* LUKS - Linux Unified Key Setup
*
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
+ * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
#include "pbkdf.h"
#include "internal.h"
-#define div_round_up(a,b) ({ \
- typeof(a) __a = (a); \
- typeof(b) __b = (b); \
- (__a - 1) / __b + 1; \
-})
-
-static inline int round_up_modulo(int x, int m) {
- return div_round_up(x, m) * m;
-}
-
-/* Get size of struct luks_phrd with all keyslots material space */
-static uint64_t LUKS_device_sectors(size_t keyLen, unsigned int stripes)
+/* Get size of struct luks_phdr with all keyslots material space */
+static size_t LUKS_device_sectors(size_t keyLen)
{
- uint64_t keyslot_sectors, sector;
+ size_t keyslot_sectors, sector;
int i;
- keyslot_sectors = div_round_up(keyLen * stripes, SECTOR_SIZE);
- sector = round_up_modulo(LUKS_PHDR_SIZE, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
+ keyslot_sectors = AF_split_sectors(keyLen, LUKS_STRIPES);
+ sector = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE;
for (i = 0; i < LUKS_NUMKEYS; i++) {
- sector = round_up_modulo(sector, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
+ sector = size_round_up(sector, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
sector += keyslot_sectors;
}
return sector;
}
-static int LUKS_check_device_size(const char *device,
- uint64_t min_sectors,
- size_t keyLength)
+int LUKS_keyslot_area(struct luks_phdr *hdr,
+ int keyslot,
+ uint64_t *offset,
+ uint64_t *length)
+{
+ if(keyslot >= LUKS_NUMKEYS || keyslot < 0)
+ return -EINVAL;
+
+ *offset = hdr->keyblock[keyslot].keyMaterialOffset * SECTOR_SIZE;
+ *length = AF_split_sectors(hdr->keyBytes, LUKS_STRIPES) * SECTOR_SIZE;
+
+ return 0;
+}
+
+static int LUKS_check_device_size(struct crypt_device *ctx, size_t keyLength)
{
- uint64_t dev_size, req_sectors;
+ struct device *device = crypt_metadata_device(ctx);
+ uint64_t dev_sectors, hdr_sectors;
- req_sectors = LUKS_device_sectors(keyLength, LUKS_STRIPES);
- if (min_sectors > req_sectors)
- req_sectors = min_sectors;
+ if (!keyLength)
+ return -EINVAL;
- if(device_size(device, &dev_size)) {
- log_dbg("Cannot get device size for device %s.", device);
+ if(device_size(device, &dev_sectors)) {
+ log_dbg("Cannot get device size for device %s.", device_path(device));
return -EIO;
}
- return (req_sectors > (dev_size >> SECTOR_SHIFT));
+ dev_sectors >>= SECTOR_SHIFT;
+ hdr_sectors = LUKS_device_sectors(keyLength);
+ log_dbg("Key length %u, device size %" PRIu64 " sectors, header size %"
+ PRIu64 " sectors.",keyLength, dev_sectors, hdr_sectors);
+
+ if (hdr_sectors > dev_sectors) {
+ log_err(ctx, _("Device %s is too small.\n"), device_path(device));
+ return -EINVAL;
+ }
+
+ return 0;
}
/* Check keyslot to prevent access outside of header and keyslot area */
uint32_t secs_per_stripes;
/* First sectors is the header itself */
- if (phdr->keyblock[keyIndex].keyMaterialOffset * SECTOR_SIZE < LUKS_ALIGN_KEYSLOTS) {
+ if (phdr->keyblock[keyIndex].keyMaterialOffset * SECTOR_SIZE < sizeof(*phdr)) {
log_dbg("Invalid offset %u in keyslot %u.",
phdr->keyblock[keyIndex].keyMaterialOffset, keyIndex);
return 1;
return 1;
}
- secs_per_stripes = div_round_up(phdr->keyBytes * phdr->keyblock[keyIndex].stripes, SECTOR_SIZE);
+ secs_per_stripes = AF_split_sectors(phdr->keyBytes, phdr->keyblock[keyIndex].stripes);
if (phdr->payloadOffset < (phdr->keyblock[keyIndex].keyMaterialOffset + secs_per_stripes)) {
log_dbg("Invalid keyslot size %u (offset %u, stripes %u) in "
int LUKS_hdr_backup(
const char *backup_file,
- const char *device,
