lib/luks1/keyencryption.c

   1 /*
   2  * LUKS - Linux Unified Key Setup
   3  *
   4  * Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
   5  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * version 2 as published by the Free Software Foundation.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19  */
  20
  21 #include <string.h>
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <ctype.h>
  25 #include <inttypes.h>
  26 #include <sys/types.h>
  27 #include <sys/stat.h>
  28 #include <sys/ioctl.h>
  29 #include <sys/mman.h>
  30 #include <sys/utsname.h>
  31 #include <fcntl.h>
  32 #include <unistd.h>
  33 #include <errno.h>
  34 #include <signal.h>
  35
  36 #include "luks.h"
  37 #include "internal.h"
  38
  39 static const char *cleaner_name=NULL;
  40 static uint64_t cleaner_size = 0;
  41 static int devfd=-1;
  42
  43 static int setup_mapping(const char *cipher, const char *name,
  44                          unsigned int bsize, struct volume_key *vk,
  45                          unsigned int sector, size_t srcLength,
  46                          int mode, struct crypt_device *ctx)
  47 {
  48         struct device *device = crypt_metadata_device(ctx);
  49         struct crypt_dm_active_device dmd = {
  50                 .target = DM_CRYPT,
  51                 .uuid   = NULL,
  52                 .size   = size_round_up(srcLength, bsize) / SECTOR_SIZE,
  53                 .flags  = CRYPT_ACTIVATE_PRIVATE,
  54                 .data_device = device,
  55                 .u.crypt = {
  56                         .cipher = cipher,
  57                         .vk     = vk,
  58                         .offset = sector,
  59                         .iv_offset = 0,
  60                 }
  61         };
  62         int r;
  63
  64         if (mode == O_RDONLY)
  65                 dmd.flags |= CRYPT_ACTIVATE_READONLY;
  66
  67         r = device_block_adjust(ctx, dmd.data_device, DEV_OK,
  68                                 dmd.u.crypt.offset, &dmd.size, &dmd.flags);
  69         if (r < 0)
  70                 return r;
  71
  72         if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) {
  73                 log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
  74                         device_path(device));
  75                 return -EACCES;
  76         }
  77         cleaner_size = dmd.size;
  78         return dm_create_device(ctx, name, "TEMP", &dmd, 0);
  79 }
  80
  81 static void sigint_handler(int sig __attribute__((unused)))
  82 {
  83         if(devfd >= 0)
  84                 close(devfd);
  85         devfd = -1;
  86         if(cleaner_name)
  87                 dm_remove_device(NULL, cleaner_name, 1, cleaner_size);
  88
  89         signal(SIGINT, SIG_DFL);
  90         kill(getpid(), SIGINT);
  91 }
  92
  93 static const char *_error_hint(char *cipherMode, size_t keyLength)
  94 {
  95         const char *hint= "";
  96
  97         if (!strncmp(cipherMode, "xts", 3) && (keyLength != 256 && keyLength != 512))
  98                 hint = _("Key size in XTS mode must be 256 or 512 bits.\n");
  99
 100         return hint;
 101 }
 102
 103 /* This function is not reentrant safe, as it installs a signal
 104    handler and global vars for cleaning */
 105 static int LUKS_endec_template(char *src, size_t srcLength,
 106                                struct luks_phdr *hdr,
 107                                struct volume_key *vk,
 108                                unsigned int sector,
 109                                ssize_t (*func)(int, int, void *, size_t),
 110                                int mode,
 111                                struct crypt_device *ctx)
 112 {
 113         char *name = NULL;
 114         char *fullpath = NULL;
 115         char *dmCipherSpec = NULL;
 116         const char *dmDir = dm_get_dir();
 117         int r = -1;
 118         int bsize = device_block_size(crypt_metadata_device(ctx));
 119
 120         if(dmDir == NULL) {
 121                 log_err(ctx, _("Failed to obtain device mapper directory."));
 122                 return -1;
 123         }
 124         if(asprintf(&name,"temporary-cryptsetup-%d",getpid())               == -1 ||
 125            asprintf(&fullpath,"%s/%s",dmDir,name)                           == -1 ||
 126            asprintf(&dmCipherSpec,"%s-%s",hdr->cipherName, hdr->cipherMode) == -1) {
 127                 r = -ENOMEM;
 128                 goto out1;
 129         }
 130
 131         signal(SIGINT, sigint_handler);
 132         cleaner_name = name;
 133
 134         r = setup_mapping(dmCipherSpec, name, bsize, vk, sector, srcLength, mode, ctx);
 135         if(r < 0) {
 136                 if (r != -EACCES && r != -ENOTSUP)
 137                         log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
 138                         "Check that kernel supports %s cipher (check syslog for more info).\n%s"),
 139                         device_path(crypt_metadata_device(ctx)), dmCipherSpec,
 140                         _error_hint(hdr->cipherMode, vk->keylength * 8));
 141                 r = -EIO;
 142                 goto out1;
 143         }
 144
 145         devfd = open(fullpath, mode | O_DIRECT | O_SYNC);  /* devfd is a global var */
 146         if(devfd == -1) {
 147                 log_err(ctx, _("Failed to open temporary keystore device.\n"));
 148                 r = -EIO;
 149                 goto out2;
 150         }
 151
 152         r = func(devfd, bsize, src, srcLength);
 153         if(r < 0) {
 154                 log_err(ctx, _("Failed to access temporary keystore device.\n"));
 155                 r = -EIO;
 156                 goto out3;
 157         }
 158
 159         r = 0;
 160  out3:
 161         close(devfd);
 162         devfd = -1;
 163  out2:
 164         dm_remove_device(ctx, cleaner_name, 1, cleaner_size);
 165  out1:
 166         signal(SIGINT, SIG_DFL);
 167         cleaner_name = NULL;
 168         cleaner_size = 0;
 169         free(dmCipherSpec);
 170         free(fullpath);
 171         free(name);
 172         return r;
 173 }
 174
 175 int LUKS_encrypt_to_storage(char *src, size_t srcLength,
 176                             struct luks_phdr *hdr,
 177                             struct volume_key *vk,
 178                             unsigned int sector,
 179                             struct crypt_device *ctx)
 180 {
 181         return LUKS_endec_template(src, srcLength, hdr, vk, sector,
 182                                    write_blockwise, O_RDWR, ctx);
 183 }
 184
 185 int LUKS_decrypt_from_storage(char *dst, size_t dstLength,
 186                               struct luks_phdr *hdr,
 187                               struct volume_key *vk,
 188                               unsigned int sector,
 189                               struct crypt_device *ctx)
 190 {
 191         return LUKS_endec_template(dst, dstLength, hdr, vk, sector,
 192                                    read_blockwise, O_RDONLY, ctx);
 193 }