diff options
Diffstat (limited to 'src/shared/creds-util.c')
| -rw-r--r-- | src/shared/creds-util.c | 1395 |
1 files changed, 1395 insertions, 0 deletions
diff --git a/src/shared/creds-util.c b/src/shared/creds-util.c new file mode 100644 index 0000000..7cc8889 --- /dev/null +++ b/src/shared/creds-util.c @@ -0,0 +1,1395 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include <sys/file.h> + +#if HAVE_OPENSSL +#include <openssl/err.h> +#endif + +#include "sd-id128.h" + +#include "blockdev-util.h" +#include "capability-util.h" +#include "chattr-util.h" +#include "constants.h" +#include "creds-util.h" +#include "efi-api.h" +#include "env-util.h" +#include "fd-util.h" +#include "fileio.h" +#include "fs-util.h" +#include "io-util.h" +#include "memory-util.h" +#include "mkdir.h" +#include "openssl-util.h" +#include "parse-util.h" +#include "path-util.h" +#include "random-util.h" +#include "sparse-endian.h" +#include "stat-util.h" +#include "tpm2-util.h" +#include "virt.h" + +#define PUBLIC_KEY_MAX (UINT32_C(1024) * UINT32_C(1024)) + +bool credential_name_valid(const char *s) { + /* We want that credential names are both valid in filenames (since that's our primary way to pass + * them around) and as fdnames (which is how we might want to pass them around eventually) */ + return filename_is_valid(s) && fdname_is_valid(s); +} + +bool credential_glob_valid(const char *s) { + const char *e, *a; + size_t n; + + /* Checks if a credential glob expression is valid. Note that this is more restrictive than + * fnmatch()! We only allow trailing asterisk matches for now (simply because we want some freedom + * with automatically extending the pattern in a systematic way to cover for unit instances getting + * per-instance credentials or similar. Moreover, credential globbing expressions are also more + * restrictive then credential names: we don't allow *, ?, [, ] in them (except for the asterisk + * match at the end of the string), simply to not allow ambiguity. After all, we want the flexibility + * to one day add full globbing should the need arise. */ + + if (isempty(s)) + return false; + + /* Find first glob (or NUL byte) */ + n = strcspn(s, "*?[]"); + e = s + n; + + /* For now, only allow asterisk wildcards, and only at the end of the string. If it's anything else, refuse. */ + if (isempty(e)) + return credential_name_valid(s); + + if (!streq(e, "*")) /* only allow trailing "*", no other globs */ + return false; + + if (n == 0) /* Explicitly allow the complete wildcard. */ + return true; + + if (n > NAME_MAX + strlen(e)) /* before we make a copy on the stack, let's check this is not overly large */ + return false; + + /* Make a copy of the string without the '*' suffix */ + a = strndupa_safe(s, n); + + return credential_name_valid(a); +} + +static int get_credentials_dir_internal(const char *envvar, const char **ret) { + const char *e; + + assert(ret); + + e = secure_getenv(envvar); + if (!e) + return -ENXIO; + + if (!path_is_absolute(e) || !path_is_normalized(e)) + return -EINVAL; + + *ret = e; + return 0; +} + +int get_credentials_dir(const char **ret) { + return get_credentials_dir_internal("CREDENTIALS_DIRECTORY", ret); +} + +int get_encrypted_credentials_dir(const char **ret) { + return get_credentials_dir_internal("ENCRYPTED_CREDENTIALS_DIRECTORY", ret); +} + +int read_credential(const char *name, void **ret, size_t *ret_size) { + _cleanup_free_ char *fn = NULL; + const char *d; + int r; + + assert(ret); + + if (!credential_name_valid(name)) + return -EINVAL; + + r = get_credentials_dir(&d); + if (r < 0) + return r; + + fn = path_join(d, name); + if (!fn) + return -ENOMEM; + + return read_full_file_full( + AT_FDCWD, fn, + UINT64_MAX, SIZE_MAX, + READ_FULL_FILE_SECURE, + NULL, + (char**) ret, ret_size); +} + +int read_credential_with_decryption(const char *name, void **ret, size_t *ret_size) { + _cleanup_(erase_and_freep) void *data = NULL; + _cleanup_free_ char *fn = NULL; + size_t sz = 0; + const char *d; + int r; + + assert(ret); + + /* Just like read_credential() but will also look for encrypted credentials. Note that services only + * receive decrypted credentials, hence use read_credential() for those. This helper here is for + * generators, i.e. code that runs outside of service context, and thus has no decrypted credentials + * yet. + * + * Note that read_credential_harder_and_warn() logs on its own, while read_credential() does not! + * (It's a lot more complex and error prone given its TPM2 connectivity, and is generally called from + * generators only where logging is OK). + * + * Error handling is also a bit different: if we can't find a credential we'll return 0 and NULL + * pointers/zero size, rather than -ENXIO/-ENOENT. */ + + if (!credential_name_valid(name)) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid credential name: %s", name); + + r = read_credential(name, ret, ret_size); + if (r >= 0) + return 1; /* found */ + if (!IN_SET(r, -ENXIO, -ENOENT)) + return log_error_errno(r, "Failed read unencrypted credential '%s': %m", name); + + r = get_encrypted_credentials_dir(&d); + if (r == -ENXIO) + goto not_found; + if (r < 0) + return log_error_errno(r, "Failed to determine encrypted credentials directory: %m"); + + fn = path_join(d, name); + if (!fn) + return log_oom(); + + r = read_full_file_full( + AT_FDCWD, fn, + UINT64_MAX, SIZE_MAX, + READ_FULL_FILE_SECURE, + NULL, + (char**) &data, &sz); + if (r == -ENOENT) + goto not_found; + if (r < 0) + return log_error_errno(r, "Failed to read encrypted credential data: %m"); + + r = decrypt_credential_and_warn( + name, + now(CLOCK_REALTIME), + /* tpm2_device = */ NULL, + /* tpm2_signature_path = */ NULL, + data, + sz, + ret, + ret_size); + if (r < 0) + return r; + + return 1; /* found */ + +not_found: + *ret = NULL; + + if (ret_size) + *ret_size = 0; + + return 0; /* not found */ +} + +int read_credential_strings_many_internal( + const char *first_name, char **first_value, + ...) { + + _cleanup_free_ void *b = NULL; + int r, ret = 0; + + /* Reads a bunch of credentials into the specified buffers. If the specified buffers are