struct luks_phdr *hdr,
struct crypt_device *ctx)
{
+ struct device *device = crypt_metadata_device(ctx);
int r = 0, devfd = -1;
ssize_t buffer_size;
char *buffer = NULL;
return -EINVAL;
}
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(hdr, 1, 0, ctx);
if (r)
return r;
- buffer_size = hdr->payloadOffset << SECTOR_SHIFT;
+ buffer_size = LUKS_device_sectors(hdr->keyBytes) << SECTOR_SHIFT;
buffer = crypt_safe_alloc(buffer_size);
if (!buffer || buffer_size < LUKS_ALIGN_KEYSLOTS) {
r = -ENOMEM;
log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes).",
sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS);
- devfd = open(device, O_RDONLY | O_DIRECT | O_SYNC);
+ devfd = open(device_path(device), O_RDONLY | O_DIRECT | O_SYNC);
if(devfd == -1) {
- log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
+ log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device_path(device));
r = -EINVAL;
goto out;
}
- if(read_blockwise(devfd, buffer, buffer_size) < buffer_size) {
+ if(read_blockwise(devfd, device_block_size(device), buffer, buffer_size) < buffer_size) {
r = -EIO;
goto out;
}
close(devfd);
/* Wipe unused area, so backup cannot contain old signatures */
- memset(buffer + sizeof(*hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(*hdr));
+ if (hdr->keyblock[0].keyMaterialOffset * SECTOR_SIZE == LUKS_ALIGN_KEYSLOTS)
+ memset(buffer + sizeof(*hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(*hdr));
devfd = creat(backup_file, S_IRUSR);
if(devfd == -1) {
int LUKS_hdr_restore(
const char *backup_file,
- const char *device,
struct luks_phdr *hdr,
struct crypt_device *ctx)
{
+ struct device *device = crypt_metadata_device(ctx);
int r = 0, devfd = -1, diff_uuid = 0;
- ssize_t buffer_size;
+ ssize_t buffer_size = 0;
char *buffer = NULL, msg[200];
struct stat st;
struct luks_phdr hdr_file;
return -EINVAL;
}
- r = LUKS_read_phdr_backup(backup_file, device, &hdr_file, 0, ctx);
- buffer_size = hdr_file.payloadOffset << SECTOR_SHIFT;
+ r = LUKS_read_phdr_backup(backup_file, &hdr_file, 0, ctx);
+ if (!r)
+ buffer_size = LUKS_device_sectors(hdr_file.keyBytes) << SECTOR_SHIFT;
if (r || buffer_size < LUKS_ALIGN_KEYSLOTS) {
log_err(ctx, _("Backup file doesn't contain valid LUKS header.\n"));
}
close(devfd);
- r = LUKS_read_phdr(device, hdr, 0, ctx);
+ r = LUKS_read_phdr(hdr, 0, 0, ctx);
if (r == 0) {
- log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device);
+ log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device_path(device));
if(hdr->payloadOffset != hdr_file.payloadOffset ||
hdr->keyBytes != hdr_file.keyBytes) {
log_err(ctx, _("Data offset or key size differs on device and backup, restore failed.\n"));
diff_uuid = 1;
}
- if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device,
+ if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device_path(device),
r ? _("does not contain LUKS header. Replacing header can destroy data on that device.") :
_("already contains LUKS header. Replacing header will destroy existing keyslots."),
diff_uuid ? _("\nWARNING: real device header has different UUID than backup!") : "") < 0) {
}
log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes) to device %s.",
- sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device);
+ sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device_path(device));
- devfd = open(device, O_WRONLY | O_DIRECT | O_SYNC);
+ devfd = open(device_path(device), O_WRONLY | O_DIRECT | O_SYNC);
if(devfd == -1) {
- log_err(ctx, _("Cannot open device %s.\n"), device);
+ if (errno == EACCES)
