1 /* 2 * QEMU Crypto block device encryption LUKS format 3 * 4 * Copyright (c) 2015-2016 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "qapi/error.h" 23 #include "qemu/bswap.h" 24 25 #include "crypto/block-luks.h" 26 27 #include "crypto/hash.h" 28 #include "crypto/afsplit.h" 29 #include "crypto/pbkdf.h" 30 #include "crypto/secret.h" 31 #include "crypto/random.h" 32 33 #ifdef CONFIG_UUID 34 #include <uuid/uuid.h> 35 #endif 36 37 #include "qemu/coroutine.h" 38 39 /* 40 * Reference for the LUKS format implemented here is 41 * 42 * docs/on-disk-format.pdf 43 * 44 * in 'cryptsetup' package source code 45 * 46 * This file implements the 1.2.1 specification, dated 47 * Oct 16, 2011. 48 */ 49 50 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS; 51 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader; 52 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot; 53 54 55 /* The following constants are all defined by the LUKS spec */ 56 #define QCRYPTO_BLOCK_LUKS_VERSION 1 57 58 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6 59 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32 60 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32 61 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32 62 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20 63 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32 64 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40 65 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8 66 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000 67 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000 68 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000 69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096 70 71 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD 72 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3 73 74 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL 75 76 static const char qcrypto_block_luks_magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN] = { 77 'L', 'U', 'K', 'S', 0xBA, 0xBE 78 }; 79 80 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap; 81 struct QCryptoBlockLUKSNameMap { 82 const char *name; 83 int id; 84 }; 85 86 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap; 87 struct QCryptoBlockLUKSCipherSizeMap { 88 uint32_t key_bytes; 89 int id; 90 }; 91 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap; 92 struct QCryptoBlockLUKSCipherNameMap { 93 const char *name; 94 const QCryptoBlockLUKSCipherSizeMap *sizes; 95 }; 96 97 98 static const QCryptoBlockLUKSCipherSizeMap 99 qcrypto_block_luks_cipher_size_map_aes[] = { 100 { 16, QCRYPTO_CIPHER_ALG_AES_128 }, 101 { 24, QCRYPTO_CIPHER_ALG_AES_192 }, 102 { 32, QCRYPTO_CIPHER_ALG_AES_256 }, 103 { 0, 0 }, 104 }; 105 106 static const QCryptoBlockLUKSCipherSizeMap 107 qcrypto_block_luks_cipher_size_map_cast5[] = { 108 { 16, QCRYPTO_CIPHER_ALG_CAST5_128 }, 109 { 0, 0 }, 110 }; 111 112 static const QCryptoBlockLUKSCipherSizeMap 113 qcrypto_block_luks_cipher_size_map_serpent[] = { 114 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128 }, 115 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192 }, 116 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256 }, 117 { 0, 0 }, 118 }; 119 120 static const QCryptoBlockLUKSCipherSizeMap 121 qcrypto_block_luks_cipher_size_map_twofish[] = { 122 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128 }, 123 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192 }, 124 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256 }, 125 { 0, 0 }, 126 }; 127 128 static const QCryptoBlockLUKSCipherNameMap 129 qcrypto_block_luks_cipher_name_map[] = { 130 { "aes", qcrypto_block_luks_cipher_size_map_aes }, 131 { "cast5", qcrypto_block_luks_cipher_size_map_cast5 }, 132 { "serpent", qcrypto_block_luks_cipher_size_map_serpent }, 133 { "twofish", qcrypto_block_luks_cipher_size_map_twofish }, 134 }; 135 136 137 /* 138 * This struct is written to disk in big-endian format, 139 * but operated upon in native-endian format. 