already + * non-NULL frees them if a credential is found. Only supports string-based credentials + * (i.e. refuses embedded NUL bytes). + * + * 0 is returned when some or all credentials are missing. + */ + + if (!first_name) + return 0; + + r = read_credential(first_name, &b, NULL); + if (r == -ENXIO) /* No creds passed at all? Bail immediately. */ + return 0; + if (r < 0) { + if (r != -ENOENT) + ret = r; + } else + free_and_replace(*first_value, b); + + va_list ap; + va_start(ap, first_value); + + for (;;) { + _cleanup_free_ void *bb = NULL; + const char *name; + char **value; + + name = va_arg(ap, const char *); + if (!name) + break; + + value = va_arg(ap, char **); + if (*value) + continue; + + r = read_credential(name, &bb, NULL); + if (r < 0) { + if (ret >= 0 && r != -ENOENT) + ret = r; + } else + free_and_replace(*value, bb); + } + + va_end(ap); + return ret; +} + +int read_credential_bool(const char *name) { + _cleanup_free_ void *data = NULL; + int r; + + r = read_credential(name, &data, NULL); + if (r < 0) + return IN_SET(r, -ENXIO, -ENOENT) ? 0 : r; + + return parse_boolean(data); +} + +int get_credential_user_password(const char *username, char **ret_password, bool *ret_is_hashed) { + _cleanup_(erase_and_freep) char *creds_password = NULL; + _cleanup_free_ char *cn = NULL; + int r; + + /* Try to pick up the password for this account via the credentials logic */ + cn = strjoin("passwd.hashed-password.", username); + if (!cn) + return -ENOMEM; + + r = read_credential(cn, (void**) &creds_password, NULL); + if (r == -ENOENT) { + free(cn); + cn = strjoin("passwd.plaintext-password.", username); + if (!cn) + return -ENOMEM; + + r = read_credential(cn, (void**) &creds_password, NULL); + if (r < 0) + log_debug_errno(r, "Couldn't read credential '%s', ignoring: %m", cn); + else + *ret_is_hashed = false; + } else if (r < 0) + log_debug_errno(r, "Couldn't read credential '%s', ignoring: %m", cn); + else + *ret_is_hashed = true; + + *ret_password = TAKE_PTR(creds_password); + + return r; +} + +#if HAVE_OPENSSL + +#define CREDENTIAL_HOST_SECRET_SIZE 4096 + +static const sd_id128_t credential_app_id = + SD_ID128_MAKE(d3,ac,ec,ba,0d,ad,4c,df,b8,c9,38,15,28,93,6c,58); + +struct credential_host_secret_format { + /* The hashed machine ID of the machine this belongs to. Why? We want to ensure that each machine + * gets its own secret, even if people forget to flush out this secret file. Hence we bind it to the + * machine ID, for which there's hopefully a better chance it will be flushed out. We use a hashed + * machine ID instead of the literal one, because it's trivial to, and it might be a good idea not + * being able to directly associate a secret key file with a host. */ + sd_id128_t machine_id; + + /* The actual secret key */ + uint8_t data[CREDENTIAL_HOST_SECRET_SIZE]; +} _packed_; + +static void warn_not_encrypted(int fd, CredentialSecretFlags flags, const char *dirname, const char *filename) { + int r; + + assert(fd >= 0); + assert(dirname); + assert(filename); + + if (!FLAGS_SET(flags, CREDENTIAL_SECRET_WARN_NOT_ENCRYPTED)) + return; + + r = fd_is_encrypted(fd); + if (r < 0) + log_debug_errno(r, "Failed to determine if credential secret file '%s/%s' is encrypted.", + dirname, filename); + else if (r == 0) + log_warning("Credential secret file '%s/%s' is not located on encrypted media, using anyway.", + dirname, filename); +} + +static int make_credential_host_secret( + int dfd, + const sd_id128_t machine_id, + CredentialSecretFlags flags, + const char *dirname, + const char *fn, + void **ret_data, + size_t *ret_size) { + + _cleanup_free_ char *t = NULL; + _cleanup_close_ int fd = -EBADF; + int r; + + assert(dfd >= 0); + assert(fn); + + /* For non-root users creating a temporary file using the openat(2) over "." will fail later, in the + * linkat(2) step at the end. The reason is that linkat(2) requires the CAP_DAC_READ_SEARCH + * capability when it uses the AT_EMPTY_PATH flag. */ + if (have_effective_cap(CAP_DAC_READ_SEARCH) > 0) { + fd = openat(dfd, ".", O_CLOEXEC|O_WRONLY|O_TMPFILE, 0400); + if (fd < 0) + log_debug_errno(errno, "Failed to create temporary credential file with O_TMPFILE, proceeding without: %m"); + } + if (fd < 0) { + if (asprintf(&t, "credential.secret.%016" PRIx64, random_u64()) < 0) + return -ENOMEM; + + fd = openat(dfd, t, O_CLOEXEC|O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW, 0400); + if (fd < 0) + return -errno; + } + + r = chattr_secret(fd, 0); + if (r < 0) + log_debug_errno(r, "Failed to set file attributes for secrets file, ignoring: %m"); + + struct credential_host_secret_format buf = { + .machine_id = machine_id, + }; + + CLEANUP_ERASE(buf); + + r = crypto_random_bytes(buf.data, sizeof(buf.data)); + if (r < 0) + goto fail; + + r = loop_write(fd, &buf, sizeof(buf)); + if (r < 0) + goto fail; + + if (fsync(fd) < 0) { + r = -errno; + goto fail; + } + + warn_not_encrypted(fd, flags, dirname, fn); + + if (t) { + r = rename_noreplace(dfd, t, dfd, fn); + if (r < 0) + goto fail; + + t = mfree(t); + } else if (linkat(fd, "", dfd, fn, AT_EMPTY_PATH) < 0) { + r = -errno; + goto fail; + } + + if (fsync(dfd) < 0) { + r = -errno; + goto fail; + } + + if (ret_data) { + void *copy; + + copy = memdup(buf.data, sizeof(buf.data)); + if (!copy) { + r = -ENOMEM; + goto fail; + } + + *ret_data = copy; + } + + if (ret_size) + *ret_size = sizeof(buf.data); + + return 0; + +fail: + if (t && unlinkat(dfd, t, 0) < 0) + log_debug_errno(errno, "Failed to remove temporary credential key: %m"); + + return r; +} + +int get_credential_host_secret(CredentialSecretFlags flags, void **ret, size_t *ret_size) { + _cleanup_free_ char *_dirname = NULL, *_filename = NULL; + _cleanup_close_ int dfd = -EBADF; + sd_id128_t machine_id; + const char *dirname, *filename; + int r; + + r = sd_id128_get_machine_app_specific(credential_app_id, &machine_id); + if (r < 0) + return r; + + const char *e = secure_getenv("SYSTEMD_CREDENTIAL_SECRET"); + if (e) { + if (!path_is_normalized(e)) + return -EINVAL; + if (!path_is_absolute(e)) + return -EINVAL; + + r = path_extract_directory(e, &_dirname); + if (r < 0) + return r; + + r = path_extract_filename(e, &_filename); + if (r < 0) + return r; + + dirname = _dirname; + filename = _filename; + } else { + dirname = "/var/lib/systemd"; + filename = "credential.secret"; + } + + assert(dirname); + assert(filename); + + mkdir_parents(dirname, 0755); + dfd = open_mkdir_at(AT_FDCWD, dirname, O_CLOEXEC, 0755); + if (dfd < 0) + return log_debug_errno(dfd, "Failed to create or open directory '%s': %m", dirname); + + if (FLAGS_SET(flags, CREDENTIAL_SECRET_FAIL_ON_TEMPORARY_FS)) { + r = fd_is_temporary_fs(dfd); + if (r < 0) + return log_debug_errno(r, "Failed to check directory '%s': %m", dirname); + if (r > 0) + return log_debug_errno(SYNTHETIC_ERRNO(ENOMEDIUM), + "Directory '%s' is on a temporary file system, refusing.", dirname); + } + + for (unsigned attempt = 0;; attempt++) { + _cleanup_(erase_and_freep) struct credential_host_secret_format *f = NULL; + _cleanup_close_ int fd = -EBADF; + size_t l = 0; + ssize_t n = 0; + struct stat st; + + if (attempt >= 3) /* Somebody is playing games with us */ + return log_debug_errno(SYNTHETIC_ERRNO(EIO), + "All attempts to create secret store in %s failed.", dirname); + + fd = openat(dfd, filename, O_CLOEXEC|O_RDONLY|O_NOCTTY|O_NOFOLLOW); + if (fd < 0) { + if (errno != ENOENT || !FLAGS_SET(flags, CREDENTIAL_SECRET_GENERATE)) + return log_debug_errno(errno, + "Failed to open %s/%s: %m", dirname, filename); + + + r = make_credential_host_secret(dfd, machine_id, flags, dirname, filename, ret, ret_size); + if (r == -EEXIST) { + log_debug_errno(r, "Credential secret %s/%s appeared while we were creating it, rereading.", + dirname, filename); + continue; + } + if (r < 0) + return log_debug_errno(r, "Failed to create credential secret %s/%s: %m", + dirname, filename); + return 0; + } + + if (fstat(fd, &st) < 0) + return log_debug_errno(errno, "Failed to stat %s/%s: %m", dirname, filename); + + r = stat_verify_regular(&st); + if (r < 0) + return log_debug_errno(r, "%s/%s is not a regular file: %m", dirname, filename); + if (st.st_nlink == 0) /* Deleted by now, try again */ + continue; + if (st.st_nlink > 1) + /* Our deletion check won't work if hardlinked somewhere else */ + return log_debug_errno(SYNTHETIC_ERRNO(EPERM), + "%s/%s has too many links, refusing.", + dirname, filename); + if ((st.st_mode & 07777) != 0400) + /* Don't use file if not 0400 access mode */ + return log_debug_errno(SYNTHETIC_ERRNO(EPERM), + "%s/%s has permissive access mode, refusing.", + dirname, filename); + l = st.st_size; + if (l < offsetof(struct credential_host_secret_format, data) + 1) + return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), + "%s/%s is too small, refusing.", dirname, filename); + if (l > 16*1024*1024) + return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), + "%s/%s is too big, refusing.", dirname, filename); + + f = malloc(l+1); + if (!f) + return log_oom_debug(); + + n = read(fd, f, l+1); + if (n < 0) + return log_debug_errno(errno, + "Failed to read %s/%s: %m", dirname, filename); + if ((size_t) n != l) /* What? The size changed? */ + return log_debug_errno(SYNTHETIC_ERRNO(EIO), + "Failed to read %s/%s: %m", dirname, filename); + + if (sd_id128_equal(machine_id, f->machine_id)) { + size_t sz; + + warn_not_encrypted(fd, flags, dirname, filename); + + sz = l - offsetof(struct credential_host_secret_format, data); + assert(sz > 0); + + if (ret) { + void *copy; + + assert(sz <= sizeof(f->data)); /* Ensure we don't read past f->data bounds */ + + copy = memdup(f->data, sz); + if (!copy) + return log_oom_debug(); + + *ret = copy; + } + + if (ret_size) + *ret_size = sz; + + return 0; + } + + /* Hmm, this secret is from somewhere else. Let's delete the file. Let's first acquire a lock + * to ensure we are the only ones accessing the file while we delete it. */ + + if (flock(fd, LOCK_EX) < 0) + return log_debug_errno(errno, + "Failed to flock %s/%s: %m", dirname, filename); + + /* Before we delete it check that the file is still linked into the file system */ + if (fstat(fd, &st) < 0) + return log_debug_errno(errno, "Failed to stat %s/%s: %m", dirname, filename); + if (st.st_nlink == 0) /* Already deleted by now? */ + continue; + if (st.st_nlink != 1) /* Safety check, someone is playing games with us */ + return log_debug_errno(SYNTHETIC_ERRNO(EPERM), + "%s/%s unexpectedly has too many links.", + dirname, filename); + if (unlinkat(dfd, filename, 0) < 0) + return log_debug_errno(errno, "Failed to unlink %s/%s: %m", dirname, filename); + + /* And now try again */ + } +} + +/* Construction is like this: + * + * A symmetric encryption key is derived from: + * + * 1. Either the "host" key (a key stored in /var/lib/credential.secret) + * + * 2. A key generated by letting the TPM2 calculate an HMAC hash of some nonce we pass to it, keyed + * by a key derived from its internal seed key. + * + * 3. The concatenation of the above. + * + * 4. Or a fixed "empty" key. This will not provide confidentiality or authenticity, of course, but is + * useful to encode credentials for the initrd on TPM-less systems, where we simply have no better + * concept to bind things to. Note that decryption of a key set up like this will be refused on + * systems that have a TPM and have SecureBoot enabled. + * + * The above is hashed with SHA256 which is then used as encryption key for AES256-GCM. The encrypted + * credential is a short (unencrypted) header describing which of the three keys to use, the IV to use for + * AES256-GCM and some more meta information (sizes of certain objects) that is strictly speaking redundant, + * but kinda nice to have since we can have a more generic parser. If the TPM2 key is used this is followed + * by another (unencrypted) header, with information about the TPM2 policy used (specifically: the PCR mask + * to bind against, and a hash of the resulting policy — the latter being redundant, but speeding up things a + * bit, since we can more quickly refuse PCR state), followed by a sealed/exported TPM2 HMAC key. This is + * then followed by the encrypted data, which begins with a metadata header (which contains