+ log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
+ device_path(device));
+ else
+ log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
r = -EINVAL;
goto out;
}
- if(write_blockwise(devfd, buffer, buffer_size) < buffer_size) {
+ if (write_blockwise(devfd, device_block_size(device), buffer, buffer_size) < buffer_size) {
r = -EIO;
goto out;
}
close(devfd);
/* Be sure to reload new data */
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(hdr, 1, 0, ctx);
out:
if (devfd != -1)
close(devfd);
return r;
}
+/* This routine should do some just basic recovery for known problems. */
+static int _keyslot_repair(struct luks_phdr *phdr, struct crypt_device *ctx)
+{
+ struct luks_phdr temp_phdr;
+ const unsigned char *sector = (const unsigned char*)phdr;
+ struct volume_key *vk;
+ uint64_t PBKDF2_per_sec = 1;
+ int i, bad, r, need_write = 0;
+
+ if (phdr->keyBytes != 16 && phdr->keyBytes != 32) {
+ log_err(ctx, _("Non standard key size, manual repair required.\n"));
+ return -EINVAL;
+ }
+ /* cryptsetup 1.0 did not align to 4k, cannot repair this one */
+ if (phdr->keyblock[0].keyMaterialOffset < (LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE)) {
+ log_err(ctx, _("Non standard keyslots alignment, manual repair required.\n"));
+ return -EINVAL;
+ }
+
+ vk = crypt_alloc_volume_key(phdr->keyBytes, NULL);
+
+ log_verbose(ctx, _("Repairing keyslots.\n"));
+
+ log_dbg("Generating second header with the same parameters for check.");
+ /* cipherName, cipherMode, hashSpec, uuid are already null terminated */
+ /* payloadOffset - cannot check */
+ r = LUKS_generate_phdr(&temp_phdr, vk, phdr->cipherName, phdr->cipherMode,
+ phdr->hashSpec,phdr->uuid, LUKS_STRIPES,
+ phdr->payloadOffset, 0,
+ 1, &PBKDF2_per_sec,
+ 1, ctx);
+ if (r < 0) {
+ log_err(ctx, _("Repair failed."));
+ goto out;
+ }
+
+ for(i = 0; i < LUKS_NUMKEYS; ++i) {
+ if (phdr->keyblock[i].active == LUKS_KEY_ENABLED) {
+ log_dbg("Skipping repair for active keyslot %i.", i);
+ continue;
+ }
+
+ bad = 0;
+ if (phdr->keyblock[i].keyMaterialOffset != temp_phdr.keyblock[i].keyMaterialOffset) {
+ log_err(ctx, _("Keyslot %i: offset repaired (%u -> %u).\n"), i,
+ (unsigned)phdr->keyblock[i].keyMaterialOffset,
+ (unsigned)temp_phdr.keyblock[i].keyMaterialOffset);
+ phdr->keyblock[i].keyMaterialOffset = temp_phdr.keyblock[i].keyMaterialOffset;
+ bad = 1;
+ }
+
+ if (phdr->keyblock[i].stripes != temp_phdr.keyblock[i].stripes) {
+ log_err(ctx, _("Keyslot %i: stripes repaired (%u -> %u).\n"), i,
+ (unsigned)phdr->keyblock[i].stripes,
+ (unsigned)temp_phdr.keyblock[i].stripes);
+ phdr->keyblock[i].stripes = temp_phdr.keyblock[i].stripes;
+ bad = 1;
+ }
+
+ /* Known case - MSDOS partition table signature */
+ if (i == 6 && sector[0x1fe] == 0x55 && sector[0x1ff] == 0xaa) {
+ log_err(ctx, _("Keyslot %i: bogus partition signature.\n"), i);
+ bad = 1;
+ }
+
+ if(bad) {
+ log_err(ctx, _("Keyslot %i: salt wiped.\n"), i);
+ phdr->keyblock[i].active = LUKS_KEY_DISABLED;
+ memset(&phdr->keyblock[i].passwordSalt, 0x00, LUKS_SALTSIZE);
+ phdr->keyblock[i].passwordIterations = 0;
+ }
+
+ if (bad)
+ need_write = 1;
+ }
+
+ if (need_write) {
+ log_verbose(ctx, _("Writing LUKS header to disk.\n"));
+ r = LUKS_write_phdr(phdr, ctx);
+ }
+out:
+ crypt_free_volume_key(vk);
+ memset(&temp_phdr, 0, sizeof(temp_phdr));
+ return r;
+}
+
static int _check_and_convert_hdr(const char *device,
struct luks_phdr *hdr,
int require_luks_device,
+ int repair,
struct crypt_device *ctx)
{
int r = 0;
log_dbg("LUKS header not detected.");
if (require_luks_device)
