lib/bitlk/bitlk.c

   1 /*
   2  * BITLK (BitLocker-compatible) volume handling
   3  *
   4  * Copyright (C) 2019-2023 Red Hat, Inc. All rights reserved.
   5  * Copyright (C) 2019-2023 Milan Broz
   6  * Copyright (C) 2019-2023 Vojtech Trefny
   7  *
   8  * This file is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License as published by the Free Software Foundation; either
  11  * version 2.1 of the License, or (at your option) any later version.
  12  *
  13  * This file is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public
  19  * License along with this file; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 #include <errno.h>
  24 #include <string.h>
  25 #include <uuid/uuid.h>
  26 #include <time.h>
  27 #include <limits.h>
  28
  29 #include "bitlk.h"
  30 #include "internal.h"
  31
  32 #define BITLK_BOOTCODE_V1 "\xeb\x52\x90"
  33 #define BITLK_BOOTCODE_V2 "\xeb\x58\x90"
  34 #define BITLK_SIGNATURE "-FVE-FS-"
  35 #define BITLK_SIGNATURE_TOGO "MSWIN4.1"
  36 #define BITLK_HEADER_METADATA_OFFSET 160
  37 #define BITLK_HEADER_METADATA_OFFSET_TOGO 424
  38
  39 /* FVE metadata header is split into two parts */
  40 #define BITLK_FVE_METADATA_BLOCK_HEADER_LEN 64
  41 #define BITLK_FVE_METADATA_HEADER_LEN 48
  42 #define BITLK_FVE_METADATA_HEADERS_LEN BITLK_FVE_METADATA_BLOCK_HEADER_LEN + BITLK_FVE_METADATA_HEADER_LEN
  43
  44 /* total size of the FVE area (64 KiB) */
  45 #define BITLK_FVE_METADATA_SIZE 64 * 1024
  46
  47 #define BITLK_ENTRY_HEADER_LEN 8
  48 #define BITLK_VMK_HEADER_LEN 28
  49
  50 #define BITLK_OPEN_KEY_METADATA_LEN 12
  51
  52 #define BITLK_RECOVERY_KEY_LEN 55
  53 #define BITLK_RECOVERY_PARTS 8
  54 #define BITLK_RECOVERY_PART_LEN 6
  55
  56 #define BITLK_BEK_FILE_HEADER_LEN 48
  57 #define BITLK_STARTUP_KEY_HEADER_LEN 24
  58
  59 #define BITLK_KDF_HASH "sha256"
  60 #define BITLK_KDF_ITERATION_COUNT 0x100000
  61
  62 /* maximum number of segments for the DM device */
  63 #define MAX_BITLK_SEGMENTS 10
  64
  65 /* January 1, 1970 as MS file time */
  66 #define EPOCH_AS_FILETIME 116444736000000000
  67 #define HUNDREDS_OF_NANOSECONDS 10000000
  68
  69 /* not available in older version of libuuid */
  70 #ifndef UUID_STR_LEN
  71 #define UUID_STR_LEN    37
  72 #endif
  73
  74 /* known types of GUIDs from the BITLK superblock */
  75 const uint8_t BITLK_GUID_NORMAL[16] = { 0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a,
  76                                         0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01 };
  77 const uint8_t BITLK_GUID_EOW[16] = { 0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d,
  78                                      0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8 };
  79
  80 /* taken from libfdisk gpt.c -- TODO: this is a good candidate for adding to libuuid */
  81 struct bitlk_guid {
  82         uint32_t   time_low;
  83         uint16_t   time_mid;
  84         uint16_t   time_hi_and_version;
  85         uint8_t    clock_seq_hi;
  86         uint8_t    clock_seq_low;
  87         uint8_t    node[6];
  88 } __attribute__ ((packed));
  89
  90 static void swap_guid(struct bitlk_guid *guid) {
  91         guid->time_low = swab32(guid->time_low);
  92         guid->time_mid = swab16(guid->time_mid);
  93         guid->time_hi_and_version = swab16(guid->time_hi_and_version);
  94 }
  95
  96 static void guid_to_string(struct bitlk_guid *guid, char *out) {
  97         swap_guid(guid);
  98         uuid_unparse((unsigned char *) guid, out);
  99 }
 100
 101 typedef enum {
 102         BITLK_SEGTYPE_CRYPT,
 103         BITLK_SEGTYPE_ZERO,
 104 } BitlkSegmentType;
 105
 106 struct segment {
 107         uint64_t offset;
 108         uint64_t length;
 109         uint64_t iv_offset;
 110         BitlkSegmentType type;
 111 };
 112
 113 struct bitlk_signature {
 114         uint8_t boot_code[3];
 115         uint8_t signature[8];
 116         uint16_t sector_size;
 117 } __attribute__ ((packed));
 118
 119 struct bitlk_superblock {
 120         struct bitlk_guid guid;
 121         uint64_t fve_offset[3];
 122 } __attribute__ ((packed));
 123
 124 struct bitlk_fve_metadata {
 125         /* FVE metadata block header */
 126         uint8_t signature[8];
 127         uint16_t fve_size;
 128         uint16_t fve_version;
 129         uint16_t curr_state;
 130         uint16_t next_state;
 131         uint64_t volume_size;
 132         uint32_t unknown2;
 133         uint32_t volume_header_size;
 134         uint64_t fve_offset[3];
 135         uint64_t volume_header_offset;
 136         /* FVE metadata header */
 137         uint32_t metadata_size;
 138         uint32_t metadata_version;
 139         uint32_t metadata_header_size;
 140         uint32_t metada_size_copy;
 141         struct bitlk_guid guid;
 142         uint32_t next_nonce;
 143         uint16_t encryption;
 144         uint16_t unknown3;
 145         uint64_t creation_time;
 146 } __attribute__ ((packed));
 147
 148 struct bitlk_entry_header_block {
 149         uint64_t offset;
 150         uint64_t size;
 151 } __attribute__ ((packed));
 152
 153 struct bitlk_entry_vmk {
 154         struct bitlk_guid guid;
 155         uint8_t modified[8];
 156         uint16_t _unknown;
 157         uint16_t protection;
 158 } __attribute__ ((packed));
 159
 160 struct bitlk_kdf_data {
 161         char last_sha256[32];
 162         char initial_sha256[32];
 163         char salt[16];
 164         uint64_t count;
 165 };
 166
 167 struct bitlk_bek_header {
 168         uint32_t metadata_size;
 169         uint32_t metadata_version;
 170         uint32_t metadata_header_size;
 171         uint32_t metada_size_copy;
 172         struct bitlk_guid guid;
 173         uint32_t next_nonce;
 174         uint16_t encryption;
 175         uint16_t unknown;
 176         uint64_t creation_time;
 177 } __attribute__ ((packed));
 178
 179 static BITLKVMKProtection get_vmk_protection(uint16_t protection)
 180 {
 181         switch (protection) {
 182         case 0x0000:
 183                 return BITLK_PROTECTION_CLEAR_KEY;
 184         case 0x0100:
 185                 return BITLK_PROTECTION_TPM;
 186         case 0x0200:
 187                 return BITLK_PROTECTION_STARTUP_KEY;
 188         case 0x0500:
 189                 return BITLK_PROTECTION_TPM_PIN;
 190         case 0x0800:
 191                 return BITLK_PROTECTION_RECOVERY_PASSPHRASE;
 192         case 0x1000:
 193                 return BITLK_PROTECTION_SMART_CARD;
 194         case 0x2000:
 195                 return BITLK_PROTECTION_PASSPHRASE;
 196         default:
 197                 return BITLK_PROTECTION_UNKNOWN;
 198         }
 199 }
 200
 201 static const char* get_vmk_protection_string(BITLKVMKProtection protection)
 202 {
 203         switch (protection) {
 204         case BITLK_PROTECTION_CLEAR_KEY:
 205                 return "VMK protected with clear key";
 206         case BITLK_PROTECTION_TPM:
 207                 return "VMK protected with TPM";
 208         case BITLK_PROTECTION_STARTUP_KEY:
 209                 return "VMK protected with startup key";
 210         case BITLK_PROTECTION_TPM_PIN:
 211                 return "VMK protected with TPM and PIN";
 212         case BITLK_PROTECTION_PASSPHRASE:
 213                 return "VMK protected with passphrase";
 214         case BITLK_PROTECTION_RECOVERY_PASSPHRASE:
 215                 return "VMK protected with recovery passphrase";
 216         case BITLK_PROTECTION_SMART_CARD:
 217                 return "VMK protected with smart card";
 218         default:
 219                 return "VMK with unknown protection";
 220         }
 221 }
 222
 223 static const char* get_bitlk_type_string(BITLKEncryptionType type)
 224 {
 225         switch (type)
 226         {
 227         case BITLK_ENCRYPTION_TYPE_NORMAL:
 228                 return "normal";
 229         case BITLK_ENCRYPTION_TYPE_EOW:
 230                 return "encrypt-on-write";
 231         default:
 232                 return "unknown";
 233         }
 234 }
 235
 236 static uint64_t filetime_to_unixtime(uint64_t time)
 237 {
 238         return (time - EPOCH_AS_FILETIME) / HUNDREDS_OF_NANOSECONDS;
 239 }
 240
 241 static int parse_vmk_entry(struct crypt_device *cd, uint8_t *data, int start, int end, struct bitlk_vmk **vmk)
 242 {
 243         uint16_t key_entry_size = 0;
 244         uint16_t key_entry_type = 0;
 245         uint16_t key_entry_value = 0;
 246         size_t key_size = 0;
