2 * LUKS - Linux Unified Key Setup v2, kernel keyring token
4 * Copyright (C) 2016-2021 Red Hat, Inc. All rights reserved.
5 * Copyright (C) 2016-2021 Ondrej Kozina
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 2
10 * of the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 #include "luks2_internal.h"
26 static int keyring_open(struct crypt_device *cd,
30 void *usrptr __attribute__((unused)))
32 json_object *jobj_token, *jobj_key;
33 struct luks2_hdr *hdr;
36 if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2)))
39 jobj_token = LUKS2_get_token_jobj(hdr, token);
43 json_object_object_get_ex(jobj_token, "key_description", &jobj_key);
45 r = keyring_get_passphrase(json_object_get_string(jobj_key), buffer, buffer_len);
47 log_dbg(cd, "Kernel keyring features disabled.");
50 log_dbg(cd, "keyring_get_passphrase failed (error %d)", r);
57 static int keyring_validate(struct crypt_device *cd __attribute__((unused)),
60 enum json_tokener_error jerr;
61 json_object *jobj_token, *jobj_key;
64 log_dbg(cd, "Validating keyring token json");
66 jobj_token = json_tokener_parse_verbose(json, &jerr);
68 log_dbg(cd, "Keyring token JSON parse failed.");
72 if (json_object_object_length(jobj_token) != 3) {
73 log_dbg(cd, "Keyring token is expected to have exactly 3 fields.");
77 if (!json_object_object_get_ex(jobj_token, "key_description", &jobj_key)) {
78 log_dbg(cd, "missing key_description field.");
82 if (!json_object_is_type(jobj_key, json_type_string)) {
83 log_dbg(cd, "key_description is not a string.");
87 /* TODO: perhaps check that key description is in '%s:%s'
88 * format where both strings are not empty */
89 r = !strlen(json_object_get_string(jobj_key));
91 json_object_put(jobj_token);
95 static void keyring_dump(struct crypt_device *cd, const char *json)
97 enum json_tokener_error jerr;
98 json_object *jobj_token, *jobj_key;
100 jobj_token = json_tokener_parse_verbose(json, &jerr);
104 if (!json_object_object_get_ex(jobj_token, "key_description", &jobj_key)) {
105 json_object_put(jobj_token);
109 log_std(cd, "\tKey description: %s\n", json_object_get_string(jobj_key));
111 json_object_put(jobj_token);
114 int token_keyring_set(json_object **jobj_builtin_token,
117 json_object *jobj_token, *jobj;
118 const struct crypt_token_params_luks2_keyring *keyring_params = (const struct crypt_token_params_luks2_keyring *) params;
120 jobj_token = json_object_new_object();
124 jobj = json_object_new_string(LUKS2_TOKEN_KEYRING);
126 json_object_put(jobj_token);
129 json_object_object_add(jobj_token, "type", jobj);
131 jobj = json_object_new_array();
133 json_object_put(jobj_token);
136 json_object_object_add(jobj_token, "keyslots", jobj);
138 jobj = json_object_new_string(keyring_params->key_description);
140 json_object_put(jobj_token);
143 json_object_object_add(jobj_token, "key_description", jobj);
145 *jobj_builtin_token = jobj_token;
149 int token_keyring_get(json_object *jobj_token,
153 struct crypt_token_params_luks2_keyring *keyring_params = (struct crypt_token_params_luks2_keyring *) params;
155 json_object_object_get_ex(jobj_token, "type", &jobj);
156 assert(!strcmp(json_object_get_string(jobj), LUKS2_TOKEN_KEYRING));
158 json_object_object_get_ex(jobj_token, "key_description", &jobj);
160 keyring_params->key_description = json_object_get_string(jobj);
165 const crypt_token_handler keyring_handler = {
166 .name = LUKS2_TOKEN_KEYRING,
167 .open = keyring_open,
168 .validate = keyring_validate,