log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
- r = -EINVAL;
+ return -EINVAL;
} else if((hdr->version = ntohs(hdr->version)) != 1) { /* Convert every uint16/32_t item from network byte order */
log_err(ctx, _("Unsupported LUKS version %d.\n"), hdr->version);
- r = -EINVAL;
- } else if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
+ return -EINVAL;
+ }
+
+ hdr->hashSpec[LUKS_HASHSPEC_L - 1] = '\0';
+ if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
log_err(ctx, _("Requested LUKS hash %s is not supported.\n"), hdr->hashSpec);
- r = -EINVAL;
- } else {
- hdr->payloadOffset = ntohl(hdr->payloadOffset);
- hdr->keyBytes = ntohl(hdr->keyBytes);
- hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
-
- for(i = 0; i < LUKS_NUMKEYS; ++i) {
- hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
- hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
- hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
- hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
- if (LUKS_check_keyslot_size(hdr, i)) {
- log_err(ctx, _("LUKS keyslot %u is invalid.\n"), i);
- // FIXME: allow header recovery
- r = -EINVAL;
- }
+ return -EINVAL;
+ }
+
+ /* Header detected */
+ hdr->payloadOffset = ntohl(hdr->payloadOffset);
+ hdr->keyBytes = ntohl(hdr->keyBytes);
+ hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
+
+ for(i = 0; i < LUKS_NUMKEYS; ++i) {
+ hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
+ hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
+ hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
+ hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
+ if (LUKS_check_keyslot_size(hdr, i)) {
+ log_err(ctx, _("LUKS keyslot %u is invalid.\n"), i);
+ r = -EINVAL;
}
+ }
+
+ /* Avoid unterminated strings */
+ hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0';
+ hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0';
+ hdr->uuid[UUID_STRING_L - 1] = '\0';
- /* Avoid unterminated strings */
- hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0';
- hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0';
- hdr->uuid[UUID_STRING_L - 1] = '\0';
+ if (repair) {
+ if (r == -EINVAL)
+ r = _keyslot_repair(hdr, ctx);
+ else
+ log_verbose(ctx, _("No known problems detected for LUKS header.\n"));
}
return r;
}
int LUKS_read_phdr_backup(const char *backup_file,
- const char *device,
struct luks_phdr *hdr,
int require_luks_device,
struct crypt_device *ctx)
devfd = open(backup_file, O_RDONLY);
if(-1 == devfd) {
- log_err(ctx, _("Cannot open file %s.\n"), device);
+ log_err(ctx, _("Cannot open file %s.\n"), backup_file);
return -EINVAL;
}
r = -EIO;
else {
LUKS_fix_header_compatible(hdr);
- r = _check_and_convert_hdr(backup_file, hdr, require_luks_device, ctx);
+ r = _check_and_convert_hdr(backup_file, hdr,
+ require_luks_device, 0, ctx);
}
close(devfd);
return r;
}
-int LUKS_read_phdr(const char *device,
- struct luks_phdr *hdr,
+int LUKS_read_phdr(struct luks_phdr *hdr,
int require_luks_device,
+ int repair,
struct crypt_device *ctx)
{
+ struct device *device = crypt_metadata_device(ctx);
ssize_t hdr_size = sizeof(struct luks_phdr);
int devfd = 0, r = 0;
+ /* LUKS header starts at offset 0, first keyslot on LUKS_ALIGN_KEYSLOTS */
+ assert(sizeof(struct luks_phdr) <= LUKS_ALIGN_KEYSLOTS);
+
+ /* Stripes count cannot be changed without additional code fixes yet */
+ assert(LUKS_STRIPES == 4000);
+
+ if (repair && !require_luks_device)
+ return -EINVAL;
+
log_dbg("Reading LUKS header of size %d from device %s",
- hdr_size, device);
+ hdr_size, device_path(device));