 247         char *string = NULL;
 248         const char *key = NULL;
 249         struct volume_key *vk = NULL;
 250         bool supported = false;
 251         int r = 0;
 252
 253         /* only passphrase or recovery passphrase vmks are supported (can be used to activate) */
 254         supported = (*vmk)->protection == BITLK_PROTECTION_PASSPHRASE ||
 255                     (*vmk)->protection == BITLK_PROTECTION_RECOVERY_PASSPHRASE ||
 256                     (*vmk)->protection == BITLK_PROTECTION_STARTUP_KEY;
 257
 258         while ((end - start) >= (ssize_t)(sizeof(key_entry_size) + sizeof(key_entry_type) + sizeof(key_entry_value))) {
 259                 /* size of this entry */
 260                 memcpy(&key_entry_size, data + start, sizeof(key_entry_size));
 261                 key_entry_size = le16_to_cpu(key_entry_size);
 262                 if (key_entry_size == 0)
 263                         break;
 264
 265                 if (key_entry_size > (end - start))
 266                         return -EINVAL;
 267
 268                 /* type and value of this entry */
 269                 memcpy(&key_entry_type, data + start + sizeof(key_entry_size), sizeof(key_entry_type));
 270                 memcpy(&key_entry_value,
 271                        data + start + sizeof(key_entry_size) + sizeof(key_entry_type),
 272                        sizeof(key_entry_value));
 273                 key_entry_type = le16_to_cpu(key_entry_type);
 274                 key_entry_value = le16_to_cpu(key_entry_value);
 275
 276                 if (key_entry_type != BITLK_ENTRY_TYPE_PROPERTY) {
 277                         if (supported) {
 278                                 log_err(cd, _("Unexpected metadata entry type '%u' found when parsing supported Volume Master Key."), key_entry_type);
 279                                 return -EINVAL;
 280                         } else {
 281                                 log_dbg(cd, "Unexpected metadata entry type '%u' found when parsing unsupported VMK.", key_entry_type);
 282                         }
 283                 }
 284
 285                 /* stretch key with salt, skip 4 B (encryption method of the stretch key) */
 286                 if (key_entry_value == BITLK_ENTRY_VALUE_STRETCH_KEY) {
 287                         if ((end - start) < (BITLK_ENTRY_HEADER_LEN + BITLK_SALT_SIZE + 4))
 288                                 return -EINVAL;
 289                         memcpy((*vmk)->salt,
 290                                data + start + BITLK_ENTRY_HEADER_LEN + 4,
 291                                BITLK_SALT_SIZE);
 292                 /* AES-CCM encrypted key */
 293                 } else if (key_entry_value == BITLK_ENTRY_VALUE_ENCRYPTED_KEY) {
 294                         if (key_entry_size < (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE))
 295                                 return -EINVAL;
 296                         /* nonce */
 297                         memcpy((*vmk)->nonce,
 298                                data + start + BITLK_ENTRY_HEADER_LEN,
 299                                BITLK_NONCE_SIZE);
 300                         /* MAC tag */
 301                         memcpy((*vmk)->mac_tag,
 302                                data + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE,
 303                                BITLK_VMK_MAC_TAG_SIZE);
 304                         /* AES-CCM encrypted key */
 305                         key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE);
 306                         key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE;
 307                         vk = crypt_alloc_volume_key(key_size, key);
 308                         if (vk == NULL)
 309                                 return -ENOMEM;
 310                         crypt_volume_key_add_next(&((*vmk)->vk), vk);
 311                 /* clear key for a partially decrypted volume */
 312                 } else if (key_entry_value == BITLK_ENTRY_VALUE_KEY) {
 313                         /* We currently don't want to support opening a partially decrypted
 314                          * device so we don't need to store this key.
 315                          *
 316                          * key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + 4);
 317                          * key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + 4;
 318                          * vk = crypt_alloc_volume_key(key_size, key);
 319                          * if (vk == NULL)
 320                          *      return -ENOMEM;
 321                          * crypt_volume_key_add_next(&((*vmk)->vk), vk);
 322                          */
 323                         log_dbg(cd, "Skipping clear key metadata entry.");
 324                 /* unknown timestamps in recovery protected VMK */
 325                 } else if (key_entry_value == BITLK_ENTRY_VALUE_RECOVERY_TIME) {
 326                         ;
 327                 } else if (key_entry_value == BITLK_ENTRY_VALUE_STRING) {
 328                         if (key_entry_size < BITLK_ENTRY_HEADER_LEN)
 329                                 return -EINVAL;
 330                         string = malloc((key_entry_size - BITLK_ENTRY_HEADER_LEN) * 2 + 1);
 331                         if (!string)
 332                                 return -ENOMEM;
 333                         r = crypt_utf16_to_utf8(&string, CONST_CAST(char16_t *)(data + start + BITLK_ENTRY_HEADER_LEN),
 334                                                      key_entry_size - BITLK_ENTRY_HEADER_LEN);
 335                         if (r < 0 || !string) {
 336                                 free(string);
 337                                 log_err(cd, _("Invalid string found when parsing Volume Master Key."));
 338                                 return -EINVAL;
 339                         } else if ((*vmk)->name != NULL) {
 340                                 if (supported) {
 341                                         log_err(cd, _("Unexpected string ('%s') found when parsing supported Volume Master Key."), string);
 342                                         free(string);
 343                                         return -EINVAL;
 344                                 }
 345                                 log_dbg(cd, "Unexpected string ('%s') found when parsing unsupported VMK.", string);
 346                                 free(string);
 347                                 string = NULL;
 348                         } else {
 349                                 /* Assume that strings in VMK are the name of the VMK */
 350                                 (*vmk)->name = string;
 351                                 string = NULL;
 352                         }
 353                 /* no idea what this is, lets hope it's not important */
 354                 } else if (key_entry_value == BITLK_ENTRY_VALUE_USE_KEY && (*vmk)->protection == BITLK_PROTECTION_STARTUP_KEY) {
 355                         ;
 356                 } else {
 357                         if (supported) {
 358                                 log_err(cd, _("Unexpected metadata entry value '%u' found when parsing supported Volume Master Key."), key_entry_value);
 359                                 return -EINVAL;
 360                         } else {
 361                                 log_dbg(cd, "Unexpected metadata entry value '%u' found when parsing unsupported VMK.", key_entry_value);
 362                         }
 363                 }
 364
 365                 start += key_entry_size;
 366         }
 367
 368         return 0;
 369 }
 370
 371 void BITLK_bitlk_fvek_free(struct bitlk_fvek *fvek)
 372 {
 373         if (!fvek)
 374                 return;
 375
 376         crypt_free_volume_key(fvek->vk);
 377         free(fvek);
 378 }
 379
 380 void BITLK_bitlk_vmk_free(struct bitlk_vmk *vmk)
 381 {
 382         struct bitlk_vmk *vmk_next = NULL;
 383
 384         while (vmk) {
 385                 if (vmk->guid)
 386                         free(vmk->guid);
 387                 if (vmk->name)
 388                         free(vmk->name);
 389                 crypt_free_volume_key(vmk->vk);
 390                 vmk_next = vmk->next;
 391                 free(vmk);
 392                 vmk = vmk_next;
 393         }
 394 }
 395
 396 void BITLK_bitlk_metadata_free(struct bitlk_metadata *metadata)
 397 {
 398         if (!metadata)
 399                 return;
 400
 401         free(metadata->guid);
