:logon:$USER_KEY_32" +dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $KEY 0 /dev/mapper/$DEV_ZERO 0" 2> /dev/null && fail "dm-crypt accepted key description for invalid key type" + +BORKED_KEYS=":\ 32:logon:$LOGON_KEY_32_OK +: 32:logon:$LOGON_KEY_32_OK +:+32:logon:$LOGON_KEY_32_OK +:-32:logon:$LOGON_KEY_32_OK +:32 :logon:$LOGON_KEY_32_OK +:32\ :logon:$LOGON_KEY_32_OK +:32_:logon:$LOGON_KEY_32_OK +:32+:logon:$LOGON_KEY_32_OK +:30+2:logon:$LOGON_KEY_32_OK +:32+0:logon:$LOGON_KEY_32_OK +:32: logon:$LOGON_KEY_32_OK +:32:\ logon:$LOGON_KEY_32_OK +:32:logonA:$LOGON_KEY_32_OK +:32:logo:$LOGON_KEY_32_OK +:32:llogon:$LOGON_KEY_32_OK +:32xlogon:$LOGON_KEY_32_OK +:32logon:$LOGON_KEY_32_OK +:32:logonx$LOGON_KEY_32_OK +:32:logon$LOGON_KEY_32_OK +: 32:user:$USER_KEY_32_OK +:\ 32:user:$USER_KEY_32_OK +:+32:user:$USER_KEY_32_OK +:-32:user:$USER_KEY_32_OK +:32 :user:$USER_KEY_32_OK +:32\ :user:$USER_KEY_32_OK +:32_:user:$USER_KEY_32_OK +:32+:user:$USER_KEY_32_OK +:30+2:user:$USER_KEY_32_OK +:32+0:user:$USER_KEY_32_OK +:32: user:$USER_KEY_32_OK +:32:\ user:$USER_KEY_32_OK +:32:userA:$USER_KEY_32_OK +:32:use:$USER_KEY_32_OK +:32:uuser:$USER_KEY_32_OK +:32xuser:$USER_KEY_32_OK +:32user:$USER_KEY_32_OK +:32:userx$USER_KEY_32_OK +:32:user$USER_KEY_32_OK +:32:userlogon:$USER_KEY_32_OK +:32:userlogon:$LOGON_KEY_32_OK +:32:logonuser:$USER_KEY_32_OK +:32:logonuser:$LOGON_KEY_32_OK +:32:logon:user:$USER_KEY_32_OK +:32:logon:user:$LOGON_KEY_32_OK +:32:user:logon:$USER_KEY_32_OK +:32:user:logon:$LOGON_KEY_32_OK" + +# TODO: add tests with whitespace in key description (not possible with current libdevmapper) + +IFS=" +" + +for key in $BORKED_KEYS; do + dmsetup create $DEV_CRYPT --table "0 100 crypt $CIPHER $key 0 /dev/mapper/$DEV_ZERO 0" 2> /dev/null && fail "dm-crypt accepted seriously borked key string" +done + +remove_mapping diff --git a/tests/loopaes-test b/tests/loopaes-test new file mode 100755 index 0000000..5c28be3 --- /dev/null +++ b/tests/loopaes-test @@ -0,0 +1,174 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup + +# try to validate using loop-AES losetup/kernel if available +LOSETUP_AES=/losetup-aes.old + +LOOP_DD_PARAM="bs=1k count=10000" +DEV_NAME=dummy +IMG=loopaes.img +KEYv1=key_v1 +KEYv2=key_v2 +KEYv3=key_v3 +LOOPDEV=$(losetup -f 2>/dev/null) + +function dmremove() { # device + udevadm settle >/dev/null 2>&1 + dmsetup remove --retry $1 >/dev/null 2>&1 +} + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME2 ] && dmremove $DEV_NAME2 + [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME + losetup -d $LOOPDEV >/dev/null 2>&1 + rm -f $IMG $KEYv1 $KEYv2 $KEYv3 >/dev/null 2>&1 +} + +function fail() +{ + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function prepare() +{ + remove_mapping + dd if=/dev/zero of=$IMG $LOOP_DD_PARAM >/dev/null 2>&1 + sync + losetup $LOOPDEV $IMG + + # Prepare raw key: v1 - one key, v2 - 64 keys, v3 - 64 + one IV + if [ ! -e $KEYv3 ]; then + head -c 3705 /dev/urandom | uuencode -m - | head -n 66 | tail -n 65 >$KEYv3 + head -n 1 $KEYv3 > $KEYv1 + head -n 64 $KEYv3 > $KEYv2 + fi + [ -n "$1" ] && echo -n "$1 " +} + +function check_exists() +{ + [ -b /dev/mapper/$DEV_NAME ] || fail +} + +function get_offset_params() # $offset +{ + offset=$1 + if [ "${offset:0:1}" = "@" ] ; then + echo "-o $((${offset:1} / 512)) -p 0" + else + echo "-o $((offset / 512))" + fi +} + +function get_expsum() # $offset +{ + case $1 in + 0) + echo "31e00e0e4c233c89051cd748122fde2c98db0121ca09ba93a3820817ea037bc5" + ;; + @8192 | 8192) + echo "bfd94392d1dd8f5d477251d21b3c736e177a4945cd4937847fc7bace82996aed" + ;; + @8388608 | 8388608) + echo "33838fe36928a929bd7971bed7e82bd426c88193fcd692c2e6f1b9c9bfecd4d6" + ;; + *) fail + ;; + esac +} + +function check_sum() # $key $keysize $offset [stdin|keyfile] +{ + $CRYPTSETUP close $DEV_NAME || fail + + EXPSUM=$(get_expsum $3) + if [ "$4" == "stdin" ] ; then + cat $1 | $CRYPTSETUP loopaesOpen $LOOPDEV $DEV_NAME -s $2 --key-file - $(get_offset_params $3) >/dev/null 2>&1 + else + $CRYPTSETUP loopaesOpen $LOOPDEV $DEV_NAME -s $2 --key-file $1 $(get_offset_params $3) >/dev/null 2>&1 + fi + ret=$? + VSUM=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1) + if [ $ret -eq 0 -a "$VSUM" = "$EXPSUM" ] ; then + echo -n "[$4:OK]" + else + echo "[$4:FAIL]" + [ "$VSUM" != "$EXPSUM" ] && echo " Expecting $EXPSUM got $VSUM." + fail + fi +} + +function check_sum_losetup() # $key $alg +{ + [ ! -x $LOSETUP_AES ] && echo && return + + echo -n " Verification using loop-AES: " + + losetup -d $LOOPDEV >/dev/null 2>&1 + cat $1 | $LOSETUP_AES -p 0 -e $2 -o $3 $LOOPDEV $IMG + ret=$? + VSUM=$(sha256sum $LOOPDEV | cut -d' ' -f 1) + if [ $ret -eq 0 -a "$VSUM" = "$EXPSUM" ] ; then + echo "[OK]" + else + echo "[FAIL]" + [ "$VSUM" != "$EXPSUM" ] && echo " Expecting $EXPSUM got $VSUM (loop-AES)." + fail + fi + losetup -d $LOOPDEV >/dev/null 2>&1 +} + +function check_version() +{ + VER_STR=$(dmsetup version | grep Driver) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PATCH=$(echo $VER_STR | cut -f 3 -d.) + + test $VER_MIN -lt 19 && return 1 + test $VER_MIN -eq 19 -a $VER_PATCH -ge 6 && return 1 # RHEL + return 0 +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ -z "$LOOPDEV" ] && skip "Cannot find free loop device, test skipped." +which uuencode >/dev/null 2>&1 || skip "WARNING: test require uuencode binary, test skipped." +check_version || skip "Probably old kernel, test skipped." + +# loop-AES tests +KEY_SIZES="128 256" +KEY_FILES="$KEYv1 $KEYv2 $KEYv3" +DEV_OFFSET="0 8192 @8192 8388608 @8388608" + +for key_size in $KEY_SIZES ; do + for key in $KEY_FILES ; do + for offset in $DEV_OFFSET ; do + prepare "Open loop-AES $key / AES-$key_size / offset $offset" + $CRYPTSETUP loopaesOpen $LOOPDEV $DEV_NAME \ + -s $key_size --key-file $key $(get_offset_params $offset) \ + 2>/dev/null + [ $? -ne 0 ] && echo "[SKIPPED]" && continue + check_exists + # Fill device with zeroes and reopen it + dd if=/dev/zero of=/dev/mapper/$DEV_NAME $LOOP_DD_PARAM >/dev/null 2>&1 + check_sum $key $key_size $offset keyfile + check_sum $key $key_size $offset stdin + $CRYPTSETUP loopaesClose $DEV_NAME || fail + check_sum_losetup $key AES$key_size $offset + done + done +done + +remove_mapping +exit 0 diff --git a/tests/luks1-compat-test b/tests/luks1-compat-test new file mode 100755 index 0000000..311a559 --- /dev/null +++ b/tests/luks1-compat-test @@ -0,0 +1,104 @@ +#!/bin/bash + +# check luks1 images parsing + +# NOTE: if image with whirlpool hash fails, check +# that you are not using old gcrypt with flawed whirlpool +# (see cryptsetup debug output) + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +TST_DIR=luks1-images +MAP=luks1tst +KEYFILE=keyfile1 + +[ -z "$srcdir" ] && srcdir="." + +function remove_mapping() +{ + [ -b /dev/mapper/$MAP ] && dmsetup remove --retry $MAP +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo " [FAILED]" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + echo "Test skipped." + exit 77 +} + +function test_one() +{ + $CRYPTSETUP benchmark -c "$1" -s "$2" | grep -v "#" || skip +} + +function test_required() +{ + which lsblk >/dev/null 2>&1 || skip "WARNING: lsblk tool required." + + echo "REQUIRED KDF TEST" + $CRYPTSETUP benchmark -h whirlpool | grep "N/A" && skip + + echo "REQUIRED CIPHERS TEST" + echo "# Algorithm | Key | Encryption | Decryption" + + test_one aes-xts 256 + test_one twofish-xts 256 + test_one serpent-xts 256 + test_one aes-cbc 256 + test_one aes-lrw 256 +} + +export LANG=C + +test_required +[ ! -d $TST_DIR ] && tar xJf $srcdir/luks1-images.tar.xz --no-same-owner + +echo "PASSPHRASE CHECK" +for file in $(ls $TST_DIR/luks1_*) ; do + echo -n " $file" + $CRYPTSETUP luksOpen -d $TST_DIR/$KEYFILE $file --test-passphrase 2>/dev/null + ret=$? + # ignore missing whirlpool (pwd failed is exit code 2) + [ $ret -eq 1 ] && (echo $file | grep -q -e "whirlpool") && echo " [N/A]" && continue + # ignore flawed whirlpool (pwd failed is exit code 2) + [ $ret -eq 2 ] && (echo $file | grep -q -e "whirlpool") && \ + ($CRYPTSETUP luksDump $file --debug | grep -q -e "flawed whirlpool") && \ + echo " [IGNORED (flawed Whirlpool library)]" && continue + [ $ret -ne 0 ] && fail + echo " [OK]" +done + +if [ $(id -u) != 0 ]; then + echo "WARNING: You must be root to run activation part of test, test skipped." + exit 0 +fi + +echo "ACTIVATION FS UUID CHECK" +for file in $(ls $TST_DIR/luks1_*) ; do + echo -n " $file" + $CRYPTSETUP luksOpen -d $TST_DIR/$KEYFILE $file $MAP 2>/dev/null + ret=$? + # ignore missing whirlpool (pwd failed is exit code 2) + [ $ret -eq 1 ] && (echo $file | grep -q -e "whirlpool") && echo " [N/A]" && continue + # ignore flawed whirlpool (pwd failed is exit code 2) + [ $ret -eq 2 ] && (echo $file | grep -q -e "whirlpool") && \ + ($CRYPTSETUP luksDump $file --debug | grep -q -e "flawed whirlpool") && \ + echo " [IGNORED (flawed Whirlpool library)]" && continue + [ $ret -ne 0 ] && fail + $CRYPTSETUP status $MAP >/dev/null || fail + $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail + UUID=$(lsblk -n -o UUID /dev/mapper/$MAP) + $CRYPTSETUP remove $MAP || fail + [ "$UUID" != "DEAD-BABE" ] && fail "UUID check failed." + echo " [OK]" +done diff --git a/tests/luks1-images.tar.xz b/tests/luks1-images.tar.xz new file mode 100644 index 0000000..dd099c6 Binary files /dev/null and b/tests/luks1-images.tar.xz differ diff --git a/tests/luks2-integrity-test b/tests/luks2-integrity-test new file mode 100755 index 0000000..0ba4b67 --- /dev/null +++ b/tests/luks2-integrity-test @@ -0,0 +1,166 @@ +#!/bin/bash +# +# Test cryptsetup/authenticated encryption compatibility. +# +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +DEV_NAME=dmi_test +DEV=mode-test.img +PWD1=nHjJHjI23JK +KEY_FILE=key.img +FAST_PBKDF_OPT="--pbkdf pbkdf2 --pbkdf-force-iterations 1000" + +dmremove() { # device + udevadm settle >/dev/null 2>&1 + dmsetup remove $1 >/dev/null 2>&1 +} + +cleanup() { + [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME + [ -b /dev/mapper/"$DEV_NAME"_dif ] && dmremove "$DEV_NAME"_dif + rm -f $DEV $KEY_FILE >/dev/null 2>&1 +} + +fail() +{ + echo + [ -n "$1" ] && echo "FAIL: $1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup + exit 100 +} + +skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +add_device() { + cleanup + dd if=/dev/urandom of=$KEY_FILE bs=1 count=512 >/dev/null 2>&1 + dd if=/dev/zero of=$DEV bs=1M count=32 >/dev/null 2>&1 + sync +} + +status_check() # name value +{ + #$CRYPTSETUP status $DEV_NAME + X=$($CRYPTSETUP status $DEV_NAME | grep -m1 "$1" | sed -e 's/.*:[ \t]\+//' | cut -d' ' -f1) + if [ "$X" != "$2" ] ; then + echo "[status FAIL]" + echo " Expecting $1:$2 got \"$X\"." + fail + fi +} + +dump_check() # name value +{ + #$CRYPTSETUP luksDump $DEV + X=$($CRYPTSETUP luksDump $DEV | grep -m1 "$1" | sed -e 's/.*:[ \t]\+//' | cut -d' ' -f1) + if [ "$X" != "$2" ] ; then + echo "[dump FAIL]" + echo " Expecting $1:$2 got \"$X\"." + fail + fi +} + +int_check_sum() # alg checksum +{ + VSUM=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1) + if [ "$VSUM" = "$2" ] ; then + echo -n "[CHECKSUM]" + else + echo "[FAIL]" + echo " Expecting $2 got $VSUM." + fail + fi +} + +int_error_detection() # alg int sector_size +{ + # FIXME: this is just a trivial failure + echo -n "[DETECT_CORRUPTION]" + echo -n "XXXXX" | dd of=$DEV bs=1M seek=28 count=1 conv=notrunc >/dev/null 2>&1 || fail "Cannot write to device." + $CRYPTSETUP open -d $KEY_FILE $DEV $DEV_NAME || fail "Cannot activate device." + dd if=/dev/mapper/$DEV_NAME of=/dev/null >/dev/null 2>&1 && fail "Error detection failed." + $CRYPTSETUP close $DEV_NAME || fail "Cannot deactivate device." +} + +intformat() # alg integrity integrity_out key_size int_key_size sector_size csum +{ + echo -n "[$1:$2:$4:$6]" + echo -n "[FORMAT]" + $CRYPTSETUP luksFormat --type luks2 -q -c $1 --integrity $2 --sector-size $6 -s $4 \ + $FAST_PBKDF_OPT -d $KEY_FILE $DEV --offset 8192 --integrity-legacy-padding >/dev/null 2>&1 + if [ $? -ne 0 ] ; then + echo "[N/A]" + return + fi + dump_check "cipher" $1 + dump_check "sector" $6 + dump_check "integrity" $3 + dump_check "Key:" $(($4 + $5)) + echo -n "[ACTIVATE]" + $CRYPTSETUP open -d $KEY_FILE $DEV $DEV_NAME || fail "Cannot activate device." + status_check "cipher" $1 + status_check "sector size" $6 + status_check "integrity:" $3 + status_check "keysize:" $(($4 + $5)) + [ $5 -gt 0 ] && status_check "integrity keysize:" $5 + int_check_sum $1 $7 + echo -n "[REMOVE]" + $CRYPTSETUP close $DEV_NAME || fail "Cannot deactivate device." + int_error_detection + echo "[OK]" +} + + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$CRYPTSETUP" ] && skip "Cannot find $CRYPTSETUP, test skipped." +modprobe dm-integrity >/dev/null 2>&1 +dmsetup targets | grep integrity >/dev/null 2>&1 || skip "Cannot find dm-integrity target, test skipped." + +add_device + +intformat aes-cbc-essiv:sha256 hmac-sha256 hmac\(sha256\) 128 256 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aes-xts-plain64 hmac-sha256 hmac\(sha256\) 256 256 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aes-xts-random hmac-sha256 hmac\(sha256\) 256 256 512 492c2d1cc9e222a850c399bfef4ed5a86bf5afc59e54f0f0c7ba8e2a64548323 +intformat aes-cbc-essiv:sha256 hmac-sha256 hmac\(sha256\) 256 256 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aes-xts-plain64 hmac-sha256 hmac\(sha256\) 512 256 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aes-xts-random hmac-sha256 hmac\(sha256\) 512 256 512 492c2d1cc9e222a850c399bfef4ed5a86bf5afc59e54f0f0c7ba8e2a64548323 +intformat aes-cbc-essiv:sha256 hmac-sha256 hmac\(sha256\) 128 256 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b +intformat aes-xts-plain64 hmac-sha256 hmac\(sha256\) 256 256 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b +intformat aes-xts-random hmac-sha256 hmac\(sha256\) 256 256 4096 8c0463f5ac09613674bdf40b0ff6f985edbc3de04e51fdc688873cb333ef3cda +intformat aes-cbc-essiv:sha256 hmac-sha256 hmac\(sha256\) 256 256 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b +intformat aes-xts-plain64 hmac-sha256 hmac\(sha256\) 512 256 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b +intformat aes-xts-random hmac-sha256 hmac\(sha256\) 512 256 4096 8c0463f5ac09613674bdf40b0ff6f985edbc3de04e51fdc688873cb333ef3cda + +intformat aes-cbc-essiv:sha256 hmac-sha512 hmac\(sha512\) 256 512 4096 9873d864fccb866521e79c9f0f75ad0c578d6bd7620399bbf4779e698c6e92fd +intformat aes-xts-essiv:sha256 hmac-sha512 hmac\(sha512\) 512 512 4096 9873d864fccb866521e79c9f0f75ad0c578d6bd7620399bbf4779e698c6e92fd +intformat aes-xts-plain64 hmac-sha512 hmac\(sha512\) 512 512 4096 9873d864fccb866521e79c9f0f75ad0c578d6bd7620399bbf4779e698c6e92fd +intformat aes-xts-random hmac-sha512 hmac\(sha512\) 512 512 4096 621f6c03f7361c2bf8f10059ae822339223f8471c750b0cf8584fba7134bd4a2 + +intformat aes-xts-plain64 hmac-sha1 hmac\(sha1\) 512 160 4096 7370c66a92708fb71b186931468be6aa9b26f4f88373b00b1c57360b9ee1304e +intformat aes-xts-random hmac-sha1 hmac\(sha1\) 512 160 4096 8c0463f5ac09613674bdf40b0ff6f985edbc3de04e51fdc688873cb333ef3cda + +intformat aes-gcm-random aead aead 128 0 512 5f6f3f6be03c74d9aaaeaf40dd310c99a20e2786045f78a1fc6a0b189d231f57 +intformat aes-gcm-random aead aead 128 0 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b +intformat aes-gcm-random aead aead 256 0 512 5f6f3f6be03c74d9aaaeaf40dd310c99a20e2786045f78a1fc6a0b189d231f57 +intformat aes-gcm-random aead aead 256 0 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b + +intformat aes-ccm-random aead aead 152 0 512 288e5e9bc5be6c0bd2a74abbb72c7944da83198b5e3041dcf159e7ae250dafa8 +intformat aes-ccm-random aead aead 152 0 4096 7370c66a92708fb71b186931468be6aa9b26f4f88373b00b1c57360b9ee1304e +intformat aes-ccm-random aead aead 280 0 512 288e5e9bc5be6c0bd2a74abbb72c7944da83198b5e3041dcf159e7ae250dafa8 +intformat aes-ccm-random aead aead 280 0 4096 7370c66a92708fb71b186931468be6aa9b26f4f88373b00b1c57360b9ee1304e + +intformat chacha20-plain64 poly1305 poly1305 256 0 512 3f82eae753ff52a689ddc559c691bbdff838361bbe9a3ce8c7212e16e51b5dbe +intformat chacha20-random poly1305 poly1305 256 0 512 5f6f3f6be03c74d9aaaeaf40dd310c99a20e2786045f78a1fc6a0b189d231f57 +intformat chacha20-plain64 poly1305 poly1305 256 0 4096 7370c66a92708fb71b186931468be6aa9b26f4f88373b00b1c57360b9ee1304e +intformat chacha20-random poly1305 poly1305 256 0 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b + +intformat aegis128-random aead aead 128 0 512 ee501705a084cd0ab6f4a28014bcf62b8bfa3434de00b82743c50b3abf06232c +intformat aegis128-random aead aead 128 0 4096 358d6beceddf593aff6b22c31684e0df9c226330aff5812e060950215217d21b + +cleanup diff --git a/tests/luks2-reencryption-mangle-test b/tests/luks2-reencryption-mangle-test new file mode 100755 index 0000000..8f308f5 --- /dev/null +++ b/tests/luks2-reencryption-mangle-test @@ -0,0 +1,506 @@ +#!/bin/bash + +PS4='$LINENO:' +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +CRYPTSETUP_RAW=$CRYPTSETUP + +CRYPTSETUP_VALGRIND=../.libs/cryptsetup +CRYPTSETUP_LIB_VALGRIND=../.libs +IMG=reenc-mangle-data +IMG_HDR=$IMG.hdr +IMG_JSON=$IMG.json +KEY1=key1 +DEV_NAME=reenc3492834 + +FAST_PBKDF2="--pbkdf pbkdf2 --pbkdf-force-iterations 1000" +CS_PWPARAMS="--disable-keyring --key-file $KEY1" +CS_PARAMS="-q --disable-locks $CS_PWPARAMS" +JSON_MSIZE=16384 + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + rm -f $IMG $IMG_HDR $IMG_JSON $KEY1 >/dev/null 2>&1 +} + +function fail() +{ + local frame=0 + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + exit 77 +} + +function bin_check() +{ + which $1 >/dev/null 2>&1 || skip "WARNING: test require $1 binary, test skipped." +} + +function img_json_save() +{ + # FIXME: why --json-file cannot be used? + #$CRYPTSETUP luksDump --dump-json-metadata $IMG | jq -c -M | tr -d '\n' >$IMG_JSON + local LUKS2_JSON_SIZE=$(($JSON_MSIZE - 4096)) + _dd if=$IMG count=$LUKS2_JSON_SIZE skip=4096 | jq -c -M . | tr -d '\n' >$IMG_JSON +} + +function img_json_dump() +{ + img_json_save + jq . $IMG_JSON +} + +function img_hash_save() +{ + IMG_HASH=$(sha256sum $IMG | cut -d' ' -f 1) +} + +function img_hash_unchanged() +{ + local IMG_HASH2=$(sha256sum $IMG | cut -d' ' -f 1) + [ "$IMG_HASH" != "$IMG_HASH2" ] && fail "Image changed!" +} + +function img_prepare_raw() # $1 options +{ + remove_mapping + + if [ ! -e $KEY1 ]; then + dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + fi + + truncate -s 32M $IMG || fail + $CRYPTSETUP luksFormat $FAST_PBKDF2 $CS_PARAMS --luks2-metadata-size $JSON_MSIZE $IMG $1 || fail +} + +function img_prepare() # $1 options +{ + img_prepare_raw + # FIXME: resilience is not saved here (always none)? + $CRYPTSETUP reencrypt $IMG $CS_PARAMS -q --init-only --resilience none $1 >/dev/null 2>&1 + [ $? -ne 0 ] && skip "Reencryption unsupported, test skipped." + img_json_save + img_hash_save +} + +function _dd() +{ + dd $@ status=none conv=notrunc bs=1 +} + +# header mangle functions +function img_update_json() +{ + local LUKS2_BIN1_OFFSET=448 + local LUKS2_BIN2_OFFSET=$((LUKS2_BIN1_OFFSET + $JSON_MSIZE)) + local LUKS2_JSON_SIZE=$(($JSON_MSIZE - 4096)) + + # if present jq script, mangle JSON + if [ -n "$1" ]; then + local JSON=$(cat $IMG_JSON) + echo $JSON | jq -M -c "$1" >$IMG_JSON || fail + local JSON=$(cat $IMG_JSON) + echo $JSON | tr -d '\n' >$IMG_JSON || fail + fi + + # wipe JSON areas + _dd if=/dev/zero of=$IMG count=$LUKS2_JSON_SIZE seek=4096 + _dd if=/dev/zero of=$IMG count=$LUKS2_JSON_SIZE seek=$(($JSON_MSIZE + 4096)) + + # write JSON data + _dd if=$IMG_JSON of=$IMG count=$LUKS2_JSON_SIZE seek=4096 + _dd if=$IMG_JSON of=$IMG count=$LUKS2_JSON_SIZE seek=$(($JSON_MSIZE + 4096)) + + # erase sha256 checksums + _dd if=/dev/zero of=$IMG count=64 seek=$LUKS2_BIN1_OFFSET + _dd if=/dev/zero of=$IMG count=64 seek=$LUKS2_BIN2_OFFSET + + # calculate sha256 and write chexksums + local SUM1_HEX=$(_dd if=$IMG count=$JSON_MSIZE | sha256sum | cut -d ' ' -f 1) + echo $SUM1_HEX | xxd -r -p | _dd of=$IMG seek=$LUKS2_BIN1_OFFSET count=64 || fail + + local SUM2_HEX=$(_dd if=$IMG skip=$JSON_MSIZE count=$JSON_MSIZE | sha256sum | cut -d ' ' -f 1) + echo $SUM2_HEX | xxd -r -p | _dd of=$IMG seek=$LUKS2_BIN2_OFFSET count=64 || fail + + img_hash_save +} + +function img_check_ok() +{ + if [ $(id -u) == 0 ]; then + $CRYPTSETUP open $CS_PWPARAMS $IMG $DEV_NAME || fail + $CRYPTSETUP close $DEV_NAME || fail + fi + + $CRYPTSETUP repair $IMG $CS_PARAMS || fail +} + +function img_check_fail() +{ + if [ $(id -u) == 0 ]; then + $CRYPTSETUP open $CS_PWPARAMS $IMG $DEV_NAME 2>/dev/null && fail + fi + + $CRYPTSETUP repair $IMG $CS_PARAMS 2>/dev/null && fail + img_hash_unchanged +} + +function img_run_reenc_ok() +{ +local EXPECT_TIMEOUT=5 +[ -n "$VALG" ] && EXPECT_TIMEOUT=60 +# For now, we cannot run reencryption in batch mode for non-block device. Just fake the terminal here. +expect_run - >/dev/null </dev/null </dev/null && fail + fi + + img_run_reenc_fail + + # repair metadata + $CRYPTSETUP repair $IMG $CS_PARAMS || fail + + img_check_ok + img_run_reenc_ok +} + +function valgrind_setup() +{ + bin_check valgrind + [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable." + export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" + CRYPTSETUP=valgrind_run + CRYPTSETUP_RAW="./valg.sh ${CRYPTSETUP_VALGRIND}" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@" +} + +function expect_run() +{ + export INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" + expect "$@" +} + +bin_check jq +bin_check sha256sum +bin_check xxd +bin_check expect + +export LANG=C + +[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run + +#while false; do + +echo "[1] Reencryption with old flag is rejected" +img_prepare +img_update_json '.config.requirements.mandatory = ["online-reencryptx"]' +img_check_fail +img_update_json '.config.requirements.mandatory = ["online-reencrypt-v2"]' +img_check_ok +img_run_reenc_ok +img_check_ok + +# Simulate old reencryption with no digest (repairable) +img_prepare +img_update_json 'del(.digests."2") | .