lib/verity/verity_hash.c

   1 /*
   2  * dm-verity volume handling
   3  *
   4  * Copyright (C) 2012-2021 Red Hat, Inc. All rights reserved.
   5  *
   6  * This file is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This file is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this file; if not, write to the Free Software
  18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  19  */
  20
  21 #include <errno.h>
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include <string.h>
  25 #include <stdint.h>
  26
  27 #include "verity.h"
  28 #include "internal.h"
  29
  30 #define VERITY_MAX_LEVELS       63
  31
  32 static unsigned get_bits_up(size_t u)
  33 {
  34         unsigned i = 0;
  35         while ((1U << i) < u)
  36                 i++;
  37         return i;
  38 }
  39
  40 static unsigned get_bits_down(size_t u)
  41 {
  42         unsigned i = 0;
  43         while ((u >> i) > 1U)
  44                 i++;
  45         return i;
  46 }
  47
  48 static int verify_zero(struct crypt_device *cd, FILE *wr, size_t bytes)
  49 {
  50         char block[bytes];
  51         size_t i;
  52
  53         if (fread(block, bytes, 1, wr) != 1) {
  54                 log_dbg(cd, "EIO while reading spare area.");
  55                 return -EIO;
  56         }
  57         for (i = 0; i < bytes; i++)
  58                 if (block[i]) {
  59                         log_err(cd, _("Spare area is not zeroed at position %" PRIu64 "."),
  60                                 ftello(wr) - bytes);
  61                         return -EPERM;
  62                 }
  63         return 0;
  64 }
  65
  66 static int verify_hash_block(const char *hash_name, int version,
  67                               char *hash, size_t hash_size,
  68                               const char *data, size_t data_size,
  69                               const char *salt, size_t salt_size)
  70 {
  71         struct crypt_hash *ctx = NULL;
  72         int r;
  73
  74         if (crypt_hash_init(&ctx, hash_name))
  75                 return -EINVAL;
  76
  77         if (version == 1 && (r = crypt_hash_write(ctx, salt, salt_size)))
  78                 goto out;
  79
  80         if ((r = crypt_hash_write(ctx, data, data_size)))
  81                 goto out;
  82
  83         if (version == 0 && (r = crypt_hash_write(ctx, salt, salt_size)))
  84                 goto out;
  85
  86         r = crypt_hash_final(ctx, hash, hash_size);
  87 out:
  88         crypt_hash_destroy(ctx);
  89         return r;
  90 }
  91
  92 static int hash_levels(size_t hash_block_size, size_t digest_size,
  93                        uint64_t data_file_blocks, uint64_t *hash_position, int *levels,
  94                        uint64_t *hash_level_block, uint64_t *hash_level_size)
  95 {
  96         size_t hash_per_block_bits;
  97         uint64_t s, s_shift;
  98         int i;
  99
 100         if (!digest_size)
 101                 return -EINVAL;
 102
 103         hash_per_block_bits = get_bits_down(hash_block_size / digest_size);
 104         if (!hash_per_block_bits)
 105                 return -EINVAL;
 106
 107         *levels = 0;
 108         while (hash_per_block_bits * *levels < 64 &&
 109                (data_file_blocks - 1) >> (hash_per_block_bits * *levels))
 110                 (*levels)++;
 111
 112         if (*levels > VERITY_MAX_LEVELS)
 113                 return -EINVAL;
 114
 115         for (i = *levels - 1; i >= 0; i--) {
 116                 if (hash_level_block)
 117                         hash_level_block[i] = *hash_position;
 118                 // verity position of block data_file_blocks at level i
 119                 s_shift = (i + 1) * hash_per_block_bits;
 120                 if (s_shift > 63)
 121                         return -EINVAL;
 122                 s = (data_file_blocks + ((uint64_t)1 << s_shift) - 1) >> ((i + 1) * hash_per_block_bits);
 123                 if (hash_level_size)
 124                         hash_level_size[i] = s;
 125                 if ((*hash_position + s) < *hash_position)
 126                         return -EINVAL;
 127                 *hash_position += s;
 128         }
 129
 130         return 0;
 131 }
 132
 133 static int create_or_verify(struct crypt_device *cd, FILE *rd, FILE *wr,
 134                                    uint64_t data_block, size_t data_block_size,
 135                                    uint64_t hash_block, size_t hash_block_size,
 136                                    uint64_t blocks, int version,
 137                                    const char *hash_name, int verify,