 402         if (metadata->description)
 403                 free(metadata->description);
 404         BITLK_bitlk_vmk_free(metadata->vmks);
 405         BITLK_bitlk_fvek_free(metadata->fvek);
 406 }
 407
 408 int BITLK_read_sb(struct crypt_device *cd, struct bitlk_metadata *params)
 409 {
 410         int devfd;
 411         struct device *device = crypt_metadata_device(cd);
 412         struct bitlk_signature sig = {};
 413         struct bitlk_superblock sb = {};
 414         struct bitlk_fve_metadata fve = {};
 415         struct bitlk_entry_vmk entry_vmk = {};
 416         uint8_t *fve_entries = NULL;
 417         size_t fve_entries_size = 0;
 418         uint32_t fve_metadata_size = 0;
 419         int fve_offset = 0;
 420         char guid_buf[UUID_STR_LEN] = {0};
 421         uint16_t entry_size = 0;
 422         uint16_t entry_type = 0;
 423         int i = 0;
 424         int r = 0;
 425         int start = 0;
 426         size_t key_size = 0;
 427         const char *key = NULL;
 428         char *description = NULL;
 429
 430         struct bitlk_vmk *vmk = NULL;
 431         struct bitlk_vmk *vmk_p = params->vmks;
 432
 433         devfd = device_open(cd, crypt_data_device(cd), O_RDONLY);
 434         if (devfd < 0) {
 435                 r = -EINVAL;
 436                 goto out;
 437         }
 438
 439         /* read and check the signature */
 440         if (read_lseek_blockwise(devfd, device_block_size(cd, device),
 441                 device_alignment(device), &sig, sizeof(sig), 0) != sizeof(sig)) {
 442                 log_dbg(cd, "Failed to read BITLK signature from %s.", device_path(device));
 443                 r = -EIO;
 444                 goto out;
 445         }
 446
 447         if (memcmp(sig.signature, BITLK_SIGNATURE, sizeof(sig.signature)) == 0) {
 448                 params->togo = false;
 449                 fve_offset = BITLK_HEADER_METADATA_OFFSET;
 450         } else if (memcmp(sig.signature, BITLK_SIGNATURE_TOGO, sizeof(sig.signature)) == 0) {
 451                 params->togo = true;
 452                 fve_offset = BITLK_HEADER_METADATA_OFFSET_TOGO;
 453         } else {
 454                 log_dbg(cd, "Invalid or unknown signature for BITLK device.");
 455                 r = -EINVAL;
 456                 goto out;
 457         }
 458
 459         if (memcmp(sig.boot_code, BITLK_BOOTCODE_V1, sizeof(sig.boot_code)) == 0) {
 460                 log_err(cd, _("BITLK version 1 is currently not supported."));
 461                 r = -ENOTSUP;
 462                 goto out;
 463         } else if (memcmp(sig.boot_code, BITLK_BOOTCODE_V2, sizeof(sig.boot_code)) == 0)
 464                 ;
 465         else {
 466                 log_err(cd, _("Invalid or unknown boot signature for BITLK device."));
 467                 r = -EINVAL;
 468                 goto out;
 469         }
 470
 471         params->sector_size = le16_to_cpu(sig.sector_size);
 472         if (params->sector_size == 0) {
 473                 log_dbg(cd, "Got sector size 0, assuming 512.");
 474                 params->sector_size = SECTOR_SIZE;
 475         }
 476
 477         if (!(params->sector_size == 512 || params->sector_size == 4096)) {
 478                 log_err(cd, _("Unsupported sector size %" PRIu16 "."), params->sector_size);
 479                 r = -EINVAL;
 480                 goto out;
 481         }
 482
 483         /* read GUID and FVE metadata offsets */
 484         if (read_lseek_blockwise(devfd, device_block_size(cd, device),
 485                 device_alignment(device), &sb, sizeof(sb), fve_offset) != sizeof(sb)) {
 486                 log_err(cd, _("Failed to read BITLK header from %s."), device_path(device));
 487                 r = -EINVAL;
 488                 goto out;
 489         }
 490
 491         /* get encryption "type" based on the GUID from BITLK superblock */
 492         if (memcmp(&sb.guid, BITLK_GUID_NORMAL, 16) == 0)
 493                 params->type = BITLK_ENCRYPTION_TYPE_NORMAL;
 494         else if (memcmp(&sb.guid, BITLK_GUID_EOW, 16) == 0)
 495                 params->type = BITLK_ENCRYPTION_TYPE_EOW;
 496         else
 497                 params->type = BITLK_ENCRYPTION_TYPE_UNKNOWN;
 498         log_dbg(cd, "BITLK type from GUID: %s.", get_bitlk_type_string(params->type));
 499
 500         for (i = 0; i < 3; i++)
 501                 params->metadata_offset[i] = le64_to_cpu(sb.fve_offset[i]);
 502
 503         log_dbg(cd, "Reading BITLK FVE metadata of size %zu on device %s, offset %" PRIu64 ".",
 504                 sizeof(fve), device_path(device), params->metadata_offset[0]);
 505
 506         /* read FVE metadata from the first metadata area */
 507         if (read_lseek_blockwise(devfd, device_block_size(cd, device),
 508                 device_alignment(device), &fve, sizeof(fve), params->metadata_offset[0]) != sizeof(fve) ||
 509                 memcmp(fve.signature, BITLK_SIGNATURE, sizeof(fve.signature)) ||
 510                 le16_to_cpu(fve.fve_version) != 2) {
 511                 log_err(cd, _("Failed to read BITLK FVE metadata from %s."), device_path(device));
 512                 r = -EINVAL;
 513                 goto out;
 514         }
 515
 516         /* check encryption state for the device */
 517         params->state = true;
 518         if (le16_to_cpu(fve.curr_state) != BITLK_STATE_NORMAL || le16_to_cpu(fve.next_state) != BITLK_STATE_NORMAL) {
 519                 params->state = false;
 520                 log_dbg(cd, "Unknown/unsupported state detected. Current state: %"PRIu16", next state: %"PRIu16".",
 521                         le16_to_cpu(fve.curr_state), le16_to_cpu(fve.next_state));
 522         }
 523
 524         params->volume_size = le64_to_cpu(fve.volume_size);
 525         params->metadata_version = le16_to_cpu(fve.fve_version);
 526
 527         switch (le16_to_cpu(fve.encryption)) {
 528         /* AES-CBC with Elephant difuser */
 529         case 0x8000:
 530                 params->key_size = 256;
 531                 params->cipher = "aes";
 532                 params->cipher_mode = "cbc-elephant";
 533                 break;
 534         case 0x8001:
 535                 params->key_size = 512;
 536                 params->cipher = "aes";
 537                 params->cipher_mode = "cbc-elephant";
 538                 break;
 539         /* AES-CBC */
 540         case 0x8002:
 541                 params->key_size = 128;
 542                 params->cipher = "aes";
 543                 params->cipher_mode = "cbc-eboiv";
 544                 break;
 545         case 0x8003:
 546                 params->key_size = 256;
 547                 params->cipher = "aes";
 548                 params->cipher_mode = "cbc-eboiv";
 549                 break;
 550         /* AES-XTS */
 551         case 0x8004:
 552                 params->key_size = 256;
 553                 params->cipher = "aes";
 554                 params->cipher_mode = "xts-plain64";
 555                 break;
 556         case 0x8005:
 557                 params->key_size = 512;
 558                 params->cipher = "aes";
 559                 params->cipher_mode = "xts-plain64";
 560                 break;
 561         default:
 562                 log_err(cd, _("Unknown or unsupported encryption type."));
 563                 params->key_size = 0;
 564                 params->cipher = NULL;
 565                 params->cipher_mode = NULL;
 566                 r = -ENOTSUP;
 567                 goto out;
 568         };
 569
 570         /* device GUID */
 571         guid_to_string(&fve.guid, guid_buf);
 572         params->guid = strdup(guid_buf);
 573         if (!params->guid) {
 574                 r = -ENOMEM;
 575                 goto out;
 576         }
 577
 578         params->creation_time = filetime_to_unixtime(le64_to_cpu(fve.creation_time));
 579
 580         fve_metadata_size = le32_to_cpu(fve.metadata_size);
 581         if (fve_metadata_size < (BITLK_FVE_METADATA_HEADER_LEN + sizeof(entry_size) + sizeof(entry_type)) ||
 582             fve_metadata_size > BITLK_FVE_METADATA_SIZE) {
 583                 r = -EINVAL;
 584                 goto out;
 585         }
 586         fve_entries_size = fve_metadata_size - BITLK_FVE_METADATA_HEADER_LEN;
 587
 588         /* read and parse all FVE metadata entries */
 589         fve_entries = malloc(fve_entries_size);
 590         if (!fve_entries) {
 591                 r = -ENOMEM;
 592                 goto out;