validity + * timestamps as well as the credential name), followed by the actual credential payload. The file ends in + * the AES256-GCM tag. To make things simple, the AES256-GCM AAD covers the main and the TPM2 header in + * full. This means the whole file is either protected by AAD, or is ciphertext, or is the tag. No + * unprotected data is included. + */ + +struct _packed_ encrypted_credential_header { + sd_id128_t id; + le32_t key_size; + le32_t block_size; + le32_t iv_size; + le32_t tag_size; + uint8_t iv[]; + /* Followed by NUL bytes until next 8 byte boundary */ +}; + +struct _packed_ tpm2_credential_header { + le64_t pcr_mask; /* Note that the spec for PC Clients only mandates 24 PCRs, and that's what systems + * generally have. But keep the door open for more. */ + le16_t pcr_bank; /* For now, either TPM2_ALG_SHA256 or TPM2_ALG_SHA1 */ + le16_t primary_alg; /* Primary key algorithm (either TPM2_ALG_RSA or TPM2_ALG_ECC for now) */ + le32_t blob_size; + le32_t policy_hash_size; + uint8_t policy_hash_and_blob[]; + /* Followed by NUL bytes until next 8 byte boundary */ +}; + +struct _packed_ tpm2_public_key_credential_header { + le64_t pcr_mask; /* PCRs used for the public key PCR policy (usually just PCR 11, i.e. the unified kernel) */ + le32_t size; /* Size of DER public key */ + uint8_t data[]; /* DER public key */ + /* Followed by NUL bytes until next 8 byte boundary */ +}; + +struct _packed_ metadata_credential_header { + le64_t timestamp; + le64_t not_after; + le32_t name_size; + char name[]; + /* Followed by NUL bytes until next 8 byte boundary */ +}; + +/* Some generic limit for parts of the encrypted credential for which we don't know the right size ahead of + * time, but where we are really sure it won't be larger than this. Should be larger than any possible IV, + * padding, tag size and so on. This is purely used for early filtering out of invalid sizes. */ +#define CREDENTIAL_FIELD_SIZE_MAX (16U*1024U) + +static int sha256_hash_host_and_tpm2_key( + const void *host_key, + size_t host_key_size, + const void *tpm2_key, + size_t tpm2_key_size, + uint8_t ret[static SHA256_DIGEST_LENGTH]) { + + _cleanup_(EVP_MD_CTX_freep) EVP_MD_CTX *md = NULL; + unsigned l; + + assert(host_key_size == 0 || host_key); + assert(tpm2_key_size == 0 || tpm2_key); + assert(ret); + + /* Combines the host key and the TPM2 HMAC hash into a SHA256 hash value we'll use as symmetric encryption key. */ + + md = EVP_MD_CTX_new(); + if (!md) + return log_oom(); + + if (EVP_DigestInit_ex(md, EVP_sha256(), NULL) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initial SHA256 context."); + + if (host_key && EVP_DigestUpdate(md, host_key, host_key_size) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to hash host key."); + + if (tpm2_key && EVP_DigestUpdate(md, tpm2_key, tpm2_key_size) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to hash TPM2 key."); + + assert(EVP_MD_CTX_size(md) == SHA256_DIGEST_LENGTH); + + if (EVP_DigestFinal_ex(md, ret, &l) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finalize SHA256 hash."); + + assert(l == SHA256_DIGEST_LENGTH); + return 0; +} + +int encrypt_credential_and_warn( + sd_id128_t with_key, + const char *name, + usec_t timestamp, + usec_t not_after, + const char *tpm2_device, + uint32_t tpm2_hash_pcr_mask, + const char *tpm2_pubkey_path, + uint32_t tpm2_pubkey_pcr_mask, + const void *input, + size_t input_size, + void **ret, + size_t *ret_size) { + + _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL; + _cleanup_(erase_and_freep) void *host_key = NULL, *tpm2_key = NULL; + size_t host_key_size = 0, tpm2_key_size = 0, tpm2_blob_size = 0, tpm2_policy_hash_size = 0, output_size, p, ml; + _cleanup_free_ void *tpm2_blob = NULL, *tpm2_policy_hash = NULL, *iv = NULL, *output = NULL; + _cleanup_free_ struct metadata_credential_header *m = NULL; + uint16_t tpm2_pcr_bank = 0, tpm2_primary_alg = 0; + struct encrypted_credential_header *h; + int ksz, bsz, ivsz, tsz, added, r; + _cleanup_free_ void *pubkey = NULL; + size_t pubkey_size = 0; + uint8_t md[SHA256_DIGEST_LENGTH]; + const EVP_CIPHER *cc; + sd_id128_t id; + + assert(input || input_size == 0); + assert(ret); + assert(ret_size); + + if (!sd_id128_in_set(with_key, + _CRED_AUTO, + _CRED_AUTO_INITRD, + CRED_AES256_GCM_BY_HOST, + CRED_AES256_GCM_BY_TPM2_HMAC, + CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK, + CRED_AES256_GCM_BY_TPM2_ABSENT)) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid key type: " SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(with_key)); + + if (name && !credential_name_valid(name)) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid credential name: %s", name); + + if (not_after != USEC_INFINITY && timestamp != USEC_INFINITY && not_after < timestamp) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential is invalidated before it is valid (" USEC_FMT " < " USEC_FMT ").", not_after, timestamp); + + if (DEBUG_LOGGING) { + char buf[FORMAT_TIMESTAMP_MAX]; + + if (name) + log_debug("Including credential name '%s' in encrypted credential.", name); + if (timestamp != USEC_INFINITY) + log_debug("Including timestamp '%s' in encrypted credential.", format_timestamp(buf, sizeof(buf), timestamp)); + if (not_after != USEC_INFINITY) + log_debug("Including not-after timestamp '%s' in encrypted credential.", format_timestamp(buf, sizeof(buf), not_after)); + } + + if (sd_id128_in_set(with_key, + _CRED_AUTO, + CRED_AES256_GCM_BY_HOST, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK)) { + + r = get_credential_host_secret( + CREDENTIAL_SECRET_GENERATE| + CREDENTIAL_SECRET_WARN_NOT_ENCRYPTED| + (sd_id128_equal(with_key, _CRED_AUTO) ? CREDENTIAL_SECRET_FAIL_ON_TEMPORARY_FS : 0), + &host_key, + &host_key_size); + if (r == -ENOMEDIUM && sd_id128_equal(with_key, _CRED_AUTO)) + log_debug_errno(r, "Credential host secret location on temporary file system, not using."); + else if (r < 0) + return log_error_errno(r, "Failed to determine local credential host secret: %m"); + } + +#if HAVE_TPM2 + bool try_tpm2; + if (sd_id128_in_set(with_key, _CRED_AUTO, _CRED_AUTO_INITRD)) { + /* If