- devfd = open(device,O_RDONLY | O_DIRECT | O_SYNC);
- if(-1 == devfd) {
- log_err(ctx, _("Cannot open device %s.\n"), device);
+ devfd = open(device_path(device), O_RDONLY | O_DIRECT | O_SYNC);
+ if (devfd == -1) {
+ log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
return -EINVAL;
}
- if (read_blockwise(devfd, hdr, hdr_size) < hdr_size)
+ if (read_blockwise(devfd, device_block_size(device), hdr, hdr_size) < hdr_size)
r = -EIO;
else
- r = _check_and_convert_hdr(device, hdr, require_luks_device, ctx);
+ r = _check_and_convert_hdr(device_path(device), hdr, require_luks_device,
+ repair, ctx);
+
+ if (!r)
+ r = LUKS_check_device_size(ctx, hdr->keyBytes);
close(devfd);
return r;
}
-int LUKS_write_phdr(const char *device,
- struct luks_phdr *hdr,
+int LUKS_write_phdr(struct luks_phdr *hdr,
struct crypt_device *ctx)
{
+ struct device *device = crypt_metadata_device(ctx);
ssize_t hdr_size = sizeof(struct luks_phdr);
int devfd = 0;
unsigned int i;
int r;
log_dbg("Updating LUKS header of size %d on device %s",
- sizeof(struct luks_phdr), device);
+ sizeof(struct luks_phdr), device_path(device));
- if (LUKS_check_device_size(device, hdr->payloadOffset, hdr->keyBytes)) {
- log_err(ctx, _("Device %s is too small.\n"), device);
- return -EINVAL;
- }
+ r = LUKS_check_device_size(ctx, hdr->keyBytes);
+ if (r)
+ return r;
- devfd = open(device,O_RDWR | O_DIRECT | O_SYNC);
+ devfd = open(device_path(device), O_RDWR | O_DIRECT | O_SYNC);
if(-1 == devfd) {
- log_err(ctx, _("Cannot open device %s.\n"), device);
+ if (errno == EACCES)
+ log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
+ device_path(device));
+ else
+ log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
return -EINVAL;
}
convHdr.keyblock[i].stripes = htonl(hdr->keyblock[i].stripes);
}
- r = write_blockwise(devfd, &convHdr, hdr_size) < hdr_size ? -EIO : 0;
+ r = write_blockwise(devfd, device_block_size(device), &convHdr, hdr_size) < hdr_size ? -EIO : 0;
if (r)
- log_err(ctx, _("Error during update of LUKS header on device %s.\n"), device);
+ log_err(ctx, _("Error during update of LUKS header on device %s.\n"), device_path(device));
close(devfd);
/* Re-read header from disk to be sure that in-memory and on-disk data are the same. */
if (!r) {
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(hdr, 1, 0, ctx);
if (r)
- log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"), device);
+ log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"),
+ device_path(device));
}
return r;
unsigned int alignOffset,
uint32_t iteration_time_ms,
uint64_t *PBKDF2_per_sec,
- const char *metadata_device,
+ int detached_metadata_device,
struct crypt_device *ctx)
{
unsigned int i=0;
- unsigned int blocksPerStripeSet = div_round_up(vk->keylength*stripes,SECTOR_SIZE);
+ size_t blocksPerStripeSet, currentSector;
int r;
uuid_t partitionUuid;
- int currentSector;
char luksMagic[] = LUKS_MAGIC;
/* For separate metadata device allow zero alignment */
- if (alignPayload == 0 && !metadata_device)
+ if (alignPayload == 0 && !detached_metadata_device)
alignPayload = DEFAULT_DISK_ALIGNMENT / SECTOR_SIZE;
if (PBKDF2_HMAC_ready(hashSpec) < 0) {
header->version, header->hashSpec ,header->cipherName, header->cipherMode,
header->keyBytes);
- r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_NORMAL);
+ r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_SALT);
if(r < 0) {
log_err(ctx, _("Cannot create LUKS header: reading random salt failed.\n"));
return r;
return r;
}
- currentSector = round_up_modulo(LUKS_PHDR_SIZE, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
