eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-11 19:00:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove signal handling from LUKS keyencryption and simplify code.

Browse Source
This commit is contained in:
Milan Broz
2012-12-11 15:39:47 +01:00
parent 50d5cfa8bc
commit d742e01a32
3 changed files with 76 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

190
lib/luks1/keyencryption.c
View File

@@ -18,172 +18,122 @@
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <signal.h>
#include "luks.h"
#include "internal.h"
static const char *cleaner_name=NULL;
static uint64_t cleaner_size = 0;
static int devfd=-1;
static int setup_mapping(const char *cipher, const char *name,
unsigned int bsize, struct volume_key *vk,
unsigned int sector, size_t srcLength,
int mode, struct crypt_device *ctx)
static void _error_hint(struct crypt_device *ctx, const char *device,
const char *cipher_spec, const char *mode, size_t keyLength)
{
struct device *device = crypt_metadata_device(ctx);
struct crypt_dm_active_device dmd = {
.target = DM_CRYPT,
.uuid = NULL,
.size = size_round_up(srcLength, bsize) / SECTOR_SIZE,
.flags = CRYPT_ACTIVATE_PRIVATE,
.data_device = device,
.u.crypt = {
.cipher = cipher,
.vk = vk,
.offset = sector,
.iv_offset = 0,
}
};
int r;
log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
"Check that kernel supports %s cipher (check syslog for more info).\n"),
device, cipher_spec);
if (mode == O_RDONLY)
dmd.flags |= CRYPT_ACTIVATE_READONLY;
r = device_block_adjust(ctx, dmd.data_device, DEV_OK,
dmd.u.crypt.offset, &dmd.size, &dmd.flags);
if (r < 0)
return r;
if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) {
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
device_path(device));
return -EACCES;
}
cleaner_size = dmd.size;
return dm_create_device(ctx, name, "TEMP", &dmd, 0);
if (!strncmp(mode, "xts", 3) && (keyLength != 256 && keyLength != 512))
log_err(ctx, _("Key size in XTS mode must be 256 or 512 bits.\n"));
}
static void sigint_handler(int sig __attribute__((unused)))
{
if(devfd >= 0)
close(devfd);
devfd = -1;
if(cleaner_name)
dm_remove_device(NULL, cleaner_name, 1, cleaner_size);
signal(SIGINT, SIG_DFL);
kill(getpid(), SIGINT);
}
static const char *_error_hint(char *cipherMode, size_t keyLength)
{
const char *hint= "";
if (!strncmp(cipherMode, "xts", 3) && (keyLength != 256 && keyLength != 512))
hint = _("Key size in XTS mode must be 256 or 512 bits.\n");
return hint;
}
/* This function is not reentrant safe, as it installs a signal
handler and global vars for cleaning */
static int LUKS_endec_template(char *src, size_t srcLength,
struct luks_phdr *hdr,
const char *cipher, const char *cipher_mode,
struct volume_key *vk,
unsigned int sector,
ssize_t (*func)(int, int, void *, size_t),
int mode,
struct crypt_device *ctx)
{
char *name = NULL;
char *fullpath = NULL;
char *dmCipherSpec = NULL;
const char *dmDir = dm_get_dir();
int r = -1;
int bsize = device_block_size(crypt_metadata_device(ctx));
char name[PATH_MAX], path[PATH_MAX];
char cipher_spec[MAX_CIPHER_LEN * 3];
struct crypt_dm_active_device dmd = {
.target = DM_CRYPT,
.uuid = NULL,
.flags = CRYPT_ACTIVATE_PRIVATE,
.data_device = crypt_metadata_device(ctx),
.u.crypt = {
.cipher = cipher_spec,
.vk = vk,
.offset = sector,
.iv_offset = 0,
}
};
int r, bsize, devfd = -1;
bsize = device_block_size(dmd.data_device);
if (bsize <= 0)
return -EINVAL;
if(dmDir == NULL) {
log_err(ctx, _("Failed to obtain device mapper directory."));
return -EINVAL;
dmd.size = size_round_up(srcLength, bsize) / SECTOR_SIZE;
if (mode == O_RDONLY)
dmd.flags |= CRYPT_ACTIVATE_READONLY;
if (snprintf(name, sizeof(name), "temporary-cryptsetup-%d", getpid()) < 0)
return -ENOMEM;
if (snprintf(path, sizeof(path), "%s/%s", dm_get_dir(), name) < 0)
return -ENOMEM;
if (snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", cipher, cipher_mode) < 0)