 593         }
 594         memset(fve_entries, 0, fve_entries_size);
 595
 596         log_dbg(cd, "Reading BITLK FVE metadata entries of size %zu on device %s, offset %" PRIu64 ".",
 597                 fve_entries_size, device_path(device), params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN);
 598
 599         if (read_lseek_blockwise(devfd, device_block_size(cd, device),
 600                 device_alignment(device), fve_entries, fve_entries_size,
 601                 params->metadata_offset[0] + BITLK_FVE_METADATA_HEADERS_LEN) != (ssize_t)fve_entries_size) {
 602                 log_err(cd, _("Failed to read BITLK metadata entries from %s."), device_path(device));
 603                 r = -EINVAL;
 604                 goto out;
 605         }
 606
 607         while ((fve_entries_size - start) >= (sizeof(entry_size) + sizeof(entry_type))) {
 608
 609                 /* size of this entry */
 610                 memcpy(&entry_size, fve_entries + start, sizeof(entry_size));
 611                 entry_size = le16_to_cpu(entry_size);
 612                 if (entry_size == 0)
 613                         break;
 614
 615                 if (entry_size > (fve_entries_size - start)) {
 616                         r = -EINVAL;
 617                         goto out;
 618                 }
 619
 620                 /* type of this entry */
 621                 memcpy(&entry_type, fve_entries + start + sizeof(entry_size), sizeof(entry_type));
 622                 entry_type = le16_to_cpu(entry_type);
 623
 624                 /* VMK */
 625                 if (entry_type == BITLK_ENTRY_TYPE_VMK) {
 626                         if (entry_size < (BITLK_ENTRY_HEADER_LEN + sizeof(entry_vmk))) {
 627                                 r = -EINVAL;
 628                                 goto out;
 629                         }
 630                         /* skip first four variables in the entry (entry size, type, value and version) */
 631                         memcpy(&entry_vmk,
 632                                fve_entries + start + BITLK_ENTRY_HEADER_LEN,
 633                                sizeof(entry_vmk));
 634
 635                         vmk = malloc(sizeof(struct bitlk_vmk));
 636                         if (!vmk) {
 637                                 r = -ENOMEM;
 638                                 goto out;
 639                         }
 640                         memset(vmk, 0, sizeof(struct bitlk_vmk));
 641
 642                         guid_to_string(&entry_vmk.guid, guid_buf);
 643                         vmk->guid = strdup (guid_buf);
 644
 645                         vmk->name = NULL;
 646
 647                         vmk->protection = get_vmk_protection(le16_to_cpu(entry_vmk.protection));
 648
 649                         /* more data in another entry list */
 650                         r = parse_vmk_entry(cd, fve_entries,
 651                                               start + BITLK_ENTRY_HEADER_LEN + BITLK_VMK_HEADER_LEN,
 652                                               start + entry_size, &vmk);
 653                         if (r < 0) {
 654                                 BITLK_bitlk_vmk_free(vmk);
 655                                 goto out;
 656                         }
 657
 658                         if (params->vmks == NULL)
 659                                 params->vmks = vmk;
 660                         else
 661                                 vmk_p->next = vmk;
 662
 663                         vmk_p = vmk;
 664                         vmk = vmk->next;
 665                 /* FVEK */
 666                 } else if (entry_type == BITLK_ENTRY_TYPE_FVEK && !params->fvek) {
 667                         if (entry_size < (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE)) {
 668                                 r = -EINVAL;
 669                                 goto out;
 670                         }
 671                         params->fvek = malloc(sizeof(struct bitlk_fvek));
 672                         if (!params->fvek) {
 673                                 r = -ENOMEM;
 674                                 goto out;
 675                         }
 676                         memcpy(params->fvek->nonce,
 677                                fve_entries + start + BITLK_ENTRY_HEADER_LEN,
 678                                BITLK_NONCE_SIZE);
 679                         /* MAC tag */
 680                         memcpy(params->fvek->mac_tag,
 681                                fve_entries + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE,
 682                                BITLK_VMK_MAC_TAG_SIZE);
 683                         /* AES-CCM encrypted key */
 684                         key_size = entry_size - (BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE);
 685                         key = (const char *) fve_entries + start + BITLK_ENTRY_HEADER_LEN + BITLK_NONCE_SIZE + BITLK_VMK_MAC_TAG_SIZE;
 686                         params->fvek->vk = crypt_alloc_volume_key(key_size, key);
 687                         if (params->fvek->vk == NULL) {
 688                                 r = -ENOMEM;
 689                                 goto out;
 690                         }
 691                 /* volume header info (location and size) */
 692                 } else if (entry_type == BITLK_ENTRY_TYPE_VOLUME_HEADER) {
 693                         struct bitlk_entry_header_block entry_header;
 694                         if ((fve_entries_size - start) < (BITLK_ENTRY_HEADER_LEN + sizeof(entry_header))) {
 695                                 r = -EINVAL;
 696                                 goto out;
 697                         }
 698                         memcpy(&entry_header,
 699                                fve_entries + start + BITLK_ENTRY_HEADER_LEN,
 700                                sizeof(entry_header));
 701                         params->volume_header_offset = le64_to_cpu(entry_header.offset);
 702                         params->volume_header_size = le64_to_cpu(entry_header.size);
 703                 /* volume description (utf-16 string) */
 704                 } else if (entry_type == BITLK_ENTRY_TYPE_DESCRIPTION && !params->description) {
 705                         if (entry_size < BITLK_ENTRY_HEADER_LEN) {
 706                                 r = -EINVAL;
 707                                 goto out;
 708                         }
 709                         description = malloc((entry_size - BITLK_ENTRY_HEADER_LEN) * 2 + 1);
 710                         if (!description) {
 711                                 r = -ENOMEM;
 712                                 goto out;
 713                         }
 714                         r = crypt_utf16_to_utf8(&description, CONST_CAST(char16_t *)(fve_entries + start + BITLK_ENTRY_HEADER_LEN),
 715                                                           entry_size - BITLK_ENTRY_HEADER_LEN);
 716                         if (r < 0) {
 717                                 free(description);
 718                                 BITLK_bitlk_vmk_free(vmk);
 719                                 log_err(cd, _("Failed to convert BITLK volume description"));
 720                                 goto out;
 721                         }
 722                         params->description = description;
 723                 }
 724
 725                 start += entry_size;
 726         }
 727
 728 out:
 729         if (fve_entries)
 730                 free(fve_entries);
 731         return r;
 732 }
 733
 734 int BITLK_dump(struct crypt_device *cd, struct device *device, struct bitlk_metadata *params)
 735 {
 736         struct volume_key *vk_p;
 737         struct bitlk_vmk *vmk_p;
 738         int next_id = 0;
 739         int i = 0;
 740
 741         log_std(cd, "Info for BITLK%s device %s.\n", params->togo ? " To Go" : "", device_path(device));
 742         log_std(cd, "Version:      \t%u\n", params->metadata_version);
 743         log_std(cd, "GUID:         \t%s\n", params->guid);
 744         log_std(cd, "Sector size:  \t%u [bytes]\n", params->sector_size);
 745         log_std(cd, "Volume size:  \t%" PRIu64 " [bytes]\n", params->volume_size);
 746         log_std(cd, "Created:      \t%s", ctime((time_t *)&(params->creation_time)));
 747         log_std(cd, "Description:  \t%s\n", params->description);
 748         log_std(cd, "Cipher name:  \t%s\n", params->cipher);
 749         log_std(cd, "Cipher mode:  \t%s\n", params->cipher_mode);
