diff --git a/lib/luks1/keyencryption.c b/lib/luks1/keyencryption.c index 84303ea4..14aa27fc 100644 --- a/lib/luks1/keyencryption.c +++ b/lib/luks1/keyencryption.c @@ -18,172 +18,122 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. */ -#include #include -#include #include -#include #include -#include - -#include "luks.h" #include "internal.h" -static const char *cleaner_name=NULL; -static uint64_t cleaner_size = 0; -static int devfd=-1; - -static int setup_mapping(const char *cipher, const char *name, - unsigned int bsize, struct volume_key *vk, - unsigned int sector, size_t srcLength, - int mode, struct crypt_device *ctx) +static void _error_hint(struct crypt_device *ctx, const char *device, + const char *cipher_spec, const char *mode, size_t keyLength) { - struct device *device = crypt_metadata_device(ctx); - struct crypt_dm_active_device dmd = { - .target = DM_CRYPT, - .uuid = NULL, - .size = size_round_up(srcLength, bsize) / SECTOR_SIZE, - .flags = CRYPT_ACTIVATE_PRIVATE, - .data_device = device, - .u.crypt = { - .cipher = cipher, - .vk = vk, - .offset = sector, - .iv_offset = 0, - } - }; - int r; + log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n" + "Check that kernel supports %s cipher (check syslog for more info).\n"), + device, cipher_spec); - if (mode == O_RDONLY) - dmd.flags |= CRYPT_ACTIVATE_READONLY; - - r = device_block_adjust(ctx, dmd.data_device, DEV_OK, - dmd.u.crypt.offset, &dmd.size, &dmd.flags); - if (r < 0) - return r; - - if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) { - log_err(ctx, _("Cannot write to device %s, permission denied.\n"), - device_path(device)); - return -EACCES; - } - cleaner_size = dmd.size; - return dm_create_device(ctx, name, "TEMP", &dmd, 0); + if (!strncmp(mode, "xts", 3) && (keyLength != 256 && keyLength != 512)) + log_err(ctx, _("Key size in XTS mode must be 256 or 512 bits.\n")); } -static void sigint_handler(int sig __attribute__((unused))) -{ - if(devfd >= 0) - close(devfd); - devfd = -1; - if(cleaner_name) - dm_remove_device(NULL, cleaner_name, 1, cleaner_size); - - signal(SIGINT, SIG_DFL); - kill(getpid(), SIGINT); -} - -static const char *_error_hint(char *cipherMode, size_t keyLength) -{ - const char *hint= ""; - - if (!strncmp(cipherMode, "xts", 3) && (keyLength != 256 && keyLength != 512)) - hint = _("Key size in XTS mode must be 256 or 512 bits.\n"); - - return hint; -} - -/* This function is not reentrant safe, as it installs a signal - handler and global vars for cleaning */ static int LUKS_endec_template(char *src, size_t srcLength, - struct luks_phdr *hdr, + const char *cipher, const char *cipher_mode, struct volume_key *vk, unsigned int sector, ssize_t (*func)(int, int, void *, size_t), int mode, struct crypt_device *ctx) { - char *name = NULL; - char *fullpath = NULL; - char *dmCipherSpec = NULL; - const char *dmDir = dm_get_dir(); - int r = -1; - int bsize = device_block_size(crypt_metadata_device(ctx)); + char name[PATH_MAX], path[PATH_MAX]; + char cipher_spec[MAX_CIPHER_LEN * 3]; + struct crypt_dm_active_device dmd = { + .target = DM_CRYPT, + .uuid = NULL, + .flags = CRYPT_ACTIVATE_PRIVATE, + .data_device = crypt_metadata_device(ctx), + .u.crypt = { + .cipher = cipher_spec, + .vk = vk, + .offset = sector, + .iv_offset = 0, + } + }; + int r, bsize, devfd = -1; + bsize = device_block_size(dmd.data_device); if (bsize <= 0) return -EINVAL; - if(dmDir == NULL) { - log_err(ctx, _("Failed to obtain device mapper directory.")); - return -EINVAL; + dmd.size = size_round_up(srcLength, bsize) / SECTOR_SIZE; + + if (mode == O_RDONLY) + dmd.flags |= CRYPT_ACTIVATE_READONLY; + + if (snprintf(name, sizeof(name), "temporary-cryptsetup-%d", getpid()) < 0) + return -ENOMEM; + if (snprintf(path, sizeof(path), "%s/%s", dm_get_dir(), name) < 0) + return -ENOMEM; + if (snprintf(cipher_spec, sizeof(cipher_spec), "%s-%s", cipher, cipher_mode) < 0) + return -ENOMEM; + + r = device_block_adjust(ctx, dmd.data_device, DEV_OK, + dmd.u.crypt.offset, &dmd.size, &dmd.flags); + if (r < 0) { + log_err(ctx, _("Device %s doesn't exist or access denied.