 138                                    char *calculated_digest, size_t digest_size,
 139                                    const char *salt, size_t salt_size)
 140 {
 141         char left_block[hash_block_size];
 142         char data_buffer[data_block_size];
 143         char read_digest[digest_size];
 144         size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
 145         size_t digest_size_full = 1 << get_bits_up(digest_size);
 146         uint64_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block;
 147         uint64_t seek_rd, seek_wr;
 148         size_t left_bytes;
 149         unsigned i;
 150         int r;
 151
 152         if (uint64_mult_overflow(&seek_rd, data_block, data_block_size) ||
 153             uint64_mult_overflow(&seek_wr, hash_block, hash_block_size)) {
 154                 log_err(cd, _("Device offset overflow."));
 155                 return -EINVAL;
 156         }
 157
 158         if (fseeko(rd, seek_rd, SEEK_SET)) {
 159                 log_dbg(cd, "Cannot seek to requested position in data device.");
 160                 return -EIO;
 161         }
 162
 163         if (wr && fseeko(wr, seek_wr, SEEK_SET)) {
 164                 log_dbg(cd, "Cannot seek to requested position in hash device.");
 165                 return -EIO;
 166         }
 167
 168         memset(left_block, 0, hash_block_size);
 169         while (blocks_to_write--) {
 170                 left_bytes = hash_block_size;
 171                 for (i = 0; i < hash_per_block; i++) {
 172                         if (!blocks)
 173                                 break;
 174                         blocks--;
 175                         if (fread(data_buffer, data_block_size, 1, rd) != 1) {
 176                                 log_dbg(cd, "Cannot read data device block.");
 177                                 return -EIO;
 178                         }
 179
 180                         if (verify_hash_block(hash_name, version,
 181                                         calculated_digest, digest_size,
 182                                         data_buffer, data_block_size,
 183                                         salt, salt_size))
 184                                 return -EINVAL;
 185
 186                         if (!wr)
 187                                 break;
 188                         if (verify) {
 189                                 if (fread(read_digest, digest_size, 1, wr) != 1) {
 190                                         log_dbg(cd, "Cannot read digest form hash device.");
 191                                         return -EIO;
 192                                 }
 193                                 if (memcmp(read_digest, calculated_digest, digest_size)) {
 194                                         log_err(cd, _("Verification failed at position %" PRIu64 "."),
 195                                                 ftello(rd) - data_block_size);
 196                                         return -EPERM;
 197                                 }
 198                         } else {
 199                                 if (fwrite(calculated_digest, digest_size, 1, wr) != 1) {
 200                                         log_dbg(cd, "Cannot write digest to hash device.");
 201                                         return -EIO;
 202                                 }
 203                         }
 204                         if (version == 0) {
 205                                 left_bytes -= digest_size;
 206                         } else {
 207                                 if (digest_size_full - digest_size) {
 208                                         if (verify) {
 209                                                 r = verify_zero(cd, wr, digest_size_full - digest_size);
 210                                                 if (r)
 211                                                         return r;
 212                                         } else if (fwrite(left_block, digest_size_full - digest_size, 1, wr) != 1) {
 213                                                 log_dbg(cd, "Cannot write spare area to hash device.");
 214                                                 return -EIO;
 215                                         }
 216                                 }
 217                                 left_bytes -= digest_size_full;
 218                         }
 219                 }
 220                 if (wr && left_bytes) {
 221                         if (verify) {
 222                                 r = verify_zero(cd , wr, left_bytes);
 223                                 if (r)
