lib/luks1/keyencryption.c

   1 /*
   2  * LUKS - Linux Unified Key Setup
   3  *
   4  * Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
   5  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * version 2 as published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19  */
  20
  21 #include <string.h>
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <ctype.h>
  25 #include <inttypes.h>
  26 #include <sys/types.h>
  27 #include <sys/stat.h>
  28 #include <sys/ioctl.h>
  29 #include <sys/mman.h>
  30 #include <sys/utsname.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <errno.h>
  34 #include <signal.h>
  35
  36 #include "luks.h"
  37 #include "internal.h"
  38
  39 #define div_round_up(a,b) ({          \
  40         typeof(a) __a = (a);          \
  41         typeof(b) __b = (b);          \
  42         (__a - 1) / __b + 1;          \
  43 })
  44
  45 static inline int round_up_modulo(int x, int m) {
  46         return div_round_up(x, m) * m;
  47 }
  48
  49 static const char *cleaner_name=NULL;
  50 static uint64_t cleaner_size = 0;
  51 static int devfd=-1;
  52
  53 static int setup_mapping(const char *cipher, const char *name,
  54                          const char *device,
  55                          struct volume_key *vk,
  56                          unsigned int sector, size_t srcLength,
  57                          int mode, struct crypt_device *ctx)
  58 {
  59         int device_sector_size = sector_size_for_device(device);
  60         struct crypt_dm_active_device dmd = {
  61                 .target = DM_CRYPT,
  62                 .uuid   = NULL,
  63                 .size   = 0,
  64                 .flags  = 0,
  65                 .u.crypt = {
  66                         .device = device,
  67                         .cipher = cipher,
  68                         .vk     = vk,
  69                         .offset = sector,
  70                         .iv_offset = 0,
  71                 }
  72         };
  73
  74         dmd.flags = CRYPT_ACTIVATE_PRIVATE;
  75         if (mode == O_RDONLY)
  76                 dmd.flags |= CRYPT_ACTIVATE_READONLY;
  77         /*
  78          * we need to round this to nearest multiple of the underlying
  79          * device's sector size, otherwise the mapping will be refused.
  80          */
  81         if(device_sector_size < 0) {
  82                 log_err(ctx, _("Unable to obtain sector size for %s"), device);
  83                 return -EINVAL;
  84         }
  85
  86         dmd.size = round_up_modulo(srcLength,device_sector_size)/SECTOR_SIZE;
  87         cleaner_size = dmd.size;
  88
  89         return dm_create_device(name, "TEMP", &dmd, 0);
  90 }
  91
  92 static void sigint_handler(int sig __attribute__((unused)))
  93 {
  94         if(devfd >= 0)
  95                 close(devfd);
  96         devfd = -1;
  97         if(cleaner_name)
  98                 dm_remove_device(cleaner_name, 1, cleaner_size);
  99
 100         signal(SIGINT, SIG_DFL);
 101         kill(getpid(), SIGINT);
 102 }
 103
 104 static const char *_error_hint(char *cipherMode, size_t keyLength)
 105 {
 106         const char *hint= "";
 107
 108         if (!strncmp(cipherMode, "xts", 3) && (keyLength != 256 && keyLength != 512))
 109                 hint = _("Key size in XTS mode must be 256 or 512 bits.\n");
 110
 111         return hint;
 112 }
 113
 114 /* This function is not reentrant safe, as it installs a signal
 115    handler and global vars for cleaning */
 116 static int LUKS_endec_template(char *src, size_t srcLength,
 117                                struct luks_phdr *hdr,
 118                                struct volume_key *vk,
 119                                const char *device,
 120                                unsigned int sector,
 121                                ssize_t (*func)(int, void *, size_t),
 122                                int mode,
 123                                struct crypt_device *ctx)
 124 {
 125         char *name = NULL;
 126         char *fullpath = NULL;
 127         char *dmCipherSpec = NULL;
 128         const char *dmDir = dm_get_dir();
 129         int r = -1;
 130
 131         if(dmDir == NULL) {
 132                 log_err(ctx, _("Failed to obtain device mapper directory."));
 133                 return -1;
 134         }
 135         if(asprintf(&name,"temporary-cryptsetup-%d",getpid())               == -1 ||
 136            asprintf(&fullpath,"%s/%s",dmDir,name)                           == -1 ||
 137            asprintf(&dmCipherSpec,"%s-%s",hdr->cipherName, hdr->cipherMode) == -1) {
 138                 r = -ENOMEM;
 139                 goto out1;
 140         }
 141
 142         signal(SIGINT, sigint_handler);
 143         cleaner_name = name;
 144
 145         r = setup_mapping(dmCipherSpec, name, device,
 146                           vk, sector, srcLength, mode, ctx);
 147         if(r < 0) {
 148                 log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
 149                         "Check that kernel supports %s cipher (check syslog for more info).\n%s"),
 150                         device, dmCipherSpec,
 151                         _error_hint(hdr->cipherMode, vk->keylength * 8));
 152                 r = -EIO;
 153                 goto out1;
 154         }
 155
 156         devfd = open(fullpath, mode | O_DIRECT | O_SYNC);  /* devfd is a global var */
 157         if(devfd == -1) {
 158                 log_err(ctx, _("Failed to open temporary keystore device.\n"));
 159                 r = -EIO;
 160                 goto out2;
 161         }
 162
 163         r = func(devfd,src,srcLength);
 164         if(r < 0) {
 165                 log_err(ctx, _("Failed to access temporary keystore device.\n"));
 166                 r = -EIO;
 167                 goto out3;
 168         }
 169
 170         r = 0;
 171  out3:
 172         close(devfd);
 173         devfd = -1;
 174  out2:
 175         dm_remove_device(cleaner_name, 1, cleaner_size);
 176  out1:
 177         signal(SIGINT, SIG_DFL);
 178         cleaner_name = NULL;
 179         cleaner_size = 0;
 180         free(dmCipherSpec);
 181         free(fullpath);
 182         free(name);
 183         return r;
 184 }
 185
 186 int LUKS_encrypt_to_storage(char *src, size_t srcLength,
 187                             struct luks_phdr *hdr,
 188                             struct volume_key *vk,
 189                             const char *device,
 190                             unsigned int sector,
 191                             struct crypt_device *ctx)
 192 {
 193         return LUKS_endec_template(src,srcLength,hdr,vk, device,
 194                                    sector, write_blockwise, O_RDWR, ctx);
 195 }
 196
 197 int LUKS_decrypt_from_storage(char *dst, size_t dstLength,
 198                               struct luks_phdr *hdr,
 199                               struct volume_key *vk,
 200                               const char *device,
 201                               unsigned int sector,
 202                               struct crypt_device *ctx)
 203 {
 204         return LUKS_endec_template(dst,dstLength,hdr,vk, device,
 205                                    sector, read_blockwise, O_RDONLY, ctx);
 206 }