140 */ 141 struct QCryptoBlockLUKSKeySlot { 142 /* state of keyslot, enabled/disable */ 143 uint32_t active; 144 /* iterations for PBKDF2 */ 145 uint32_t iterations; 146 /* salt for PBKDF2 */ 147 uint8_t salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 148 /* start sector of key material */ 149 uint32_t key_offset; 150 /* number of anti-forensic stripes */ 151 uint32_t stripes; 152 } QEMU_PACKED; 153 154 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot) != 48); 155 156 157 /* 158 * This struct is written to disk in big-endian format, 159 * but operated upon in native-endian format. 160 */ 161 struct QCryptoBlockLUKSHeader { 162 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */ 163 char magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN]; 164 165 /* LUKS version, currently 1 */ 166 uint16_t version; 167 168 /* cipher name specification (aes, etc) */ 169 char cipher_name[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN]; 170 171 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */ 172 char cipher_mode[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN]; 173 174 /* hash specification (sha256, etc) */ 175 char hash_spec[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN]; 176 177 /* start offset of the volume data (in 512 byte sectors) */ 178 uint32_t payload_offset; 179 180 /* Number of key bytes */ 181 uint32_t key_bytes; 182 183 /* master key checksum after PBKDF2 */ 184 uint8_t master_key_digest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 185 186 /* salt for master key PBKDF2 */ 187 uint8_t master_key_salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 188 189 /* iterations for master key PBKDF2 */ 190 uint32_t master_key_iterations; 191 192 /* UUID of the partition in standard ASCII representation */ 193 uint8_t uuid[QCRYPTO_BLOCK_LUKS_UUID_LEN]; 194 195 /* key slots */ 196 QCryptoBlockLUKSKeySlot key_slots[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS]; 197 } QEMU_PACKED; 198 199 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader) != 592); 200 201 202 struct QCryptoBlockLUKS { 203 QCryptoBlockLUKSHeader header; 204 205 /* Cache parsed versions of what's in header fields, 206 * as we can't rely on QCryptoBlock.cipher being 207 * non-NULL */ 208 QCryptoCipherAlgorithm cipher_alg; 209 QCryptoCipherMode cipher_mode; 210 QCryptoIVGenAlgorithm ivgen_alg; 211 QCryptoHashAlgorithm ivgen_hash_alg; 212 QCryptoHashAlgorithm hash_alg; 213 }; 214 215 216 static int qcrypto_block_luks_cipher_name_lookup(const char *name, 217 QCryptoCipherMode mode, 218 uint32_t key_bytes, 219 Error **errp) 220 { 221 const QCryptoBlockLUKSCipherNameMap *map = 222 qcrypto_block_luks_cipher_name_map; 223 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 224 size_t i, j; 225 226 if (mode == QCRYPTO_CIPHER_MODE_XTS) { 227 key_bytes /= 2; 228 } 229 230 for (i = 0; i < maplen; i++) { 231 if (!g_str_equal(map[i].name, name)) { 232 continue; 233 } 234 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 235 if (map[i].sizes[j].key_bytes == key_bytes) { 236 return map[i].sizes[j].id; 237 } 238 } 239 } 240 241 error_setg(errp, "Algorithm %s with key size %d bytes not supported", 242 name, key_bytes); 243 return 0; 244 } 245 246 static const char * 247 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg, 248 Error **errp) 249 { 250 const QCryptoBlockLUKSCipherNameMap *map = 251 qcrypto_block_luks_cipher_name_map; 252 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 253 size_t i, j; 254 for (i = 0; i < maplen; i++) { 255 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 256 if (map[i].sizes[j].id == alg) { 257 return map[i].name; 258 } 