 750         log_std(cd, "Cipher key:   \t%u bits\n", params->key_size);
 751
 752         log_std(cd, "\n");
 753
 754         log_std(cd, "Keyslots:\n");
 755         vmk_p = params->vmks;
 756         while (vmk_p) {
 757                 log_std(cd, " %d: VMK\n", next_id);
 758                 if (vmk_p->name != NULL) {
 759                         log_std(cd, "\tName:       \t%s\n", vmk_p->name);
 760                 }
 761                 log_std(cd, "\tGUID:       \t%s\n", vmk_p->guid);
 762                 log_std(cd, "\tProtection: \t%s\n", get_vmk_protection_string (vmk_p->protection));
 763                 log_std(cd, "\tSalt:       \t");
 764                 crypt_log_hex(cd, (const char *) vmk_p->salt, 16, "", 0, NULL);
 765                 log_std(cd, "\n");
 766
 767                 vk_p = vmk_p->vk;
 768                 while (vk_p) {
 769                         log_std(cd, "\tKey data size:\t%zu [bytes]\n", vk_p->keylength);
 770                         vk_p = vk_p->next;
 771                 }
 772                 vmk_p = vmk_p->next;
 773                 next_id++;
 774         }
 775
 776         log_std(cd, " %d: FVEK\n", next_id);
 777         log_std(cd, "\tKey data size:\t%zu [bytes]\n", params->fvek->vk->keylength);
 778
 779         log_std(cd, "\n");
 780
 781         log_std(cd, "Metadata segments:\n");
 782
 783         for (i = 0; i < 3; i++) {
 784                 log_std(cd, " %d: FVE metadata area\n", i);
 785                 log_std(cd, "\tOffset: \t%" PRIu64 " [bytes]\n", params->metadata_offset[i]);
 786                 log_std(cd, "\tSize:   \t%d [bytes]\n", BITLK_FVE_METADATA_SIZE);
 787         }
 788
 789         log_std(cd, " %d: Volume header\n", i);
 790         log_std(cd, "\tOffset: \t%" PRIu64 " [bytes]\n", params->volume_header_offset);
 791         log_std(cd, "\tSize:   \t%" PRIu64 " [bytes]\n", params->volume_header_size);
 792         log_std(cd, "\tCipher: \t%s-%s\n", params->cipher, params->cipher_mode);
 793
 794         return 0;
 795 }
 796
 797 /* check if given passphrase can be a recovery key (has right format) and convert it */
 798 static int get_recovery_key(struct crypt_device *cd,
 799                             const char *password,
 800                             size_t passwordLen,
 801                             struct volume_key **rc_key)
 802 {
 803         unsigned int i, j = 0;
 804         uint16_t parts[BITLK_RECOVERY_PARTS] = {0};
 805         char part_str[BITLK_RECOVERY_PART_LEN + 1] = {0};
 806         long part_num = 0;
 807
 808         /* check the passphrase it should be:
 809             - 55 characters
 810             - 8 groups of 6 divided by '-'
 811             - each part is a number dividable by 11
 812         */
 813         if (passwordLen != BITLK_RECOVERY_KEY_LEN) {
 814                 if (passwordLen == BITLK_RECOVERY_KEY_LEN + 1 && password[passwordLen - 1] == '\n') {
 815                         /* looks like a recovery key with an extra newline, possibly from a key file */
 816                         passwordLen--;
 817                         log_dbg(cd, "Possible extra EOL stripped from the recovery key.");
 818                 } else
 819                         return 0;
 820         }
 821
 822         for (i = BITLK_RECOVERY_PART_LEN; i < passwordLen; i += BITLK_RECOVERY_PART_LEN + 1) {
 823                 if (password[i] != '-')
 824                         return 0;
 825         }
 826
 827         for (i = 0, j = 0; i < passwordLen; i += BITLK_RECOVERY_PART_LEN + 1, j++) {
 828                 strncpy(part_str, password + i, BITLK_RECOVERY_PART_LEN);
 829
 830                 errno = 0;
 831                 part_num = strtol(part_str, NULL, 10);
 832                 if ((errno == ERANGE && (part_num == LONG_MAX || part_num == LONG_MIN)) ||
 833                     (errno != 0 && part_num == 0))
 834                         return -errno;
 835
 836                 if (part_num % 11 != 0)
 837                         return 0;
 838                 parts[j] = cpu_to_le16(part_num / 11);
 839         }
 840
 841         *rc_key = crypt_alloc_volume_key(16, (const char*) parts);
 842         if (*rc_key == NULL)
 843                 return -ENOMEM;
 844
 845         return 0;
 846 }
 847
 848 static int parse_external_key_entry(struct crypt_device *cd,
 849                                     const char *data,
 850                                     int start,
 851                                     int end,
 852                                     struct volume_key **vk,
 853                                     const struct bitlk_metadata *params)
 854 {
 855         uint16_t key_entry_size = 0;
 856         uint16_t key_entry_type = 0;
 857         uint16_t key_entry_value = 0;
 858         size_t key_size = 0;
 859         const char *key = NULL;
 860         struct bitlk_guid guid;
 861         char guid_buf[UUID_STR_LEN] = {0};
 862
 863         while ((end - start) >= (ssize_t)(sizeof(key_entry_size) + sizeof(key_entry_type) + sizeof(key_entry_value))) {
 864                 /* size of this entry */
 865                 memcpy(&key_entry_size, data + start, sizeof(key_entry_size));
 866                 key_entry_size = le16_to_cpu(key_entry_size);
 867                 if (key_entry_size == 0)
 868                         break;
 869
 870                 if (key_entry_size > (end - start))
 871                         return -EINVAL;
 872
 873                 /* type and value of this entry */
 874                 memcpy(&key_entry_type, data + start + sizeof(key_entry_size), sizeof(key_entry_type));
 875                 memcpy(&key_entry_value,
 876                        data + start + sizeof(key_entry_size) + sizeof(key_entry_type),
 877                        sizeof(key_entry_value));
 878                 key_entry_type = le16_to_cpu(key_entry_type);
 879                 key_entry_value = le16_to_cpu(key_entry_value);
 880
 881                 if (key_entry_type != BITLK_ENTRY_TYPE_PROPERTY && key_entry_type != BITLK_ENTRY_TYPE_VOLUME_GUID) {
 882                         log_err(cd, _("Unexpected metadata entry type '%u' found when parsing external key."), key_entry_type);
 883                         return -EINVAL;
 884                 }
 885
 886                 if (key_entry_value == BITLK_ENTRY_VALUE_KEY) {
 887                         if (key_entry_size < (BITLK_ENTRY_HEADER_LEN + 4))
 888                                 return -EINVAL;
 889                         key_size = key_entry_size - (BITLK_ENTRY_HEADER_LEN + 4);
 890                         key = (const char *) data + start + BITLK_ENTRY_HEADER_LEN + 4;
 891                         *vk = crypt_alloc_volume_key(key_size, key);
 892                         if (*vk == NULL)
 893                                 return -ENOMEM;
 894                         return 0;
 895                 /* optional "ExternalKey" string, we can safely ignore it */
 896                 } else if (key_entry_value == BITLK_ENTRY_VALUE_STRING)
 897                         ;
 898                 /* GUID of the BitLocker device we are trying to open with this key */
 899                 else if (key_entry_value == BITLK_ENTRY_VALUE_GUID) {
 900                         if ((end - start) < (ssize_t)(BITLK_ENTRY_HEADER_LEN + sizeof(struct bitlk_guid)))
 901                                 return -EINVAL;
 902                         memcpy(&guid, data + start + BITLK_ENTRY_HEADER_LEN, sizeof(struct bitlk_guid));
 903                         guid_to_string(&guid, guid_buf);
 904                         if (strcmp(guid_buf, params->guid) != 0) {
 905                                 log_err(cd, _("BEK file GUID '%s' does not match GUID of the volume."), guid_buf);
 906                                 return -EINVAL;
 907                         }
 908                 } else {
 909                         log_err(cd, _("Unexpected metadata entry value '%u' found when parsing external key."), key_entry_value);
 910                         return -EINVAL;
 911                 }
 912
 913                 start += key_entry_size;
 914         }
 915
 916         /* if we got here we failed to parse the metadata */
 917         return -EINVAL;
 918 }
 919
 920 /* check if given passphrase can be a startup key (has right format) and convert it */
 921 static int get_startup_key(struct crypt_device *cd,
 922                            const char *password,
 923                            size_t passwordLen,
