#include "verity.h"
#include "internal.h"
-static unsigned get_bits_up(unsigned u)
+static unsigned get_bits_up(size_t u)
{
unsigned i = 0;
while ((1 << i) < u)
return i;
}
-static unsigned get_bits_down(unsigned u)
+static unsigned get_bits_down(size_t u)
{
unsigned i = 0;
while ((u >> i) > 1)
return i;
}
-static int verify_zero(struct crypt_device *cd, FILE *wr, unsigned bytes)
+static int verify_zero(struct crypt_device *cd, FILE *wr, size_t bytes)
{
- unsigned i;
char block[bytes];
+ size_t i;
if (fread(block, bytes, 1, wr) != 1)
return -EIO;
for (i = 0; i < bytes; i++)
if (block[i]) {
- log_err(cd, "spare area is not zeroed at position %lld\n",
- (long long)ftello(wr) - bytes);
+ log_err(cd, _("Spare area is not zeroed at position %" PRIu64 ".\n"),
+ ftello(wr) - bytes);
return -EPERM;
}
return 0;
}
static int create_or_verify(struct crypt_device *cd, FILE *rd, FILE *wr,
- off_t data_block, int data_block_size,
- off_t hash_block, int hash_block_size,
+ off_t data_block, size_t data_block_size,
+ off_t hash_block, size_t hash_block_size,
off_t blocks, int version,
const char *hash_name, int verify,
- char *calculated_digest, unsigned digest_size,
- const char *salt, unsigned salt_size)
+ char *calculated_digest, size_t digest_size,
+ const char *salt, size_t salt_size)
{
char left_block[hash_block_size];
char data_buffer[data_block_size];
char read_digest[digest_size];
- off_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
+ size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
+ size_t digest_size_full = 1 << get_bits_up(digest_size);
off_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block;
- unsigned i, left_bytes;
- off_t digest_size_full = 1 << get_bits_up(digest_size);
- int r;
- unsigned long long pos_rd = (unsigned long long)data_block * data_block_size;
- unsigned long long pos_wr = (unsigned long long)hash_block * hash_block_size;
+ size_t left_bytes;
+ int i, r;
- if (fseeko(rd, pos_rd, SEEK_SET))
+ if (fseeko(rd, data_block * data_block_size, SEEK_SET))
return -EIO;
- if (wr && fseeko(wr, pos_wr, SEEK_SET))
+ if (wr && fseeko(wr, hash_block * hash_block_size, SEEK_SET))
return -EIO;
memset(left_block, 0, hash_block_size);
if (fread(read_digest, digest_size, 1, wr) != 1)
return -EIO;
if (memcmp(read_digest, calculated_digest, digest_size)) {
- log_err(cd, "verification failed at position %lld\n",
- (long long)ftello(rd) - data_block_size);
+ log_err(cd, _("Verification failed at position %" PRIu64 ".\n"),
+ ftello(rd) - data_block_size);
return -EPERM;
}
} else {
const char *hash_name,
const char *hash_device,
const char *data_device,
- int hash_block_size,
- int data_block_size,
+ size_t hash_block_size,
+ size_t data_block_size,
off_t data_blocks,
- long long hash_position,
+ off_t hash_position,
char *root_hash,
- unsigned digest_size,
+ size_t digest_size,
const char *salt,
- unsigned salt_size)
+ size_t salt_size)
{
- static FILE *data_file = NULL;
- static FILE *hash_file = NULL, *hash_file_2;
-
- int i, r;
char calculated_digest[digest_size];
+ FILE *data_file = NULL;
+ FILE *hash_file = NULL, *hash_file_2;
off_t hash_level_block[VERITY_MAX_LEVELS];
off_t hash_level_size[VERITY_MAX_LEVELS];
- off_t data_file_blocks;
+ off_t data_file_blocks, s;
+ size_t hash_per_block, hash_per_block_bits;
uint64_t data_device_size;
- unsigned long long hash_per_block, hash_per_block_bits;
- unsigned levels;
+ int levels, i, r;
- log_dbg("Userspace hash %s %s, data device %s, data blocks %u, hash device %s, offset %u.",
- verify ? "verification" : "creation", hash_name, data_device,
- (unsigned)data_blocks, hash_device, (unsigned)hash_position);
+ log_dbg("Hash %s %s, data device %s, data blocks %" PRIu64
+ ", hash_device %s, offset %" PRIu64 ".",