automatic mode is selected lets see if a TPM2 it is present. If we are running in a + * container tpm2_support will detect this, and will return a different flag combination of + * TPM2_SUPPORT_FULL, effectively skipping the use of TPM2 when inside one. */ + + try_tpm2 = tpm2_support() == TPM2_SUPPORT_FULL; + if (!try_tpm2) + log_debug("System lacks TPM2 support or running in a container, not attempting to use TPM2."); + } else + try_tpm2 = sd_id128_in_set(with_key, + CRED_AES256_GCM_BY_TPM2_HMAC, + CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK); + + if (try_tpm2) { + if (sd_id128_in_set(with_key, + _CRED_AUTO, + _CRED_AUTO_INITRD, + CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK, + CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK)) { + + /* Load public key for PCR policies, if one is specified, or explicitly requested */ + + r = tpm2_load_pcr_public_key(tpm2_pubkey_path, &pubkey, &pubkey_size); + if (r < 0) { + if (tpm2_pubkey_path || r != -ENOENT || !sd_id128_in_set(with_key, _CRED_AUTO, _CRED_AUTO_INITRD)) + return log_error_errno(r, "Failed read TPM PCR public key: %m"); + + log_debug_errno(r, "Failed to read TPM2 PCR public key, proceeding without: %m"); + } + } + + if (!pubkey) + tpm2_pubkey_pcr_mask = 0; + + _cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL; + r = tpm2_context_new(tpm2_device, &tpm2_context); + if (r < 0) + return log_error_errno(r, "Failed to create TPM2 context: %m"); + + r = tpm2_get_best_pcr_bank(tpm2_context, tpm2_hash_pcr_mask | tpm2_pubkey_pcr_mask, &tpm2_pcr_bank); + if (r < 0) + return log_error_errno(r, "Could not find best pcr bank: %m"); + + TPML_PCR_SELECTION tpm2_hash_pcr_selection; + tpm2_tpml_pcr_selection_from_mask(tpm2_hash_pcr_mask, tpm2_pcr_bank, &tpm2_hash_pcr_selection); + + _cleanup_free_ Tpm2PCRValue *tpm2_hash_pcr_values = NULL; + size_t tpm2_n_hash_pcr_values; + r = tpm2_pcr_read(tpm2_context, &tpm2_hash_pcr_selection, &tpm2_hash_pcr_values, &tpm2_n_hash_pcr_values); + if (r < 0) + return log_error_errno(r, "Could not read PCR values: %m"); + + TPM2B_PUBLIC public; + if (pubkey) { + r = tpm2_tpm2b_public_from_pem(pubkey, pubkey_size, &public); + if (r < 0) + return log_error_errno(r, "Could not convert public key to TPM2B_PUBLIC: %m"); + } + + TPM2B_DIGEST tpm2_policy = TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE); + r = tpm2_calculate_sealing_policy( + tpm2_hash_pcr_values, + tpm2_n_hash_pcr_values, + pubkey ? &public : NULL, + /* use_pin= */ false, + /* pcrlock_policy= */ NULL, + &tpm2_policy); + if (r < 0) + return log_error_errno(r, "Could not calculate sealing policy digest: %m"); + + r = tpm2_seal(tpm2_context, + /* seal_key_handle= */ 0, + &tpm2_policy, + /* pin= */ NULL, + &tpm2_key, &tpm2_key_size, + &tpm2_blob, &tpm2_blob_size, + &tpm2_primary_alg, + /* ret_srk_buf= */ NULL, + /* ret_srk_buf_size= */ NULL); + if (r < 0) { + if (sd_id128_equal(with_key, _CRED_AUTO_INITRD)) + log_warning("TPM2 present and used, but we didn't manage to talk to it. Credential will be refused if SecureBoot is enabled."); + else if (!sd_id128_equal(with_key, _CRED_AUTO)) + return log_error_errno(r, "Failed to seal to TPM2: %m"); + + log_notice_errno(r, "TPM2 sealing didn't work, continuing without TPM2: %m"); + } + + tpm2_policy_hash_size = tpm2_policy.size; + tpm2_policy_hash = malloc(tpm2_policy_hash_size); + if (!tpm2_policy_hash) + return log_oom(); + memcpy(tpm2_policy_hash, tpm2_policy.buffer, tpm2_policy_hash_size); + + assert(tpm2_blob_size <= CREDENTIAL_FIELD_SIZE_MAX); + assert(tpm2_policy_hash_size <= CREDENTIAL_FIELD_SIZE_MAX); + } +#endif + + if (sd_id128_in_set(with_key, _CRED_AUTO, _CRED_AUTO_INITRD)) { + /* Let's settle the key type in auto mode now. */ + + if (host_key && tpm2_key) + id = pubkey ? CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK : CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC; + else if (tpm2_key) + id = pubkey ? CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK : CRED_AES256_GCM_BY_TPM2_HMAC; + else if (host_key) + id = CRED_AES256_GCM_BY_HOST; + else if (sd_id128_equal(with_key, _CRED_AUTO_INITRD)) + id = CRED_AES256_GCM_BY_TPM2_ABSENT; + else + return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), + "TPM2 not available and host key located on temporary file system, no encryption key available."); + } else + id = with_key; + + if (sd_id128_equal(id, CRED_AES256_GCM_BY_TPM2_ABSENT)) + log_warning("Using a null key for encryption and signing. Confidentiality or authenticity will not be provided."); + + /* Let's now take the host key and the TPM2 key and hash it together, to use as encryption key for the data */ + r = sha256_hash_host_and_tpm2_key(host_key, host_key_size, tpm2_key, tpm2_key_size, md); + if (r < 0) + return r; + + assert_se(cc = EVP_aes_256_gcm()); + + ksz = EVP_CIPHER_key_length(cc); + assert(ksz == sizeof(md)); + + bsz = EVP_CIPHER_block_size(cc); + assert(bsz > 0); + assert((size_t) bsz <= CREDENTIAL_FIELD_SIZE_MAX); + + ivsz = EVP_CIPHER_iv_length(cc); + if (ivsz > 0) { + assert((size_t) ivsz <= CREDENTIAL_FIELD_SIZE_MAX); + + iv = malloc(ivsz); + if (!iv) + return log_oom(); + + r = crypto_random_bytes(iv, ivsz); + if (r < 0) + return log_error_errno(r, "Failed to acquired randomized IV: %m"); + } + + tsz = 16; /* FIXME: On OpenSSL 3 there is EVP_CIPHER_CTX_get_tag_length(), until then let's hardcode this */ + + context = EVP_CIPHER_CTX_new(); + if (!context) + return log_error_errno(SYNTHETIC_ERRNO(ENOMEM), "Failed to allocate encryption object: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_EncryptInit_ex(context, cc, NULL, md, iv) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context: %s", + ERR_error_string(ERR_get_error(), NULL)); + + /* Just an upper estimate */ + output_size = + ALIGN8(offsetof(struct encrypted_credential_header, iv) + ivsz) + + ALIGN8(tpm2_key ? offsetof(struct tpm2_credential_header, policy_hash_and_blob) + tpm2_blob_size + tpm2_policy_hash_size : 0) + + ALIGN8(pubkey ? offsetof(struct tpm2_public_key_credential_header, data) + pubkey_size : 0) + + ALIGN8(offsetof(struct