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +# This must fail for new releases +echo "[2] Old reencryption in-progress (journal)" +img_prepare +img_update_json ' + del(.digests."2") | + .keyslots."2".area.type = "journal" | + .segments = { + "0" : (.segments."0" + + {"size" : .keyslots."2".area.size} + + {"flags" : ["in-reencryption"]}), + "1" : (.segments."0" + + {"offset" : ((.segments."0".offset|tonumber) + + (.keyslots."2".area.size|tonumber))|tostring}), + "2" : .segments."1", + "3" : .segments."2" + } | + .digests."0".segments = ["1","2"] | + .digests."1".segments = ["0","3"] | + .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +echo "[3] Old reencryption in-progress (checksum)" +img_prepare +img_update_json ' + del(.digests."2") | + .keyslots."2".area.type = "checksum" | + .keyslots."2".area.hash = "sha256" | + .keyslots."2".area.sector_size = 4096 | + .segments = { + "0" : (.segments."0" + + {"size" : .keyslots."2".area.size} + + {"flags" : ["in-reencryption"]}), + "1" : (.segments."0" + + {"offset": ((.segments."0".offset|tonumber) + + (.keyslots."2".area.size|tonumber))|tostring}), + "2" : .segments."1", + "3" : .segments."2" + } | + .digests."0".segments = ["1","2"] | + .digests."1".segments = ["0","3"] | + .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +# Note: older tools cannot create this from commandline +echo "[4] Old decryption in-progress (journal)" +img_prepare +img_update_json ' + del(.digests."1") | + del(.digests."2") | + del(.keyslots."1") | + .keyslots."2".mode = "decrypt" | + .keyslots."2".area.type = "journal" | + .segments = { + "0" : { + "type" : "linear", + "offset" : .segments."0".offset, + "size" : .keyslots."2".area.size, + "flags" : ["in-reencryption"] + }, + "1" : (.segments."0" + + {"offset" : ((.segments."0".offset|tonumber) + + (.keyslots."2".area.size|tonumber))|tostring}), + "2" : .segments."1", + "3" : { + "type" : "linear", + "offset" : .segments."0".offset, + "size" : "dynamic", + "flags" : ["backup-final"] + } + } | + .digests."0".segments = ["1","2"] | + .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +echo "[5] Old decryption in-progress (checksum)" +img_prepare +img_update_json ' + del(.digests."1") | + del(.digests."2") | + del(.keyslots."1") | + .keyslots."2".mode = "decrypt" | + .keyslots."2".area.type = "checksum" | + .keyslots."2".area.hash = "sha256" | + .keyslots."2".area.sector_size = 4096 | + .segments = { + "0" : { + "type" : "linear", + "offset" : .segments."0".offset, + "size" : .keyslots."2".area.size, + "flags" : ["in-reencryption"] + }, + "1" : (.segments."0" + + {"offset" : ((.segments."0".offset|tonumber) + + (.keyslots."2".area.size|tonumber))|tostring}), + "2" : .segments."1", + "3" : { + "type" : "linear", + "offset" : .segments."0".offset, + "size" : "dynamic", + "flags" : ["backup-final"] + } + } | + .digests."0".segments = ["1","2"] | + .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +# Note - offset is set to work with the old version (with a datashift bug) +echo "[6] Old reencryption in-progress (datashift)" +img_prepare +img_update_json ' + del(.digests."2") | + .keyslots."2".direction = "backward" | + .keyslots."2".area.type = "datashift" | + .keyslots."2".area.size = "4096" | + .keyslots."2".area.shift_size = ((1 * 1024 * 1024)|tostring) | + .segments = { + "0" : (.segments."0" + + {"size" : ((13 * 1024 * 1024)|tostring)}), + "1" : (.segments."0" + + {"offset" : ((30 * 1024 * 1024)|tostring)}), + "2" : .segments."1", + "3" : (.segments."2" + + {"offset" : ((17 * 1024 * 1024)|tostring)}), + } | + .digests."0".segments = ["0","2"] | + .digests."1".segments = ["1","3"] | + .config.requirements.mandatory = ["online-reencrypt"]' +img_check_fail_repair_ok + +# +# NEW metadata (with reenc digest) +# +echo "[7] Reencryption with various mangled metadata" + +# Normal situation +img_prepare +img_run_reenc_ok +img_check_ok + +# The same in various steps. +# Repair must validate not only metadata, but also reencryption digest. +img_prepare +img_update_json 'del(.digests."2")' +img_check_fail_repair_ok + +img_prepare '--reduce-device-size 2M' +img_update_json '.keyslots."2".area.shift_size = ((.keyslots."2".area.shift_size|tonumber / 2)|tostring)' +img_check_fail + +#FIXME: cannot check with correct digest for now (--init-only does not store area type) +img_prepare +img_update_json ' + .keyslots."2".area.type = "checksum" | + .keyslots."2".area.hash = "sha256" | + .keyslots."2".area.sector_size = 4096' +img_check_fail + +img_prepare +img_update_json '.keyslots."2".area.type = "journal"' +img_check_fail + +img_prepare +img_update_json '.keyslots."2".mode = "decrypt"' +img_check_fail + +img_prepare +img_update_json '.keyslots."2".direction = "backward"' +img_check_fail + +# key_size must be 1 +img_prepare +img_update_json '.keyslots."2".key_size = 16' +img_check_fail + +# Mangling segments +img_prepare +img_update_json 'del(.segments."1")' +img_check_fail + +img_prepare +img_update_json '.segments."0".encryption = "aes-cbc-null"' +img_check_fail + +img_prepare +img_update_json '.segments."1".encryption = "aes-cbc-null"' +img_check_fail + +img_prepare +img_update_json '.segments."2".encryption = "aes-cbc-null"' +img_check_fail + +# Mangling digests +img_prepare +img_update_json ' + .digests."2" = .digests."0" | + .digests."2".keyslots = ["2"] | + .digests."2".segments = []' +img_check_fail + +img_prepare +img_update_json '.digests."2".iterations = 1111' +img_check_fail + +# Simulate correct progress +img_prepare +img_update_json ' + .segments = { + "0" : (.segments."0" + + {"size" : ((1 * 1024 * 1024)|tostring)}), + "1" : (.segments."0" + + {"offset" : ((17 * 1024 * 1024)|tostring)}), + "2" : .segments."1", + "3" : .segments."2" + } | + .digests."0".segments = ["1","2"] | + .digests."1".segments = ["0","3"]' +img_check_ok + +# Mangling keyslots + +# Set reencrypt slot to non-ignore priority +# This should be benign, just avoid noisy messages +img_prepare +img_update_json 'del(.keyslots."2".priority)' +img_check_ok + +# Flags + +# Remove mandatory reenc flag, but keep reenc metadata +img_prepare +img_update_json '.config.requirements.mandatory = []' +img_check_fail + +# Unknown segment flag, should be ignored +img_prepare +img_update_json '.segments."0".flags = ["dead-parrot"]' +img_check_ok + +echo "[8] Reencryption with AEAD is not supported" +img_prepare_raw +img_json_save +img_update_json ' + .segments."0".integrity = { + "type" : "hmac(sha256)", + "journal_encryption": "none", + "journal_integrity": "none" + }' +$CRYPTSETUP reencrypt $IMG $CS_PARAMS >/dev/null 2>&1 && fail + +remove_mapping +exit 0 diff --git a/tests/luks2-reencryption-test b/tests/luks2-reencryption-test new file mode 100755 index 0000000..92f223d --- /dev/null +++ b/tests/luks2-reencryption-test @@ -0,0 +1,1550 @@ +#!/bin/bash + +PS4='$LINENO:' +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup + +CRYPTSETUP_VALGRIND=../.libs/cryptsetup +CRYPTSETUP_LIB_VALGRIND=../.libs + +FAST_PBKDF2="--pbkdf pbkdf2 --pbkdf-force-iterations 1000" +FAST_PBKDF_ARGON="--pbkdf-force-iterations 4 --pbkdf-memory 32 --pbkdf-parallel 1" +DEFAULT_ARGON="argon2i" + +DEV="" +OVRDEV="123reenc321" +DEVBIG="reenc2134" +DEV_NAME=reenc9768 +DEV_NAME2=reenc97682 +IMG=reenc-data +IMG_HDR=/tmp/$IMG.hdr +KEY1=key1 +VKEY1=vkey1 +PWD1="93R4P4pIqAH8" +PWD2="1cND4319812f" +PWD3="1-9Qu5Ejfnqv" + +[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) + +function dm_crypt_features() +{ + VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + VER_PTC=$(echo $VER_STR | cut -f 3 -d.) + + [ $VER_MAJ -lt 1 ] && return + [ $VER_MAJ -gt 1 ] && { + DM_PERF_CPU=1 + DM_SECTOR_SIZE=1 + return + } + + [ $VER_MIN -lt 14 ] && return + DM_PERF_CPU=1 + if [ $VER_MIN -ge 17 -o \( $VER_MIN -eq 14 -a $VER_PTC -ge 5 \) ]; then + DM_SECTOR_SIZE=1 + fi +} + +function dm_delay_features() +{ + local _ver_str=$(dmsetup targets | grep delay | cut -f2 -dv) + [ -z "$_ver_str" ] && return 1 + return 0 +} + +# $1 path to scsi debug bdev +scsi_debug_teardown() { + local _tries=15; + + while [ -b "$1" -a $_tries -gt 0 ]; do + rmmod scsi_debug 2> /dev/null + if [ -b "$1" ]; then + sleep .1 + _tries=$((_tries-1)) + fi + done + + test ! -b "$1" || rmmod scsi_debug 2> /dev/null +} + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME ] && { + dmsetup resume $DEV_NAME + dmsetup remove --retry $DEV_NAME + } + [ -b /dev/mapper/$DEV_NAME2 ] && { + dmsetup resume $DEV_NAME2 + dmsetup remove --retry $DEV_NAME2 + } + [ -b /dev/mapper/$DEV_NAME-overlay ] && { + dmsetup resume $DEV_NAME-overlay + dmsetup remove --retry $DEV_NAME-overlay + } + [ -b /dev/mapper/$DEV_NAME-hotzone-forward ] && { + dmsetup resume $DEV_NAME-hotzone-forward + dmsetup remove --retry $DEV_NAME-hotzone-forward + } + [ -b /dev/mapper/$DEV_NAME-hotzone-backward ] && { + dmsetup resume $DEV_NAME-hotzone-backward + dmsetup remove --retry $DEV_NAME-hotzone-backward + } + [ -b /dev/mapper/$OVRDEV ] && dmsetup remove --retry $OVRDEV 2>/dev/null + [ -b /dev/mapper/$OVRDEV-err ] && dmsetup remove --retry $OVRDEV-err 2>/dev/null + [ -n "$LOOPDEV" ] && losetup -d $LOOPDEV + unset LOOPDEV + rm -f $IMG $IMG_HDR $KEY1 $VKEY1 $DEVBIG >/dev/null 2>&1 + rmmod scsi_debug 2> /dev/null + scsi_debug_teardown $DEV +} + +function fail() +{ + local frame=0 + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + remove_mapping + exit 77 +} + +function fips_mode() +{ + [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ] +} + +function add_scsi_device() { + scsi_debug_teardown $DEV + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 1 + DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + [ -b $DEV ] || fail "Cannot find $DEV." +} + +function open_crypt() # $1 pwd, $2 hdr +{ + if [ -n "$2" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $DEV $DEV_NAME --header $2 || fail + elif [ -n "$1" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $DEV $DEV_NAME || fail + else + $CRYPTSETUP luksOpen -d $KEY1 $DEV $DEV_NAME || fail + fi +} + +function wipe_dev() # $1 dev +{ + if [ -b $1 ] ; then + blkdiscard --zeroout $1 2>/dev/null || dd if=/dev/zero of=$1 bs=1M conv=notrunc >/dev/null 2>&1 + else + local size=$(stat --printf="%s" $1) + truncate -s 0 $1 + truncate -s $size $1 + fi +} + +function wipe() # $1 pass, $2 hdr +{ + open_crypt $1 $2 + wipe_dev /dev/mapper/$DEV_NAME + udevadm settle >/dev/null 2>&1 + $CRYPTSETUP luksClose $DEV_NAME || fail +} + +function prepare() # $1 dev1_siz +{ + remove_mapping + + if [ ! -e $KEY1 ]; then + dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + fi + + if [ ! -e $VKEY1 ]; then + echo -n $'\x44\xc6\x74\x4f\x41\x4e\x50\xc0\x79\xc2\x2d\x5b\x5f\x68\x84\x17' >$VKEY1 + echo -n $'\x9c\x03\xba\xbe\x4d\x0f\x9a\x75\xb3\x90\x70\x32\x0a\xf8\xae\xc4'>>$VKEY1 + fi + + add_scsi_device $@ +} + +function preparebig() # $1 dev1_siz +{ + remove_mapping + + if [ ! -e $KEY1 ]; then + dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + fi + + truncate -s "$1"M $DEVBIG + LOOPDEV=$(losetup -f) + losetup -f $DEVBIG || fail + DEV=$LOOPDEV +} + +function check_hash_dev() # $1 dev, $2 hash +{ + HASH=$(sha256sum $1 | cut -d' ' -f 1) + [ $HASH != "$2" ] && fail "HASH differs (expected: $2) (result $HASH)" +} + +function check_hash() # $1 pwd, $2 hash, $3 hdr +{ + open_crypt $1 $3 + check_hash_dev /dev/mapper/$DEV_NAME $2 + $CRYPTSETUP remove $DEV_NAME || fail +} + +function check_hash_head() # $1 pwd, $2 len, $3 hash, $4 hdr +{ + open_crypt $1 $4 + if [ -n "$4" ]; then + echo $1 | $CRYPTSETUP resize $DEV_NAME --size $2 --header $4 || fail + else + echo $1 | $CRYPTSETUP resize $DEV_NAME --size $2 || fail + fi + check_hash_dev /dev/mapper/$DEV_NAME $3 + $CRYPTSETUP remove $DEV_NAME || fail +} + +function resize_file() # $1 dev, $2 shrink bytes +{ + local size=$(stat --printf="%s" $1) + truncate -s $(($size + $2)) $1 + losetup -c $LOOPDEV +} + +function error_writes() { # $1 dmdev, $2 data dev, $3 offset, $4 size + local _dev_size=$(blockdev --getsz /dev/mapper/$1) + local _offset=$(($3+$4)) + local _size=$((_dev_size-_offset)) + local _err=$1-err + local _table= + dmsetup create $_err --table "0 $_dev_size error" || fail + + if [ $3 -ne 0 ]; then + _table="0 $3 linear $2 0\n" + fi + + _table=$_table"$3 $4 delay $2 $3 0 /dev/mapper/$_err $3 0" + + if [ $_size -ne 0 ]; then + _table="$_table\n$_offset $_size linear $2 $_offset" + fi + + echo -e "$_table" | dmsetup load $1 || fail + dmsetup resume $1 || fail + blockdev --setra 0 /dev/mapper/$1 + blockdev --setra 0 /dev/mapper/$_err +} + +function fix_writes() { # $1 dmdev, $2 data dev + local _dev_size=$(blockdev --getsz /dev/mapper/$1) + dmsetup load $1 --table "0 $_dev_size linear $2 0" || fail + dmsetup resume $1 || fail + dmsetup remove --retry $1-err 2>/dev/null || fail +} + +function prepare_linear_dev() { + local _sizemb=$1 + shift + + if [ "$_sizemb" -gt 32 ]; then + preparebig $_sizemb + else + prepare dev_size_mb=$_sizemb $@ + fi + + dmsetup create $OVRDEV --table "0 $((_sizemb*1024*2)) linear $DEV 0" || fail + + OLD_DEV=$DEV + DEV=/dev/mapper/$OVRDEV +} + +function get_error_offsets() # $1 devsize, $2 minimal offset, $3 sector_size [512 if omitted], $4 max offset +{ + local _devsize=$(($1*1024*2)) + local _sector_size=${3:-512} + local _max_offset=${4:-$_devsize} + _sector_size=$((_sector_size/512)) + + # 8 sectors minimal size (4096) + ERRLENGTH=$((($RANDOM%56)+8)) + ERRLENGTH=$(($ERRLENGTH-($ERRLENGTH%$_sector_size))) + + ERROFFSET=$(($2+((2*$RANDOM)%($_max_offset-$2-$ERRLENGTH)))) + ERROFFSET=$(($ERROFFSET-($ERROFFSET%$_sector_size))) +} + +function reencrypt_recover() { # $1 sector size, $2 resilience, $3 digest, [$4 header] + echo -n "resilience mode: $2 ..." + local _hdr="" + test -z "$4" || _hdr="--header $4" + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV $_hdr --hotzone-size 1M --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON >/dev/null 2>&1 && fail + fix_writes $OVRDEV $OLD_DEV + + echo $PWD1 | $CRYPTSETUP -q repair $DEV $_hdr || fail + + check_hash $PWD1 $3 $4 + + echo $PWD1 | $CRYPTSETUP reencrypt $DEV $_hdr --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $3 $4 + + echo "[OK]" +} + +function reencrypt_recover_online() { # $1 sector size, $2 resilience, $3 digest, [$4 header] + echo -n "resilience mode: $2 ..." + local _hdr="" + test -z "$4" || _hdr="--header $4" + + echo $PWD1 | $CRYPTSETUP open $DEV $_hdr $DEV_NAME || fail + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt --active-name $DEV_NAME $_hdr --hotzone-size 1M --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON >/dev/null 2>&1 && fail + $CRYPTSETUP status $DEV_NAME $_hdr | grep -q "reencryption: in-progress" || fail + $CRYPTSETUP close $DEV_NAME || fail + fix_writes $OVRDEV $OLD_DEV + + # recovery during activation + echo $PWD1 | $CRYPTSETUP open $DEV $_hdr $DEV_NAME || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + + $CRYPTSETUP luksDump ${4:-$DEV} | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + $CRYPTSETUP status $DEV_NAME $_hdr | grep -q "reencryption: in-progress" || fail + echo $PWD1 | $CRYPTSETUP reencrypt --active-name $DEV_NAME $_hdr --resilience $2 --resume-only -q || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + fi + + $CRYPTSETUP close $DEV_NAME || fail + echo "[OK]" +} + +function encrypt_recover() { # $1 sector size, $2 reduce size, $3 digest, $4 device size in sectors, $5 origin digest + wipe_dev $DEV + check_hash_dev $DEV $5 + + echo -n "resilience mode: datashift ..." + + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --reduce-device-size $2 --sector-size $1 -q $FAST_PBKDF_ARGON --init-only >/dev/null 2>&1 || fail + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q >/dev/null 2>&1 && fail + fix_writes $OVRDEV $OLD_DEV + + echo $PWD1 | $CRYPTSETUP -q repair $DEV || fail + + $CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + check_hash $PWD1 $3 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --sector-size $1 -q $FAST_PBKDF_ARGON || fail + fi + + check_hash_head $PWD1 $4 $3 + + echo "[OK]" +} + +function encrypt_recover_online() { # $1 sector size, $2 reduce size, $3 digest, $4 device size in sectors, $5 origin digest + wipe_dev $DEV + check_hash_dev $DEV $5 + + echo -n "resilience mode: datashift ..." + + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --reduce-device-size $2 --sector-size $1 -q $FAST_PBKDF_ARGON --init-only > /dev/null || fail + echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q >/dev/null 2>&1 && fail + $CRYPTSETUP status $DEV_NAME | grep -q "reencryption: in-progress" || fail + $CRYPTSETUP close $DEV_NAME || fail + fix_writes $OVRDEV $OLD_DEV + + # recovery in activation + echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail + + $CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + $CRYPTSETUP status $DEV_NAME | grep -q "reencryption: in-progress" || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + echo $PWD1 | $CRYPTSETUP reencrypt --resume-only --active-name $DEV_NAME -q || fail + fi + + $CRYPTSETUP close $DEV_NAME || fail + check_hash_head $PWD1 $4 $3 + + echo "[OK]" +} + +function encrypt_recover_detached() { # $1 sector size, $2 resilience, $3 digest, $4 hdr + wipe_dev $DEV + check_hash_dev $DEV $3 + + echo -n "resilience mode: $2 ..." + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --hotzone-size 1M --header $4 --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON 2>/dev/null && fail + fix_writes $OVRDEV $OLD_DEV + + echo $PWD1 | $CRYPTSETUP repair $DEV --header $4 || fail + + check_hash $PWD1 $3 $4 + + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --header $4 --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $3 $4 + + echo "[OK]" +} + +function encrypt_recover_detached_online() { # $1 sector size, $2 resilience, $3 digest, $4 hdr + wipe_dev $DEV + check_hash_dev $DEV $3 + + echo -n "resilience mode: $2 ..." + + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --hotzone-size 1M --header $4 --resilience $2 --sector-size $1 -q $FAST_PBKDF_ARGON --init-only || fail + echo $PWD1 | $CRYPTSETUP open $DEV --header $4 $DEV_NAME || fail + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt -q $DEV --header $4 --hotzone-size 1M 2>/dev/null && fail + $CRYPTSETUP status $DEV_NAME --header $4 | grep -q "reencryption: in-progress" || fail + $CRYPTSETUP close $DEV_NAME || fail + fix_writes $OVRDEV $OLD_DEV + + echo $PWD1 | $CRYPTSETUP open $DEV --header $4 $DEV_NAME || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + + $CRYPTSETUP luksDump $4 | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + $CRYPTSETUP status $DEV_NAME --header $4 | grep -q "reencryption: in-progress" || fail + echo $PWD1 | $CRYPTSETUP reencrypt --active-name $DEV_NAME --resume-only --header $4 --resilience $2 -q || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + fi + + $CRYPTSETUP close $DEV_NAME || fail + + echo "[OK]" +} + +function decrypt_recover_detached() { # $1 sector size, $2 resilience, $3 digest, $4 hdr + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size $1 --header $4 $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $4 + check_hash $PWD1 $3 $4 + + echo -n "resilience mode: $2 ..." + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --decrypt --hotzone-size 1M --header $4 --resilience $2 -q 2>/dev/null && fail + fix_writes $OVRDEV $OLD_DEV + + echo $PWD1 | $CRYPTSETUP repair $DEV --header $4 || fail + + $CRYPTSETUP luksDump $4 | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + check_hash $PWD1 $3 $4 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --resume-only --header $4 --resilience $2 -q || fail + fi + + check_hash_dev $DEV $3 + + echo "[OK]" +} + +function decrypt_recover_detached_online() { # $1 sector size, $2 resilience, $3 digest, $4 hdr + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size $1 --header $4 $FAST_PBKDF_ARGON $DEV || fail + echo $PWD1 | $CRYPTSETUP open $DEV --header $4 $DEV_NAME || fail + wipe_dev /dev/mapper/$DEV_NAME + check_hash_dev /dev/mapper/$DEV_NAME $3 + + echo -n "resilience mode: $2 ..." + + error_writes $OVRDEV $OLD_DEV $ERROFFSET $ERRLENGTH + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --decrypt --hotzone-size 1M --header $4 --resilience $2 -q 2>/dev/null && fail + $CRYPTSETUP status $DEV_NAME --header $4 | grep -q "reencryption: in-progress" || fail + $CRYPTSETUP close $DEV_NAME || fail + fix_writes $OVRDEV $OLD_DEV + + # recovery during activation + echo $PWD1 | $CRYPTSETUP open $DEV --header $4 $DEV_NAME || fail + + $CRYPTSETUP luksDump $4 | grep -q "online-reencrypt" + if [ $? -eq 0 ]; then + $CRYPTSETUP status $DEV_NAME --header $4 | grep -q "reencryption: in-progress" || fail + check_hash_dev /dev/mapper/$DEV_NAME $3 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV --header $4 --resilience $2 -q || fail + fi + + $CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 && fail + check_hash_dev $DEV $3 + + echo "[OK]" +} + +# sector size (bytes) +# reenc dev size (sectors) +# reenc dev digest +# resilience +# orig size +# orig size digest +# hdr (optional) +function reencrypt_offline_fixed_size() { + local _esz=$(($1>>9)) + local _hdr="" + test -z "$7" || _hdr="--header $7" + + # reencrypt with fixed device size + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --sector-size $1 --device-size $2s --resilience $4 || fail + check_hash_head $PWD1 $2 $3 $7 + wipe $PWD1 $7 + + # try to reencrypt device size + 1 encryption sector size + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --sector-size $1 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --device-size $(($5+_esz))s --resilience $4 2>/dev/null && fail + check_hash $PWD1 $6 $7 + + # misaligned reencryption size + if [ $_esz -gt 1 ]; then + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --device-size $(($2+_esz-1))s --resilience $4 2>/dev/null && fail + $CRYPTSETUP luksDump ${7:-$DEV} | grep -q "2: crypt" || fail + $CRYPTSETUP luksDump ${7:-$DEV} | grep -q "3: crypt" && fail + check_hash $PWD1 $6 $7 + fi +} + +# sector size (bytes) +# reenc dev size (sectors) +# reenc dev digest +# resilience +# orig size +# orig size digest +# hdr +function encrypt_offline_fixed_size() { + local _esz=$(($1>>9)) + + # reencrypt with fixed device size + wipe_dev $DEV + echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --sector-size $1 --device-size $2s --resilience $4 || fail + check_hash_head $PWD1 $2 $3 $7 + + # try to reencrypt device size + 1 encryption sector size + wipe_dev $DEV + echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --sector-size $1 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --device-size $(($5+_esz))s --resilience $4 2>/dev/null && fail + check_hash $PWD1 $6 $7 + + # misaligned reencryption size + if [ $_esz -gt 1 ]; then + echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --sector-size $1 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $DEV --header $7 --device-size $(($2+_esz-1))s --resilience $4 2>/dev/null && fail + $CRYPTSETUP luksDump $7 | grep -q "2: crypt" || fail + $CRYPTSETUP luksDump $7 | grep -q "3: crypt" && fail + check_hash $PWD1 $6 $7 + fi +} + +# sector size (bytes) +# reenc dev size (sectors) +# reenc dev digest +# resilience +# orig size +# orig size digest +# hdr +function decrypt_offline_fixed_size() { + local _esz=$(($1>>9)) + + # decrypt with fixed device size + echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -q $FAST_PBKDF_ARGON $DEV --header $7 --sector-size $1 || fail + wipe $PWD1 $7 + echo $PWD1 | $CRYPTSETUP reencrypt --decrypt -q $DEV --header $7 --device-size $2s --resilience $4 || fail + + dmsetup load $OVRDEV --table "0 $2 linear $OLD_DEV 0" || fail + dmsetup resume $OVRDEV || fail + check_hash_dev $DEV $3 + dmsetup load $OVRDEV --table "0 $5 linear $OLD_DEV 0" || fail + dmsetup resume $OVRDEV || fail + + # try to decrypt device size + 1 encryption sector size + echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -q $FAST_PBKDF_ARGON $DEV --header $7 --sector-size $1 || fail + wipe $PWD1 $7 + echo $PWD1 | $CRYPTSETUP reencrypt --decrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV --header $7 --device-size $(($5+_esz))s --resilience $4 2>/dev/null && fail + check_hash $PWD1 $6 $7 + + # misaligned reencryption size + if [ $_esz -gt 1 ]; then + echo $PWD1 | $CRYPTSETUP reencrypt -q $DEV --header $7 --device-size $(($2+_esz-1))s --resilience $4 2>/dev/null && fail + $CRYPTSETUP luksDump $7 | grep -q "2: linear\|2: crypt" || fail + $CRYPTSETUP luksDump $7 | grep -q "3: crypt\|3: linear" && fail + check_hash $PWD1 $6 $7 + fi +} + +# sector size (bytes) +# reenc dev size (sectors) +# reenc dev digest +# resilience +# orig size +# orig size digest +# hdr (optional) +function reencrypt_online_fixed_size() { + local _esz=$(($1>>9)) + local _hdr="" + test -z "$7" || _hdr="--header $7" + + if [ -z "$_hdr" ]; then + echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 --offset 16384 $FAST_PBKDF_ARGON $DEV || fail + else + echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 $_hdr $FAST_PBKDF_ARGON $DEV || fail + fi + wipe $PWD1 $7 + + # reencrypt with fixed device size + echo $PWD1 | $CRYPTSETUP open $DEV $_hdr $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP resize $DEV_NAME $_hdr --size $2 || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --sector-size $1 --resilience $4 || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "$2 sectors" || fail + $CRYPTSETUP close $DEV_NAME || fail + check_hash_head $PWD1 $2 $3 $7 + wipe $PWD1 $7 + + # active device != requested reencryption size + echo $PWD1 | $CRYPTSETUP open $DEV $_hdr $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP resize $DEV_NAME $_hdr --size $2 || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --sector-size $1 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --device-size $(($2-_esz))s --resilience $4 2>/dev/null && fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --device-size $2s --resilience $4 || fail + $CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "$2 sectors" || fail + $CRYPTSETUP close $DEV_NAME || fail + check_hash_head $PWD1 $2 $3 $7 + + # misaligned reencryption size + if [ $_esz -gt 1 ]; then + if [ -z "$_hdr" ]; then + echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 --offset 16384 $FAST_PBKDF_ARGON $DEV || fail + else + echo $PWD1 | $CRYPTSETUP -q luksFormat --sector-size 512 --type luks2 $_hdr $FAST_PBKDF_ARGON $DEV || fail + fi + wipe $PWD1 $7 + check_hash $PWD1 $6 $7 + + echo $PWD1 | $CRYPTSETUP open $DEV $_hdr $DEV_NAME || fail + echo $PWD1 | $CRYPTSETUP resize $DEV_NAME $_hdr --size $(($2+_esz-1)) || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --sector-size $1 --init-only || fail + echo $PWD1 | $CRYPTSETUP reencrypt -q $FAST_PBKDF_ARGON $DEV $_hdr --resilience $4 2>/dev/null && fail + $CRYPTSETUP close $DEV_NAME || fail + check_hash $PWD1 $6 $7 + fi +} + +function setup_luks2_env() { + echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c aes-xts-plain64 $FAST_PBKDF_ARGON $DEV || fail + echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail + HAVE_KEYRING=$($CRYPTSETUP status $DEV_NAME | grep "key location: keyring") + if [ -n "$HAVE_KEYRING" ]; then + HAVE_KEYRING=1 + else + HAVE_KEYRING=0 + fi + DEF_XTS_KEY=$($CRYPTSETUP status $DEV_NAME | grep "keysize:" | sed 's/\( keysize: \)\([0-9]\+\)\(.*\)/\2/') + [ -n "$DEF_XTS_KEY" ] || fail "Failed to parse xts mode key size." + $CRYPTSETUP close $DEV_NAME || fail +} + +function valgrind_setup() +{ + which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind." + [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable." + export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@" +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$CRYPTSETUP" ] && skip "Cannot find $CRYPTSETUP, test skipped." +fips_mode && skip "This test cannot be run in FIPS mode." +modprobe --dry-run scsi_debug || exit 77 +modprobe dm-crypt || fail "dm-crypt failed to load" +modprobe dm-delay > /dev/null 2>&1 +dm_crypt_features + +if [ -n "$DM_SECTOR_SIZE" ]; then + TEST_SECTORS="512 4096" +else + TEST_SECTORS="512" +fi + +modinfo scsi_debug -p | grep -q opt_xferlen_exp && OPT_XFERLEN_EXP="opt_xferlen_exp=6" + +export LANG=C + +[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run + +# REENCRYPTION tests + +# 28 MiBs of zeros (32MiBs - 4MiB LUKS2 header) +HASH1=f8280c81b347b01405277bf9e8bf0685ae8be863ff104797c65b7169f8203fd2 +# 1 MiB of zeros +HASH2=30e14955ebf1352266dc2ff8067e68104607e750abb9d3b36582b8af909fcb58 +# 256 MiBs of zeros +HASH3=a6d72ac7690f53be6ae46ba88506bd97302a093f7108472bd9efc3cefda06484 +# 64 MiBs of zeroes +HASH4=3b6a07d0d404fab4e23b6d34bc6696a6a312dd92821332385e5af7c01c421351 +# 56 MiBs of zeroes +HASH5=8afcb7e7189ce4d112fd245eaa60c3cfcf5a5d5e1d6bf4eb85941d73ef8cfbd5 +# 43 MiBs of zeroes +HASH6=39f7c6d38af574fe2c90ef400dfaba8ef8edccd11bdac998a3f8143a86837331 +# 31 MiBs of zeroes +HASH7=18a393d1a505e22ccf3e29effe3005ea8627e4c36b7cca0e53f58121f49b67e1 +# 60 MiBs of zeroes +HASH8=cf5ac69ca412f9b3b1a8b8de27d368c5c05ed4b1b6aa40e6c38d9cbf23711342 + +prepare dev_size_mb=32 +setup_luks2_env + +echo "[1] Reencryption" +echo -n "[512 sector]" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-essiv:sha256 --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON 2>&1 | tail -1 | grep -q "not supported" && skip " No reenryption support, test skipped." +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +# simple test --active-name can consume absolute path to mapping +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -c aes-xts-plain64 --init-only $FAST_PBKDF_ARGON || fail +echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME || fail +echo $PWD1 | $CRYPTSETUP reencrypt --active-name /dev/mapper/$DEV_NAME --resilience none -q || fail +XTS_KEY=$($CRYPTSETUP status $DEV_NAME | grep "keysize:" | sed 's/\( keysize: \)\([0-9]\+\)\(.*\)/\2/') +[ "$XTS_KEY" -eq "$DEF_XTS_KEY" ] || fail "xts mode has wrong key size after reencryption ($XTS_KEY != expected $DEF_XTS_KEY)" +echo $PWD1 | $CRYPTSETUP close $DEV_NAME || fail +echo -n "[OK][4096 sector]" +prepare sector_size=4096 dev_size_mb=32 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-essiv:sha256 --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +if [ -n "$DM_SECTOR_SIZE" ]; then + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON --sector-size 4096 || fail + check_hash $PWD1 $HASH1 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal --sector-size 2048 $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $HASH1 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON --sector-size 1024 || fail + check_hash $PWD1 $HASH1 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum --sector-size 512 $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $HASH1 +fi +echo -n "[OK][4096/512 sector]" +prepare sector_size=512 physblk_exp=3 dev_size_mb=32 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-essiv:sha256 --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 +echo "[OK]" + +# reencrypt minimal device size (FIXME: change data device size to single encryption sector size) +# temporary small device size is default luks2 hdr size + 1MiB +echo -n "[small device reencryption]" +prepare dev_size_mb=5 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-essiv:sha256 --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH2 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH2 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH2 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH2 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH2 +if [ -n "$DM_SECTOR_SIZE" ]; then + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON --sector-size 4096 || fail + check_hash $PWD1 $HASH2 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 256 -c twofish-cbc-essiv:sha256 --resilience journal --sector-size 2048 $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $HASH2 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q --resilience none $FAST_PBKDF_ARGON --sector-size 1024 || fail + check_hash $PWD1 $HASH2 + echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -s 128 -c aes-cbc-essiv:sha256 --resilience checksum --sector-size 512 $FAST_PBKDF_ARGON || fail + check_hash $PWD1 $HASH2 +fi +echo "[OK]" + +echo "[2] Encryption with data shift" +# well, movin' zeroes :-) +preparebig 64 +wipe_dev $DEV +check_hash_dev $DEV $HASH4 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c aes-cbc-essiv:sha256 -s 128 --reduce-device-size 8M -q $FAST_PBKDF_ARGON || fail +check_hash_head $PWD1 $((56*1024*2)) $HASH5 +wipe_dev $DEV +check_hash_dev $DEV $HASH4 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c twofish-cbc-essiv:sha256 -s 128 --reduce-device-size 21M -q $FAST_PBKDF_ARGON || fail +check_hash_head $PWD1 $((43*1024*2)) $HASH6 +wipe_dev $DEV +# offset 21504 equals 10,5MiBs, equals --reduce-device-size 21M from test above (30M is ignored here, we'll reduce it to 21M in cryptsetup anyway) +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c twofish-cbc-essiv:sha256 -s 128 --offset 21504 --reduce-device-size 30M -q $FAST_PBKDF_ARGON > /dev/null || fail +check_hash_head $PWD1 $((43*1024*2)) $HASH6 +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --reduce-device-size 33M -q $FAST_PBKDF_ARGON || fail +check_hash_head $PWD1 $((31*1024*2)) $HASH7 +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --reduce-device-size 64M -q $FAST_PBKDF_ARGON > /dev/null 2>&1 && fail +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt --reduce-device-size 8M --init-only -q $FAST_PBKDF_ARGON $DEV || fail +resize_file $DEVBIG -512 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV 2> /dev/null && fail +resize_file $DEVBIG 512 +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c aes-cbc-essiv:sha256 -s 128 --offset 32760 --reduce-device-size 8M -q $FAST_PBKDF_ARGON --init-only >/dev/null 2>&1 && fail +# data offset at 21MiB +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --header $IMG_HDR --offset 43008 --reduce-device-size 21M -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH6 $IMG_HDR +$CRYPTSETUP luksHeaderRestore --header-backup-file $IMG_HDR $DEV -q || fail +check_hash $PWD1 $HASH6 + +# Device activation after encryption initialization +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt --init-only -c aes-cbc-essiv:sha256 -s 128 -S11 --reduce-device-size 8M -q $FAST_PBKDF_ARGON $DEV_NAME >/dev/null || fail +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail +check_hash_dev /dev/mapper/$DEV_NAME $HASH5 +echo $PWD1 | $CRYPTSETUP reencrypt --resume-only $DEV -q || fail +check_hash_dev /dev/mapper/$DEV_NAME $HASH5 + +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c aes-cbc-essiv:sha256 -s 128 --reduce-device-size 8M -q $FAST_PBKDF_ARGON $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP close $DEV_NAME +check_hash_head $PWD1 $((56*1024*2)) $HASH5 + +# Device activation using key file +wipe_dev $DEV +echo -n $PWD1 > $KEY1 +$CRYPTSETUP reencrypt $DEV --encrypt --init-only -c aes-cbc-essiv:sha256 -s 128 --reduce-device-size 8M --key-file $KEY1 -q $FAST_PBKDF_ARGON $DEV_NAME >/dev/null || fail +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail +$CRYPTSETUP close $DEV_NAME +echo $PWD1 | $CRYPTSETUP open $DEV --test-passphrase || fail + +echo "[3] Encryption with detached header" +preparebig 256 +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt --resilience journal --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -c twofish-cbc-essiv:sha256 -s 128 --resilience none --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt -c serpent-xts-plain --resilience checksum --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR + +# Device activation after encryption initialization +wipe_dev $DEV +echo $PWD1 | $CRYPTSETUP reencrypt --encrypt --init-only -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV $DEV_NAME >/dev/null || fail +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail +check_hash_dev /dev/mapper/$DEV_NAME $HASH3 +echo $PWD1 | $CRYPTSETUP reencrypt --resume-only --header $IMG_HDR --active-name $DEV_NAME -q || fail +check_hash_dev /dev/mapper/$DEV_NAME $HASH3 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --encrypt -c aes-cbc-essiv:sha256 -s 128 --reduce-device-size 8M -q $FAST_PBKDF_ARGON $DEV_NAME 2>/dev/null && fail +$CRYPTSETUP close $DEV_NAME +check_hash $PWD1 $HASH3 $IMG_HDR + +# Device activation using key file +wipe_dev $DEV +echo -n $PWD1 > $KEY1 +$CRYPTSETUP reencrypt $DEV --encrypt --init-only -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR --key-file $KEY1 -q $FAST_PBKDF_ARGON $DEV_NAME >/dev/null || fail +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 || fail +$CRYPTSETUP close $DEV_NAME +echo $PWD1 | $CRYPTSETUP open --header $IMG_HDR $DEV --test-passphrase || fail + +echo "[4] Reencryption with detached header" +wipe $PWD1 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt --resilience journal --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -c twofish-cbc-essiv:sha256 -s 128 --resilience none --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -c serpent-xts-plain --resilience checksum --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +check_hash $PWD1 $HASH3 $IMG_HDR +# trivial check for detached header misuse +dd if=/dev/zero of=$IMG bs=4k count=1 >/dev/null 2>&1 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +echo $PWD1 | $CRYPTSETUP open $IMG $DEV_NAME --header $IMG_HDR || fail +echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME2 --header $IMG_HDR || fail +echo $PWD1 | $CRYPTSETUP reencrypt --active-name $DEV_NAME --header $IMG_HDR -q || fail +# key description mismatch in active device +echo $PWD1 | $CRYPTSETUP reencrypt --active-name $DEV_NAME2 --header $IMG_HDR >/dev/null 2>&1 && fail +# also check it can abort initialization in this case +$CRYPTSETUP luksDump $IMG_HDR | grep -q "online-reencrypt" && fail +$CRYPTSETUP close $DEV_NAME || fail +$CRYPTSETUP close $DEV_NAME2 || fail + +echo "[5] Decryption with detached header" +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c aes-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --header $IMG_HDR $DEV || fail +check_hash_dev $DEV $HASH3 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --resilience journal --header $IMG_HDR $DEV || fail +check_hash_dev $DEV $HASH3 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c twofish-cbc-essiv:sha256 -s 128 --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --resilience none --header $IMG_HDR $DEV || fail +check_hash_dev $DEV $HASH3 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c serpent-xts-plain --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --resilience checksum --header $IMG_HDR $DEV || fail +check_hash_dev $DEV $HASH3 + +# check deferred remove works as expected after decryption +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c serpent-xts-plain --header $IMG_HDR -q $FAST_PBKDF_ARGON $DEV || fail +open_crypt $PWD1 $IMG_HDR +dmsetup create $DEV_NAME2 --table "0 1 linear /dev/mapper/$DEV_NAME 0" || fail +echo $PWD1 | $CRYPTSETUP reencrypt -q --decrypt --resilience checksum --header $IMG_HDR --active-name $DEV_NAME || fail +$CRYPTSETUP status $DEV_NAME >/dev/null || fail +dmsetup remove --retry $DEV_NAME2 +$CRYPTSETUP status $DEV_NAME >/dev/null 2>&1 && fail + +# check tool can block some funny user ideas +preparebig 64 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 -c serpent-xts-plain -q $FAST_PBKDF_ARGON $DEV || fail +echo $PWD1 | $CRYPTSETUP reencrypt --decrypt $DEV -q 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP reencrypt --decrypt $DEV --header $DEV -q 2>/dev/null && fail +open_crypt $PWD1 +echo $PWD1 | $CRYPTSETUP reencrypt --decrypt --active-name $DEV_NAME -q 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP reencrypt --decrypt --active-name $DEV_NAME --header $DEV -q 2>/dev/null && fail +$CRYPTSETUP status $DEV_NAME | grep -q "reencryption: in-progress" && fail +$CRYPTSETUP close $DEV_NAME + +if ! dm_delay_features; then + echo "dm-delay target is missing, skipping recovery tests." + remove_mapping + exit 0 +fi + +echo "[6] Reencryption recovery" +# (check opt-io size optimization in reencryption code does not affect recovery) +# device with opt-io size 32k +prepare_linear_dev 32 opt_blks=64 $OPT_XFERLEN_EXP +OFFSET=8192 + +echo "sector size 512->512" + +get_error_offsets 32 $OFFSET +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover 512 checksum $HASH1 +reencrypt_recover 512 journal $HASH1 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH1 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + reencrypt_recover 4096 journal $HASH1 + + echo "sector size 4096->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 --sector-size 4096 -c aes-cbc-essiv:sha256 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH1 + reencrypt_recover 4096 journal $HASH1 +fi + +echo "[7] Reencryption recovery (online i/o error)" + +echo "sector size 512->512" + +get_error_offsets 32 $OFFSET +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover_online 512 checksum $HASH1 +reencrypt_recover_online 512 journal $HASH1 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH1 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + reencrypt_recover_online 4096 journal $HASH1 + + echo "sector size 4096->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 --sector-size 4096 -c aes-cbc-essiv:sha256 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH1 + reencrypt_recover_online 4096 journal $HASH1 +fi + +echo "[8] Reencryption with detached header recovery" +prepare_linear_dev 31 opt_blks=64 $OPT_XFERLEN_EXP + +echo "sector size 512->512" + +get_error_offsets 31 0 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +check_hash $PWD1 $HASH7 $IMG_HDR + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover 512 checksum $HASH7 $IMG_HDR +reencrypt_recover 512 journal $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 31 0 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH7 $IMG_HDR + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + reencrypt_recover 4096 journal $HASH7 $IMG_HDR + + echo "sector size 4096->4096" + + get_error_offsets 31 0 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 4096 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH7 $IMG_HDR + reencrypt_recover 4096 journal $HASH7 $IMG_HDR +fi + +echo "[9] Reencryption with detached header recovery (online i/o error)" + +echo "sector size 512->512" + +get_error_offsets 31 0 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +check_hash $PWD1 $HASH7 $IMG_HDR + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover_online 512 checksum $HASH7 $IMG_HDR +reencrypt_recover_online 512 journal $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 31 0 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH7 $IMG_HDR + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + reencrypt_recover_online 4096 journal $HASH7 $IMG_HDR + + echo "sector size 4096->4096" + + get_error_offsets 31 0 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 4096 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 $IMG_HDR + check_hash $PWD1 $HASH7 $IMG_HDR + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH7 $IMG_HDR + reencrypt_recover_online 4096 journal $HASH7 $IMG_HDR +fi + +echo "[10] Encryption recovery" +prepare_linear_dev 64 +OFFSET=$((2*1024*2)) + +echo "sector size 512" + +get_error_offsets 64 $OFFSET 512 $((62*1024*2)) + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +encrypt_recover 512 4M $HASH8 $((60*1024*2)) $HASH4 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 4096" + + get_error_offsets 64 $OFFSET 4096 $((62*1024*2)) + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + encrypt_recover 4096 4M $HASH8 $((60*1024*2)) $HASH4 +fi + +echo "[11] Encryption recovery (online i/o error)" + +echo "sector size 512" + +get_error_offsets 64 $OFFSET 512 $((62*1024*2)) + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +encrypt_recover_online 512 4M $HASH8 $((60*1024*2)) $HASH4 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 4096" + + get_error_offsets 64 $OFFSET 4096 $((62*1024*2)) + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + encrypt_recover_online 4096 4M $HASH8 $((60*1024*2)) $HASH4 +fi + +echo "[12] Encryption with detached header recovery" +prepare_linear_dev 31 opt_blks=64 $OPT_XFERLEN_EXP + +get_error_offsets 31 0 + +echo "sector size 512" + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +encrypt_recover_detached 512 checksum $HASH7 $IMG_HDR +encrypt_recover_detached 512 journal $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + get_error_offsets 31 0 4096 + + echo "sector size 4096" + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + encrypt_recover_detached 4096 checksum $HASH7 $IMG_HDR + encrypt_recover_detached 4096 journal $HASH7 $IMG_HDR +fi + +echo "[13] Encryption with detached header recovery (online i/o error)" + +get_error_offsets 31 0 + +echo "sector size 512" + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +encrypt_recover_detached_online 512 checksum $HASH7 $IMG_HDR +encrypt_recover_detached_online 512 journal $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + get_error_offsets 31 0 4096 + + echo "sector size 4096" + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + encrypt_recover_detached_online 4096 checksum $HASH7 $IMG_HDR + encrypt_recover_detached_online 4096 journal $HASH7 $IMG_HDR +fi + +echo "[14] Decryption with detached header recovery" + +echo "sector size 512" + +# TODO: What should decryption do when it finishes decryption during recovery (with open) +get_error_offsets 31 2049 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +decrypt_recover_detached 512 journal $HASH7 $IMG_HDR +decrypt_recover_detached 512 checksum $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 4096" + + # TODO: What should decryption do when it finishes decryption during recovery (with open) + get_error_offsets 31 2048 4096 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + decrypt_recover_detached 4096 checksum $HASH7 $IMG_HDR + decrypt_recover_detached 4096 journal $HASH7 $IMG_HDR +fi + +echo "[15] Decryption with detached header recovery (online i/o error)" + +echo "sector size 512" + +# TODO: What should decryption do when it finishes decryption during recovery (with open) +get_error_offsets 31 2049 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +decrypt_recover_detached_online 512 journal $HASH7 $IMG_HDR +decrypt_recover_detached_online 512 checksum $HASH7 $IMG_HDR + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 4096" + + # TODO: What should decryption do when it finishes decryption during recovery (with open) + get_error_offsets 31 2048 4096 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + decrypt_recover_detached_online 4096 checksum $HASH7 $IMG_HDR + decrypt_recover_detached_online 4096 journal $HASH7 $IMG_HDR +fi + +echo "[16] Offline reencryption with fixed device size." +preparebig 68 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --offset 16384 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH8 + +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + reencrypt_offline_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 + reencrypt_offline_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 + reencrypt_offline_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 + echo -n "[OK]" +done +echo "" +done + +echo "[17] Online reencryption with fixed device size." +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + reencrypt_online_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 + reencrypt_online_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 + reencrypt_online_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 + echo -n "[OK]" +done +echo "" +done + +echo "[18] Offline reencryption with fixed device size (detached header)." +preparebig 60 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --header $IMG_HDR $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 $IMG_HDR +check_hash $PWD1 $HASH8 $IMG_HDR + +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + reencrypt_offline_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + reencrypt_offline_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + reencrypt_offline_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + echo -n "[OK]" +done +echo "" +done + +echo "[19] Online reencryption with fixed device size (detached header)." +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + reencrypt_online_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + reencrypt_online_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + reencrypt_online_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + echo -n "[OK]" +done +echo "" +done + +echo "[20] Offline encryption with fixed device size (detached header)." +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + encrypt_offline_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + encrypt_offline_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + encrypt_offline_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + echo -n "[OK]" +done +echo "" +done + +echo "[21] Offline decryption with fixed device size (detached header)." +prepare_linear_dev 60 +for test_ss in $TEST_SECTORS; do +printf "sector size %4s: " $test_ss +for test_res in checksum journal none; do + echo -n "[$test_res]" + decrypt_offline_fixed_size $test_ss 2048 $HASH2 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + decrypt_offline_fixed_size $test_ss $((28*1024*2)) $HASH1 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + decrypt_offline_fixed_size $test_ss $((31*1024*2)) $HASH7 $test_res $((60*1024*2)) $HASH8 $IMG_HDR + echo -n "[OK]" +done +echo "" +done + +echo "[22] Multi-keyslot device reencryption" +prepare dev_size_mb=17 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --offset 32768 $FAST_PBKDF_ARGON $DEV || fail +echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV || fail +echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH2 + +echo -e "$PWD1\n$PWD2\n$PWD3" | $CRYPTSETUP reencrypt $DEV -q || fail +check_hash $PWD1 $HASH2 +check_hash $PWD2 $HASH2 +check_hash $PWD3 $HASH2 + +# check at least pbkdf type is preserved +$CRYPTSETUP luksDump $DEV | grep -e "3: luks2" -A5 | grep -q "argon2" || fail +$CRYPTSETUP luksDump $DEV | grep -e "4: luks2" -A5 | grep -q "pbkdf2" || fail +$CRYPTSETUP luksDump $DEV | grep -e "5: luks2" -A5 | grep -q "argon2" || fail + +echo $PWD1 | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV $KEY1 || fail + +# with more keyslots, specific has to be selected +$CRYPTSETUP reencrypt $DEV -d $KEY1 -q 2>/dev/null && fail +$CRYPTSETUP reencrypt $DEV -d $KEY1 -q -S0 || fail +open_crypt +check_hash_dev /dev/mapper/$DEV_NAME $HASH2 +$CRYPTSETUP close $DEV_NAME + +# there should be single keyslot now +$CRYPTSETUP reencrypt $DEV -d $KEY1 -q || fail +echo $PWD1 | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV -S1 -d $KEY1 || fail + +echo $PWD3 | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV -S2 --unbound --key-size 32 || fail +echo $PWD3 | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV -S22 --unbound --key-size 32 || fail +echo $PWD3 | $CRYPTSETUP -q luksAddKey $FAST_PBKDF2 $DEV -S23 --unbound --key-size 32 || fail + +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -S1 -q || fail +$CRYPTSETUP open --test-passphrase -d $KEY1 $DEV 2>/dev/null && fail +echo $PWD3 | $CRYPTSETUP open --test-passphrase -S2 $DEV || fail +echo $PWD3 | $CRYPTSETUP open --test-passphrase -S22 $DEV || fail +check_hash $PWD1 $HASH2 + +# fill 31 keyslots +COUNT=27 +while [ $COUNT -gt 0 ]; do + echo -e "$PWD1\n$PWD1" | $CRYPTSETUP luksAddKey $DEV -q $FAST_PBKDF_ARGON || fail + COUNT=$((COUNT-1)) +done + +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -S0 -q 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksKillSlot $DEV 30 || fail +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -S0 || fail + +COUNT=14 +while [ $COUNT -gt 0 ]; do + echo -e "$PWD1\n$PWD1" | $CRYPTSETUP luksAddKey $DEV -q $FAST_PBKDF_ARGON || fail + COUNT=$((COUNT-1)) +done + +echo -e "$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1" | $CRYPTSETUP reencrypt $DEV -q 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP luksKillSlot $DEV 1 || fail +# one wrong passphrase +echo -e "$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD2" | $CRYPTSETUP reencrypt $DEV -q 2>/dev/null && fail +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --resume-only -q 2>/dev/null && fail +echo -e "$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1\n$PWD1" | $CRYPTSETUP reencrypt $DEV -q || fail + +echo "[23] Reencryption with specified new volume key" +prepare dev_size_mb=32 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 256 -c aes-cbc-essiv:sha256 --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q -S0 $FAST_PBKDF_ARGON --master-key-file $VKEY1 -s 128 || fail +check_hash $PWD1 $HASH1 +$CRYPTSETUP luksErase -q $DEV || fail +echo $PWD1 | $CRYPTSETUP luksAddKey -q $FAST_PBKDF_ARGON --master-key-file $VKEY1 -s 128 $DEV || fail +check_hash $PWD1 $HASH1 + +echo "[24] Reencryption with initial cipher_null" +# aka custom encryption +prepare dev_size_mb=32 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -c aes-xts-plain64 -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH1 + +# online +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -c aes-xts-plain64 -q $FAST_PBKDF_ARGON || fail +check_hash_dev /dev/mapper/$DEV_NAME $HASH1 +if [ $HAVE_KEYRING -gt 0 ]; then + $CRYPTSETUP status $DEV_NAME | grep -q "key location: keyring" || fail +fi +$CRYPTSETUP close $DEV_NAME + +# simulate LUKS2 device with cipher_null in both keyslot and segment (it can be created only by up conversion from LUKS1) +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail +$CRYPTSETUP convert -q --type luks2 $DEV || fail +wipe $PWD1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail +check_hash $PWD1 $HASH1 +# both keyslot and segment cipher must not be null after reencryption with default params +$CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail + +# multistep reencryption with initial cipher_null +preparebig 64 +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $DEV -c null --offset 16384 -q $FAST_PBKDF_ARGON || fail +echo $PWD1 | $CRYPTSETUP open $DEV $DEV_NAME +wipe_dev /dev/mapper/$DEV_NAME +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --hotzone-size 1M --resilience none -q $FAST_PBKDF_ARGON >/dev/null || fail +$CRYPTSETUP close $DEV_NAME +check_hash $PWD1 $HASH5 + +echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $DEV -c null --offset 16384 -q $FAST_PBKDF_ARGON || fail +wipe $PWD1 +echo $PWD1 | $CRYPTSETUP reencrypt $DEV --hotzone-size 1M --resilience none -q $FAST_PBKDF_ARGON >/dev/null || fail +check_hash $PWD1 $HASH5 + +echo "[25] Reencryption recovery with cipher_null" +# (check opt-io size optimization in reencryption code does not affect recovery) +# device with opt-io size 32k +prepare_linear_dev 32 opt_blks=64 $OPT_XFERLEN_EXP +OFFSET=8192 + +echo "sector size 512->512" + +get_error_offsets 32 $OFFSET +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover 512 checksum $HASH1 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +reencrypt_recover 512 journal $HASH1 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH1 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + reencrypt_recover 4096 journal $HASH1 + + echo "sector size 4096->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 4096 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover 4096 checksum $HASH1 + reencrypt_recover 4096 journal $HASH1 +fi + +echo "[26] Reencryption recovery with cipher_null (online i/o error)" + +echo "sector size 512->512" + +get_error_offsets 32 $OFFSET +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 -c null --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 + +echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" +reencrypt_recover_online 512 checksum $HASH1 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 --sector-size 512 -c null --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail +wipe $PWD1 +reencrypt_recover_online 512 journal $HASH1 + +if [ -n "$DM_SECTOR_SIZE" ]; then + echo "sector size 512->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH1 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 512 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + reencrypt_recover_online 4096 journal $HASH1 + + echo "sector size 4096->4096" + + get_error_offsets 32 $OFFSET 4096 + echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c null --sector-size 4096 --offset $OFFSET $FAST_PBKDF_ARGON $DEV || fail + wipe $PWD1 + check_hash $PWD1 $HASH1 + + echo "ERR writes to sectors [$ERROFFSET,$(($ERROFFSET+$ERRLENGTH-1))]" + reencrypt_recover_online 4096 checksum $HASH1 + reencrypt_recover_online 4096 journal $HASH1 +fi + +remove_mapping +exit 0 diff --git a/tests/luks2-validation-test b/tests/luks2-validation-test new file mode 100755 index 0000000..04183fb --- /dev/null +++ b/tests/luks2-validation-test @@ -0,0 +1,235 @@ +#!/bin/bash + +#turn on debug mode by following env. variable _DEBUG=1 + +PS4='$LINENO:' +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup + +CRYPTSETUP_VALGRIND=../.libs/cryptsetup +CRYPTSETUP_LIB_VALGRIND=../.libs + +START_DIR=$(pwd) + +IMG=luks2-backend.img +ORIG_IMG=luks2_valid_hdr.img +TST_IMGS=$START_DIR/luks2-images + +GEN_DIR=generators + +FAILS=0 + +[ -z "$srcdir" ] && srcdir="." + +function remove_mapping() +{ + rm -rf $IMG $TST_IMGS >/dev/null 2>&1 +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cd $START_DIR + remove_mapping + exit 2 +} + +fail_count() +{ + echo "$1" + FAILS=$((FAILS+1)) +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function prepare() # $1 dev1_size +{ + remove_mapping + + test -d $TST_IMGS || mkdir $TST_IMGS + + test -e $ORIG_IMG || xz -dkc $srcdir/$ORIG_IMG.xz >$ORIG_IMG + cp $ORIG_IMG $TST_IMGS + cp $ORIG_IMG $IMG +} + +function test_load() +{ + local _debug= + + test -z "$_DEBUG" || _debug="--debug" + + case "$1" in + R) + if [ -n "$_debug" ]; then + $CRYPTSETUP luksDump $_debug $IMG + else + $CRYPTSETUP luksDump $_debug $IMG > /dev/null 2>&1 + fi + test $? -eq 0 || return 1 + ;; + F) + if [ -n "$_debug" ]; then + $CRYPTSETUP luksDump $_debug $IMG + else + $CRYPTSETUP luksDump $_debug $IMG > /dev/null 2>&1 + fi + test $? -ne 0 || return 1 + ;; + *) + fail "Internal test error" + ;; + esac +} + +function RUN() +{ + echo -n "Test image: $1..." + cp $TST_IMGS/$1 $IMG || fail "Missing test image" + test_load $2 "$3" + if [ $? -ne 0 ]; then + fail_count "$3" + else + echo "OK" + fi +} + +function valgrind_setup() +{ + which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind." + [ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable." + export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@" +} + +[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run + +which jq >/dev/null 2>&1 || skip "Cannot find jq, test skipped." + +prepare + +echo "[0] Generating test headers" +cd $srcdir/$GEN_DIR +for scr in ./generate-*.sh; do + echo -n "$(basename $scr)..." + $scr $TST_IMGS $TST_IMGS/$ORIG_IMG || fail "Header generator $scr failed: '$?'" + echo "done" +done +cd $START_DIR + +echo "[1] Test basic auto-recovery" +RUN luks2-invalid-checksum-hdr0.img "R" "Failed to recover from trivial header corruption at offset 0" +# TODO: check epoch is incresed after recovery +# TODO: check only sectors related to corrupted hdr at offset 0 are written (dmstats tool/differ.c) + +RUN luks2-invalid-checksum-hdr1.img "R" "Failed to recover from trivial header corruption at offset 16384" +# TODO: check epoch is incresed after recovery +# TODO: check only sectors related to corrupted hdr at offset 16384 are written (dmstats tool/differ.c) + +RUN luks2-invalid-checksum-both-hdrs.img "F" "Failed to recognise corrupted header beyond repair" + +echo "[2] Test ability to auto-correct mallformed json area" +RUN luks2-corrupted-hdr0-with-correct-chks.img "R" "Failed to auto correct malformed json area at offset 512" +# TODO: check epoch is incresed after recovery +# TODO: check only sectors related to corrupted hdr at offset 0 are written (dmstats tool/differ.c) + +RUN luks2-corrupted-hdr1-with-correct-chks.img "R" "Failed to auto correct malformed json area at offset 16896" +# TODO: check epoch is incresed after recovery +# TODO: check only sectors related to corrupted hdr at offset 16384 are written (dmstats tool/differ.c) + +RUN luks2-correct-full-json0.img "R" "Failed to parse full and correct json area" +# TODO: detect noop (norecovery, epoch untouched) +# TODO: check epoch is NOT incresed after recovery of secondary header + +# these tests auto-correct json in-memory only. It'll get fixed on-disk after write operation +RUN luks2-argon2-leftover-params.img "R" "Failed to repair keyslot with old argon2 parameters." +RUN luks2-pbkdf2-leftover-params-0.img "R" "Failed to repair keyslot with old pbkdf2 parameters." +RUN luks2-pbkdf2-leftover-params-1.img "R" "Failed to repair keyslot with old pbkdf2 parameters." + +# Secondary header is always broken in following tests +echo "[3] Test LUKS2 json area restrictions" +RUN luks2-non-null-byte-beyond-json0.img "F" "Failed to detect illegal data right beyond json data string" +RUN luks2-non-null-bytes-beyond-json0.img "F" "Failed to detect illegal data in json area" +RUN luks2-missing-trailing-null-byte-json0.img "F" "Failed to detect missing terminal null byte" +RUN luks2-invalid-opening-char-json0.img "F" "Failed to detect invalid opening character in json area" +RUN luks2-invalid-object-type-json0.img "F" "Failed to detect invalid json object type" +RUN luks2-overlapping-areas-c0-json0.img "F" "Failed to detect two exactly same area specifications" +RUN luks2-overlapping-areas-c1-json0.img "F" "Failed to detect two intersecting area specifications" +RUN luks2-overlapping-areas-c2-json0.img "F" "Failed to detect two slightly intersecting area specifications" +RUN luks2-area-in-json-hdr-space-json0.img "F" "Failed to detect area referencing LUKS2 header space" +RUN luks2-missing-keyslot-referenced-in-digest.img "F" "Failed to detect missing keyslot referenced in digest" +RUN luks2-missing-segment-referenced-in-digest.img "F" "Failed to detect missing segment referenced in digest" +RUN luks2-missing-keyslot-referenced-in-token.img "F" "Failed to detect missing keyslots referenced in token" +RUN luks2-keyslot-missing-digest.img "F" "Failed to detect missing keyslot digest." +RUN luks2-keyslot-too-many-digests.img "F" "Failed to detect keyslot has too many digests." + +echo "[4] Test integers value limits" +RUN luks2-uint64-max-segment-size.img "R" "Validation rejected correct value" +RUN luks2-uint64-overflow-segment-size.img "F" "Failed to detect uint64_t overflow" +RUN luks2-uint64-signed-segment-size.img "F" "Failed to detect negative value" + +echo "[5] Test segments validation" +RUN luks2-segment-missing-type.img "F" "Failed to detect missing type field" +RUN luks2-segment-wrong-type.img "F" "Failed to detect invalid type field" +RUN luks2-segment-missing-offset.img "F" "Failed to detect missing offset field" +RUN luks2-segment-wrong-offset.img "F" "Failed to detect invalid offset field" +RUN luks2-segment-missing-size.img "F" "Failed to detect missing size field" +RUN luks2-segment-wrong-size-0.img "F" "Failed to detect invalid size field" +RUN luks2-segment-wrong-size-1.img "F" "Failed to detect invalid size field" +RUN luks2-segment-wrong-size-2.img "F" "Failed to detect invalid size field" +RUN luks2-segment-crypt-missing-encryption.img "F" "Failed to detect missing encryption field" +RUN luks2-segment-crypt-wrong-encryption.img "F" "Failed to detect invalid encryption field" +RUN luks2-segment-crypt-missing-ivoffset.img "F" "Failed to detect missing iv_tweak field" +RUN luks2-segment-crypt-wrong-ivoffset.img "F" "Failed to detect invalid iv_tweak field" +RUN luks2-segment-crypt-missing-sectorsize.img "F" "Failed to detect missing sector_size field" +RUN luks2-segment-crypt-wrong-sectorsize-0.img "F" "Failed to detect invalid sector_size field" +RUN luks2-segment-crypt-wrong-sectorsize-1.img "F" "Failed to detect invalid sector_size field" +RUN luks2-segment-crypt-wrong-sectorsize-2.img "F" "Failed to detect invalid sector_size field" +RUN luks2-segment-unknown-type.img "R" "Validation rejected segment with all mandatory fields correct" +RUN luks2-segment-two.img "R" "Validation rejected two valid segments" +RUN luks2-segment-wrong-flags.img "F" "Failed to detect invalid flags field" +RUN luks2-segment-wrong-flags-element.img "F" "Failed to detect invalid flags content" +RUN luks2-segment-wrong-backup-key-0.img "F" "Failed to detect gap in backup segments" +RUN luks2-segment-wrong-backup-key-1.img "F" "Failed to detect gap in backup segments" + +echo "[6] Test metadata size and keyslots size (config section)" +RUN luks2-invalid-keyslots-size-c0.img "F" "Failed to detect too large keyslots_size in config section" +RUN luks2-invalid-keyslots-size-c1.img "F" "Failed to