 224                                         return r;
 225                         } else if (fwrite(left_block, left_bytes, 1, wr) != 1) {
 226                                 log_dbg(cd, "Cannot write remaining spare area to hash device.");
 227                                 return -EIO;
 228                         }
 229                 }
 230         }
 231
 232         return 0;
 233 }
 234
 235 static int VERITY_create_or_verify_hash(struct crypt_device *cd, bool verify,
 236         struct crypt_params_verity *params,
 237         char *root_hash, size_t digest_size)
 238 {
 239         char calculated_digest[digest_size];
 240         FILE *data_file = NULL;
 241         FILE *hash_file = NULL, *hash_file_2;
 242         uint64_t hash_level_block[VERITY_MAX_LEVELS];
 243         uint64_t hash_level_size[VERITY_MAX_LEVELS];
 244         uint64_t data_file_blocks;
 245         uint64_t data_device_offset_max = 0, hash_device_offset_max = 0;
 246         uint64_t hash_position = VERITY_hash_offset_block(params);
 247         uint64_t dev_size;
 248         int levels, i, r;
 249
 250         log_dbg(cd, "Hash %s %s, data device %s, data blocks %" PRIu64
 251                 ", hash_device %s, offset %" PRIu64 ".",
 252                 verify ? "verification" : "creation", params->hash_name,
 253                 device_path(crypt_data_device(cd)), params->data_size,
 254                 device_path(crypt_metadata_device(cd)), hash_position);
 255
 256         if (!params->data_size) {
 257                 r = device_size(crypt_data_device(cd), &dev_size);
 258                 if (r < 0)
 259                         return r;
 260
 261                 data_file_blocks = dev_size / params->data_block_size;
 262         } else
 263                 data_file_blocks = params->data_size;
 264
 265         if (uint64_mult_overflow(&data_device_offset_max, params->data_size, params->data_block_size)) {
 266                 log_err(cd, _("Device offset overflow."));
 267                 return -EINVAL;
 268         }
 269         log_dbg(cd, "Data device size required: %" PRIu64 " bytes.", data_device_offset_max);
 270
 271         if (hash_levels(params->hash_block_size, digest_size, data_file_blocks, &hash_position,
 272                 &levels, &hash_level_block[0], &hash_level_size[0])) {
 273                 log_err(cd, _("Hash area overflow."));
 274                 return -EINVAL;
 275         }
 276         if (uint64_mult_overflow(&hash_device_offset_max, hash_position, params->hash_block_size)) {
 277                 log_err(cd, _("Device offset overflow."));
 278                 return -EINVAL;
 279         }
 280         log_dbg(cd, "Hash device size required: %" PRIu64 " bytes.",
 281                 hash_device_offset_max - params->hash_area_offset);
 282         log_dbg(cd, "Using %d hash levels.", levels);
 283
 284         data_file = fopen(device_path(crypt_data_device(cd)), "r");
 285         if (!data_file) {
 286                 log_err(cd, _("Cannot open device %s."),
 287                         device_path(crypt_data_device(cd))
 288                 );
 289                 r = -EIO;
 290                 goto out;
 291         }
 292
 293         hash_file = fopen(device_path(crypt_metadata_device(cd)), verify ? "r" : "r+");
 294         if (!hash_file) {
 295                 log_err(cd, _("Cannot open device %s."),
 296                         device_path(crypt_metadata_device(cd)));
 297                 r = -EIO;
 298                 goto out;
 299         }
 300
 301         memset(calculated_digest, 0, digest_size);
 302
 303         for (i = 0; i < levels; i++) {
 304                 if (!i) {
 305                         r = create_or_verify(cd, data_file, hash_file,
 306                                                     0, params->data_block_size,
 307                                                     hash_level_block[i], params->hash_block_size,
 308                                                     data_file_blocks, params->hash_type, params->hash_name, verify,
 309                                                     calculated_digest, digest_size, params->salt, params->salt_size);
 310                         if (r)
 311                                 goto out;
 312                 } else {
 313                         hash_file_2 = fopen(device_path(crypt_metadata_device(cd)), "r");
 314                         if (!hash_file_2) {
 315                                 log_err(cd, _("Cannot open device %s."),
 316                                         device_path(crypt_metadata_device(cd)));