return -ENOMEM;
r = device_block_adjust(ctx, dmd.data_device, DEV_OK,
dmd.u.crypt.offset, &dmd.size, &dmd.flags);
if (r < 0) {
log_err(ctx, _("Device %s doesn't exist or access denied.\n"),
device_path(dmd.data_device));
return -EIO;
}
if(asprintf(&name,"temporary-cryptsetup-%d",getpid()) == -1 ||
asprintf(&fullpath,"%s/%s",dmDir,name) == -1 ||
asprintf(&dmCipherSpec,"%s-%s",hdr->cipherName, hdr->cipherMode) == -1) {
r = -ENOMEM;
goto out1;
}
signal(SIGINT, sigint_handler);
cleaner_name = name;
if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) {
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
device_path(dmd.data_device));
return -EACCES;
}
r = setup_mapping(dmCipherSpec, name, bsize, vk, sector, srcLength, mode, ctx);
if(r < 0) {
r = dm_create_device(ctx, name, "TEMP", &dmd, 0);
if (r < 0) {
if (r != -EACCES && r != -ENOTSUP)
log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
"Check that kernel supports %s cipher (check syslog for more info).\n%s"),
device_path(crypt_metadata_device(ctx)), dmCipherSpec,
_error_hint(hdr->cipherMode, vk->keylength * 8));
r = -EIO;
goto out1;
_error_hint(ctx, device_path(dmd.data_device),
cipher_spec, cipher_mode, vk->keylength * 8);
return -EIO;
}
devfd = open(fullpath, mode | O_DIRECT | O_SYNC); /* devfd is a global var */
if(devfd == -1) {
devfd = open(path, mode | O_DIRECT | O_SYNC);
if (devfd == -1) {
log_err(ctx, _("Failed to open temporary keystore device.\n"));
r = -EIO;
goto out2;
goto out;
}
r = func(devfd, bsize, src, srcLength);
if(r < 0) {
if (r < 0) {
log_err(ctx, _("Failed to access temporary keystore device.\n"));
r = -EIO;
goto out3;
}
r = 0;
out3:
close(devfd);
devfd = -1;
out2:
dm_remove_device(ctx, cleaner_name, 1, cleaner_size);
out1:
signal(SIGINT, SIG_DFL);
cleaner_name = NULL;
cleaner_size = 0;
free(dmCipherSpec);
free(fullpath);
free(name);
} else
r = 0;
out:
if(devfd != -1)
close(devfd);
dm_remove_device(ctx, name, 1, dmd.size);
return r;
}
int LUKS_encrypt_to_storage(char *src, size_t srcLength,
struct luks_phdr *hdr,
const char *cipher,
const char *cipher_mode,
struct volume_key *vk,
unsigned int sector,
struct crypt_device *ctx)
{
return LUKS_endec_template(src, srcLength, hdr, vk, sector,
write_blockwise, O_RDWR, ctx);
return LUKS_endec_template(src, srcLength, cipher, cipher_mode,
vk, sector, write_blockwise, O_RDWR, ctx);
}
int LUKS_decrypt_from_storage(char *dst, size_t dstLength,
struct luks_phdr *hdr,
const char *cipher,
const char *cipher_mode,
struct volume_key *vk,
unsigned int sector,
struct crypt_device *ctx)
{
return LUKS_endec_template(dst, dstLength, hdr, vk, sector,
read_blockwise, O_RDONLY, ctx);
return LUKS_endec_template(dst, dstLength, cipher, cipher_mode,
vk, sector, read_blockwise, O_RDONLY, ctx);
}

4
lib/luks1/keymanage.c
View File

@@ -809,7 +809,7 @@ int LUKS_set_key(unsigned int keyIndex,
/* Encryption via dm */
r = LUKS_encrypt_to_storage(AfKey,
AFEKSize,
hdr,
hdr->cipherName, hdr->cipherMode,
derived_key,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);
@@ -892,7 +892,7 @@ static int LUKS_open_key(unsigned int keyIndex,
log_dbg("Reading key slot %d area.", keyIndex);
r = LUKS_decrypt_from_storage(AfKey,
AFEKSize,
hdr,
hdr->cipherName, hdr->cipherMode,
derived_key,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);

6
lib/luks1/luks.h
View File

@@ -175,14 +175,16 @@ int LUKS_keyslot_area(struct luks_phdr *hdr,
int LUKS_encrypt_to_storage(
char *src, size_t srcLength,
struct luks_phdr *hdr,
const char *cipher,
const char *cipher_mode,
struct volume_key *vk,
unsigned int sector,
struct crypt_device *ctx);
int LUKS_decrypt_from_storage(
char *dst, size_t dstLength,
struct luks_phdr *hdr,
const char *cipher,
const char *cipher_mode,
struct volume_key *vk,
unsigned int sector,
struct crypt_device *ctx);