metadata_credential_header, name) + strlen_ptr(name)) + + input_size + 2U * (size_t) bsz + + tsz; + + output = malloc0(output_size); + if (!output) + return log_oom(); + + h = (struct encrypted_credential_header*) output; + h->id = id; + h->block_size = htole32(bsz); + h->key_size = htole32(ksz); + h->tag_size = htole32(tsz); + h->iv_size = htole32(ivsz); + memcpy(h->iv, iv, ivsz); + + p = ALIGN8(offsetof(struct encrypted_credential_header, iv) + ivsz); + + if (tpm2_key) { + struct tpm2_credential_header *t; + + t = (struct tpm2_credential_header*) ((uint8_t*) output + p); + t->pcr_mask = htole64(tpm2_hash_pcr_mask); + t->pcr_bank = htole16(tpm2_pcr_bank); + t->primary_alg = htole16(tpm2_primary_alg); + t->blob_size = htole32(tpm2_blob_size); + t->policy_hash_size = htole32(tpm2_policy_hash_size); + memcpy(t->policy_hash_and_blob, tpm2_blob, tpm2_blob_size); + memcpy(t->policy_hash_and_blob + tpm2_blob_size, tpm2_policy_hash, tpm2_policy_hash_size); + + p += ALIGN8(offsetof(struct tpm2_credential_header, policy_hash_and_blob) + tpm2_blob_size + tpm2_policy_hash_size); + } + + if (pubkey) { + struct tpm2_public_key_credential_header *z; + + z = (struct tpm2_public_key_credential_header*) ((uint8_t*) output + p); + z->pcr_mask = htole64(tpm2_pubkey_pcr_mask); + z->size = htole32(pubkey_size); + memcpy(z->data, pubkey, pubkey_size); + + p += ALIGN8(offsetof(struct tpm2_public_key_credential_header, data) + pubkey_size); + } + + /* Pass the encrypted + TPM2 header as AAD */ + if (EVP_EncryptUpdate(context, NULL, &added, output, p) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to write AAD data: %s", + ERR_error_string(ERR_get_error(), NULL)); + + /* Now construct the metadata header */ + ml = strlen_ptr(name); + m = malloc0(ALIGN8(offsetof(struct metadata_credential_header, name) + ml)); + if (!m) + return log_oom(); + + m->timestamp = htole64(timestamp); + m->not_after = htole64(not_after); + m->name_size = htole32(ml); + memcpy_safe(m->name, name, ml); + + /* And encrypt the metadata header */ + if (EVP_EncryptUpdate(context, (uint8_t*) output + p, &added, (const unsigned char*) m, ALIGN8(offsetof(struct metadata_credential_header, name) + ml)) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt metadata header: %s", + ERR_error_string(ERR_get_error(), NULL)); + + assert(added >= 0); + assert((size_t) added <= output_size - p); + p += added; + + /* Then encrypt the plaintext */ + if (EVP_EncryptUpdate(context, (uint8_t*) output + p, &added, input, input_size) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt data: %s", + ERR_error_string(ERR_get_error(), NULL)); + + assert(added >= 0); + assert((size_t) added <= output_size - p); + p += added; + + /* Finalize */ + if (EVP_EncryptFinal_ex(context, (uint8_t*) output + p, &added) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finalize data encryption: %s", + ERR_error_string(ERR_get_error(), NULL)); + + assert(added >= 0); + assert((size_t) added <= output_size - p); + p += added; + + assert(p <= output_size - tsz); + + /* Append tag */ + if (EVP_CIPHER_CTX_ctrl(context, EVP_CTRL_GCM_GET_TAG, tsz, (uint8_t*) output + p) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to get tag: %s", + ERR_error_string(ERR_get_error(), NULL)); + + p += tsz; + assert(p <= output_size); + + if (DEBUG_LOGGING && input_size > 0) { + size_t base64_size; + + base64_size = DIV_ROUND_UP(p * 4, 3); /* Include base64 size increase in debug output */ + assert(base64_size >= input_size); + log_debug("Input of %zu bytes grew to output of %zu bytes (+%2zu%%).", input_size, base64_size, base64_size * 100 / input_size - 100); + } + + *ret = TAKE_PTR(output); + *ret_size = p; + + return 0; +} + +int decrypt_credential_and_warn( + const char *validate_name, + usec_t validate_timestamp, + const char *tpm2_device, + const char *tpm2_signature_path, + const void *input, + size_t input_size, + void **ret, + size_t *ret_size) { + + _cleanup_(erase_and_freep) void *host_key = NULL, *tpm2_key = NULL, *plaintext = NULL; + _cleanup_(json_variant_unrefp) JsonVariant *signature_json = NULL; + _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL; + size_t host_key_size = 0, tpm2_key_size = 0, plaintext_size, p, hs; + struct encrypted_credential_header *h; + struct metadata_credential_header *m; + uint8_t md[SHA256_DIGEST_LENGTH]; + bool with_tpm2, with_host_key, is_tpm2_absent, with_tpm2_pk; + const EVP_CIPHER *cc; + int r, added; + + assert(input || input_size == 0); + assert(ret); + assert(ret_size); + + h = (struct encrypted_credential_header*) input; + + /* The ID must fit in, for the current and all future formats */ + if (input_size < sizeof(h->id)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Encrypted file too short."); + + with_host_key = sd_id128_in_set(h->id, CRED_AES256_GCM_BY_HOST, CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC, CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK); + with_tpm2_pk = sd_id128_in_set(h->id, CRED_AES256_GCM_BY_TPM2_HMAC_WITH_PK, CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC_WITH_PK); + with_tpm2 = sd_id128_in_set(h->id, CRED_AES256_GCM_BY_TPM2_HMAC, CRED_AES256_GCM_BY_HOST_AND_TPM2_HMAC) || with_tpm2_pk; + is_tpm2_absent = sd_id128_equal(h->id, CRED_AES256_GCM_BY_TPM2_ABSENT); + + if (!with_host_key && !with_tpm2 && !is_tpm2_absent) + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Unknown encryption format, or corrupted data: %m"); + + if (with_tpm2_pk) { + r = tpm2_load_pcr_signature(tpm2_signature_path, &signature_json); + if (r < 0) + return log_error_errno(r, "Failed to load pcr signature: %m"); + } + + if (is_tpm2_absent) { + /* So this is a credential encrypted with a zero length key. We support this to cover for the + * case where neither a host key not a TPM2 are available (specifically: initrd environments + * where the host key is not yet accessible and no TPM2 chip exists at all), to minimize + * different codeflow for TPM2 and non-TPM2 codepaths. Of course, credentials encoded this + * way offer no confidentiality nor authenticity. Because of that it's important we refuse to + * use them on systems