 317                                 r = -EIO;
 318                                 goto out;
 319                         }
 320                         r = create_or_verify(cd, hash_file_2, hash_file,
 321                                                     hash_level_block[i - 1], params->hash_block_size,
 322                                                     hash_level_block[i], params->hash_block_size,
 323                                                     hash_level_size[i - 1], params->hash_type, params->hash_name, verify,
 324                                                     calculated_digest, digest_size, params->salt, params->salt_size);
 325                         fclose(hash_file_2);
 326                         if (r)
 327                                 goto out;
 328                 }
 329         }
 330
 331         if (levels)
 332                 r = create_or_verify(cd, hash_file, NULL,
 333                                             hash_level_block[levels - 1], params->hash_block_size,
 334                                             0, params->hash_block_size,
 335                                             1, params->hash_type, params->hash_name, verify,
 336                                             calculated_digest, digest_size, params->salt, params->salt_size);
 337         else
 338                 r = create_or_verify(cd, data_file, NULL,
 339                                             0, params->data_block_size,
 340                                             0, params->hash_block_size,
 341                                             data_file_blocks, params->hash_type, params->hash_name, verify,
 342                                             calculated_digest, digest_size, params->salt, params->salt_size);
 343 out:
 344         if (verify) {
 345                 if (r)
 346                         log_err(cd, _("Verification of data area failed."));
 347                 else {
 348                         log_dbg(cd, "Verification of data area succeeded.");
 349                         r = memcmp(root_hash, calculated_digest, digest_size) ? -EFAULT : 0;
 350                         if (r)
 351                                 log_err(cd, _("Verification of root hash failed."));
 352                         else
 353                                 log_dbg(cd, "Verification of root hash succeeded.");
 354                 }
 355         } else {
 356                 if (r == -EIO)
 357                         log_err(cd, _("Input/output error while creating hash area."));
 358                 else if (r)
 359                         log_err(cd, _("Creation of hash area failed."));
 360                 else {
 361                         fsync(fileno(hash_file));
 362                         memcpy(root_hash, calculated_digest, digest_size);
 363                 }
 364         }
 365
 366         if (data_file)
 367                 fclose(data_file);
 368         if (hash_file)
 369                 fclose(hash_file);
 370         return r;
 371 }
 372
 373 /* Verify verity device using userspace crypto backend */
 374 int VERITY_verify(struct crypt_device *cd,
 375                   struct crypt_params_verity *verity_hdr,
 376                   const char *root_hash,
 377                   size_t root_hash_size)
 378 {
 379         return VERITY_create_or_verify_hash(cd, 1, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
 380 }
 381
 382 /* Create verity hash */
 383 int VERITY_create(struct crypt_device *cd,
 384                   struct crypt_params_verity *verity_hdr,
 385                   const char *root_hash,
 386                   size_t root_hash_size)
 387 {
 388         unsigned pgsize = (unsigned)crypt_getpagesize();
 389
 390         if (verity_hdr->salt_size > 256)
 391                 return -EINVAL;
 392
 393         if (verity_hdr->data_block_size > pgsize)
 394                 log_err(cd, _("WARNING: Kernel cannot activate device if data "
 395                               "block size exceeds page size (%u)."), pgsize);
 396
 397         return VERITY_create_or_verify_hash(cd, 0, verity_hdr, CONST_CAST(char*)root_hash, root_hash_size);
 398 }
 399
 400 uint64_t VERITY_hash_blocks(struct crypt_device *cd, struct crypt_params_verity *params)
 401 {
 402         uint64_t hash_position = 0;
 403         int levels = 0;
 404
 405         if (hash_levels(params->hash_block_size, crypt_get_volume_key_size(cd),
 406                 params->data_size, &hash_position, &levels, NULL, NULL))
 407                 return 0;
 408
 409         return (uint64_t)hash_position;
 410 }