 924                            const struct bitlk_vmk *vmk,
 925                            struct volume_key **su_key,
 926                            const struct bitlk_metadata *params)
 927 {
 928         struct bitlk_bek_header bek_header = {0};
 929         char guid_buf[UUID_STR_LEN] = {0};
 930
 931         uint16_t key_entry_size = 0;
 932         uint16_t key_entry_type = 0;
 933         uint16_t key_entry_value = 0;
 934
 935         if (passwordLen < (BITLK_BEK_FILE_HEADER_LEN + sizeof(key_entry_size) + sizeof(key_entry_type) + sizeof(key_entry_value)))
 936                 return -EPERM;
 937
 938         memcpy(&bek_header, password, BITLK_BEK_FILE_HEADER_LEN);
 939
 940         /* metadata should contain GUID of the VMK this startup key is used for */
 941         guid_to_string(&bek_header.guid, guid_buf);
 942         if (strcmp(guid_buf, vmk->guid) == 0)
 943                 log_dbg(cd, "Found matching startup key for VMK %s", vmk->guid);
 944         else
 945                 return -EPERM;
 946
 947         if (le32_to_cpu(bek_header.metadata_version) != 1) {
 948                 log_err(cd, _("Unsupported BEK metadata version %" PRIu32), le32_to_cpu(bek_header.metadata_version));
 949                 return -ENOTSUP;
 950         }
 951
 952         if (le32_to_cpu(bek_header.metadata_size) != passwordLen) {
 953                 log_err(cd, _("Unexpected BEK metadata size %" PRIu32 " does not match BEK file length"),
 954                         le32_to_cpu(bek_header.metadata_size));
 955                 return -EINVAL;
 956         }
 957
 958         /* we are expecting exactly one metadata entry starting immediately after the header */
 959         memcpy(&key_entry_size, password + BITLK_BEK_FILE_HEADER_LEN, sizeof(key_entry_size));
 960         key_entry_size = le16_to_cpu(key_entry_size);
 961         if (key_entry_size < BITLK_ENTRY_HEADER_LEN) {
 962                 log_dbg(cd, "Unexpected metadata entry size %" PRIu16 " when parsing BEK file", key_entry_size);
 963                 return -EINVAL;
 964         }
 965
 966         /* type and value of this entry */
 967         memcpy(&key_entry_type, password + BITLK_BEK_FILE_HEADER_LEN + sizeof(key_entry_size), sizeof(key_entry_type));
 968         memcpy(&key_entry_value,
 969                password + BITLK_BEK_FILE_HEADER_LEN + sizeof(key_entry_size) + sizeof(key_entry_type),
 970                sizeof(key_entry_value));
 971         key_entry_type = le16_to_cpu(key_entry_type);
 972         key_entry_value = le16_to_cpu(key_entry_value);
 973
 974         if (key_entry_type == BITLK_ENTRY_TYPE_STARTUP_KEY && key_entry_value == BITLK_ENTRY_VALUE_EXTERNAL_KEY) {
 975                 return parse_external_key_entry(cd, password,
 976                                                 BITLK_BEK_FILE_HEADER_LEN + BITLK_ENTRY_HEADER_LEN + BITLK_STARTUP_KEY_HEADER_LEN,
 977                                                 passwordLen, su_key, params);
 978         } else {
 979                 log_err(cd, _("Unexpected metadata entry found when parsing startup key."));
 980                 log_dbg(cd, "Entry type: %u, entry value: %u", key_entry_type, key_entry_value);
 981                 return -EINVAL;
 982         }
 983 }
 984
 985 static int bitlk_kdf(struct crypt_device *cd,
 986                      const char *password,
 987                      size_t passwordLen,
 988                      bool recovery,
 989                      const uint8_t *salt,
 990                      struct volume_key **vk)
 991 {
 992         struct bitlk_kdf_data kdf = {};
 993         struct crypt_hash *hd = NULL;
 994         int len = 0;
 995         char16_t *utf16Password = NULL;
 996         int i = 0;
 997         int r = 0;
 998
 999         memcpy(kdf.salt, salt, 16);
1000
1001         r = crypt_hash_init(&hd, BITLK_KDF_HASH);
1002         if (r < 0)
1003                 return r;
1004         len = crypt_hash_size(BITLK_KDF_HASH);
1005         if (len < 0) {
1006                 crypt_hash_destroy(hd);
1007                 return len;
1008         }
1009
1010         if (!recovery) {
1011                 /* passphrase: convert to UTF-16 first, then sha256(sha256(pw)) */
1012                 utf16Password = crypt_safe_alloc(sizeof(char16_t) * (passwordLen + 1));
1013                 if (!utf16Password) {
1014                         r = -ENOMEM;
1015                         goto out;
1016                 }
1017                 r = crypt_utf8_to_utf16(&utf16Password, CONST_CAST(char*)password, passwordLen);
1018                 if (r < 0)
1019                         goto out;
1020
1021                 crypt_hash_write(hd, (char*)utf16Password, passwordLen * 2);
1022                 r = crypt_hash_final(hd, kdf.initial_sha256, len);
1023                 if (r < 0)
1024                         goto out;
1025
1026                 crypt_hash_write(hd, kdf.initial_sha256, len);
1027                 r = crypt_hash_final(hd, kdf.initial_sha256, len);
1028                 if (r < 0)
1029                         goto out;
1030         } else {
1031                 /* recovery passphrase: already converted in #get_recovery_key, now just sha256(rpw) */
1032                 crypt_hash_write(hd, password, passwordLen);
1033                 r = crypt_hash_final(hd, kdf.initial_sha256, len);
1034                 if (r < 0)
1035                         goto out;
1036         }
1037
1038         for (i = 0; i < BITLK_KDF_ITERATION_COUNT; i++) {
1039                 crypt_hash_write(hd, (const char*) &kdf, sizeof(kdf));
1040                 r = crypt_hash_final(hd, kdf.last_sha256, len);
1041                 if (r < 0)
1042                         goto out;
1043                 kdf.count = cpu_to_le64(le64_to_cpu(kdf.count) + 1);
1044         }
1045
1046         *vk = crypt_alloc_volume_key(len, kdf.last_sha256);
1047
1048 out:
1049         crypt_safe_free(utf16Password);
1050         if (hd)
1051                 crypt_hash_destroy(hd);
1052         return r;
1053 }
1054
1055 static int decrypt_key(struct crypt_device *cd,
1056                        struct volume_key **vk,
1057                        struct volume_key *enc_key,
1058                        struct volume_key *key,
1059                        const uint8_t *tag, size_t tag_size,
1060                        const uint8_t *iv, size_t iv_size,
1061                        bool is_fvek)
1062 {
1063         char *outbuf;
1064         int r;
1065         uint16_t key_size = 0;
1066
1067         outbuf = crypt_safe_alloc(enc_key->keylength);
1068         if (!outbuf)
1069                 return -ENOMEM;
1070
1071         r = crypt_bitlk_decrypt_key(key->key, key->keylength, enc_key->key, outbuf, enc_key->keylength,
1072                                 (const char*)iv, iv_size, (const char*)tag, tag_size);
1073         if (r < 0) {
1074                 if (r == -ENOTSUP)
1075                         log_err(cd, _("This operation is not supported."));
1076                 goto out;
1077         }
1078
1079         /* key_data has it's size as part of the metadata */
1080         memcpy(&key_size, outbuf, 2);
1081         key_size = le16_to_cpu(key_size);
1082         if (enc_key->keylength != key_size) {
1083                 log_err(cd, _("Unexpected key data size."));
1084                 log_dbg(cd, "Expected key data size: %zu, got %" PRIu16 "", enc_key->keylength, key_size);
1085
1086                 r = -EINVAL;
1087                 goto out;
1088         }
1089
1090         if (is_fvek && strcmp(crypt_get_cipher_mode(cd), "cbc-elephant") == 0 &&
1091                 crypt_get_volume_key_size(cd) == 32) {
1092                 /* 128bit AES-CBC with Elephant -- key size is 256 bit (2 keys) but key data is 512 bits,
1093                    data: 16B CBC key, 16B empty, 16B elephant key, 16B empty */
1094                 memcpy(outbuf + 16 + BITLK_OPEN_KEY_METADATA_LEN,
1095                         outbuf + 2 * 16 + BITLK_OPEN_KEY_METADATA_LEN, 16);
1096                 key_size = 32 + BITLK_OPEN_KEY_METADATA_LEN;
1097         }
1098
1099
1100         *vk = crypt_alloc_volume_key(key_size - BITLK_OPEN_KEY_METADATA_LEN,
1101                                         (const char *)(outbuf + BITLK_OPEN_KEY_METADATA_LEN));
1102         r = *vk ? 0 : -ENOMEM;
1103 out:
1104         crypt_safe_free(outbuf);
1105         return r;
1106 }
1107
1108 int BITLK_get_volume_key(struct crypt_device *cd,
1109                          const char *password,