that actually *do* have a TPM2 chip – if we are in SecureBoot + * mode. Otherwise an attacker could hand us credentials like this and we'd use them thinking + * they are trusted, even though they are not. */ + + if (efi_has_tpm2()) { + if (is_efi_secure_boot()) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), + "Credential uses fixed key for fallback use when TPM2 is absent — but TPM2 is present, and SecureBoot is enabled, refusing."); + + log_warning("Credential uses fixed key for use when TPM2 is absent, but TPM2 is present! Accepting anyway, since SecureBoot is disabled."); + } else + log_debug("Credential uses fixed key for use when TPM2 is absent, and TPM2 indeed is absent. Accepting."); + } + + /* Now we know the minimum header size */ + if (input_size < offsetof(struct encrypted_credential_header, iv)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Encrypted file too short."); + + /* Verify some basic header values */ + if (le32toh(h->key_size) != sizeof(md)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected key size in header."); + if (le32toh(h->block_size) <= 0 || le32toh(h->block_size) > CREDENTIAL_FIELD_SIZE_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected block size in header."); + if (le32toh(h->iv_size) > CREDENTIAL_FIELD_SIZE_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "IV size too large."); + if (le32toh(h->tag_size) != 16) /* FIXME: On OpenSSL 3, let's verify via EVP_CIPHER_CTX_get_tag_length() */ + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected tag size in header."); + + /* Ensure we have space for the full header now (we don't know the size of the name hence this is a + * lower limit only) */ + if (input_size < + ALIGN8(offsetof(struct encrypted_credential_header, iv) + le32toh(h->iv_size)) + + ALIGN8(with_tpm2 ? offsetof(struct tpm2_credential_header, policy_hash_and_blob) : 0) + + ALIGN8(with_tpm2_pk ? offsetof(struct tpm2_public_key_credential_header, data) : 0) + + ALIGN8(offsetof(struct metadata_credential_header, name)) + + le32toh(h->tag_size)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Encrypted file too short."); + + p = ALIGN8(offsetof(struct encrypted_credential_header, iv) + le32toh(h->iv_size)); + + if (with_tpm2) { +#if HAVE_TPM2 + struct tpm2_credential_header* t = (struct tpm2_credential_header*) ((uint8_t*) input + p); + struct tpm2_public_key_credential_header *z = NULL; + + if (!TPM2_PCR_MASK_VALID(t->pcr_mask)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "TPM2 PCR mask out of range."); + if (!tpm2_hash_alg_to_string(le16toh(t->pcr_bank))) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "TPM2 PCR bank invalid or not supported"); + if (!tpm2_asym_alg_to_string(le16toh(t->primary_alg))) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "TPM2 primary key algorithm invalid or not supported."); + if (le32toh(t->blob_size) > CREDENTIAL_FIELD_SIZE_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected TPM2 blob size."); + if (le32toh(t->policy_hash_size) > CREDENTIAL_FIELD_SIZE_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected TPM2 policy hash size."); + + /* Ensure we have space for the full TPM2 header now (still don't know the name, and its size + * though, hence still just a lower limit test only) */ + if (input_size < + ALIGN8(offsetof(struct encrypted_credential_header, iv) + le32toh(h->iv_size)) + + ALIGN8(offsetof(struct tpm2_credential_header, policy_hash_and_blob) + le32toh(t->blob_size) + le32toh(t->policy_hash_size)) + + ALIGN8(with_tpm2_pk ? offsetof(struct tpm2_public_key_credential_header, data) : 0) + + ALIGN8(offsetof(struct metadata_credential_header, name)) + + le32toh(h->tag_size)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Encrypted file too short."); + + p += ALIGN8(offsetof(struct tpm2_credential_header, policy_hash_and_blob) + + le32toh(t->blob_size) + + le32toh(t->policy_hash_size)); + + if (with_tpm2_pk) { + z = (struct tpm2_public_key_credential_header*) ((uint8_t*) input + p); + + if (!TPM2_PCR_MASK_VALID(le64toh(z->pcr_mask)) || le64toh(z->pcr_mask) == 0) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "TPM2 PCR mask out of range."); + if (le32toh(z->size) > PUBLIC_KEY_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected public key size."); + + if (input_size < + ALIGN8(offsetof(struct encrypted_credential_header, iv) + le32toh(h->iv_size)) + + ALIGN8(offsetof(struct tpm2_credential_header, policy_hash_and_blob) + le32toh(t->blob_size) + le32toh(t->policy_hash_size)) + + ALIGN8(offsetof(struct tpm2_public_key_credential_header, data) + le32toh(z->size)) + + ALIGN8(offsetof(struct metadata_credential_header, name)) + + le32toh(h->tag_size)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Encrypted file too short."); + + p += ALIGN8(offsetof(struct tpm2_public_key_credential_header, data) + + le32toh(z->size)); + } + + _cleanup_(tpm2_context_unrefp) Tpm2Context *tpm2_context = NULL; + r = tpm2_context_new(tpm2_device, &tpm2_context); + if (r < 0) + return r; + + // TODO: Add the SRK data to the credential structure so it can be plumbed + // through and used to verify the TPM session. + r = tpm2_unseal(tpm2_context, + le64toh(t->pcr_mask), + le16toh(t->pcr_bank), + z ? z->data : NULL, + z ? le32toh(z->size) : 0, + z ? le64toh(z->pcr_mask) : 0, + signature_json, + /* pin= */ NULL, + /* pcrlock_policy= */ NULL, + le16toh(t->primary_alg), + t->policy_hash_and_blob, + le32toh(t->blob_size), + t->policy_hash_and_blob + le32toh(t->blob_size), + le32toh(t->policy_hash_size), + /* srk_buf= */ NULL, + /* srk_buf_size= */ 0, + &tpm2_key, + &tpm2_key_size); + if (r < 0) + return log_error_errno(r, "Failed to unseal secret using TPM2: %m"); +#else + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Credential requires TPM2 support, but TPM2 support not available."); +#endif + } + + if (with_host_key) { + r = get_credential_host_secret( + 0, + &host_key, + &host_key_size); + if (r < 0) + return log_error_errno(r, "Failed to determine local credential key: %m"); + } + + if (is_tpm2_absent) + log_warning("Warning: using a null key for decryption