detect unaligned keyslots_size in config section" +RUN luks2-invalid-keyslots-size-c2.img "F" "Failed to detect too small keyslots_size config section" +RUN luks2-invalid-json-size-c0.img "F" "Failed to detect invalid json_size config section" +RUN luks2-invalid-json-size-c1.img "F" "Failed to detect invalid json_size config section" +RUN luks2-invalid-json-size-c2.img "F" "Failed to detect mismatching json size in config and binary hdr" +RUN luks2-metadata-size-32k.img "R" "Valid 32KiB metadata size failed to validate" +RUN luks2-metadata-size-64k.img "R" "Valid 64KiB metadata size failed to validate" +RUN luks2-metadata-size-64k-inv-area-c0.img "F" "Failed to detect keyslot area trespassing in json area" +RUN luks2-metadata-size-64k-inv-area-c1.img "F" "Failed to detect keyslot area overflowing keyslots area" +RUN luks2-metadata-size-64k-inv-keyslots-size-c0.img "F" "Failed to detect keyslots size overflowing in data area" +RUN luks2-metadata-size-128k.img "R" "Valid 128KiB metadata size failed to validate" +RUN luks2-metadata-size-256k.img "R" "Valid 256KiB metadata size failed to validate" +RUN luks2-metadata-size-512k.img "R" "Valid 512KiB metadata size failed to validate" +RUN luks2-metadata-size-1m.img "R" "Valid 1MiB metadata size failed to validate" +RUN luks2-metadata-size-2m.img "R" "Valid 2MiB metadata size failed to validate" +RUN luks2-metadata-size-4m.img "R" "Valid 4MiB metadata size failed to validate" +RUN luks2-metadata-size-16k-secondary.img "R" "Valid 16KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-32k-secondary.img "R" "Valid 32KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-64k-secondary.img "R" "Valid 64KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-128k-secondary.img "R" "Valid 128KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-256k-secondary.img "R" "Valid 256KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-512k-secondary.img "R" "Valid 512KiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-1m-secondary.img "R" "Valid 1MiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-2m-secondary.img "R" "Valid 2MiB metadata size in secondary hdr failed to validate" +RUN luks2-metadata-size-4m-secondary.img "R" "Valid 4MiB metadata size in secondary hdr failed to validate" + +remove_mapping + +test $FAILS -eq 0 || fail "($FAILS wrong result(s) in total)" diff --git a/tests/luks2_header_requirements.xz b/tests/luks2_header_requirements.xz new file mode 100644 index 0000000..eaaa73c Binary files /dev/null and b/tests/luks2_header_requirements.xz differ diff --git a/tests/luks2_header_requirements_free.xz b/tests/luks2_header_requirements_free.xz new file mode 100644 index 0000000..7617ee6 Binary files /dev/null and b/tests/luks2_header_requirements_free.xz differ diff --git a/tests/luks2_keyslot_unassigned.img.xz b/tests/luks2_keyslot_unassigned.img.xz new file mode 100644 index 0000000..726cdd7 Binary files /dev/null and b/tests/luks2_keyslot_unassigned.img.xz differ diff --git a/tests/luks2_mda_images.tar.xz b/tests/luks2_mda_images.tar.xz new file mode 100644 index 0000000..a27f5c7 Binary files /dev/null and b/tests/luks2_mda_images.tar.xz differ diff --git a/tests/luks2_valid_hdr.img.xz b/tests/luks2_valid_hdr.img.xz new file mode 100644 index 0000000..4e03a20 Binary files /dev/null and b/tests/luks2_valid_hdr.img.xz differ diff --git a/tests/mode-test b/tests/mode-test new file mode 100755 index 0000000..d16482f --- /dev/null +++ b/tests/mode-test @@ -0,0 +1,171 @@ +#!/bin/bash +# +# Test mode compatibility, check input + kernel and cryptsetup cipher status +# +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +DEV_NAME=dmc_test +HEADER_IMG=mode-test.img +PASSWORD=3xrododenron +PASSWORD1=$PASSWORD + +# cipher-chainmode-ivopts:ivmode +CIPHERS="aes twofish serpent" +MODES="cbc lrw xts" +IVMODES="null benbi plain plain64 essiv:sha256" + +LOOPDEV=$(losetup -f 2>/dev/null) + +dmremove() { # device + udevadm settle >/dev/null 2>&1 + dmsetup remove --retry $1 >/dev/null 2>&1 +} + +cleanup() { + for dev in $(dmsetup status --target crypt | sed s/\:\ .*// | grep "^$DEV_NAME"_); do + dmremove $dev + sleep 2 + done + [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME + losetup -d $LOOPDEV >/dev/null 2>&1 + rm -f $HEADER_IMG >/dev/null 2>&1 +} + +fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup + exit 100 +} + +skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +add_device() { + cleanup + dd if=/dev/zero of=$HEADER_IMG bs=1M count=6 >/dev/null 2>&1 + sync + losetup $LOOPDEV $HEADER_IMG >/dev/null 2>&1 + dmsetup create $DEV_NAME --table "0 10240 linear $LOOPDEV 8" >/dev/null 2>&1 +} + +dmcrypt_check() # device outstring +{ + X=$(dmsetup table $1 2>/dev/null | sed 's/.*: //' | cut -d' ' -f 4) + if [ "$X" = $2 ] ; then + echo -n "[table OK]" + else + echo "[table FAIL]" + echo " Expecting $2 got $X." + fail + fi + + X=$($CRYPTSETUP status $1 | grep cipher: | sed s/\.\*cipher:\\s*//) + if [ $X = $2 ] ; then + echo -n "[status OK]" + else + echo "[status FAIL]" + echo " Expecting $2 got \"$X\"." + fail + fi + + dmremove $1 +} + +dmcrypt_check_sum() # cipher device +{ + EXPSUM="c036cbb7553a909f8b8877d4461924307f27ecb66cff928eeeafd569c3887e29" + # Fill device with zeroes and reopen it + dd if=/dev/zero of=/dev/mapper/$2 bs=1M count=6 >/dev/null 2>&1 + sync + dmremove $2 + + echo $PASSWORD | $CRYPTSETUP create -h sha256 -c $1 -s 256 $2 /dev/mapper/$DEV_NAME >/dev/null 2>&1 + ret=$? + VSUM=$(sha256sum /dev/mapper/$2 | cut -d' ' -f 1) + if [ $ret -eq 0 -a "$VSUM" = "$EXPSUM" ] ; then + echo -n "[OK]" + else + echo "[FAIL]" + echo " Expecting $EXPSUM got $VSUM." + fail + fi + + dmremove $2 +} + +dmcrypt() +{ + OUT=$2 + [ -z "$OUT" ] && OUT=$1 + printf "%-31s" "$1" + + echo $PASSWORD | $CRYPTSETUP create -h sha256 -c $1 -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME >/dev/null 2>&1 + if [ $? -eq 0 ] ; then + echo -n -e "PLAIN:" + dmcrypt_check "$DEV_NAME"_tstdev $OUT + else + echo -n "[n/a]" + fi + + echo $PASSWORD | $CRYPTSETUP luksFormat --type luks1 -i 1 -c $1 -s 256 /dev/mapper/$DEV_NAME >/dev/null 2>&1 + if [ $? -eq 0 ] ; then + echo -n -e " LUKS1:" + echo $PASSWORD | $CRYPTSETUP luksOpen /dev/mapper/$DEV_NAME "$DEV_NAME"_tstdev >/dev/null 2>&1 || fail + dmcrypt_check "$DEV_NAME"_tstdev $OUT + fi + + echo $PASSWORD | $CRYPTSETUP luksFormat --type luks2 --pbkdf pbkdf2 -i 1 -c $1 -s 256 --offset 8192 /dev/mapper/$DEV_NAME >/dev/null 2>&1 + if [ $? -eq 0 ] ; then + echo -n -e " LUKS2:" + echo $PASSWORD | $CRYPTSETUP luksOpen /dev/mapper/$DEV_NAME "$DEV_NAME"_tstdev >/dev/null 2>&1 || fail + dmcrypt_check "$DEV_NAME"_tstdev $OUT + fi + + # repeated device creation must return the same checksum + echo $PASSWORD | $CRYPTSETUP create -h sha256 -c $1 -s 256 "$DEV_NAME"_tstdev /dev/mapper/$DEV_NAME >/dev/null 2>&1 + if [ $? -eq 0 ] ; then + echo -n -e " CHECKSUM:" + dmcrypt_check_sum "$1" "$DEV_NAME"_tstdev + fi + echo +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ -z "$LOOPDEV" ] && skip "Cannot find free loop device, test skipped." + +add_device + +# compatibility modes +dmcrypt aes aes-cbc-plain +dmcrypt aes-plain aes-cbc-plain + +# empty cipher +PASSWORD="" +dmcrypt null cipher_null-ecb +dmcrypt cipher_null cipher_null-ecb +dmcrypt cipher_null-ecb + +PASSWORD=$PASSWORD1 +# codebook doesn't support IV at all +for cipher in $CIPHERS ; do + dmcrypt "$cipher-ecb" +done + +for cipher in $CIPHERS ; do + for mode in $MODES ; do + for ivmode in $IVMODES ; do + dmcrypt "$cipher-$mode-$ivmode" + done + done +done + +dmcrypt xchacha12,aes-adiantum-plain64 +dmcrypt xchacha20,aes-adiantum-plain64 + +cleanup diff --git a/tests/password-hash-test b/tests/password-hash-test new file mode 100755 index 0000000..0fb58b3 --- /dev/null +++ b/tests/password-hash-test @@ -0,0 +1,190 @@ +#!/bin/bash + +# check hash processing in create command + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +DEV_NAME=dmc_test +KEY_FILE=keyfile + +DEV2=$DEV_NAME"_x" + +dmremove() { # device + udevadm settle >/dev/null 2>&1 + dmsetup remove --retry $1 >/dev/null 2>&1 +} + +cleanup() { + [ -b /dev/mapper/$DEV2 ] && dmremove $DEV2 + [ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME + rm -f $KEY_FILE + exit $1 +} + +function fail() +{ + echo " $1 [FAILED]" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cleanup 2 +} + +crypt_key() # hash keysize pwd/file name outkey [limit] [offset] +{ + DEV2=$DEV_NAME"_x" + LIMIT="" + MODE=aes-cbc-essiv:sha256 + [ $2 -gt 256 ] && MODE=aes-xts-plain + [ -n "$6" ] && LIMIT="-l $6" + [ -n "$7" ] && LIMIT="$LIMIT --keyfile-offset $7" + + echo -n "HASH: $1 KSIZE: $2 / $3" + case "$3" in + pwd) + echo -e -n "$4" | $CRYPTSETUP create -c $MODE -h $1 -s $2 $LIMIT $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + std-) + echo -e -n "$4" | $CRYPTSETUP create -c $MODE -d "-" -h $1 -s $2 $LIMIT $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + stdin) + echo -e -n "$4" | $CRYPTSETUP create -c $MODE -h $1 -s $2 $LIMIT $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + cat) + cat $4 | $CRYPTSETUP create -c $MODE -h $1 -s $2 $LIMIT $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + cat-) + cat $4 | $CRYPTSETUP create -c $MODE -h $1 -s $2 $LIMIT $DEV2 -d - /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + file) + $CRYPTSETUP create -q -c $MODE -d $4 -h $1 -s $2 $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null + ret=$? + ;; + failpwd) + echo -e -n "$4" | $CRYPTSETUP create -c $MODE -h $1 -s $2 $LIMIT $DEV2 /dev/mapper/$DEV_NAME 2>/dev/null && fail "Expecting failure" + echo " [OK]" + return + ;; + *) + fail "" + ;; + esac + + # ignore these cases, not all libs/kernel supports it + if [ "$1" != "sha1" -a "$1" != "sha256" ] || [ $2 -gt 256 ] ; then + if [ $ret -ne 0 ] ; then + echo " [N/A] ($ret, SKIPPED)" + return + fi + fi + + VKEY=$(dmsetup table $DEV2 --showkeys 2>/dev/null | sed 's/.*: //' | cut -d' ' -f 5) + if [ "$VKEY" != "$5" ] ; then + echo " [FAILED]" + echo "expected: $5" + echo "real key: $VKEY" + cleanup 100 + else + echo " [OK]" + fi + + dmremove $DEV2 +} + +if [ $(id -u) != 0 ]; then + echo "WARNING: You must be root to run this test, test skipped." + exit 77 +fi + +dmsetup create $DEV_NAME --table "0 10240 zero" >/dev/null 2>&1 + +crypt_key ripemd160 0 pwd "xxx" aeb26d1f69eb6dddfb9381eed4d7299f091e99aa5d3ff06866d4ce9f620f7aca +crypt_key ripemd160 256 pwd "xxx" aeb26d1f69eb6dddfb9381eed4d7299f091e99aa5d3ff06866d4ce9f620f7aca +crypt_key ripemd160 128 pwd "xxx" aeb26d1f69eb6dddfb9381eed4d7299f +crypt_key sha1 256 pwd "xxx" b60d121b438a380c343d5ec3c2037564b82ffef30b1e0a6ad9af7a73aa91c197 +crypt_key sha1 128 pwd "xxx" b60d121b438a380c343d5ec3c2037564 +crypt_key sha256 256 pwd "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860 +crypt_key sha256 128 pwd "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7 + +crypt_key sha256 0 std- "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860 +crypt_key sha256 256 std- "xxx\n" 042aea10a0f14f2d391373599be69d53a75dde9951fc3d3cd10b6100aa7a9f24 +crypt_key sha256 128 std- "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" \ + 2a42b97084779dcedf2c66405c5d296c +crypt_key sha256 256 stdin "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860 +crypt_key sha256 0 stdin "xxx\n" cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860 + +# with keyfile, hash is ignored +crypt_key ripemd160 256 file /dev/zero 0000000000000000000000000000000000000000000000000000000000000000 +crypt_key sha256 256 file /dev/zero 0000000000000000000000000000000000000000000000000000000000000000 +crypt_key unknown* 256 file /dev/zero 0000000000000000000000000000000000000000000000000000000000000000 + +# limiting key +crypt_key sha256:20 256 pwd "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7b4580588000000000000000000000000 +crypt_key sha256:32 256 pwd "xxx" cd2eb0837c9b4c962c22d2ff8b5441b7b45805887f051d39bf133b583baf6860 + +crypt_key sha256: 256 failpwd "xxx" x +crypt_key sha256:xx 256 failpwd "xxx" x + +# key file, 80 chars +echo -n -e "0123456789abcdef\n\x01\x00\x03\xff\xff\r\xff\xff\n\r" \ + "2352j3rkjhadcfasc823rqaw7e1 3dq sdq3d 2dkjqw3h2=====" >$KEY_FILE +KEY_FILE_HEX="303132333435363738396162636465660a010003ffff0dffff0a0d20323335326a33726b6a686164636661736338323372716177376531203364712073647133" + + +# ignore hash if keyfile is specified +crypt_key ripemd160 256 file $KEY_FILE ${KEY_FILE_HEX:0:64} +crypt_key sha256 256 file $KEY_FILE ${KEY_FILE_HEX:0:64} +crypt_key sha256 128 file $KEY_FILE ${KEY_FILE_HEX:0:32} +crypt_key sha256 512 file $KEY_FILE $KEY_FILE_HEX + +# stdin can be limited +crypt_key plain 128 cat /dev/zero 00000000000000000000000000000000 16 +crypt_key plain 128 cat /dev/zero 00000000000000000000000000000000 17 + +# read key only up to \n +crypt_key plain 128 cat $KEY_FILE ${KEY_FILE_HEX:0:28}0000 14 + +# read full key, ignore keyfile length +crypt_key plain 128 cat- $KEY_FILE ${KEY_FILE_HEX:0:32} +crypt_key plain 128 cat- $KEY_FILE ${KEY_FILE_HEX:0:32} 14 + +# but do not ignore hash if keysgfile is "-" +crypt_key sha256 128 cat- $KEY_FILE f3b827c8a6f159ad8c8ed5bd5ab3f8c5 +crypt_key sha256 128 cat- $KEY_FILE f3b827c8a6f159ad8c8ed5bd5ab3f8c5 0 +crypt_key sha256 128 cat- $KEY_FILE f3b827c8a6f159ad8c8ed5bd5ab3f8c5 80 +crypt_key sha256 128 cat- $KEY_FILE a82c9227cc54c7475620ce85ba1fca1e 14 +crypt_key sha256 128 cat- $KEY_FILE 7df3f4a41a33805596be85c781cac3b4 14 2 +crypt_key sha256 128 cat- $KEY_FILE ebbe65a178e886ddbb778e0a5538db72 40 40 + +# limiting plain (no hash) +crypt_key plain 256 pwd "xxxxxxxx" 7878787878787878000000000000000000000000000000000000000000000000 +crypt_key plain:2 256 pwd "xxxxxxxx" 7878000000000000000000000000000000000000000000000000000000000000 +crypt_key plain:9 256 failpwd "xxxxxxxx" x + +crypt_key sha256 128 cat $KEY_FILE a82c9227cc54c7475620ce85ba1fca1e 14 +crypt_key sha256:14 128 cat $KEY_FILE a82c9227cc54c7475620ce85ba1f0000 14 + +crypt_key sha256 128 pwd "0123456789abcdef" 9f9f5111f7b27a781f1f1ddde5ebc2dd 16 +crypt_key sha256 128 pwd "0123456789abcdef" 1be2e452b46d7a0d9656bbb1f768e824 4 +crypt_key sha256 128 pwd "0123" 1be2e452b46d7a0d9656bbb1f768e824 4 + +# Test list of various hash algorithms +crypt_key sha1 256 pwd "0123456789abcdef" fe5567e8d769550852182cdf69d74bb16dff8e295e4b6077d6d3fc73e7fe33b0 +crypt_key sha224 256 pwd "0123456789abcdef" 7330215f6741fd2bacbd3658681a70f65e2e90a02887989018974ce83775a568 +crypt_key sha256 256 pwd "0123456789abcdef" 9f9f5111f7b27a781f1f1ddde5ebc2dd2b796bfc7365c9c28b548e564176929f +crypt_key sha384 256 pwd "0123456789abcdef" fc6304023487cb6f85ac80e47817760c6b153c02da46c6429649e963b031e525 +crypt_key sha512 256 pwd "0123456789abcdef" 1c043fbe4bca7c7920dae536c680fd44c15d71ec12cd82a2a9491b0043b57f4d +crypt_key ripemd160 256 pwd "0123456789abcdef" edf4e38018cd71dd489b9c1e54b32054eb42dfad9fdcc22d629d756391a24982 +crypt_key whirlpool 256 pwd "0123456789abcdef" b21fc274d47d79ba45f94d67077f0846f75a7acc1a4dc560eacca300179cc142 +crypt_key sha3-224 256 pwd "0123456789abcdef" bbb7d56cc80a8c80e907f7d9240edc0be264aa173266b30918bc1065d59a9388 +crypt_key sha3-256 256 pwd "0123456789abcdef" a5df4caae9fdb5dbacf667075b709a2f30a115c43168af332062b42d4b0da01f +crypt_key sha3-384 256 pwd "0123456789abcdef" 56f351f754c418892eab4009e5f85c8d5436a591014503563e9395b895526413 +crypt_key sha3-512 256 pwd "0123456789abcdef" 59d06155d25dffdb982729de8dce9d7855ca094d8bab8124b347c40668477056 +crypt_key sm3 256 pwd "0123456789abcdef" a34fdd8e843802b31a262dce5b1f501bed68ef81520de14b39657aecffaf8a86 +crypt_key stribog512 256 pwd "0123456789abcdef" ab1284a64c2325c0ad52494e696df9aa9b92e701605a9a1258b58be08e8240ea + +cleanup 0 diff --git a/tests/reencryption-compat-test b/tests/reencryption-compat-test new file mode 100755 index 0000000..6dc85bd --- /dev/null +++ b/tests/reencryption-compat-test @@ -0,0 +1,397 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +REENC=$CRYPTSETUP_PATH/cryptsetup-reencrypt +FAST_PBKDF="--pbkdf-force-iterations 1000" + +DEV_NAME=reenc9768 +DEV_NAME2=reenc1273 +IMG=reenc-data +IMG_HDR=$IMG.hdr +ORIG_IMG=reenc-data-orig +KEY1=key1 +PWD1="93R4P4pIqAH8" +PWD2="1cND4319812f" +PWD3="1-9Qu5Ejfnqv" + +MNT_DIR=./mnt_luks +START_DIR=$(pwd) + +function del_scsi_device() +{ + rmmod scsi_debug 2>/dev/null + sleep 2 +} + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2 + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + [ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1 + rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 >/dev/null 2>&1 + umount $MNT_DIR > /dev/null 2>&1 + rmdir $MNT_DIR > /dev/null 2>&1 + LOOPDEV1="" + del_scsi_device +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cd $START_DIR + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function add_scsi_device() { + del_scsi_device + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 2 + SCSI_DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + [ -b $SCSI_DEV ] || fail "Cannot find $SCSI_DEV." +} + +function open_crypt() # $1 pwd, $2 hdr +{ + if [ -n "$2" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $LOOPDEV1 $DEV_NAME --header $2 || fail + elif [ -n "$1" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $LOOPDEV1 $DEV_NAME || fail + else + $CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV1 $DEV_NAME || fail + fi +} + +function wipe_dev() # $1 dev +{ + dd if=/dev/zero of=$1 bs=256k >/dev/null 2>&1 +} + +function wipe() # $1 pass +{ + open_crypt $1 + wipe_dev /dev/mapper/$DEV_NAME + udevadm settle >/dev/null 2>&1 + $CRYPTSETUP luksClose $DEV_NAME || fail +} + +function prepare() # $1 dev1_siz +{ + remove_mapping + + dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1 + LOOPDEV1=$(losetup -f 2>/dev/null) + [ -z "$LOOPDEV1" ] && fail "No free loop device" + losetup $LOOPDEV1 $IMG + + if [ ! -e $KEY1 ]; then + dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + fi +} + +function check_hash_dev() # $1 dev, $2 hash +{ + HASH=$(sha256sum $1 | cut -d' ' -f 1) + [ $HASH != "$2" ] && fail "HASH differs ($HASH)" +} + +function check_hash() # $1 pwd, $2 hash, $3 hdr +{ + open_crypt $1 $3 + check_hash_dev /dev/mapper/$DEV_NAME $2 + $CRYPTSETUP remove $DEV_NAME || fail +} + +function backup_orig() +{ + sync + losetup -d $LOOPDEV1 + cp $IMG $ORIG_IMG + losetup $LOOPDEV1 $IMG +} + +function rollback() +{ + sync + losetup -d $LOOPDEV1 + cp $ORIG_IMG $IMG + losetup $LOOPDEV1 $IMG +} + +function check_slot() #space separated list of ENABLED key slots +{ + local _KS0=DISABLED + local _KS1=$_KS0 _KS2=$_KS0 _KS3=$_KS0 _KS4=$_KS0 _KS5=$_KS0 _KS6=$_KS0 _KS7=$_KS0 + local _tmp + + for _tmp in $*; do + eval _KS$_tmp=ENABLED + done + + local _out=$($CRYPTSETUP luksDump $LOOPDEV1 | grep -e "Key Slot" | cut -d ' ' -f 4) + + local _i=0 + for _tmp in $_out; do + eval local _orig="\${_KS${_i}}" + if [ "$_tmp" != "$_orig" ]; then + echo "Keyslot $_i is $_tmp, expected result: $_orig" + return 1 + fi + _i=$[_i+1] + done + + return 0 +} + +function simple_scsi_reenc() +{ + echo -n "$1" + echo $PWD1 | $CRYPTSETUP luksFormat --type luks1 $FAST_PBKDF $SCSI_DEV || fail + + echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail + HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1) + $CRYPTSETUP luksClose $DEV_NAME || fail + + echo $PWD1 | $REENC -q $FAST_PBKDF $SCSI_DEV || fail + + echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail + check_hash_dev /dev/mapper/$DEV_NAME $HASH + $CRYPTSETUP luksClose $DEV_NAME || fail +} + +function mount_and_test() { + test -d $MNT_DIR || mkdir -p $MNT_DIR + mount $@ $MNT_DIR 2>/dev/null || { + echo -n "failed to mount [SKIP]" + return 0 + } + rm $MNT_DIR/* 2>/dev/null + cd $MNT_DIR + + if [ "${REENC:0:1}" != "/" ] ; then + MNT_REENC=$START_DIR/$REENC + else + MNT_REENC=$REENC + fi + + echo $PWD2 | $MNT_REENC $LOOPDEV1 -q --use-fsync --use-directio --write-log $FAST_PBKDF || return 1 + cd $START_DIR + umount $MNT_DIR + echo -n [OK] +} + +function test_logging_tmpfs() { + echo -n "[tmpfs]" + mount_and_test -t tmpfs none -o size=$[25*1024*1024] || return 1 + echo +} + +function test_logging() { + echo -n "$1:" + for img in $(ls img_fs*img.xz) ; do + wipefs -a $SCSI_DEV > /dev/null + echo -n "[${img%.img.xz}]" + xz -d -c $img | dd of=$SCSI_DEV bs=4k >/dev/null 2>&1 + mount_and_test $SCSI_DEV || return 1 + done + echo +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$REENC" ] && skip "Cannot find $REENC, test skipped." +which wipefs >/dev/null 2>&1 || skip "Cannot find wipefs, test skipped." + +# REENCRYPTION tests + +HASH1=b69dae56a14d1a8314ed40664c4033ea0a550eea2673e04df42a66ac6b9faf2c +HASH2=d85ef2a08aeac2812a648deb875485a6e3848fc3d43ce4aa380937f08199f86b +HASH3=e4e5749032a5163c45125eccf3e8598ba5ed840df442c97e1d5ad4ad84359605 +HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74 +HASH5=5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef + +echo "[1] Reencryption" +prepare 8192 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c aes-cbc-plain $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 $FAST_PBKDF +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 -c aes-xts-plain64 -h sha256 $FAST_PBKDF +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --use-directio $FAST_PBKDF +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --master-key-file /dev/urandom $FAST_PBKDF +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q -s 512 --master-key-file /dev/urandom $FAST_PBKDF +check_hash $PWD1 $HASH1 +$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail + +echo "[2] Reencryption with data shift" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 2048 $LOOPDEV1 || fail +wipe $PWD1 +echo $PWD1 | $REENC $LOOPDEV1 -q -s 256 --reduce-device-size 1024S $FAST_PBKDF || fail +check_hash $PWD1 $HASH2 +echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF || fail +check_hash $PWD1 $HASH2 +$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail + +echo "[3] Reencryption with keyfile" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF --align-payload 4096 $LOOPDEV1 || fail +wipe +check_hash "" $HASH1 +echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $LOOPDEV1 $FAST_PBKDF || fail +$REENC $LOOPDEV1 -d $KEY1 $FAST_PBKDF -q 2>/dev/null && fail +$REENC $LOOPDEV1 -d $KEY1 -S 0 $FAST_PBKDF -q || fail +check_hash "" $HASH1 +check_slot 0 || fail "Only keyslot 0 expected to be enabled" +$REENC $LOOPDEV1 -d $KEY1 $FAST_PBKDF -q || fail +# FIXME echo $PWD1 | $REENC ... + +echo "[4] Encryption of not yet encrypted device" +# well, movin' zeroes :-) +OFFSET=2048 +SIZE=$(blockdev --getsz $LOOPDEV1) +wipe_dev $LOOPDEV1 +dmsetup create $DEV_NAME2 --table "0 $(($SIZE - $OFFSET)) linear $LOOPDEV1 0" || fail +check_hash_dev /dev/mapper/$DEV_NAME2 $HASH3 +dmsetup remove --retry $DEV_NAME2 || fail +echo $PWD1 | $REENC $LOOPDEV1 -c aes-cbc-essiv:sha256 -s 128 --new --type luks1 --reduce-device-size "$OFFSET"S -q $FAST_PBKDF || fail +check_hash $PWD1 $HASH3 +$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail +# 64MiB + 1 KiB +prepare 65537 +OFFSET=131072 +SIZE=$(blockdev --getsz $LOOPDEV1) +wipe_dev $LOOPDEV1 +dmsetup create $DEV_NAME2 --table "0 $(($SIZE - $OFFSET)) linear $LOOPDEV1 0" || fail +check_hash_dev /dev/mapper/$DEV_NAME2 $HASH5 +dmsetup remove --retry $DEV_NAME2 || fail +echo $PWD1 | $REENC $LOOPDEV1 -c aes-cbc-essiv:sha256 -s 128 --new --type luks1 --reduce-device-size "$OFFSET"S -q $FAST_PBKDF || fail +check_hash $PWD1 $HASH5 +$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail +prepare 8192 +OFFSET=4096 +echo fake | $REENC $LOOPDEV1 -d $KEY1 --new --type luks1 --reduce-device-size "$OFFSET"S -q $FAST_PBKDF || fail +$CRYPTSETUP open --test-passphrase $LOOPDEV1 -d $KEY1 || fail +wipe_dev $LOOPDEV1 + +echo "[5] Reencryption using specific keyslot" +echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 1 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 2 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 3 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 4 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 5 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 6 $LOOPDEV1 || fail +echo -e "$PWD2\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF -S 7 $LOOPDEV1 || fail +backup_orig +echo $PWD2 | $REENC $FAST_PBKDF -S 0 -q $LOOPDEV1 || fail +check_slot 0 || fail "Only keyslot 0 expected to be enabled" +wipe $PWD2 +rollback +echo $PWD1 | $REENC $FAST_PBKDF -S 1 -q $LOOPDEV1 || fail +check_slot 1 || fail "Only keyslot 1 expected to be enabled" +wipe $PWD1 +rollback +echo $PWD2 | $REENC $FAST_PBKDF -S 6 -q $LOOPDEV1 || fail +check_slot 6 || fail "Only keyslot 6 expected to be enabled" +wipe $PWD2 +rollback +echo $PWD3 | $REENC $FAST_PBKDF -S 7 -q $LOOPDEV1 || fail +check_slot 7 || fail "Only keyslot 7 expected to be enabled" +wipe $PWD3 +rollback +echo $PWD3 | $REENC $FAST_PBKDF -S 8 -q $LOOPDEV1 2>/dev/null && fail +$CRYPTSETUP luksDump $LOOPDEV1 > /dev/null || fail + +echo "[6] Reencryption using all active keyslots" +echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $LOOPDEV1 $FAST_PBKDF || fail +check_slot 0 1 2 3 4 5 6 7 || fail "All keyslots expected to be enabled" + +echo "[7] Reencryption of block devices with different block size" +add_scsi_device sector_size=512 dev_size_mb=8 +simple_scsi_reenc "[512 sector]" +add_scsi_device sector_size=4096 dev_size_mb=8 +simple_scsi_reenc "[4096 sector]" +add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=8 +simple_scsi_reenc "[4096/512 sector]" +echo "[OK]" + +echo "[8] Header only reencryption (hash and iteration time)" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 --hash sha1 $FAST_PBKDF $LOOPDEV1 || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --pbkdf-force-iterations 999 2>/dev/null && fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --hash sha256 --pbkdf-force-iterations 1001 +check_hash $PWD1 $HASH1 +[ "$($CRYPTSETUP luksDump $LOOPDEV1 | grep -A1 -m1 "Key Slot 0" | grep Iterations: | sed -e 's/[[:space:]]\+Iterations:\ \+//g')" -eq 1001 ] || fail +[ "$($CRYPTSETUP luksDump $LOOPDEV1 | grep -m1 "Hash spec:" | cut -f2)" = "sha256" ] || fail +echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key --hash sha512 $FAST_PBKDF +check_hash $PWD1 $HASH1 +[ "$($CRYPTSETUP luksDump $LOOPDEV1 | grep -A1 -m1 "Key Slot 0" | grep Iterations: | sed -e 's/[[:space:]]\+Iterations:\ \+//g')" -eq 1000 ] || fail +echo $PWD1 | $REENC $LOOPDEV1 -q --keep-key $FAST_PBKDF +check_hash $PWD1 $HASH1 +$CRYPTSETUP --type luks1 luksDump $LOOPDEV1 > /dev/null || fail + +echo "[9] Test log I/Os on various underlying block devices" +prepare 8192 +echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail +add_scsi_device sector_size=512 dev_size_mb=32 +test_logging "[512 sector]" || fail +add_scsi_device sector_size=4096 dev_size_mb=32 +test_logging "[4096 sector]" || fail +add_scsi_device sector_size=512 dev_size_mb=32 physblk_exp=3 +test_logging "[4096/512 sector]" || fail +test_logging_tmpfs || fail + +echo "[10] Removal of encryption" +prepare 8192 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF $LOOPDEV1 || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --decrypt || fail +check_hash_dev $LOOPDEV1 $HASH4 + +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -S5 $FAST_PBKDF $LOOPDEV1 || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +echo $PWD1 | $REENC $LOOPDEV1 -q --decrypt || fail +check_hash_dev $LOOPDEV1 $HASH4 + +echo "[11] Detached header - adding encryption/reencryption/decryption" +prepare 8192 +check_hash_dev $IMG $HASH4 +echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new --type luks1 +check_hash $PWD1 $HASH4 $IMG_HDR +echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR +check_hash $PWD1 $HASH4 $IMG_HDR +echo $PWD1 | $REENC $LOOPDEV1 -q --header $IMG_HDR --decrypt +check_hash_dev $IMG $HASH4 +# existing header of zero size +cat /dev/null >$IMG_HDR +echo $PWD1 | $REENC $LOOPDEV1 -q $FAST_PBKDF --header $IMG_HDR --new --type luks1 +check_hash $PWD1 $HASH4 $IMG_HDR +$CRYPTSETUP isLuks $LOOPDEV1 && fail +$CRYPTSETUP isLuks $IMG_HDR || fail + +remove_mapping +exit 0 diff --git a/tests/reencryption-compat-test2 b/tests/reencryption-compat-test2 new file mode 100755 index 0000000..812788a --- /dev/null +++ b/tests/reencryption-compat-test2 @@ -0,0 +1,473 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +REENC=$CRYPTSETUP_PATH/cryptsetup-reencrypt +FAST_PBKDF_ARGON="--pbkdf-force-iterations 4 --pbkdf-memory 32 --pbkdf-parallel 1" +FAST_PBKDF_PBKDF2="--pbkdf-force-iterations 1000 --pbkdf pbkdf2" +DEFAULT_ARGON="argon2i" + +DEV_NAME=reenc9768 +DEV_NAME2=reenc1273 +IMG=reenc-data +IMG_HDR=$IMG.hdr +ORIG_IMG=reenc-data-orig +KEY1=key1 +PWD1="93R4P4pIqAH8" +PWD2="1cND4319812f" +PWD3="1-9Qu5Ejfnqv" + +MNT_DIR=./mnt_luks +START_DIR=$(pwd) +[ -f /etc/system-fips ] && FIPS_MODE=$(cat /proc/sys/crypto/fips_enabled 2>/dev/null) + +function fips_mode() +{ + [ -n "$FIPS_MODE" ] && [ "$FIPS_MODE" -gt 0 ] +} + +function dm_crypt_features() +{ + local VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-crypt version." + + local VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + local VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + [ $VER_MAJ -lt 1 ] && return + [ $VER_MAJ -eq 1 -a $VER_MIN -lt 11 ] && return + ALLOW_DISCARDS=--allow-discards + [ $VER_MAJ -eq 1 -a $VER_MIN -lt 14 ] && return + PERF_CPU=--perf-same_cpu_crypt +} + +function del_scsi_device() +{ + rmmod scsi_debug 2>/dev/null + sleep 2 +} + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2 + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME + rm -f $IMG $IMG_HDR $ORIG_IMG $KEY1 >/dev/null 2>&1 + umount $MNT_DIR > /dev/null 2>&1 + rmdir $MNT_DIR > /dev/null 2>&1 + del_scsi_device +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + cd $START_DIR + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function add_scsi_device() { + del_scsi_device + modprobe scsi_debug $@ delay=0 + if [ $? -ne 0 ] ; then + echo "This kernel seems to not support proper scsi_debug module, test skipped." + exit 77 + fi + + sleep 2 + SCSI_DEV="/dev/"$(grep -l -e scsi_debug /sys/block/*/device/model | cut -f4 -d /) + [ -b $SCSI_DEV ] || fail "Cannot find $SCSI_DEV." +} + +function open_crypt() # $1 pwd, $2 hdr +{ + if [ -n "$2" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME --header $2 || fail + elif [ -n "$1" ] ; then + echo "$1" | $CRYPTSETUP luksOpen $IMG $DEV_NAME || fail + else + $CRYPTSETUP luksOpen -d $KEY1 $IMG $DEV_NAME || fail + fi +} + +function wipe_dev() # $1 dev +{ + dd if=/dev/zero of=$1 bs=256k conv=notrunc >/dev/null 2>&1 +} + +function wipe() # $1 pass +{ + open_crypt $1 + wipe_dev /dev/mapper/$DEV_NAME + udevadm settle >/dev/null 2>&1 + $CRYPTSETUP luksClose $DEV_NAME || fail +} + +function prepare() # $1 dev1_siz +{ + remove_mapping + + dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1 + + if [ ! -e $KEY1 ]; then + dd if=/dev/urandom of=$KEY1 count=1 bs=32 >/dev/null 2>&1 + fi +} + +function check_hash_dev() # $1 dev, $2 hash, $3 size +{ + if [ -n "$3" ]; then + HASH=$(head -c $3 $1 | sha256sum | cut -d' ' -f 1) + else + HASH=$(sha256sum $1 | cut -d' ' -f 1) + fi + [ $HASH != "$2" ] && fail "HASH differs ($HASH)" +} + +function check_hash() # $1 pwd, $2 hash, $3 hdr +{ + open_crypt $1 $3 + check_hash_dev /dev/mapper/$DEV_NAME $2 + $CRYPTSETUP remove $DEV_NAME || fail +} + +function backup_orig() +{ + sync + cp $IMG $ORIG_IMG +} + +function rollback() +{ + sync + cp $ORIG_IMG $IMG +} + +function check_slot() #space separated list of active key slots +{ + local _out=$($CRYPTSETUP luksDump $IMG | grep -e ": luks2" | sed -e 's/[[:space:]]*\([0-9]\+\):.*/\1/g') + + local _req + local _hdr + local _j + + for _i in $*; do + _j=$((_i)) + _req="$_req $_j" + done + + for _i in $_out; do + _j=$((_i)) + _hdr="$_hdr $_j" + done + + test "$_req" = "$_hdr" +} + +function simple_scsi_reenc() +{ + echo -n "$1" + echo $PWD1 | $CRYPTSETUP luksFormat --type luks2 $FAST_PBKDF_ARGON $SCSI_DEV || fail + + echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail + HASH=$(sha256sum /dev/mapper/$DEV_NAME | cut -d' ' -f 1) + $CRYPTSETUP luksClose $DEV_NAME || fail + + echo $PWD1 | $REENC -q $FAST_PBKDF_ARGON $SCSI_DEV || fail + + echo $PWD1 | $CRYPTSETUP luksOpen $SCSI_DEV $DEV_NAME || fail + check_hash_dev /dev/mapper/$DEV_NAME $HASH + $CRYPTSETUP luksClose $DEV_NAME || fail +} + +function mount_and_test() { + test -d $MNT_DIR || mkdir -p $MNT_DIR + mount $@ $MNT_DIR 2>/dev/null || { + echo -n "failed to mount [SKIP]" + return 0 + } + rm $MNT_DIR/* 2>/dev/null + cd $MNT_DIR + + if [ "${REENC:0:1}" != "/" ] ; then + MNT_REENC=$START_DIR/$REENC + else + MNT_REENC=$REENC + fi + echo $PWD2 | $MNT_REENC $START_DIR/$IMG -q --use-fsync --use-directio --write-log $FAST_PBKDF_ARGON || return 1 + cd $START_DIR + umount $MNT_DIR + echo -n [OK] +} + +function test_logging_tmpfs() { + echo -n "[tmpfs]" + mount_and_test -t tmpfs none -o size=$[25*1024*1024] || return 1 + echo +} + +function test_logging() { + echo -n "$1:" + for img in $(ls img_fs*img.xz) ; do + wipefs -a $SCSI_DEV > /dev/null + echo -n "[${img%.img.xz}]" + xz -d -c $img | dd of=$SCSI_DEV bs=4k >/dev/null 2>&1 + mount_and_test $SCSI_DEV || return 1 + done + echo +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$REENC" ] && skip "Cannot find $REENC, test skipped." +which wipefs >/dev/null || skip "Cannot find wipefs, test skipped." +fips_mode && skip "This test cannot be run in FIPS mode." + +# REENCRYPTION tests + +HASH1=b69dae56a14d1a8314ed40664c4033ea0a550eea2673e04df42a66ac6b9faf2c +HASH4=2daeb1f36095b44b318410b3f4e8b5d989dcc7bb023d1426c492dab0a3053e74 +HASH5=bb9f8df61474d25e71fa00722318cd387396ca1736605e1248821cc0de3d3af8 +HASH6=4d9cbaf3aa0935a8c113f139691b3daf9c94c8d6c278aedc8eec66a4b9f6c8ae +HASH7=5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef + +echo "[1] Reencryption" +prepare 8192 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q -s 256 $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q -s 256 -c aes-xts-plain64 -h sha256 $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --use-directio $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --master-key-file /dev/urandom $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q -s 512 --master-key-file /dev/urandom $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 --luks2-metadata-size 128k -c aes-cbc-plain $FAST_PBKDF_ARGON --offset 8192 $IMG > /dev/null || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON > /dev/null || fail +check_hash $PWD1 $HASH5 +MDA_SIZE=$($CRYPTSETUP luksDump $IMG | grep "Metadata area: " | cut -f 3 -d ' ') +test "$MDA_SIZE" -eq 131072 || fail "Unexpected Metadata area size $MDA_SIZE" + +echo "[2] Reencryption with data shift" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail +wipe $PWD1 +echo $PWD1 | $REENC $IMG -q -s 256 --reduce-device-size 1024S $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH6 +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH6 +$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail + +echo "[3] Reencryption with keyfile" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -d $KEY1 -c aes-cbc-essiv:sha256 -s 128 $FAST_PBKDF_ARGON --offset 8192 $IMG || fail +wipe +check_hash "" $HASH5 +echo $PWD1 | $CRYPTSETUP -q luksAddKey -d $KEY1 $IMG $FAST_PBKDF_ARGON || fail +$REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q 2>/dev/null && fail +$REENC $IMG -d $KEY1 -S 0 $FAST_PBKDF_ARGON -q || fail +check_hash "" $HASH5 +check_slot 0 || fail "Only keyslot 0 expected to be enabled" +$REENC $IMG -d $KEY1 $FAST_PBKDF_ARGON -q || fail +$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail +# FIXME echo $PWD1 | $REENC ... + +echo "[4] Encryption of not yet encrypted device" +# well, movin' zeroes :-) +OFFSET=8192 # default LUKS2 header size +prepare 8192 +check_hash_dev $IMG $HASH4 +echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH5 +$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail +# 64MiB + 1 KiB +prepare 65537 +OFFSET=131072 +check_hash_dev $IMG $HASH7 1024 +echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON || fail +check_hash $PWD1 $HASH7 +$CRYPTSETUP --type luks2 luksDump $IMG > /dev/null || fail +prepare 8192 + +echo "[5] Reencryption using specific keyslot" +echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 1 $IMG || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 2 $IMG || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 3 $IMG || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 4 $IMG || fail +echo -e "$PWD2\n$PWD1" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 5 $IMG || fail +echo -e "$PWD2\n$PWD2" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 6 $IMG || fail +echo -e "$PWD2\n$PWD3" | $CRYPTSETUP -q luksAddKey $FAST_PBKDF_ARGON -S 22 $IMG || fail +backup_orig +echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 0 -q $IMG || fail +check_slot 0 || fail "Only keyslot 0 expected to be enabled" +wipe $PWD2 +rollback +echo $PWD1 | $REENC $FAST_PBKDF_ARGON -S 1 -q $IMG || fail +check_slot 1 || fail "Only keyslot 1 expected to be enabled" +wipe $PWD1 +rollback +echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 6 -q $IMG || fail +check_slot 6 || fail "Only keyslot 6 expected to be enabled" +wipe $PWD2 +rollback +echo $PWD3 | $REENC $FAST_PBKDF_ARGON -S 22 -q $IMG || fail +check_slot 22 || fail "Only keyslot 22 expected to be enabled" +wipe $PWD3 +rollback + +echo "[6] Reencryption using all active keyslots" +echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $IMG $FAST_PBKDF_ARGON || fail +check_slot 0 1 2 3 4 5 6 22 || fail "All keyslots expected to be enabled" + +echo "[7] Reencryption of block devices with different block size" +add_scsi_device sector_size=512 dev_size_mb=32 +simple_scsi_reenc "[512 sector]" +add_scsi_device sector_size=4096 dev_size_mb=32 +simple_scsi_reenc "[4096 sector]" +add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=32 +simple_scsi_reenc "[4096/512 sector]" +echo "[OK]" + +echo "[8] Header only reencryption (hash and iteration time)" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --keep-key || fail +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 999 2>/dev/null && fail +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 3 2>/dev/null && fail +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf-force-iterations 4 --pbkdf-memory 31 2>/dev/null && fail +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --hash sha512 +check_hash $PWD1 $HASH5 +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF: | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = "pbkdf2" ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Hash: | sed -e 's/[[:space:]]\+Hash:\ \+//g')" = "sha512" ] || fail +echo $PWD1 | $REENC $IMG -q --keep-key $FAST_PBKDF_ARGON +check_hash $PWD1 $HASH5 +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep PBKDF: | sed -e 's/[[:space:]]\+PBKDF:\ \+//g')" = $DEFAULT_ARGON ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep "Time cost" | sed -e 's/[[:space:]]\+Time\ cost:\ \+//g')" -eq 4 ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Memory | sed -e 's/[[[:space:]]\+Memory:\ \+//g')" -eq 32 ] || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A8 -m1 "0: luks2" | grep Threads | sed -e 's/[[[:space:]]\+Threads:\ \+//g')" -eq 1 ] || fail +echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S21 $FAST_PBKDF_ARGON $IMG || fail +echo $PWD2 | $REENC -S21 -q --keep-key --pbkdf pbkdf2 --pbkdf-force-iterations 1000 $IMG || fail +check_hash $PWD2 $HASH5 +check_slot 21 || fail "Only keyslot 21 expected to be enabled" +$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail + +echo "[9] Test log I/Os on various underlying block devices" +echo $PWD2 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +add_scsi_device sector_size=512 dev_size_mb=32 +test_logging "[512 sector]" || fail +add_scsi_device sector_size=4096 dev_size_mb=32 +test_logging "[4096 sector]" || fail +add_scsi_device sector_size=512 dev_size_mb=32 physblk_exp=3 +test_logging "[4096/512 sector]" || fail +test_logging_tmpfs || fail + +echo "[10] Removal of encryption" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --decrypt || fail +check_hash_dev $IMG $HASH4 + +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -S5 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $REENC $IMG -q --decrypt || fail +check_hash_dev $IMG $HASH4 + +echo "[11] Reencryption with tokens" +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo -e "$PWD1\n$PWD2" | $CRYPTSETUP -q luksAddKey -S23 $FAST_PBKDF_ARGON $IMG || fail +echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S1 $FAST_PBKDF_ARGON $IMG || fail +echo -e "$PWD1\n$PWD3" | $CRYPTSETUP -q luksAddKey -S3 $FAST_PBKDF_ARGON $IMG || fai +$CRYPTSETUP token add --key-description key-name0 --key-slot 23 --token-id 0 $IMG +$CRYPTSETUP token add --key-description key-name2 --key-slot 1 --token-id 2 $IMG +$CRYPTSETUP token add --key-description key-name31 --token-id 31 $IMG +echo $PWD1 | $CRYPTSETUP -q luksKillSlot $IMG 3 || fail +echo $PWD2 | $REENC $FAST_PBKDF_ARGON -S 23 -q $IMG || fail +$CRYPTSETUP luksDump $IMG | grep "0: luks2-keyring" >/dev/null || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "0: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail +$CRYPTSETUP luksDump $IMG | grep "2: luks2-keyring" >/dev/null || fail +$CRYPTSETUP luksDump $IMG | grep "31: luks2-keyring" >/dev/null || fail +[ "$($CRYPTSETUP luksDump $IMG | grep -A2 -m1 "31: luks2-keyring" | grep Keyslot: | sed -e 's/[[[:space:]]\+Keyslot:\ \+//g')" -eq 23 ] || fail + +echo "[12] Reencryption with persistent flags" +dm_crypt_features +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +echo $PWD1 | $CRYPTSETUP open $IMG $DEV_NAME $ALLOW_DISCARDS $PERF_CPU --persistent || fail +$CRYPTSETUP close $DEV_NAME || fail +echo $PWD1 | $REENC $FAST_PBKDF_ARGON -q $IMG || fail +if [ -n "$PERF_CPU" ]; then + $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep same-cpu-crypt > /dev/null || fail +fi +if [ -n "$ALLOW_DISCARDS" ]; then + $CRYPTSETUP luksDump $IMG | grep -m1 Flags: | grep allow-discards > /dev/null || fail +fi + +echo "[13] Detached header - adding encryption/reencryption/decryption" +prepare 8192 +check_hash_dev $IMG $HASH4 +echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new +check_hash $PWD1 $HASH4 $IMG_HDR +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR +check_hash $PWD1 $HASH4 $IMG_HDR +echo $PWD1 | $REENC $IMG -q --header $IMG_HDR --decrypt +check_hash_dev $IMG $HASH4 +# existing header of zero size +cat /dev/null >$IMG_HDR +echo $PWD1 | $REENC --type luks2 $IMG -q $FAST_PBKDF_ARGON --header $IMG_HDR --new +check_hash $PWD1 $HASH4 $IMG_HDR +$CRYPTSETUP isLuks $IMG && fail +$CRYPTSETUP isLuks $IMG_HDR || fail +$CRYPTSETUP luksDump $IMG_HDR | grep -q "0: luks2" || fail + +echo "[14] Reencryption with unbound keyslot" +prepare 8192 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG --offset 8192 || fail +echo $PWD2 | $CRYPTSETUP -q luksAddKey -S 3 --unbound --key-size 64 $FAST_PBKDF_ARGON $IMG || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +$CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail +echo $PWD2 | $REENC $IMG -q $FAST_PBKDF_ARGON 2>/dev/null && fail +echo -e "$PWD1\n$PWD2" | $REENC $IMG -q $FAST_PBKDF_ARGON || fail +$CRYPTSETUP luksDump $IMG | grep -q "3: luks2 (unbound)" || fail + +echo "[15] Reencryption after conversion" +prepare 8192 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 $FAST_PBKDF_PBKDF2 $IMG --offset 4096 || fail +wipe $PWD1 +check_hash $PWD1 $HASH1 +$CRYPTSETUP -q convert --type luks2 $IMG || fail +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail +check_hash $PWD1 $HASH1 +echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_PBKDF2 $IMG --offset 8192 || fail +wipe $PWD1 +check_hash $PWD1 $HASH5 +$CRYPTSETUP -q convert --type luks1 $IMG || fail +echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail +check_hash $PWD1 $HASH5 + +remove_mapping +exit 0 diff --git a/tests/tcrypt-compat-test b/tests/tcrypt-compat-test new file mode 100755 index 0000000..e706427 --- /dev/null +++ b/tests/tcrypt-compat-test @@ -0,0 +1,172 @@ +#!