1110                          size_t passwordLen,
1111                          const struct bitlk_metadata *params,
1112                          struct volume_key **open_fvek_key)
1113 {
1114         int r = 0;
1115         struct volume_key *open_vmk_key = NULL;
1116         struct volume_key *vmk_dec_key = NULL;
1117         struct volume_key *recovery_key = NULL;
1118         const struct bitlk_vmk *next_vmk = NULL;
1119
1120         next_vmk = params->vmks;
1121         while (next_vmk) {
1122                 if (next_vmk->protection == BITLK_PROTECTION_PASSPHRASE) {
1123                         r = bitlk_kdf(cd, password, passwordLen, false, next_vmk->salt, &vmk_dec_key);
1124                         if (r) {
1125                                 /* something wrong happened, but we still want to check other key slots */
1126                                 next_vmk = next_vmk->next;
1127                                 continue;
1128                         }
1129                 } else if (next_vmk->protection == BITLK_PROTECTION_RECOVERY_PASSPHRASE) {
1130                         r = get_recovery_key(cd, password, passwordLen, &recovery_key);
1131                         if (r) {
1132                                 /* something wrong happened, but we still want to check other key slots */
1133                                 next_vmk = next_vmk->next;
1134                                 continue;
1135                         }
1136                         if (recovery_key == NULL) {
1137                                 /* r = 0 but no key -> given passphrase is not a recovery passphrase */
1138                                 r = -EPERM;
1139                                 next_vmk = next_vmk->next;
1140                                 continue;
1141                         }
1142                         log_dbg(cd, "Trying to use given password as a recovery key.");
1143                         r = bitlk_kdf(cd, recovery_key->key, recovery_key->keylength,
1144                                       true, next_vmk->salt, &vmk_dec_key);
1145                         crypt_free_volume_key(recovery_key);
1146                         if (r)
1147                                 return r;
1148                 } else if (next_vmk->protection == BITLK_PROTECTION_STARTUP_KEY) {
1149                         r = get_startup_key(cd, password, passwordLen, next_vmk, &vmk_dec_key, params);
1150                         if (r) {
1151                                 next_vmk = next_vmk->next;
1152                                 continue;
1153                         }
1154                         log_dbg(cd, "Trying to use external key found in provided password.");
1155                 } else {
1156                         /* only passphrase, recovery passphrase and startup key VMKs supported right now */
1157                         log_dbg(cd, "Skipping %s", get_vmk_protection_string(next_vmk->protection));
1158                         next_vmk = next_vmk->next;
1159                         if (r == 0)
1160                                 /* we need to set error code in case we have only unsupported VMKs */
1161                                 r = -ENOTSUP;
1162                         continue;
1163                 }
1164
1165                 log_dbg(cd, "Trying to decrypt %s.", get_vmk_protection_string(next_vmk->protection));
1166                 r = decrypt_key(cd, &open_vmk_key, next_vmk->vk, vmk_dec_key,
1167                                 next_vmk->mac_tag, BITLK_VMK_MAC_TAG_SIZE,
1168                                 next_vmk->nonce, BITLK_NONCE_SIZE, false);
1169                 if (r < 0) {
1170                         log_dbg(cd, "Failed to decrypt VMK using provided passphrase.");
1171                         crypt_free_volume_key(vmk_dec_key);
1172                         if (r == -ENOTSUP)
1173                                 return r;
1174                         next_vmk = next_vmk->next;
1175                         continue;
1176                 }
1177                 crypt_free_volume_key(vmk_dec_key);
1178
1179                 r = decrypt_key(cd, open_fvek_key, params->fvek->vk, open_vmk_key,
1180                                 params->fvek->mac_tag, BITLK_VMK_MAC_TAG_SIZE,
1181                                 params->fvek->nonce, BITLK_NONCE_SIZE, true);
1182                 if (r < 0) {
1183                         log_dbg(cd, "Failed to decrypt FVEK using VMK.");
1184                         crypt_free_volume_key(open_vmk_key);
1185                         if (r == -ENOTSUP)
1186                                 return r;
1187                 } else {
1188                         crypt_free_volume_key(open_vmk_key);
1189                         break;
1190                 }
1191
1192                 next_vmk = next_vmk->next;
1193         }
1194
1195         if (r) {
1196                 log_dbg(cd, "No more VMKs to try.");
1197                 return r;
1198         }
1199
1200         return 0;
1201 }
1202
1203 static int _activate_check(struct crypt_device *cd,
1204                            const struct bitlk_metadata *params)
1205 {
1206         const struct bitlk_vmk *next_vmk = NULL;
1207
1208         if (!params->state) {
1209                 log_err(cd, _("This BITLK device is in an unsupported state and cannot be activated."));
1210                 return -ENOTSUP;
1211         }
1212
1213         if (params->type != BITLK_ENCRYPTION_TYPE_NORMAL) {
1214                 log_err(cd, _("BITLK devices with type '%s' cannot be activated."), get_bitlk_type_string(params->type));
1215                 return -ENOTSUP;
1216         }
1217
1218         next_vmk = params->vmks;
1219         while (next_vmk) {
1220                 if (next_vmk->protection == BITLK_PROTECTION_CLEAR_KEY) {
1221                         log_err(cd, _("Activation of partially decrypted BITLK device is not supported."));
1222                         return -ENOTSUP;
1223                 }
1224                 next_vmk = next_vmk->next;
1225         }
1226
1227         return 0;
1228 }
1229
1230 static int _activate(struct crypt_device *cd,
1231                      const char *name,
1232                      struct volume_key *open_fvek_key,
1233                      const struct bitlk_metadata *params,
1234                      uint32_t flags)
1235 {
1236         int r = 0;
1237         int i = 0;
1238         int j = 0;
1239         int min = 0;
1240         int num_segments = 0;
1241         struct crypt_dm_active_device dmd = {
1242                 .flags = flags,
1243         };
1244         struct dm_target *next_segment = NULL;
1245         struct segment segments[MAX_BITLK_SEGMENTS] = {};
1246         struct segment temp;
1247         uint64_t next_start = 0;
1248         uint64_t next_end = 0;
1249         uint64_t last_segment = 0;
1250         uint32_t dmt_flags = 0;
1251
1252         r = _activate_check(cd, params);
1253         if (r)
1254                 return r;
1255
1256         r = device_block_adjust(cd, crypt_data_device(cd), DEV_EXCL,
1257                                 0, &dmd.size, &dmd.flags);
1258         if (r)
1259                 return r;
1260
1261         if (dmd.size * SECTOR_SIZE != params->volume_size)
1262                 log_std(cd, _("WARNING: BitLocker volume size %" PRIu64 " does not match the underlying device size %" PRIu64 ""),
1263                         params->volume_size,
1264                         dmd.size * SECTOR_SIZE);
1265
1266         /* there will be always 4 dm-zero segments: 3x metadata, 1x FS header */
1267         for (i = 0; i < 3; i++) {
1268                 segments[num_segments].offset = params->metadata_offset[i] / SECTOR_SIZE;
1269                 segments[num_segments].length = BITLK_FVE_METADATA_SIZE / SECTOR_SIZE;
1270                 segments[num_segments].iv_offset = 0;
1271                 segments[num_segments].type = BITLK_SEGTYPE_ZERO;
1272                 num_segments++;
1273         }
1274         segments[num_segments].offset = params->volume_header_offset / SECTOR_SIZE;
1275         segments[num_segments].length = params->volume_header_size / SECTOR_SIZE;
1276         segments[num_segments].iv_offset = 0;
1277         segments[num_segments].type = BITLK_SEGTYPE_ZERO;
1278         num_segments++;
1279
1280         /* filesystem header (moved from the special location) */
1281         segments[num_segments].offset = 0;
1282         segments[num_segments].length = params->volume_header_size / SECTOR_SIZE;