+ verify ? "verification" : "creation", hash_name,
+ data_device, data_blocks, hash_device, hash_position);
if (!data_blocks) {
r = device_size(data_device, &data_device_size);
hash_per_block_bits = get_bits_down(hash_block_size / digest_size);
hash_per_block = 1 << hash_per_block_bits;
- if (!hash_per_block_bits) {
- log_err(cd, "at least two hashes must fit in a hash file block\n");
+ if (!hash_per_block_bits)
return -EINVAL;
- }
levels = 0;
if (data_file_blocks) {
while (hash_per_block_bits * levels < 64 &&
- (unsigned long long)(data_file_blocks - 1) >>
- (hash_per_block_bits * levels))
+ (data_file_blocks - 1) >> (hash_per_block_bits * levels))
levels++;
}
if (levels > VERITY_MAX_LEVELS) {
- log_err(cd, "too many tree levels\n");
+ log_err(cd, _("Too many tree levels for verity volume.\n"));
return -EINVAL;
}
for (i = levels - 1; i >= 0; i--) {
- off_t s;
hash_level_block[i] = hash_position;
// verity position of block data_file_blocks at level i
s = data_file_blocks >> (i * hash_per_block_bits);
s = (s + hash_per_block - 1) / hash_per_block;
hash_level_size[i] = s;
if (hash_position + s < hash_position ||
- (off_t)(hash_position + s) < 0 ||
- (off_t)(hash_position + s) != hash_position + s) {
- log_err(cd, "hash device offset overflow\n");
+ (hash_position + s) < 0 ||
+ (hash_position + s) != hash_position + s) {
+ log_dbg("Hash device offset overflow.");
return -EINVAL;
}
hash_position += s;
data_file = fopen(data_device, "r");
if (!data_file) {
- log_err(cd, "Cannot open %s.\n", data_device);
+ log_err(cd, _("Cannot open device %s.\n"), data_device);
r = -EIO;
goto out;
}
hash_file = fopen(hash_device, verify ? "r" : "r+");
if (!hash_file) {
- log_err(cd, "Cannot open %s.\n", hash_device);
+ log_err(cd, _("Cannot open device %s.\n"), hash_device);
r = -EIO;
goto out;
}
data_file_blocks, version, hash_name, verify,
calculated_digest, digest_size, salt, salt_size);
- if (r) {
- log_err(cd, "Hash of data area verification failed.\n");
+ if (r == -EPERM) {
+ log_err(cd, _("Verification of data area failed.\n"));
goto out;
- } else
- log_dbg("Hash of data area successfully verified.");
+ } else if (!r)
+ log_dbg("Verification of data area succeeded.");
/* root hash verification */
if (verify) {
r = memcmp(root_hash, calculated_digest, digest_size) ? -EPERM : 0;
if (r)
- log_err(cd, "Root hash verification failed.\n");
+ log_err(cd, _("Verification of root hash failed.\n"));
else
- log_dbg("Root hash successfully verified.");
+ log_dbg("Verification of root hash succeeded.");
} else {
fsync(fileno(hash_file));
memcpy(root_hash, calculated_digest, digest_size);
const char *root_hash,
size_t root_hash_size)
{
- int r = VERITY_create_or_verify_hash(cd, 1,
- verity_hdr->version,
+ return VERITY_create_or_verify_hash(cd, 1,
+ verity_hdr->hash_type,
verity_hdr->hash_name,
hash_device,
data_device,
root_hash_size,
verity_hdr->salt,
verity_hdr->salt_size);
-
- if (r == -EPERM)
- log_err(cd, "Userspace hash verification failed.\n");
-
- return r;
}
+/* Create verity hash */
int VERITY_create(struct crypt_device *cd,
struct crypt_params_verity *verity_hdr,
const char *data_device,
char *root_hash,
size_t root_hash_size)
{
- if (verity_hdr->salt_size > VERITY_MAX_SALT_SIZE)
+ int pgsize = crypt_getpagesize();
+
+ if (verity_hdr->salt_size > 256)
return -EINVAL;
+ if (verity_hdr->hash_block_size > pgsize ||
+ verity_hdr->data_block_size > pgsize)
+ log_err(cd, _("WARNING: Kernel cannot activate device if block "
+ "size exceeds page size (%u).\n"), pgsize);
+
return VERITY_create_or_verify_hash(cd, 0,
- verity_hdr->version,
+ verity_hdr->hash_type,
verity_hdr->hash_name,
hash_device,
data_device,
projects / platform / upstream / cryptsetup.git / blobdiff