Add new DEK to encrypt database.

Database mustn't be encrypted with user Domain KEK so we need to
generate special DEK for database.

Change-Id: I9de405c44ed3a17eb11e70255962b908e199ae0d

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index 51bb6f4..bedabd7 100755 (executable)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -58,16 +58,23 @@ RawBuffer CKMLogic::unlockUserKey(uid_t user, const Password &password) {
         if (0 == m_userDataMap.count(user) || !(m_userDataMap[user].keyProvider.isInitialized())) {
             auto &handle = m_userDataMap[user];
             FileSystem fs(user);
-            auto wrappedDomainKEK = fs.getDomainKEK();
+            auto wrappedDomainKEK = fs.getDKEK();
 
             if (wrappedDomainKEK.empty()) {
                 wrappedDomainKEK = KeyProvider::generateDomainKEK(std::to_string(user), password);
-                fs.saveDomainKEK(wrappedDomainKEK);
+                fs.saveDKEK(wrappedDomainKEK);
             }
 
             handle.keyProvider = KeyProvider(wrappedDomainKEK, password);
 
-            RawBuffer key = handle.keyProvider.getPureDomainKEK();
+            auto wrappedDatabaseDEK = fs.getDBDEK();
+
+            if (wrappedDatabaseDEK.empty()) {
+                wrappedDatabaseDEK = handle.keyProvider.generateDEK(std::to_string(user));
+                fs.saveDBDEK(wrappedDatabaseDEK);
+            }
+
+            RawBuffer key = handle.keyProvider.getPureDEK(wrappedDatabaseDEK);
             handle.database = DBCrypto(fs.getDBPath(), key);
             handle.crypto = CryptoLogic();
             // TODO wipe key
@@ -128,12 +135,12 @@ RawBuffer CKMLogic::changeUserPassword(
     int retCode = CKM_API_SUCCESS;
     try {
         FileSystem fs(user);
-        auto wrappedDomainKEK = fs.getDomainKEK();
+        auto wrappedDomainKEK = fs.getDKEK();
         if (wrappedDomainKEK.empty()) {
             retCode = CKM_API_ERROR_BAD_REQUEST;
         } else {
             wrappedDomainKEK = KeyProvider::reencrypt(wrappedDomainKEK, oldPassword, newPassword);
-            fs.saveDomainKEK(wrappedDomainKEK);
+            fs.saveDKEK(wrappedDomainKEK);
         }
     } catch (const KeyProvider::Exception::PassWordError &e) {
         LogError("Incorrect Password " << e.GetMessage());
@@ -162,7 +169,7 @@ RawBuffer CKMLogic::resetUserPassword(
     } else {
         auto &handler = m_userDataMap[user];
         FileSystem fs(user);
-        fs.saveDomainKEK(handler.keyProvider.getWrappedDomainKEK(newPassword));
+        fs.saveDKEK(handler.keyProvider.getWrappedDomainKEK(newPassword));
     }
 
     MessageBuffer response;

diff --git a/src/manager/service/file-system.cpp b/src/manager/service/file-system.cpp
index c77da10..10301ea 100644 (file)
--- a/src/manager/service/file-system.cpp
+++ b/src/manager/service/file-system.cpp
@@ -36,6 +36,7 @@ namespace {
 
 static const std::string CKM_DATA_PATH = "/opt/data/ckm/";
 static const std::string CKM_KEY_PREFIX = "key-";
+static const std::string CKM_DB_KEY_PREFIX = "db-key-";
 static const std::string CKM_DB_PREFIX = "db-";
 
 } // namespace anonymous
@@ -59,9 +60,18 @@ std::string FileSystem::getDKEKPath() const {
     return ss.str();
 }
 
-RawBuffer FileSystem::getDomainKEK() const
-{
-    std::ifstream is(getDKEKPath());
+std::string FileSystem::getDBDEKPath() const {
+    std::stringstream ss;
+    ss << CKM_DATA_PATH << CKM_DB_KEY_PREFIX << m_uid;
+    return ss.str();
+}
+
+RawBuffer FileSystem::loadFile(const std::string &path) const {
+    std::ifstream is(path);
+
+    if (is.fail())
+        return RawBuffer();
+
     std::istreambuf_iterator<char> begin(is),end;
     std::vector<char> buff(begin,end); // This trick does not work with boost vector
 
@@ -70,13 +80,30 @@ RawBuffer FileSystem::getDomainKEK() const
     return buffer;
 }
 
-bool FileSystem::saveDomainKEK(const RawBuffer &buffer) const
+RawBuffer FileSystem::getDKEK() const
+{
+    return loadFile(getDKEKPath());
+}
+
+RawBuffer FileSystem::getDBDEK() const
 {
-    std::ofstream os(getDKEKPath(), std::ios::out | std::ofstream::binary);
+    return loadFile(getDBDEKPath());
+}
+
+bool FileSystem::saveFile(const std::string &path, const RawBuffer &buffer) const {
+    std::ofstream os(path, std::ios::out | std::ofstream::binary);
     std::copy(buffer.begin(), buffer.end(), std::ostreambuf_iterator<char>(os));
     return !os.fail();
 }
 
+bool FileSystem::saveDKEK(const RawBuffer &buffer) const {
+    return saveFile(getDKEKPath(), buffer);
+}
+
+bool FileSystem::saveDBDEK(const RawBuffer &buffer) const {
+    return saveFile(getDBDEKPath(), buffer);
+}
+
 int FileSystem::init() {
     errno = 0;
     if ((mkdir(CKM_DATA_PATH.c_str(), 0700)) && (errno != EEXIST)) {
@@ -90,18 +117,28 @@ int FileSystem::init() {
 
 int FileSystem::removeUserData() const {
     int err, retCode = 0;
+
     if (unlink(getDBPath().c_str())) {
         retCode = -1;
         err = errno;
         LogError("Error in unlink user database: " << getDBPath()
             << "Errno: " << errno << " " << strerror(err));
     }
+
     if (unlink(getDKEKPath().c_str())) {
         retCode = -1;
         err = errno;
         LogError("Error in unlink user DKEK: " << getDKEKPath()
             << "Errno: " << errno << " " << strerror(err));
     }
+
+    if (unlink(getDBDEKPath().c_str())) {
+        retCode = -1;
+        err = errno;
+        LogError("Error in unlink user DBDEK: " << getDBDEKPath()
+            << "Errno: " << errno << " " << strerror(err));
+    }
+
     return retCode;
 }
 

diff --git a/src/manager/service/file-system.h b/src/manager/service/file-system.h
index 197cc96..5e1c06a 100644 (file)
--- a/src/manager/service/file-system.h
+++ b/src/manager/service/file-system.h
@@ -31,8 +31,15 @@ public:
     FileSystem(uid_t uid);
 
     std::string getDBPath() const;
-    RawBuffer getDomainKEK() const;
-    bool saveDomainKEK(const RawBuffer &buffer) const;
+
+    // Domain Key Encryption Key
+    RawBuffer getDKEK() const;
+    bool saveDKEK(const RawBuffer &buffer) const;
+
+    // Database Data Encryption Key
+    RawBuffer getDBDEK() const;
+    bool saveDBDEK(const RawBuffer &buffer) const;
+
     int removeUserData() const;
 
     static int init();
@@ -40,6 +47,9 @@ public:
     virtual ~FileSystem(){}
 protected:
     std::string getDKEKPath() const;
+    std::string getDBDEKPath() const;
+    RawBuffer loadFile(const std::string &path) const;
+    bool saveFile(const std::string &path, const RawBuffer &buffer) const;
 
     uid_t m_uid;
 };