+ currentSector = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE;
+ blocksPerStripeSet = AF_split_sectors(vk->keylength, stripes);
for(i = 0; i < LUKS_NUMKEYS; ++i) {
header->keyblock[i].active = LUKS_KEY_DISABLED;
header->keyblock[i].keyMaterialOffset = currentSector;
header->keyblock[i].stripes = stripes;
- currentSector = round_up_modulo(currentSector + blocksPerStripeSet,
+ currentSector = size_round_up(currentSector + blocksPerStripeSet,
LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
}
- if (metadata_device) {
+ if (detached_metadata_device) {
/* for separate metadata device use alignPayload directly */
header->payloadOffset = alignPayload;
} else {
/* alignOffset - offset from natural device alignment provided by topology info */
- currentSector = round_up_modulo(currentSector, alignPayload);
+ currentSector = size_round_up(currentSector, alignPayload);
header->payloadOffset = currentSector + alignOffset;
}
}
int LUKS_hdr_uuid_set(
- const char *device,
struct luks_phdr *hdr,
const char *uuid,
struct crypt_device *ctx)
uuid_unparse(partitionUuid, hdr->uuid);
- return LUKS_write_phdr(device, hdr, ctx);
+ return LUKS_write_phdr(hdr, ctx);
}
-int LUKS_set_key(const char *device, unsigned int keyIndex,
+int LUKS_set_key(unsigned int keyIndex,
const char *password, size_t passwordLen,
struct luks_phdr *hdr, struct volume_key *vk,
uint32_t iteration_time_ms,
{
struct volume_key *derived_key;
char *AfKey = NULL;
- unsigned int AFEKSize;
+ size_t AFEKSize;
uint64_t PBKDF2_temp;
int r;
return -EINVAL;
}
- if(hdr->keyblock[keyIndex].stripes < LUKS_STRIPES) {
+ /* LUKS keyslot has always at least 4000 stripes accoding to specification */
+ if(hdr->keyblock[keyIndex].stripes < 4000) {
log_err(ctx, _("Key slot %d material includes too few stripes. Header manipulation?\n"),
keyIndex);
return -EINVAL;
return -ENOMEM;
r = crypt_random_get(ctx, hdr->keyblock[keyIndex].passwordSalt,
- LUKS_SALTSIZE, CRYPT_RND_NORMAL);
+ LUKS_SALTSIZE, CRYPT_RND_SALT);
if (r < 0)
- return r;
+ goto out;
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
* AF splitting, the masterkey stored in vk->key is split to AfKey
*/
assert(vk->keylength == hdr->keyBytes);
- AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
+ AFEKSize = AF_split_sectors(vk->keylength, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE;
AfKey = crypt_safe_alloc(AFEKSize);
if (!AfKey) {
r = -ENOMEM;
if (r < 0)
goto out;
- log_dbg("Updating key slot %d [0x%04x] area on device %s.", keyIndex,
- hdr->keyblock[keyIndex].keyMaterialOffset << 9, device);
+ log_dbg("Updating key slot %d [0x%04x] area.", keyIndex,
+ hdr->keyblock[keyIndex].keyMaterialOffset << 9);
/* Encryption via dm */
r = LUKS_encrypt_to_storage(AfKey,
AFEKSize,
hdr,
derived_key,
- device,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);
- if (r < 0) {
- log_err(ctx, _("Failed to write to key storage.\n"));
+ if (r < 0)
goto out;
- }
/* Mark the key as active in phdr */
r = LUKS_keyslot_set(hdr, (int)keyIndex, 1);
if (r < 0)
goto out;
- r = LUKS_write_phdr(device, hdr, ctx);
+ r = LUKS_write_phdr(hdr, ctx);
if (r < 0)
goto out;
}
/* Try to open a particular key slot */
-static int LUKS_open_key(const char *device,
- unsigned int keyIndex,
+static int LUKS_open_key(unsigned int keyIndex,
const char *password,
size_t passwordLen,
struct luks_phdr *hdr,
return -ENOMEM;
assert(vk->keylength == hdr->keyBytes);
- AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