/bin/bash + +# check tcrypt images parsing + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup +TST_DIR=tcrypt-images +MAP=tctst +PASSWORD="aaaaaaaaaaaa" +PASSWORD_HIDDEN="bbbbbbbbbbbb" +PASSWORD_72C="aaaaaaaaaaaabbbbbbbbbbbbccccccccccccddddddddddddeeeeeeeeeeeeffffffffffff" +PIM=1234 + +[ -z "$srcdir" ] && srcdir="." + +function remove_mapping() +{ + [ -b /dev/mapper/$MAP ] && dmsetup remove --retry $MAP + [ -b /dev/mapper/"$MAP"_1 ] && dmsetup remove --retry "$MAP"_1 + [ -b /dev/mapper/"$MAP"_2 ] && dmsetup remove --retry "$MAP"_2 +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo " [FAILED]" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + echo "Test skipped." + exit 77 +} + +function test_one() # cipher mode keysize rm_pattern +{ + $CRYPTSETUP benchmark -c "$1-$2" -s "$3" >/dev/null 2>&1 + if [ $? -ne 0 ] ; then + echo "$1-$2 [N/A]" + IMGS=$(ls $TST_DIR/[tv]c* | grep "$4") + [ -n "$IMGS" ] && rm $IMGS + #echo $IMGS + else + echo "$1-$2 [OK]" + fi +} + +function test_kdf() # hash +{ + $CRYPTSETUP benchmark -h "$1" >/dev/null 2>&1 + if [ $? -ne 0 ] ; then + echo "pbkdf2-$1 [N/A]" + IMGS=$(ls $TST_DIR/[tv]c* | grep "$1") + [ -n "$IMGS" ] && rm $IMGS + else + echo "pbkdf2-$1 [OK]" + fi +} + +function test_required() +{ + which lsblk >/dev/null 2>&1 || skip "WARNING: lsblk tool required." + + echo "REQUIRED KDF TEST" + test_kdf sha256 + test_kdf sha512 + test_kdf ripemd160 + test_kdf whirlpool + test_kdf stribog512 + + echo "REQUIRED CIPHERS TEST" + test_one aes cbc 256 cbc-aes + test_one aes lrw 384 lrw-aes + test_one aes xts 512 xts-aes + + test_one twofish ecb 256 twofish + test_one twofish cbc 256 cbc-twofish + test_one twofish lrw 384 lrw-twofish + test_one twofish xts 512 xts-twofish + + test_one serpent ecb 256 serpent + test_one serpent cbc 256 cbc-serpent + test_one serpent lrw 384 lrw-serpent + test_one serpent xts 512 xts-serpent + + test_one blowfish cbc 256 blowfish + + test_one des3_ede cbc 192 des3_ede + test_one cast5 cbc 128 cast5 + + test_one camellia xts 512 camellia + test_one kuznyechik xts 512 kuznyechik + + ls $TST_DIR/[tv]c* >/dev/null 2>&1 || skip "No remaining images." +} + +export LANG=C +[ ! -d $TST_DIR ] && tar xJf $srcdir/tcrypt-images.tar.xz --no-same-owner +test_required + +echo "HEADER CHECK" +for file in $(ls $TST_DIR/[tv]c_* $TST_DIR/vcpim_* $TST_DIR/sys_[tv]c_*) ; do + echo -n " $file" + PIM_OPT="" + [[ $file =~ vcpim.* ]] && PIM_OPT="--veracrypt-pim $PIM" + SYS_OPT="" + [[ $file =~ sys_.* ]] && SYS_OPT="--tcrypt-system" + echo $PASSWORD | $CRYPTSETUP tcryptDump --veracrypt $SYS_OPT $PIM_OPT $file >/dev/null || fail + echo " [OK]" +done + +echo "HEADER CHECK (HIDDEN)" +for file in $(ls $TST_DIR/[tv]c_*-hidden) ; do + echo -n " $file (hidden)" + echo $PASSWORD_HIDDEN | $CRYPTSETUP tcryptDump --tcrypt-hidden --veracrypt $file >/dev/null || fail + echo " [OK]" +done + +echo "HEADER KEYFILES CHECK" +for file in $(ls $TST_DIR/[tv]ck_*) ; do + echo -n " $file" + PWD=$PASSWORD + [[ $file =~ vck_1_nopw.* ]] && PWD="" + [[ $file =~ vck_1_pw72.* ]] && PWD=$PASSWORD_72C + echo $PWD | $CRYPTSETUP tcryptDump --veracrypt -d $TST_DIR/keyfile1 -d $TST_DIR/keyfile2 $file >/dev/null || fail + echo " [OK]" +done + + +if [ $(id -u) != 0 ]; then + echo "WARNING: You must be root to run activation part of test, test skipped." + exit 0 +fi + +echo "ACTIVATION FS UUID CHECK" +for file in $(ls $TST_DIR/[tv]c_* $TST_DIR/vcpim_* $TST_DIR/sys_[tv]c_*) ; do + echo -n " $file" + PIM_OPT="" + [[ $file =~ vcpim.* ]] && PIM_OPT="--veracrypt-pim $PIM" + SYS_OPT="" + [[ $file =~ sys_.* ]] && SYS_OPT="--tcrypt-system" + out=$(echo $PASSWORD | $CRYPTSETUP tcryptOpen --veracrypt $SYS_OPT $PIM_OPT -r $file $MAP 2>&1) + ret=$? + [ $ret -eq 1 ] && ( echo "$out" | grep -q -e "TCRYPT legacy mode" ) && echo " [N/A]" && continue + [ $ret -eq 1 ] && ( echo "$out" | grep -q -e "TCRYPT compatible mapping" ) && echo " [N/A]" && continue + [ $ret -ne 0 ] && fail + $CRYPTSETUP status $MAP >/dev/null || fail + $CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail + UUID=$(lsblk -n -o UUID /dev/mapper/$MAP) + $CRYPTSETUP remove $MAP || fail + [ "$UUID" != "DEAD-BABE" ] && fail "UUID check failed." + echo " [OK]" +done + +echo "ACTIVATION FS UUID (HIDDEN) CHECK" +for file in $(ls $TST_DIR/[tv]c_*-hidden) ; do + echo -n " $file" + out=$(echo $PASSWORD_HIDDEN | $CRYPTSETUP tcryptOpen --veracrypt -r $file $MAP --tcrypt-hidden 2>&1) + ret=$? + [ $ret -eq 1 ] && ( echo "$out" | grep -q -e "TCRYPT legacy mode" ) && echo " [N/A]" && continue + [ $ret -eq 1 ] && ( echo "$out" | grep -q -e "TCRYPT compatible mapping" ) && echo " [N/A]" && continue + [ $ret -ne 0 ] && fail + UUID=$(lsblk -n -o UUID /dev/mapper/$MAP) + $CRYPTSETUP remove $MAP || fail + [ "$UUID" != "CAFE-BABE" ] && fail "UUID check failed." + echo " [OK]" +done diff --git a/tests/tcrypt-images.tar.xz b/tests/tcrypt-images.tar.xz new file mode 100644 index 0000000..1841870 Binary files /dev/null and b/tests/tcrypt-images.tar.xz differ diff --git a/tests/test_utils.c b/tests/test_utils.c new file mode 100644 index 0000000..9f070e9 --- /dev/null +++ b/tests/test_utils.c @@ -0,0 +1,637 @@ +/* + * cryptsetup library API test utilities + * + * Copyright (C) 2009-2021 Red Hat, Inc. All rights reserved. + * Copyright (C) 2009-2021 Milan Broz + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#ifdef KERNEL_KEYRING +# include +# include +#endif +#ifdef HAVE_SYS_SYSMACROS_H +# include +#endif +#include + +#include "api_test.h" +#include "libcryptsetup.h" + +static char last_error[256]; +static char global_log[4096]; +static uint32_t t_dm_crypt_flags = 0; + +char *THE_LOOP_DEV = NULL; +int _debug = 0; +int global_lines = 0; +int _quit = 0; +int _verbose = 0; +uint64_t t_dev_offset = 0; + +static void (*_cleanup)(void); + +void register_cleanup(void (*cleanup)(void)) +{ + _cleanup = cleanup; +} + +void check_ok(int status, int line, const char *func) +{ + if (status) { + printf("FAIL line %d [%s]: code %d, %s\n", line, func, status, last_error); + _cleanup(); + exit(-1); + } +} + +void check_ok_return(int status, int line, const char *func) +{ + if (status < 0) { + printf("FAIL line %d [%s]: code %d, %s\n", line, func, status, last_error); + _cleanup(); + exit(-1); + } +} + +void check_ko(int status, int line, const char *func) +{ + if (status >= 0) { + printf("FAIL line %d [%s]: code %d, %s\n", line, func, status, last_error); + _cleanup(); + exit(-1); + } else if (_verbose) + printf(" => errno %d, errmsg: %s\n", status, last_error); +} + +void check_equal(int line, const char *func, int64_t x, int64_t y) +{ + printf("FAIL line %d [%s]: expected equal values differs: %" + PRIi64 " != %" PRIi64 "\n", line, func, x, y); + _cleanup(); + exit(-1); +} + +void check_ge_equal(int line, const char *func, int64_t x, int64_t y) +{ + printf("FAIL line %d [%s]: expected greater or equal values differs: %" + PRIi64 " < %" PRIi64 "\n", line, func, x, y); + _cleanup(); + exit(-1); +} + +void check_null(int line, const char *func, const void *x) +{ + if (x) { + printf("FAIL line %d [%s]: expected NULL value: %p\n", line, func, x); + _cleanup(); + exit(-1); + } +} + +void check_notnull(int line, const char *func, const void *x) +{ + if (!x) { + printf("FAIL line %d [%s]: expected not NULL value: %p\n", line, func, x); + _cleanup(); + exit(-1); + } +} + +void xlog(const char *msg, const char *tst, const char *func, int line, const char *txt) +{ + if (_verbose) { + if (txt) + printf(" [%s,%s:%d] %s [%s]\n", msg, func, line, tst, txt); + else + printf(" [%s,%s:%d] %s\n", msg, func, line, tst); + } + if (_quit) { + if (_verbose) + printf("Interrupted by a signal.\n"); + _cleanup(); + exit(-1); + } +} + +int t_device_size(const char *device, uint64_t *size) +{ + int devfd, r = 0; + + devfd = open(device, O_RDONLY); + if(devfd == -1) + return -EINVAL; + + if (ioctl(devfd, BLKGETSIZE64, size) < 0) + r = -EINVAL; + close(devfd); + return r; +} + +int fips_mode(void) +{ + int fd; + char buf = 0; + + fd = open("/proc/sys/crypto/fips_enabled", O_RDONLY); + + if (fd < 0) + return 0; + + if (read(fd, &buf, 1) != 1) + buf = '0'; + + close(fd); + + return (buf == '1'); +} + +/* + * Creates dm-linear target over the test loop device. Offset is held in + * global variables so that size can be tested whether it fits into remaining + * size of the loop device or not + */ +int create_dmdevice_over_loop(const char *dm_name, const uint64_t size) +{ + char cmd[128]; + int r; + uint64_t r_size; + + if (t_device_size(THE_LOOP_DEV, &r_size) < 0 || r_size <= t_dev_offset || !size) + return -1; + if ((r_size - t_dev_offset) < size) { + printf("No enough space on backing loop device\n."); + return -2; + } + snprintf(cmd, sizeof(cmd), + "dmsetup create %s --table \"0 %" PRIu64 " linear %s %" PRIu64 "\"", + dm_name, size, THE_LOOP_DEV, t_dev_offset); + if (!(r = _system(cmd, 1))) + t_dev_offset += size; + return r; +} + +// Get key from kernel dm mapping table using dm-ioctl +int get_key_dm(const char *name, char *buffer, unsigned int buffer_size) +{ + struct dm_task *dmt; + struct dm_info dmi; + uint64_t start, length; + char *target_type, *key, *params; + void *next = NULL; + int r = -EINVAL; + + if (!(dmt = dm_task_create(DM_DEVICE_TABLE))) + goto out; + if (!dm_task_set_name(dmt, name)) + goto out; + if (!dm_task_run(dmt)) + goto out; + if (!dm_task_get_info(dmt, &dmi)) + goto out; + if (!dmi.exists) + goto out; + + next = dm_get_next_target(dmt, next, &start, &length, &target_type, ¶ms); + if (!target_type || strcmp(target_type, "crypt") != 0) + goto out; + + (void)strsep(¶ms, " "); /* rcipher */ + key = strsep(¶ms, " "); + + if (buffer_size <= strlen(key)) + goto out; + + strncpy(buffer, key, buffer_size); + r = 0; +out: + if (dmt) + dm_task_destroy(dmt); + + return r; +} + +int prepare_keyfile(const char *name, const char *passphrase, int size) +{ + int fd, r; + + fd = open(name, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR|S_IWUSR); + if (fd != -1) { + r = write(fd, passphrase, size); + close(fd); + } else + r = 0; + + return r == size ? 0 : 1; +} + +// Decode key from its hex representation +int crypt_decode_key(char *key, const char *hex, unsigned int size) +{ + char buffer[3]; + char *endp; + unsigned int i; + + buffer[2] = '\0'; + + for (i = 0; i < size; i++) { + buffer[0] = *hex++; + buffer[1] = *hex++; + + key[i] = (unsigned char)strtoul(buffer, &endp, 16); + + if (endp != &buffer[2]) + return -1; + } + + if (*hex != '\0') + return -1; + + return 0; +} + +void global_log_callback(int level, const char *msg, void *usrptr) +{ + size_t len; + + if (_debug) { + if (level == CRYPT_LOG_DEBUG) + fprintf(stdout, "# %s", msg); + else + fprintf(stdout, "%s", msg); + } + + if (level <= CRYPT_LOG_DEBUG) + return; + + len = strlen(global_log); + + if (len + strlen(msg) > sizeof(global_log)) { + printf("Log buffer is too small, fix the test.\n"); + return; + } + + strncat(global_log, msg, sizeof(global_log) - len); + global_lines++; + if (level == CRYPT_LOG_ERROR) { + len = strlen(msg); + if (len > sizeof(last_error)) + len = sizeof(last_error); + strncpy(last_error, msg, sizeof(last_error)); + last_error[len-1] = '\0'; + } +} + +void reset_log(void) +{ + memset(global_log, 0, sizeof(global_log)); + memset(last_error, 0, sizeof(last_error)); + global_lines = 0; +} + +int _system(const char *command, int warn) +{ + int r; + if (_debug) + printf("Running system: %s\n", command); + if ((r=system(command)) < 0 && warn) + printf("System command failed: %s", command); + return r; +} + +static int keyring_check(void) +{ +#ifdef KERNEL_KEYRING + return syscall(__NR_request_key, "logon", "dummy", NULL, 0) == -1l && errno != ENOSYS; +#else + return 0; +#endif +} + +static int t_dm_satisfies_version(unsigned target_maj, unsigned target_min, unsigned target_patch, + unsigned actual_maj, unsigned actual_min, unsigned actual_patch) +{ + if (actual_maj > target_maj) + return 1; + if (actual_maj == target_maj && actual_min > target_min) + return 1; + if (actual_maj == target_maj && actual_min == target_min && actual_patch >= target_patch) + return 1; + return 0; +} + +static void t_dm_set_crypt_compat(const char *dm_version, unsigned crypt_maj, + unsigned crypt_min, unsigned crypt_patch) +{ + unsigned dm_maj = 0, dm_min = 0, dm_patch = 0; + + if (sscanf(dm_version, "%u.%u.%u", &dm_maj, &dm_min, &dm_patch) != 3) { + dm_maj = 0; + dm_min = 0; + dm_patch = 0; + } + + if (t_dm_satisfies_version(1, 2, 0, crypt_maj, crypt_min, 0)) + t_dm_crypt_flags |= T_DM_KEY_WIPE_SUPPORTED; + + if (t_dm_satisfies_version(1, 10, 0, crypt_maj, crypt_min, 0)) + t_dm_crypt_flags |= T_DM_LMK_SUPPORTED; + + if (t_dm_satisfies_version(4, 20, 0, dm_maj, dm_min, 0)) + t_dm_crypt_flags |= T_DM_SECURE_SUPPORTED; + + if (t_dm_satisfies_version(1, 8, 0, crypt_maj, crypt_min, 0)) + t_dm_crypt_flags |= T_DM_PLAIN64_SUPPORTED; + + if (t_dm_satisfies_version(1, 11, 0, crypt_maj, crypt_min, 0)) + t_dm_crypt_flags |= T_DM_DISCARDS_SUPPORTED; + + if (t_dm_satisfies_version(1, 13, 0, crypt_maj, crypt_min, 0)) + t_dm_crypt_flags |= T_DM_TCW_SUPPORTED; + + if (t_dm_satisfies_version(1, 14, 0, crypt_maj, crypt_min, 0)) { + t_dm_crypt_flags |= T_DM_SAME_CPU_CRYPT_SUPPORTED; + t_dm_crypt_flags |= T_DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED; + } + + if (t_dm_satisfies_version(1, 18, 1, crypt_maj, crypt_min, crypt_patch) && keyring_check()) + t_dm_crypt_flags |= T_DM_KERNEL_KEYRING_SUPPORTED; +} + +static void t_dm_set_verity_compat(const char *dm_version, unsigned verity_maj, + unsigned verity_min, unsigned verity_patch) +{ + if (verity_maj > 0) + t_dm_crypt_flags |= T_DM_VERITY_SUPPORTED; + else + return; + /* + * ignore_corruption, restart_on corruption is available since 1.2 (kernel 4.1) + * ignore_zero_blocks since 1.3 (kernel 4.5) + * (but some dm-verity targets 1.2 don't support it) + * FEC is added in 1.3 as well. + */ + if (t_dm_satisfies_version(1, 3, 0, verity_maj, verity_min, 0)) { + t_dm_crypt_flags |= T_DM_VERITY_ON_CORRUPTION_SUPPORTED; + t_dm_crypt_flags |= T_DM_VERITY_FEC_SUPPORTED; + } +} + +static void t_dm_set_integrity_compat(const char *dm_version, unsigned integrity_maj, + unsigned integrity_min, unsigned integrity_patch) +{ + if (integrity_maj > 0) + t_dm_crypt_flags |= T_DM_INTEGRITY_SUPPORTED; +} + +int t_dm_check_versions(void) +{ + struct dm_task *dmt; + struct dm_versions *target, *last_target; + char dm_version[16]; + int r = 1; + + if (!(dmt = dm_task_create(DM_DEVICE_LIST_VERSIONS))) + goto out; + + if (!dm_task_run(dmt)) + goto out; + + if (!dm_task_get_driver_version(dmt, dm_version, sizeof(dm_version))) + goto out; + + target = dm_task_get_versions(dmt); + do { + last_target = target; + if (!strcmp("crypt", target->name)) { + t_dm_set_crypt_compat(dm_version, + (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } else if (!strcmp("verity", target->name)) { + t_dm_set_verity_compat(dm_version, + (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } else if (!strcmp("integrity", target->name)) { + t_dm_set_integrity_compat(dm_version, + (unsigned)target->version[0], + (unsigned)target->version[1], + (unsigned)target->version[2]); + } + target = (struct dm_versions *)((char *) target + target->next); + } while (last_target != target); + + r = 0; +out: + if (dmt) + dm_task_destroy(dmt); + + return r; +} + +int t_dm_crypt_keyring_support(void) +{ + return t_dm_crypt_flags & T_DM_KERNEL_KEYRING_SUPPORTED; +} + +int t_dm_crypt_cpu_switch_support(void) +{ + return t_dm_crypt_flags & (T_DM_SAME_CPU_CRYPT_SUPPORTED | + T_DM_SUBMIT_FROM_CRYPT_CPUS_SUPPORTED); +} + +int t_dm_crypt_discard_support(void) +{ + return t_dm_crypt_flags & T_DM_DISCARDS_SUPPORTED; +} + +/* loop helpers */ + +#define LOOP_DEV_MAJOR 7 + +#ifndef LO_FLAGS_AUTOCLEAR +#define LO_FLAGS_AUTOCLEAR 4 +#endif + +#ifndef LOOP_CTL_GET_FREE +#define LOOP_CTL_GET_FREE 0x4C82 +#endif + +#ifndef LOOP_SET_CAPACITY +#define LOOP_SET_CAPACITY 0x4C07 +#endif + +int loop_device(const char *loop) +{ + struct stat st; + + if (!loop) + return 0; + + if (stat(loop, &st) || !S_ISBLK(st.st_mode) || + major(st.st_rdev) != LOOP_DEV_MAJOR) + return 0; + + return 1; +} + +static char *crypt_loop_get_device_old(void) +{ + char dev[20]; + int i, loop_fd; + struct loop_info64 lo64 = {0}; + + for (i = 0; i < 256; i++) { + sprintf(dev, "/dev/loop%d", i); + + loop_fd = open(dev, O_RDONLY); + if (loop_fd < 0) + return NULL; + + if (ioctl(loop_fd, LOOP_GET_STATUS64, &lo64) && + errno == ENXIO) { + close(loop_fd); + return strdup(dev); + } + close(loop_fd); + } + + return NULL; +} + +static char *crypt_loop_get_device(void) +{ + char dev[64]; + int i, loop_fd; + struct stat st; + + loop_fd = open("/dev/loop-control", O_RDONLY); + if (loop_fd < 0) + return crypt_loop_get_device_old(); + + i = ioctl(loop_fd, LOOP_CTL_GET_FREE); + if (i < 0) { + close(loop_fd); + return NULL; + } + close(loop_fd); + + if (sprintf(dev, "/dev/loop%d", i) < 0) + return NULL; + + if (stat(dev, &st) || !S_ISBLK(st.st_mode)) + return NULL; + + return strdup(dev); +} + +int loop_attach(char **loop, const char *file, int offset, + int autoclear, int *readonly) +{ + struct loop_info64 lo64 = {0}; + char *lo_file_name; + int loop_fd = -1, file_fd = -1, r = 1; + + *loop = NULL; + + file_fd = open(file, (*readonly ? O_RDONLY : O_RDWR) | O_EXCL); + if (file_fd < 0 && (errno == EROFS || errno == EACCES) && !*readonly) { + *readonly = 1; + file_fd = open(file, O_RDONLY | O_EXCL); + } + if (file_fd < 0) + goto out; + + while (loop_fd < 0) { + *loop = crypt_loop_get_device(); + if (!*loop) + goto out; + + loop_fd = open(*loop, *readonly ? O_RDONLY : O_RDWR); + if (loop_fd < 0) + goto out; + + if (ioctl(loop_fd, LOOP_SET_FD, file_fd) < 0) { + if (errno != EBUSY) + goto out; + free(*loop); + *loop = NULL; + + close(loop_fd); + loop_fd = -1; + } + } + + lo_file_name = (char*)lo64.lo_file_name; + lo_file_name[LO_NAME_SIZE-1] = '\0'; + strncpy(lo_file_name, file, LO_NAME_SIZE-1); + lo64.lo_offset = offset; + if (autoclear) + lo64.lo_flags |= LO_FLAGS_AUTOCLEAR; + + if (ioctl(loop_fd, LOOP_SET_STATUS64, &lo64) < 0) { + (void)ioctl(loop_fd, LOOP_CLR_FD, 0); + goto out; + } + + /* Verify that autoclear is really set */ + if (autoclear) { + memset(&lo64, 0, sizeof(lo64)); + if (ioctl(loop_fd, LOOP_GET_STATUS64, &lo64) < 0 || + !(lo64.lo_flags & LO_FLAGS_AUTOCLEAR)) { + (void)ioctl(loop_fd, LOOP_CLR_FD, 0); + goto out; + } + } + + r = 0; +out: + if (r && loop_fd >= 0) + close(loop_fd); + if (file_fd >= 0) + close(file_fd); + if (r && *loop) { + free(*loop); + *loop = NULL; + } + return r ? -1 : loop_fd; +} + +int loop_detach(const char *loop) +{ + int loop_fd = -1, r = 1; + + loop_fd = open(loop, O_RDONLY); + if (loop_fd < 0) + return 1; + + if (!ioctl(loop_fd, LOOP_CLR_FD, 0)) + r = 0; + + close(loop_fd); + return r; +} diff --git a/tests/unit-utils-io.c b/tests/unit-utils-io.c new file mode 100644 index 0000000..8120842 --- /dev/null +++ b/tests/unit-utils-io.c @@ -0,0 +1,346 @@ +/* + * simple unit test for utils_io.c (blockwise low level functions) + * + * Copyright (C) 2018-2021 Red Hat, Inc. All rights reserved. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "utils_io.h" + +enum fn_enum { + READ_BUFFER = 0, + WRITE_BUFFER, + READ_BLOCKWISE, + WRITE_BLOCKWISE, + READ_LSEEK_BLOCKWISE, + WRITE_LSEEK_BLOCKWISE +} test_fn; + +char *test_file; +size_t test_bsize; +size_t test_alignment; +size_t test_length; +off_t test_offset; //FIXME: check for proper 64bit support (and test it!) +size_t test_mem_alignment = 4096; + +static int test_read_buffer(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_read_buffer\n"); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_RDONLY | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + ret = read_buffer(fd, buffer, test_length); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static int test_write_buffer(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_write_buffer\n"); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_WRONLY | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + ret = write_buffer(fd, buffer, test_length); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static int test_read_blockwise(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_read_blockwise "); + //printf("test_bsize: %zu, test_length: %zu\n", test_bsize, test_length); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_RDONLY | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + + ret = read_blockwise(fd, test_bsize, test_mem_alignment, buffer, test_length); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static int test_write_blockwise(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_write_blockwise\n"); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_RDWR | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + ret = write_blockwise(fd, test_bsize, test_mem_alignment, buffer, test_length); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static int test_read_lseek_blockwise(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_read_lseek_blockwise\n"); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_RDONLY | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + ret = read_lseek_blockwise(fd, test_bsize, test_mem_alignment, buffer, test_length, test_offset); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static int test_write_lseek_blockwise(void) +{ + void *buffer = NULL; + int fd = -1; + ssize_t ret = -EINVAL; + + //printf("Entering test_write_lseek_blockwise\n"); + + if (posix_memalign(&buffer, test_mem_alignment, test_length)) { + fprintf(stderr, "Failed to allocate aligned buffer.