1283         segments[num_segments].iv_offset = params->volume_header_offset / SECTOR_SIZE;
1284         segments[num_segments].type = BITLK_SEGTYPE_CRYPT;
1285         num_segments++;
1286
1287         /* now fill gaps between the dm-zero segments with dm-crypt */
1288         last_segment = params->volume_header_size / SECTOR_SIZE;
1289         while (true) {
1290                 next_start = dmd.size;
1291                 next_end = dmd.size;
1292
1293                 /* start of the next segment: end of the first existing segment after the last added */
1294                 for (i = 0; i < num_segments; i++)
1295                         if (segments[i].offset + segments[i].length < next_start && segments[i].offset + segments[i].length >= last_segment)
1296                                 next_start = segments[i].offset + segments[i].length;
1297
1298                 /* end of the next segment: start of the next segment after start we found above */
1299                 for (i = 0; i < num_segments; i++)
1300                         if (segments[i].offset < next_end && segments[i].offset >= next_start)
1301                                 next_end = segments[i].offset;
1302
1303                 /* two zero segments next to each other, just bump the last_segment
1304                    so the algorithm moves */
1305                 if (next_end - next_start == 0) {
1306                         last_segment = next_end + 1;
1307                         continue;
1308                 }
1309
1310                 segments[num_segments].offset = next_start;
1311                 segments[num_segments].length = next_end - next_start;
1312                 segments[num_segments].iv_offset = next_start;
1313                 segments[num_segments].type = BITLK_SEGTYPE_CRYPT;
1314                 last_segment = next_end;
1315                 num_segments++;
1316
1317                 if (next_end == dmd.size)
1318                         break;
1319
1320                 if (num_segments == 10) {
1321                         log_dbg(cd, "Failed to calculate number of dm-crypt segments for open.");
1322                         r = -EINVAL;
1323                         goto out;
1324                 }
1325         }
1326
1327         /* device mapper needs the segment sorted */
1328         for (i = 0; i < num_segments - 1; i++) {
1329                 min = i;
1330                 for (j = i + 1; j < num_segments; j++)
1331                         if (segments[j].offset < segments[min].offset)
1332                                 min = j;
1333
1334                 if (min != i) {
1335                         temp.offset = segments[min].offset;
1336                         temp.length = segments[min].length;
1337                         temp.iv_offset = segments[min].iv_offset;
1338                         temp.type = segments[min].type;
1339
1340                         segments[min].offset = segments[i].offset;
1341                         segments[min].length = segments[i].length;
1342                         segments[min].iv_offset = segments[i].iv_offset;
1343                         segments[min].type = segments[i].type;
1344
1345                         segments[i].offset = temp.offset;
1346                         segments[i].length = temp.length;
1347                         segments[i].iv_offset = temp.iv_offset;
1348                         segments[i].type = temp.type;
1349                 }
1350         }
1351
1352         if (params->sector_size != SECTOR_SIZE)
1353                 dmd.flags |= CRYPT_ACTIVATE_IV_LARGE_SECTORS;
1354
1355         r = dm_targets_allocate(&dmd.segment, num_segments);
1356         if (r)
1357                 goto out;
1358         next_segment = &dmd.segment;
1359
1360         for (i = 0; i < num_segments; i++) {
1361                 if (segments[i].type == BITLK_SEGTYPE_ZERO)
1362                         r = dm_zero_target_set(next_segment,
1363                                                segments[i].offset,
1364                                                segments[i].length);
1365                 else if (segments[i].type == BITLK_SEGTYPE_CRYPT)
1366                         r = dm_crypt_target_set(next_segment,
1367                                                 segments[i].offset,
1368                                                 segments[i].length,
1369                                                 crypt_data_device(cd),
1370                                                 open_fvek_key,
1371                                                 crypt_get_cipher_spec(cd),
1372                                                 segments[i].iv_offset,
1373                                                 segments[i].iv_offset,
1374                                                 NULL, 0,
1375                                                 params->sector_size);
1376                 if (r)
1377                         goto out;
1378
1379                 next_segment = next_segment->next;
1380         }
1381
1382         log_dbg(cd, "Trying to activate BITLK on device %s%s%s.",
1383                 device_path(crypt_data_device(cd)), name ? " with name " :"", name ?: "");
1384
1385         r = dm_create_device(cd, name, CRYPT_BITLK, &dmd);
1386         if (r < 0) {
1387                 dm_flags(cd, DM_CRYPT, &dmt_flags);
1388                 if (!strcmp(params->cipher_mode, "cbc-eboiv") && !(dmt_flags & DM_BITLK_EBOIV_SUPPORTED)) {
1389                         log_err(cd, _("Cannot activate device, kernel dm-crypt is missing support for BITLK IV."));
1390                         r = -ENOTSUP;
1391                 }
1392                 if (!strcmp(params->cipher_mode, "cbc-elephant") && !(dmt_flags & DM_BITLK_ELEPHANT_SUPPORTED)) {
1393                         log_err(cd, _("Cannot activate device, kernel dm-crypt is missing support for BITLK Elephant diffuser."));
1394                         r = -ENOTSUP;
1395                 }
1396                 if ((dmd.flags & CRYPT_ACTIVATE_IV_LARGE_SECTORS) && !(dmt_flags & DM_SECTOR_SIZE_SUPPORTED)) {
1397                         log_err(cd, _("Cannot activate device, kernel dm-crypt is missing support for large sector size."));
1398                         r = -ENOTSUP;
1399                 }
1400                 if (dm_flags(cd, DM_ZERO, &dmt_flags) < 0) {
1401                         log_err(cd, _("Cannot activate device, kernel dm-zero module is missing."));
1402                         r = -ENOTSUP;
1403                 }
1404         }
1405 out:
1406         dm_targets_free(cd, &dmd);
1407         return r;
1408 }
1409
1410 int BITLK_activate_by_passphrase(struct crypt_device *cd,
1411                                  const char *name,
1412                                  const char *password,
1413                                  size_t passwordLen,
1414                                  const struct bitlk_metadata *params,
1415                                  uint32_t flags)
1416 {
1417         int r = 0;
1418         struct volume_key *open_fvek_key = NULL;
1419
1420         r = _activate_check(cd, params);
1421         if (r)
1422                 return r;
1423
1424         r = BITLK_get_volume_key(cd, password, passwordLen, params, &open_fvek_key);
1425         if (r < 0)
1426                 goto out;
1427
1428         /* Password verify only */
1429         if (!name)
1430                 goto out;
1431
1432         r = _activate(cd, name, open_fvek_key, params, flags);
1433 out:
1434         crypt_free_volume_key(open_fvek_key);
1435         return r;
1436 }
1437
1438 int BITLK_activate_by_volume_key(struct crypt_device *cd,
1439                                  const char *name,
1440                                  const char *volume_key,
1441                                  size_t volume_key_size,
1442                                  const struct bitlk_metadata *params,
1443                                  uint32_t flags)
1444 {
1445         int r = 0;
1446         struct volume_key *open_fvek_key = NULL;
1447
1448         r = _activate_check(cd, params);
1449         if (r)
1450                 return r;
1451
1452         open_fvek_key = crypt_alloc_volume_key(volume_key_size, volume_key);
1453         if (!open_fvek_key)
1454                 return -ENOMEM;
1455
1456         r = _activate(cd, name, open_fvek_key, params, flags);
1457
1458         crypt_free_volume_key(open_fvek_key);
1459         return r;
1460 }