+ AFEKSize = AF_split_sectors(vk->keylength, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE;
AfKey = crypt_safe_alloc(AFEKSize);
- if (!AfKey)
- return -ENOMEM;
+ if (!AfKey) {
+ r = -ENOMEM;
+ goto out;
+ }
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
AFEKSize,
hdr,
derived_key,
- device,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);
- if (r < 0) {
- log_err(ctx, _("Failed to read from key storage.\n"));
+ if (r < 0)
goto out;
- }
r = AF_merge(AfKey,vk->key,vk->keylength,hdr->keyblock[keyIndex].stripes,hdr->hashSpec);
if (r < 0)
return r;
}
-int LUKS_open_key_with_hdr(const char *device,
- int keyIndex,
+int LUKS_open_key_with_hdr(int keyIndex,
const char *password,
size_t passwordLen,
struct luks_phdr *hdr,
*vk = crypt_alloc_volume_key(hdr->keyBytes, NULL);
if (keyIndex >= 0) {
- r = LUKS_open_key(device, keyIndex, password, passwordLen, hdr, *vk, ctx);
+ r = LUKS_open_key(keyIndex, password, passwordLen, hdr, *vk, ctx);
return (r < 0) ? r : keyIndex;
}
for(i = 0; i < LUKS_NUMKEYS; i++) {
- r = LUKS_open_key(device, i, password, passwordLen, hdr, *vk, ctx);
+ r = LUKS_open_key(i, password, passwordLen, hdr, *vk, ctx);
if(r == 0)
return i;
return -EPERM;
}
-int LUKS_del_key(const char *device,
- unsigned int keyIndex,
+int LUKS_del_key(unsigned int keyIndex,
struct luks_phdr *hdr,
struct crypt_device *ctx)
{
- unsigned int startOffset, endOffset, stripesLen;
+ struct device *device = crypt_metadata_device(ctx);
+ unsigned int startOffset, endOffset;
int r;
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(hdr, 1, 0, ctx);
if (r)
return r;
/* secure deletion of key material */
startOffset = hdr->keyblock[keyIndex].keyMaterialOffset;
- stripesLen = hdr->keyBytes * hdr->keyblock[keyIndex].stripes;
- endOffset = startOffset + div_round_up(stripesLen, SECTOR_SIZE);
+ endOffset = startOffset + AF_split_sectors(hdr->keyBytes, hdr->keyblock[keyIndex].stripes);
r = crypt_wipe(device, startOffset * SECTOR_SIZE,
(endOffset - startOffset) * SECTOR_SIZE,
CRYPT_WIPE_DISK, 0);
if (r) {
- log_err(ctx, _("Cannot wipe device %s.\n"), device);
+ if (r == -EACCES) {
+ log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
+ device_path(device));
+ r = -EINVAL;
+ } else
+ log_err(ctx, _("Cannot wipe device %s.\n"),
+ device_path(device));
return r;
}
memset(&hdr->keyblock[keyIndex].passwordSalt, 0, LUKS_SALTSIZE);
hdr->keyblock[keyIndex].passwordIterations = 0;
- r = LUKS_write_phdr(device, hdr, ctx);
+ r = LUKS_write_phdr(hdr, ctx);
return r;
}
{
int r;
char *dm_cipher = NULL;
+ enum devcheck device_check;
struct crypt_dm_active_device dmd = {
- .device = crypt_get_device_name(cd),
- .cipher = NULL,
+ .target = DM_CRYPT,
.uuid = crypt_get_uuid(cd),
- .vk = vk,
- .offset = crypt_get_data_offset(cd),
- .iv_offset = 0,
+ .flags = flags,
.size = 0,
- .flags = flags
+ .data_device = crypt_data_device(cd),
+ .u.crypt = {
+ .cipher = NULL,
+ .vk = vk,
+ .offset = crypt_get_data_offset(cd),
+ .iv_offset = 0,
+ }
};
- r = device_check_and_adjust(cd, dmd.device, DEV_EXCL,
- &dmd.size, &dmd.offset, &flags);
+ if (dmd.flags & CRYPT_ACTIVATE_SHARED)
+ device_check = DEV_SHARED;
+ else
+ device_check = DEV_EXCL;
+
+ r = device_block_adjust(cd, dmd.data_device, device_check,
+ dmd.u.crypt.offset, &dmd.size, &dmd.flags);
if (r)
return r;
if (r < 0)
return -ENOMEM;
- dmd.cipher = dm_cipher;
- r = dm_create_device(name, CRYPT_LUKS1, &dmd, 0);
+ dmd.u.crypt.cipher = dm_cipher;
+ r = dm_create_device(cd, name, CRYPT_LUKS1, &dmd, 0);
free(dm_cipher);
return r;
projects / platform / upstream / cryptsetup.git / blobdiff