\n"); + goto out; + } + + fd = open(test_file, O_RDWR | O_DIRECT); + if (fd < 0) { + fprintf(stderr, "Failed to open %s.\n", test_file); + goto out; + } + + ret = write_lseek_blockwise(fd, test_bsize, test_mem_alignment, buffer, test_length, test_offset); + if (ret < 0) + goto out; + + ret = (size_t) ret == test_length ? 0 : -EIO; +out: + if (fd >= 0) + close(fd); + free(buffer); + return ret; +} + +static void usage(void) +{ + fprintf(stderr, "Use:\tunit-utils-io file/device blockwise_fn length [bsize] [offset].\n"); +} + +static int parse_input_params(int argc, char **argv) +{ + struct stat st; + unsigned long offset; + + if (argc < 4) { + usage(); + return 1; + } + + if (stat(argv[1], &st)) { + fprintf(stderr, "File/device %s is missing?\n", argv[1]); + return 1; + } + test_file = argv[1]; + if (sscanf(argv[3], "%zu", &test_length) != 1) + return 1; + if (argc >= 5 && sscanf(argv[4], "%zu", &test_bsize) != 1) + return 1; + if (argc >= 6) { + if (sscanf(argv[5], "%ld", &offset) != 1) + return 1; + test_offset = offset; + } + + if (!strcmp(argv[2], "read_buffer")) + test_fn = READ_BUFFER; + else if (!strcmp(argv[2], "write_buffer")) + test_fn = WRITE_BUFFER; + else if (!strcmp(argv[2], "read_blockwise")) { + if (argc < 5) { + usage(); + return 1; + } + test_fn = READ_BLOCKWISE; + } else if (!strcmp(argv[2], "write_blockwise")) { + if (argc < 5) { + usage(); + return 1; + } + test_fn = WRITE_BLOCKWISE; + } else if (!strcmp(argv[2], "read_lseek_blockwise")) { + if (argc < 6) { + usage(); + return 1; + } + test_fn = READ_LSEEK_BLOCKWISE; + } else if (!strcmp(argv[2], "write_lseek_blockwise")) { + if (argc < 6) { + usage(); + return 1; + } + test_fn = WRITE_LSEEK_BLOCKWISE; + } else { + usage(); + return 1; + } + + /* printf("function '%s': length %zu", argv[2], test_length); + if (argc >= 5) + printf(", bsize %zu", test_bsize); + if (argc >= 6) + printf(", offset %llu", test_offset); + printf("\n"); */ + + return 0; +} + +int main(int argc, char **argv) +{ + long ps; + int r = EXIT_FAILURE; + + if (parse_input_params(argc, argv)) + return r; + + ps = sysconf(_SC_PAGESIZE); + if (ps > 0) + test_mem_alignment = (size_t)ps; + + switch (test_fn) { + case READ_BUFFER: + r = test_read_buffer(); + break; + case WRITE_BUFFER: + r = test_write_buffer(); + break; + case READ_BLOCKWISE: + r = test_read_blockwise(); + break; + case WRITE_BLOCKWISE: + r = test_write_blockwise(); + break; + case READ_LSEEK_BLOCKWISE: + r = test_read_lseek_blockwise(); + break; + case WRITE_LSEEK_BLOCKWISE: + r = test_write_lseek_blockwise(); + break; + default : + fprintf(stderr, "Internal test error.\n"); + return r; + } + + return r == 0 ? EXIT_SUCCESS : EXIT_FAILURE; +} diff --git a/tests/valg-api.sh b/tests/valg-api.sh new file mode 100755 index 0000000..fcd59a8 --- /dev/null +++ b/tests/valg-api.sh @@ -0,0 +1,11 @@ +#!/bin/sh +SUP="--suppressions=./cryptsetup-valg-supps" +CHILD="--trace-children=no --child-silent-after-fork=yes" +MALLOC="--malloc-fill=aa" +FREE="--free-fill=21" +STACK="--max-stackframe=300000" +EXTRAS="--read-var-info=yes --show-reachable=yes" +LOGFILE="--log-file=./valglog.$(date +%H:%M:%S:%N)_${INFOSTRING}" +LEAKCHECK="--leak-check=full --track-origins=yes" + +exec valgrind $SUP $GETSUP $CHILD $MALLOC $FREE $STACK $EXTRAS $LOGFILE $LEAKCHECK "$@" diff --git a/tests/valg.sh b/tests/valg.sh new file mode 100755 index 0000000..888efcc --- /dev/null +++ b/tests/valg.sh @@ -0,0 +1,11 @@ +#!/bin/sh +SUP="--suppressions=./cryptsetup-valg-supps" +CHILD="--trace-children=yes --child-silent-after-fork=yes" +MALLOC="--malloc-fill=aa" +FREE="--free-fill=21" +STACK="--max-stackframe=2000000" +EXTRAS="--read-var-info=yes --show-reachable=yes" +LOGFILE="--log-file=./valglog.$(date +%H:%M:%S:%N)_${INFOSTRING}" +LEAKCHECK="--leak-check=full --track-origins=yes" + +exec valgrind $SUP $GETSUP $CHILD $MALLOC $FREE $STACK $EXTRAS $LOGFILE $LEAKCHECK "$@" diff --git a/tests/valid_header_file.xz b/tests/valid_header_file.xz new file mode 100644 index 0000000..4b443ae Binary files /dev/null and b/tests/valid_header_file.xz differ diff --git a/tests/verity-compat-test b/tests/verity-compat-test new file mode 100755 index 0000000..7f381e7 --- /dev/null +++ b/tests/verity-compat-test @@ -0,0 +1,484 @@ +#!/bin/bash + +[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".." +VERITYSETUP=$CRYPTSETUP_PATH/veritysetup +VERITYSETUP_VALGRIND=../.libs/veritysetup +VERITYSETUP_LIB_VALGRIND=../.libs + +DEV_NAME=verity3273 +DEV_OUT="$DEV_NAME.out" +IMG=verity-data +IMG_HASH=verity-hash +IMG_TMP=tst-dev +FEC_DEV=tst_fec123 +# If we need deterministic image creation +DEV_SALT=9e7457222290f1bac0d42ad2de2d602a87bb871c22ab70ca040bad450578a436 +DEV_UUID=a60c98d2-ae9b-4865-bfcb-b4e3ace11033 + +function remove_mapping() +{ + [ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME >/dev/null 2>&1 + [ ! -z "$LOOPDEV1" ] && losetup -d $LOOPDEV1 >/dev/null 2>&1 + rm -f $IMG $IMG_HASH $DEV_OUT $FEC_DEV $IMG_TMP >/dev/null 2>&1 + LOOPDEV1="" + LOOPDEV2="" +} + +function fail() +{ + [ -n "$1" ] && echo "$1" + echo "FAILED backtrace:" + while caller $frame; do ((frame++)); done + [ -f $DEV_OUT ] && cat $DEV_OUT + remove_mapping + exit 2 +} + +function skip() +{ + [ -n "$1" ] && echo "$1" + exit 77 +} + +function prepare() # $1 dev1_siz [$2 dev2_size] +{ + remove_mapping + + dd if=/dev/zero of=$IMG bs=1k count=$1 >/dev/null 2>&1 + LOOPDEV1=$(losetup -f 2>/dev/null) + [ -z "$LOOPDEV1" ] && fail "No free loop device" + losetup $LOOPDEV1 $IMG + + [ -z "$2" ] && return + LOOPDEV2=$IMG_HASH +} + +function wipe() +{ + dd if=/dev/zero of=$LOOPDEV1 bs=256k >/dev/null 2>&1 + rm -f $IMG_HASH $DEV_OUT >/dev/null 2>&1 +} + +function check_exists() +{ + [ -b /dev/mapper/$DEV_NAME ] || fail +} + +function check_version() # MAJ MIN +{ + VER_STR=$(dmsetup targets | grep verity | cut -f 3 -dv) + [ -z "$VER_STR" ] && fail "Failed to parse dm-verity version." + + VER_MAJ=$(echo $VER_STR | cut -f 1 -d.) + VER_MIN=$(echo $VER_STR | cut -f 2 -d.) + + test $VER_MAJ -gt $1 && return 0 + test $VER_MIN -ge $2 && return 0 + return 1 +} + +function compare_out() # $1 what, $2 expected +{ + OPT=$(grep -v "^#" $DEV_OUT | grep -i "$1" | sed -e s/.*\:\ // ) + [ -z "$OPT" ] && fail + [ $OPT != $2 ] && fail "$1 differs ($2)" +} + +function check_root_hash_fail() +{ + echo -n "Root hash check " + ARR=(`$VERITYSETUP format $IMG $IMG_HASH --fec-device $FEC_DEV --fec-roots 2 -h sha256`) + ROOT_HASH=${ARR[28]} + ROOT_HASH_BAD=abcdef0000000000000000000000000000000000000000000000000000000000 + + $VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH || fail + $VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 && fail + $VERITYSETUP verify $IMG $IMG_HASH $ROOT_HASH_BAD --fec-device $FEC_DEV --fec-roots 2 >/dev/null 2>&1 && fail + + $VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH || fail + check_exists + dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail + $VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail + + $VERITYSETUP open $IMG $DEV_NAME $IMG_HASH $ROOT_HASH_BAD >/dev/null 2>&1 || fail + check_exists + dmsetup status $DEV_NAME | grep "verity C" >/dev/null || fail + $VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail + + echo "[OK]" +} + +function check_root_hash() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, [$6 offset] +{ + if [ -z "$LOOPDEV2" ] ; then + BLOCKS=$(($6 / $1)) + DEV_PARAMS="$LOOPDEV1 $LOOPDEV1 \ + --hash-offset $6 \ + --data-blocks=$BLOCKS --debug" + else + DEV_PARAMS="$LOOPDEV1 $LOOPDEV2" + fi + + for sb in yes no; do + FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3" + if [ $sb == yes ] ; then + VERIFY_PARAMS="" + else + FORMAT_PARAMS="$FORMAT_PARAMS --no-superblock" + VERIFY_PARAMS=$FORMAT_PARAMS + fi + + for fail in data hash; do + wipe + echo -n "V$4(sb=$sb) $5 block size $1: " + $VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >$DEV_OUT || fail + + echo -n "[root hash]" + compare_out "root hash" $2 + compare_out "salt" "$3" + + $VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $2 >>$DEV_OUT 2>&1 || fail + echo -n "[verify]" + + $VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $2 >>$DEV_OUT 2>&1 || fail + check_exists + echo -n "[activate]" + + dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null + dmsetup status $DEV_NAME | grep "verity V" >/dev/null || fail + echo -n "[in-kernel verify]" + + $VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail + + case $fail in + data) + dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=3456 count=8 conv=notrunc 2>/dev/null + TXT="data_dev" + ;; + hash) + if [ -z "$LOOPDEV2" ] ; then + dd if=/dev/urandom of=$LOOPDEV1 bs=1 seek=$((8193 + $4)) count=8 conv=notrunc 2>/dev/null + else + dd if=/dev/urandom of=$LOOPDEV2 bs=1 seek=8193 count=8 conv=notrunc 2>/dev/null + fi + TXT="hash_dev" + ;; + esac + + $VERITYSETUP verify $DEV_PARAMS $VERIFY_PARAMS $2 >>$DEV_OUT 2>&1 && \ + fail "userspace check for $TXT corruption" + $VERITYSETUP create $DEV_NAME $DEV_PARAMS $VERIFY_PARAMS $2 >>$DEV_OUT 2>&1 || \ + fail "activation" + dd if=/dev/mapper/$DEV_NAME of=/dev/null bs=$1 2>/dev/null + dmsetup status $DEV_NAME | grep "verity V" >/dev/null && \ + fail "in-kernel check for $TXT corruption" + $VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail "deactivation" + echo "[$TXT corruption]" + done + done +} + +function corrupt_device() # $1 device, $2 device_size(in bytes), $3 #{corrupted_bytes} +{ + # Repeatable magic corruption :-) + CORRUPT=$3 + RANDOM=43 + while [ "$CORRUPT" -gt 0 ]; do + SEEK=$RANDOM + while [ $SEEK -ge $2 ] ; do SEEK=$RANDOM; done + echo -n -e "\x55" | dd of=$1 bs=1 count=1 seek=$SEEK conv=notrunc > /dev/null 2>&1 + CORRUPT=$(($CORRUPT - 1)) + done +} + +# $1 data_device, $2 hash_device, $3 fec_device, $4 data/hash_block_size(in bytes), +# $5 data_size(in blocks), $6 device_size(in blocks), $7 hash_offset(in bytes), +# $8 fec_offset(in bytes), $9 fec_roots, ${10} corrupted_bytes, [${11} superblock(y/n), ${12} salt] +function check_fec() +{ + INDEX=25 + dd if=/dev/zero of=$1 bs=$4 count=$6 > /dev/null 2>&1 + + echo -n "Block_size: $4, Data_size: $(($4 * $5))B, FEC_roots: $9, Corrupted_bytes: ${10} " + + PARAMS=" --data-block-size=$4 --hash-block-size=$4 " + if [ "$5" -ne "$6" ]; then + PARAMS="$PARAMS --data-blocks=$5" + fi + + if [ "$7" -ne 0 ]; then + PARAMS="$PARAMS --hash-offset=$7" + fi + + if [ "$8" -ne 0 ]; then + PARAMS="$PARAMS --fec-offset=$8" + fi + + if [ "${11}" == "n" ]; then + INDEX=24 + echo -n "[no-superblock]" + PARAMS="$PARAMS --no-superblock -s=${12}" + elif [ -n "${12}" ]; then + PARAMS="$PARAMS -s=${12}" + fi + + if [[ "$1" == "$2" && "$1" == "$3" ]]; then + echo -n "[one_device_test]" + dd if=/dev/zero of=$IMG_TMP bs=$4 count=$5 > /dev/null 2>&1 + ARR=(`sha256sum $IMG_TMP`) + HASH_ORIG=${ARR[0]} + else + ARR=(`sha256sum $1`) + HASH_ORIG=${ARR[0]} + fi + + ARR=(`$VERITYSETUP format $1 $2 --fec-device=$3 $PARAMS`) + SALT=${ARR[$INDEX]} + ROOT_HASH=${ARR[$(($INDEX+3))]} + + corrupt_device $1 $(($5 * $4)) ${10} + + $VERITYSETUP create $DEV_NAME $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS > /dev/null 2>&1 + if [ "$?" -ne "0" ] ; then + echo "[N/A, test skipped]" + return 3 + fi + + udevadm settle + + dd if=/dev/mapper/$DEV_NAME of=$IMG_TMP > /dev/null 2>&1 + ARR=(`sha256sum $IMG_TMP`) + + HASH_REPAIRED=${ARR[0]} + + $VERITYSETUP close $DEV_NAME + + if [ "$HASH_ORIG" != "$HASH_REPAIRED" ]; then + echo -n "[kernel correction failed]" + $VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 && fail "Userspace verify should fail" + echo -n "[userspace verify failed]" + RET=1 + else + echo -n "[repaired in kernel]" + $VERITYSETUP verify $1 $2 $ROOT_HASH --fec-device=$3 $PARAMS >/dev/null 2>&1 || fail "Userspace verify failed" + echo "[userspace verify][OK]" + RET=0 + fi + rm $1 $2 $3 $IMG_TMP > /dev/null 2>&1 + return $RET +} + +function check_option() # $1 size, $2 hash, $3 salt, $4 version, $5 hash, $6 CLI option, $7 status option +{ + DEV_PARAMS="$LOOPDEV1 $LOOPDEV2" + FORMAT_PARAMS="--format=$4 --data-block-size=$1 --hash-block-size=$1 --hash=$5 --salt=$3" + + echo -n "Option $6 " + $VERITYSETUP format $DEV_PARAMS $FORMAT_PARAMS >/dev/null 2>&1 || fail + $VERITYSETUP create $DEV_NAME $DEV_PARAMS $2 $6 >/dev/null 2>&1 || fail + check_exists + $VERITYSETUP status $DEV_NAME 2>/dev/null | grep flags | grep -q $7 || fail + dmsetup table $DEV_NAME 2>/dev/null | grep -q $7 || fail + $VERITYSETUP close $DEV_NAME >/dev/null 2>&1 || fail + echo "[OK]" +} + +function valgrind_setup() +{ + which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind." + [ ! -f $VERITYSETUP_VALGRIND ] && fail "Unable to get location of veritysetup executable." + export LD_LIBRARY_PATH="$VERITYSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH" +} + +function valgrind_run() +{ + INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${VERITYSETUP_VALGRIND} "$@" +} + +function checkOffsetBug() # $1 size, $2 hash-offset, $3 data-blocks +{ + echo -n "Size :: $1 B | Hash-offset :: $2 blocks | Data-blocks :: $3 " + dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1 + $VERITYSETUP --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 || fail "Test [hash-offset greater than 2G] failed" + echo "[OK]" + remove_mapping +} + +function checkOverlapBug() # $1 size, $2 hash-offset, $3 data-blocks, $4 block_size, $5 fec_offset +{ + echo -n "Device-size :: $1 B | " + [ $# -ge 3 ] && echo -n "Data-blocks :: $3 blocks| " + [ $# -lt 3 ] && echo -n "Data-blocks :: whole device | " + [ $# -ge 4 ] && echo -n "Block-size :: $4 B | " + [ $# -lt 4 ] && echo -n "Block-size :: 4096 B | " + echo -n "Hash-offset :: $2 B | " + + dd if=/dev/zero of=$IMG bs=1 count=0 seek=$1 >/dev/null 2>&1 + if [ -z $3 ] ; then + # veritysetup must fail + $VERITYSETUP --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 && fail "Test [overlap with option \"--data-blocks\" not entered] failed" + else + $VERITYSETUP --data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --hash-offset=$2 format $IMG $IMG >/dev/null 2>&1 + RET=$? + [ "$3" -gt "$(($2 / $4))" ] && [ "$RET" -eq "0" ] && fail "Test [overlap - hash-offset in data area] failed" + fi + + if [ $# -eq 5 ] ; then + echo -n "FEC-offset :: $5 B | " + PARAMS="--data-block-size=$4 --hash-block-size=$4 --data-blocks=$3 --fec-device=$IMG --fec-offset=$5" + + # test data-fec area overlap + $VERITYSETUP format $IMG $IMG_HASH $PARAMS >/dev/null 2>&1 + RET=$? + [ "$(($3*$4))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [data/fec area overlap] failed" + + HASH_SIZE=$(stat --printf="%s" $IMG_HASH) + + # test hash-fec area overlap + $VERITYSETUP format $IMG $IMG $PARAMS --hash-offset=$2 >/dev/null 2>&1 + RET=$? + [ "$(($2 + $HASH_SIZE))" -gt "$5" ] && [ "$RET" -eq "0" ] && fail "Test [hash/fec area overlap] failed" + fi + + echo "[OK]" + remove_mapping +} + +# $1 size, $2 block size, $3 roots, $4 hash offset, $5 fec offset, +# $6 one dev(1 - one device, 2 - one device for data and hash, one device for fec data, 3 - three separate devices), +# $7 #{corrupted bytes} +function checkUserSpaceRepair() +{ + BS=512 + COUNT=50000 + dd if=/dev/zero of=$IMG bs=$BS count=$COUNT >/dev/null 2>&1 + PARAMS="--data-block-size=$2 --hash-block-size=$2 --fec-roots=$3" + [ "$1" -gt 0 ] && PARAMS="$PARAMS --data-blocks=$1" && BS=$2 && COUNT=$1 + + # different parameters for different number of devices + [ "$6" -eq 1 ] && HASH_DEV=$IMG && FEC=$IMG && PARAMS="$PARAMS --hash-offset=$4 --fec-offset=$5" && echo -n "[One device]" + [ "$6" -eq 2 ] && HASH_DEV=$IMG && FEC=$FEC_DEV && PARAMS="$PARAMS --hash-offset=$4" && echo -n "[Two separate data/hash and fec devices]" + [ "$6" -eq 3 ] && HASH_DEV=$IMG_HASH && FEC=$FEC_DEV && echo -n "[Three separate devices]" + + echo -n "[nroots::$3]" + + ARR=(`$VERITYSETUP format $IMG $HASH_DEV --fec-device $FEC $PARAMS --salt=$DEV_SALT --uuid=$DEV_UUID`) + ROOT_HASH=${ARR[28]} + + echo -n "[Errors can be corrected]" + corrupt_device $IMG $(($BS*$COUNT)) $7 + $VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1 + RET=$? + [ "$RET" -ne 0 ] && fail "Device can be corrected, but it wasn't." + echo -n "[OK]" + + echo -n "[Errors cannot be corrected]" + dd if=/dev/urandom of=$IMG bs=$BS count=$COUNT conv=notrunc >/dev/null 2>&1 + $VERITYSETUP verify $IMG $HASH_DEV $ROOT_HASH --fec-device=$FEC $PARAMS >/dev/null 2>&1 + RET=$? + [ "$RET" -eq 0 ] && fail "Device cannot be correct, but it didn't fail." + echo "[OK]" +} + +[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped." +[ ! -x "$VERITYSETUP" ] && skip "Cannot find $VERITYSETUP, test skipped." + +[ -n "$VALG" ] && valgrind_setup && VERITYSETUP=valgrind_run +modprobe dm-verity >/dev/null 2>&1 +dmsetup targets | grep verity >/dev/null 2>&1 || skip "Cannot find dm-verity target, test skipped." + +# VERITYSETUP tests + +SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d + +echo "Verity tests [separate devices]" +prepare 8192 1024 +check_root_hash_fail + +check_root_hash 512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256 +check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256 +check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256 +# version 0 +check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256 +# no salt +check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256 +# sha1 +check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1 +check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1 + +echo "Verity tests [one device offset]" +prepare $((8192 + 1024)) +check_root_hash 512 9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 $SALT 1 sha256 8388608 +check_root_hash 1024 54d92778750495d1f80832b486ebd007617d746271511bbf0e295e143da2b3df $SALT 1 sha256 8388608 +check_root_hash 4096 e522df0f97da4febb882ac40f30b37dc0b444bf6df418929463fa25280f09d5c $SALT 1 sha256 8388608 +# version 0 +check_root_hash 4096 cbbf4ebd004ef65e29b935bb635a39cf754d677f3fa10b0126da725bbdf10f7d $SALT 0 sha256 8388608 +# no salt +check_root_hash 4096 ef29c902d87350f1da4bfa536e16cebc162a909bf89abe448b81ec500d4fb9bf - 1 sha256 8388608 +# sha1 +check_root_hash 1024 d0e9163ca8844aaa2e88fe5265a8c5d9ee494a99 $SALT 1 sha1 8388608 +check_root_hash 1024 73509e8e868be6b8ac939817a98a3d35121413b2 dadada 1 sha1 8388608 + +if check_version 1 3; then + echo "Verity data corruption options test." + SALT=e48da609055204e89ae53b655ca2216dd983cf3cb829f34f63a297d106d53e2d + HASH=9de18652fe74edfb9b805aaed72ae2aa48f94333f1ba5c452ac33b1c39325174 + prepare 8192 1024 + check_option 512 $HASH $SALT 1 sha256 "--ignore-corruption" "ignore_corruption" + check_option 512 $HASH $SALT 1 sha256 "--restart-on-corruption" "restart_on_corruption" + check_option 512 $HASH $SALT 1 sha256 "--ignore-zero-blocks" "ignore_zero_blocks" + check_option 512 $HASH $SALT 1 sha256 "--ignore-corruption --ignore-zero-blocks" "ignore_corruption" + if check_version 1 4; then + check_option 512 $HASH $SALT 1 sha256 "--check-at-most-once" "check_at_most_once" + fi + if check_version 1 7; then + check_option 512 $HASH $SALT 1 sha256 "--panic-on-corruption" "panic_on_corruption" + fi +fi + +echo "Veritysetup [hash-offset bigger than 2G works] " +checkOffsetBug 3000000000 2499997696 256 +checkOffsetBug 10000000000 8000000000 128 + +echo "Veritysetup [overlap-detection] " +checkOverlapBug 2097152 1433600 +checkOverlapBug 2097152 1433600 350 4096 +checkOverlapBug 2097152 1228800 350 4096 # data-hash overlap +checkOverlapBug 2097152 0 350 4096 1228800 # data-fec overlap +checkOverlapBug 10240000 256000 400 512 256512 # hash-fec overlap + +if check_version 1 3; then + echo "Veritysetup [FEC tests]" + for INDEX in {1..4}; do + # in the first iteration check if we can use FEC (it can be compiled-out) + (check_fec $IMG $IMG $IMG 4096 30 150 163840 409600 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) ) + RET=$? + [ "$RET" -eq "3" ] && break + [ "$RET" -eq "0" ] || fail "FEC repair failed" + + (check_fec $IMG $IMG $IMG 512 500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed" + (check_fec $IMG $IMG $IMG 512 500 50000 2457600 4915200 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed" + (check_fec $IMG $IMG $IMG 4096 64 6250 4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed" + (check_fec $IMG $IMG $IMG 4096 64 6250 4194304 8388608 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'y' $SALT) || fail "FEC repair failed" + + (check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4)) 'n' $SALT) || fail "FEC repair failed" + (check_fec $IMG $IMG_HASH $FEC_DEV 4096 35 35 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed" + (check_fec $IMG $IMG_HASH $FEC_DEV 512 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed" + (check_fec $IMG $IMG_HASH $FEC_DEV 1024 2000 2000 0 0 $(($RANDOM % 23 + 2)) $(($INDEX * 4))) || fail "FEC repair failed" + # this test should fail + (check_fec $IMG $IMG_HASH $FEC_DEV 4096 30 30 0 0 $(($RANDOM % 23 + 2)) $(($RANDOM % 200 + 200))) && fail "FEC repair must fail" + echo "[OK]" + done +fi + +echo "Correction in userspace: " +# checkUserSpaceRepair <#blocks> <#devices> <#corrupted bytes> +checkUserSpaceRepair -1 512 2 0 0 3 100 +checkUserSpaceRepair 400 512 2 256000 0 2 50 +checkUserSpaceRepair 500 512 2 2457600 4915200 1 1 +checkUserSpaceRepair -1 4096 2 0 0 3 10 +checkUserSpaceRepair 400 4096 2 2048000 0 2 1 +checkUserSpaceRepair 500 4096 2 2457600 4915200 1 2 + +remove_mapping +exit 0 -- cgit v1.2.3