\n"), + device_path(dmd.data_device)); + return -EIO; } - if(asprintf(&name,"temporary-cryptsetup-%d",getpid()) == -1 || - asprintf(&fullpath,"%s/%s",dmDir,name) == -1 || - asprintf(&dmCipherSpec,"%s-%s",hdr->cipherName, hdr->cipherMode) == -1) { - r = -ENOMEM; - goto out1; - } - signal(SIGINT, sigint_handler); - cleaner_name = name; + if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) { + log_err(ctx, _("Cannot write to device %s, permission denied.\n"), + device_path(dmd.data_device)); + return -EACCES; + } - r = setup_mapping(dmCipherSpec, name, bsize, vk, sector, srcLength, mode, ctx); - if(r < 0) { + r = dm_create_device(ctx, name, "TEMP", &dmd, 0); + if (r < 0) { if (r != -EACCES && r != -ENOTSUP) - log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n" - "Check that kernel supports %s cipher (check syslog for more info).\n%s"), - device_path(crypt_metadata_device(ctx)), dmCipherSpec, - _error_hint(hdr->cipherMode, vk->keylength * 8)); - r = -EIO; - goto out1; + _error_hint(ctx, device_path(dmd.data_device), + cipher_spec, cipher_mode, vk->keylength * 8); + return -EIO; } - devfd = open(fullpath, mode | O_DIRECT | O_SYNC); /* devfd is a global var */ - if(devfd == -1) { + devfd = open(path, mode | O_DIRECT | O_SYNC); + if (devfd == -1) { log_err(ctx, _("Failed to open temporary keystore device.\n")); r = -EIO; - goto out2; + goto out; } r = func(devfd, bsize, src, srcLength); - if(r < 0) { + if (r < 0) { log_err(ctx, _("Failed to access temporary keystore device.\n")); r = -EIO; - goto out3; - } - - r = 0; - out3: - close(devfd); - devfd = -1; - out2: - dm_remove_device(ctx, cleaner_name, 1, cleaner_size); - out1: - signal(SIGINT, SIG_DFL); - cleaner_name = NULL; - cleaner_size = 0; - free(dmCipherSpec); - free(fullpath); - free(name); + } else + r = 0; + out: + if(devfd != -1) + close(devfd); + dm_remove_device(ctx, name, 1, dmd.size); return r; } int LUKS_encrypt_to_storage(char *src, size_t srcLength, - struct luks_phdr *hdr, + const char *cipher, + const char *cipher_mode, struct volume_key *vk, unsigned int sector, struct crypt_device *ctx) { - return LUKS_endec_template(src, srcLength, hdr, vk, sector, - write_blockwise, O_RDWR, ctx); + return LUKS_endec_template(src, srcLength, cipher, cipher_mode, + vk, sector, write_blockwise, O_RDWR, ctx); } int LUKS_decrypt_from_storage(char *dst, size_t dstLength, - struct luks_phdr *hdr, + const char *cipher, + const char *cipher_mode, struct volume_key *vk, unsigned int sector, struct crypt_device *ctx) { - return LUKS_endec_template(dst, dstLength, hdr, vk, sector, - read_blockwise, O_RDONLY, ctx); + return LUKS_endec_template(dst, dstLength, cipher, cipher_mode, + vk, sector, read_blockwise, O_RDONLY, ctx); } diff --git a/lib/luks1/keymanage.c b/lib/luks1/keymanage.c index 204484ab..025fcde4 100644 --- a/lib/luks1/keymanage.c +++ b/lib/luks1/keymanage.c @@ -809,7 +809,7 @@ int LUKS_set_key(unsigned int keyIndex, /* Encryption via dm */ r = LUKS_encrypt_to_storage(AfKey, AFEKSize, - hdr, + hdr->cipherName, hdr->cipherMode, derived_key, hdr->keyblock[keyIndex].keyMaterialOffset, ctx); @@ -892,7 +892,7 @@ static int LUKS_open_key(unsigned int keyIndex, log_dbg("Reading key slot %d area.", keyIndex); r = LUKS_decrypt_from_storage(AfKey, AFEKSize, - hdr, + hdr->cipherName, hdr->cipherMode, derived_key, hdr->keyblock[keyIndex].keyMaterialOffset, ctx); diff --git a/lib/luks1/luks.h b/lib/luks1/luks.h index 8491032e..961df353 100644 --- a/lib/luks1/luks.h +++ b/lib/luks1/luks.h @@ -175,14 +175,16 @@ int LUKS_keyslot_area(struct luks_phdr *hdr, int LUKS_encrypt_to_storage( char *src, size_t srcLength, - struct luks_phdr *hdr, + const char *cipher, + const char *cipher_mode, struct volume_key *vk, unsigned int sector, struct crypt_device *ctx); int LUKS_decrypt_from_storage( char *dst, size_t dstLength, - struct luks_phdr *hdr, + const char *cipher, + const char *cipher_mode, struct volume_key *vk, unsigned int sector, struct crypt_device *ctx);