eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-05 16:00:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Do not allow null cipher for LUKS2 keyslot even in conversion.

Browse Source
This commit is contained in:
Milan Broz
2025-05-29 15:39:28 +02:00
parent 8d7ee84006
commit b81c84bd8f
4 changed files with 20 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/luks2/luks2_keyslot.c
View File

@@ -175,6 +175,9 @@ int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd, const char *ciphe
if (!strncmp(cipher_spec, "capi:", 5)) if (!strncmp(cipher_spec, "capi:", 5))
return 1; return 1;
if (crypt_is_cipher_null(cipher_spec))
return 1;
if (crypt_parse_name_and_mode(cipher_spec, cipher, NULL, cipher_mode) < 0) if (crypt_parse_name_and_mode(cipher_spec, cipher, NULL, cipher_mode) < 0)
return 1; return 1;

2
lib/luks2/luks2_luks1_convert.c
View File

@@ -596,7 +596,7 @@ int LUKS2_luks1_to_luks2(struct crypt_device *cd, struct luks_phdr *hdr1, struct
if (r < 0 || (size_t)r >= sizeof(cipher_spec)) if (r < 0 || (size_t)r >= sizeof(cipher_spec))
return -EINVAL; return -EINVAL;
if (LUKS2_keyslot_cipher_incompatible(cd, cipher_spec)) { if (LUKS2_keyslot_cipher_incompatible(cd, cipher_spec)) {
log_err(cd, _("Unable to use cipher specification %s-%s for LUKS2."), log_err(cd, _("Unable to use cipher specification %s-%s for LUKS2 keyslot."),
hdr1->cipherName, hdr1->cipherMode); hdr1->cipherName, hdr1->cipherMode);
return -EINVAL; return -EINVAL;
} }

7
src/cryptsetup.c
View File

@@ -78,6 +78,7 @@ static bool isLUKS(const char *type)
static int _set_keyslot_encryption_params(struct crypt_device *cd) static int _set_keyslot_encryption_params(struct crypt_device *cd)
{ {
const char *type = crypt_get_type(cd); const char *type = crypt_get_type(cd);
int r;
if (!ARG_SET(OPT_KEYSLOT_KEY_SIZE_ID) && !ARG_SET(OPT_KEYSLOT_CIPHER_ID)) if (!ARG_SET(OPT_KEYSLOT_KEY_SIZE_ID) && !ARG_SET(OPT_KEYSLOT_CIPHER_ID))
return 0; return 0;
@@ -87,7 +88,11 @@ static int _set_keyslot_encryption_params(struct crypt_device *cd)
return -EINVAL; return -EINVAL;
} }
return crypt_keyslot_set_encryption(cd, ARG_STR(OPT_KEYSLOT_CIPHER_ID), ARG_UINT32(OPT_KEYSLOT_KEY_SIZE_ID) / 8); r = crypt_keyslot_set_encryption(cd, ARG_STR(OPT_KEYSLOT_CIPHER_ID), ARG_UINT32(OPT_KEYSLOT_KEY_SIZE_ID) / 8);
if (r < 0)
log_err(_("Keyslot encryption parameters are not compatible with LUKS2 keyslot encryption."));
return r;
} }
static int init_new_keyslot_context(struct crypt_device *cd, static int init_new_keyslot_context(struct crypt_device *cd,

18
tests/luks2-reencryption-test
View File

@@ -1855,14 +1855,16 @@ if [ $HAVE_KEYRING -gt 0 ]; then
fi fi
$CRYPTSETUP close $DEV_NAME $CRYPTSETUP close $DEV_NAME
# simulate LUKS2 device with cipher_null in both keyslot and segment (it can be created only by up conversion from LUKS1) # FIXME: Add test luks2 image with both keyslot and data using cipher_null and verify LUKS2 reencryption fixes this.
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail
$CRYPTSETUP convert -q --type luks2 $DEV || fail ## simulate LUKS2 device with cipher_null in both keyslot and segment (it can be created only by up conversion from LUKS1)
wipe $PWD1 #echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail
echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail #$CRYPTSETUP convert -q --type luks2 $DEV || fail
check_hash $PWD1 $HASH1 #wipe $PWD1
# both keyslot and segment cipher must not be null after reencryption with default params #echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail
$CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail #check_hash $PWD1 $HASH1
## both keyslot and segment cipher must not be null after reencryption with default params
#$CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail
# multistep reencryption with initial cipher_null # multistep reencryption with initial cipher_null
preparebig 64 preparebig 64