and authentication. Confidentiality or authenticity are not provided."); + + sha256_hash_host_and_tpm2_key(host_key, host_key_size, tpm2_key, tpm2_key_size, md); + + assert_se(cc = EVP_aes_256_gcm()); + + /* Make sure cipher expectations match the header */ + if (EVP_CIPHER_key_length(cc) != (int) le32toh(h->key_size)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected key size in header."); + if (EVP_CIPHER_block_size(cc) != (int) le32toh(h->block_size)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Unexpected block size in header."); + + context = EVP_CIPHER_CTX_new(); + if (!context) + return log_error_errno(SYNTHETIC_ERRNO(ENOMEM), "Failed to allocate decryption object: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_DecryptInit_ex(context, cc, NULL, NULL, NULL) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_CIPHER_CTX_ctrl(context, EVP_CTRL_GCM_SET_IVLEN, le32toh(h->iv_size), NULL) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set IV size on decryption context: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_DecryptInit_ex(context, NULL, NULL, md, h->iv) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set IV and key: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_DecryptUpdate(context, NULL, &added, input, p) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to write AAD data: %s", + ERR_error_string(ERR_get_error(), NULL)); + + plaintext = malloc(input_size - p - le32toh(h->tag_size)); + if (!plaintext) + return -ENOMEM; + + if (EVP_DecryptUpdate( + context, + plaintext, + &added, + (uint8_t*) input + p, + input_size - p - le32toh(h->tag_size)) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt data: %s", + ERR_error_string(ERR_get_error(), NULL)); + + assert(added >= 0); + assert((size_t) added <= input_size - p - le32toh(h->tag_size)); + plaintext_size = added; + + if (EVP_CIPHER_CTX_ctrl(context, EVP_CTRL_GCM_SET_TAG, le32toh(h->tag_size), (uint8_t*) input + input_size - le32toh(h->tag_size)) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to set tag: %s", + ERR_error_string(ERR_get_error(), NULL)); + + if (EVP_DecryptFinal_ex(context, (uint8_t*) plaintext + plaintext_size, &added) != 1) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Decryption failed (incorrect key?): %s", + ERR_error_string(ERR_get_error(), NULL)); + + plaintext_size += added; + + if (plaintext_size < ALIGN8(offsetof(struct metadata_credential_header, name))) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Metadata header incomplete."); + + m = plaintext; + + if (le64toh(m->timestamp) != USEC_INFINITY && + le64toh(m->not_after) != USEC_INFINITY && + le64toh(m->timestamp) >= le64toh(m->not_after)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Timestamps of credential are not in order, refusing."); + + if (le32toh(m->name_size) > CREDENTIAL_NAME_MAX) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Embedded credential name too long, refusing."); + + hs = ALIGN8(offsetof(struct metadata_credential_header, name) + le32toh(m->name_size)); + if (plaintext_size < hs) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Metadata header incomplete."); + + if (le32toh(m->name_size) > 0) { + _cleanup_free_ char *embedded_name = NULL; + + r = make_cstring(m->name, le32toh(m->name_size), MAKE_CSTRING_REFUSE_TRAILING_NUL, &embedded_name); + if (r < 0) + return log_error_errno(r, "Unable to convert embedded credential name to C string: %m"); + + if (!credential_name_valid(embedded_name)) + return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Embedded credential name is not valid, refusing."); + + if (validate_name && !streq(embedded_name, validate_name)) { + + r = getenv_bool_secure("SYSTEMD_CREDENTIAL_VALIDATE_NAME"); + if (r < 0 && r != -ENXIO) + log_debug_errno(r, "Failed to parse $SYSTEMD_CREDENTIAL_VALIDATE_NAME: %m"); + if (r != 0) + return log_error_errno(SYNTHETIC_ERRNO(EREMOTE), "Embedded credential name '%s' does not match filename '%s', refusing.", embedded_name, validate_name); + + log_debug("Embedded credential name '%s' does not match expected name '%s', but configured to use credential anyway.", embedded_name, validate_name); + } + } + + if (validate_timestamp != USEC_INFINITY) { + if (le64toh(m->timestamp) != USEC_INFINITY && le64toh(m->timestamp) > validate_timestamp) + log_debug("Credential timestamp is from the future, assuming clock skew."); + + if (le64toh(m->not_after) != USEC_INFINITY && le64toh(m->not_after) < validate_timestamp) { + + r = getenv_bool_secure("SYSTEMD_CREDENTIAL_VALIDATE_NOT_AFTER"); + if (r < 0 && r != -ENXIO) + log_debug_errno(r, "Failed to parse $SYSTEMD_CREDENTIAL_VALIDATE_NOT_AFTER: %m"); + if (r != 0) + return log_error_errno(SYNTHETIC_ERRNO(ESTALE), "Credential's time passed, refusing to use."); + + log_debug("Credential not-after timestamp has passed, but configured to use credential anyway."); + } + } + + if (ret) { + char *without_metadata; + + without_metadata = memdup((uint8_t*) plaintext + hs, plaintext_size - hs); + if (!without_metadata) + return log_oom(); + + *ret = without_metadata; + } + + if (ret_size) + *ret_size = plaintext_size - hs; + + return 0; +} + +#else + +int get_credential_host_secret(CredentialSecretFlags flags, void **ret, size_t *ret_size) { + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Support for encrypted credentials not available."); +} + +int encrypt_credential_and_warn(sd_id128_t with_key, const char *name, usec_t timestamp, usec_t not_after, const char *tpm2_device, uint32_t tpm2_hash_pcr_mask, const char *tpm2_pubkey_path, uint32_t tpm2_pubkey_pcr_mask, const void *input, size_t input_size, void **ret, size_t *ret_size) { + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Support for encrypted credentials not available."); +} + +int decrypt_credential_and_warn(const char *validate_name, usec_t validate_timestamp, const char *tpm2_device, const char *tpm2_signature_path, const void *input, size_t input_size, void **ret, size_t *ret_size) { + return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Support for encrypted credentials not available."); +} + +#endif |