259 } 260 } 261 262 error_setg(errp, "Algorithm '%s' not supported", 263 QCryptoCipherAlgorithm_lookup[alg]); 264 return NULL; 265 } 266 267 /* XXX replace with qapi_enum_parse() in future, when we can 268 * make that function emit a more friendly error message */ 269 static int qcrypto_block_luks_name_lookup(const char *name, 270 const char *const *map, 271 size_t maplen, 272 const char *type, 273 Error **errp) 274 { 275 size_t i; 276 for (i = 0; i < maplen; i++) { 277 if (g_str_equal(map[i], name)) { 278 return i; 279 } 280 } 281 282 error_setg(errp, "%s %s not supported", type, name); 283 return 0; 284 } 285 286 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \ 287 qcrypto_block_luks_name_lookup(name, \ 288 QCryptoCipherMode_lookup, \ 289 QCRYPTO_CIPHER_MODE__MAX, \ 290 "Cipher mode", \ 291 errp) 292 293 #define qcrypto_block_luks_hash_name_lookup(name, errp) \ 294 qcrypto_block_luks_name_lookup(name, \ 295 QCryptoHashAlgorithm_lookup, \ 296 QCRYPTO_HASH_ALG__MAX, \ 297 "Hash algorithm", \ 298 errp) 299 300 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \ 301 qcrypto_block_luks_name_lookup(name, \ 302 QCryptoIVGenAlgorithm_lookup, \ 303 QCRYPTO_IVGEN_ALG__MAX, \ 304 "IV generator", \ 305 errp) 306 307 308 static bool 309 qcrypto_block_luks_has_format(const uint8_t *buf, 310 size_t buf_size) 311 { 312 const QCryptoBlockLUKSHeader *luks_header = (const void *)buf; 313 314 if (buf_size >= offsetof(QCryptoBlockLUKSHeader, cipher_name) && 315 memcmp(luks_header->magic, qcrypto_block_luks_magic, 316 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) == 0 && 317 be16_to_cpu(luks_header->version) == QCRYPTO_BLOCK_LUKS_VERSION) { 318 return true; 319 } else { 320 return false; 321 } 322 } 323 324 325 /** 326 * Deal with a quirk of dm-crypt usage of ESSIV. 327 * 328 * When calculating ESSIV IVs, the cipher length used by ESSIV 329 * may be different from the cipher length used for the block 330 * encryption, becauses dm-crypt uses the hash digest length 331 * as the key size. ie, if you have AES 128 as the block cipher 332 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as 333 * the cipher since that gets a key length matching the digest 334 * size, not AES 128 with truncated digest as might be imagined 335 */ 336 static QCryptoCipherAlgorithm 337 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher, 338 QCryptoHashAlgorithm hash, 339 Error **errp) 340 { 341 size_t digestlen = qcrypto_hash_digest_len(hash); 342 size_t keylen = qcrypto_cipher_get_key_len(cipher); 343 if (digestlen == keylen) { 344 return cipher; 345 } 346 347 switch (cipher) { 348 case QCRYPTO_CIPHER_ALG_AES_128: 349 case QCRYPTO_CIPHER_ALG_AES_192: 350 case QCRYPTO_CIPHER_ALG_AES_256: 351 if (digestlen == qcrypto_cipher_get_key_len( 352 QCRYPTO_CIPHER_ALG_AES_128)) { 353 return QCRYPTO_CIPHER_ALG_AES_128; 354 } else if (digestlen == qcrypto_cipher_get_key_len( 355 QCRYPTO_CIPHER_ALG_AES_192)) { 356 return QCRYPTO_CIPHER_ALG_AES_192; 357 } else if (digestlen == qcrypto_cipher_get_key_len( 358 QCRYPTO_CIPHER_ALG_AES_256)) { 359 return QCRYPTO_CIPHER_ALG_AES_256; 360 } else { 361 error_setg(errp, "No AES cipher with key size %zu available", 362 digestlen); 363 return 0; 364 } 365 break; 366 case QCRYPTO_CIPHER_ALG_SERPENT_128: 367 case QCRYPTO_CIPHER_ALG_SERPENT_192: 368 case QCRYPTO_CIPHER_ALG_SERPENT_256: 369 if (digestlen == qcrypto_cipher_get_key_len( 370 QCRYPTO_CIPHER_ALG_SERPENT_128)) { 371 return QCRYPTO_CIPHER_ALG_SERPENT_128; 372 } else if (digestlen == qcrypto_cipher_get_key_len( 373 QCRYPTO_CIPHER_ALG_SERPENT_192)) { 374 return QCRYPTO_CIPHER_ALG_SERPENT_192; 375 } else if (digestlen == qcrypto_cipher_get_key_len( 376 QCRYPTO_CIPHER_ALG_SERPENT_256)) { 377 return QCRYPTO_CIPHER_ALG_SERPENT_256; 378 } else { 379 error_setg(errp, "No Serpent cipher with key size %zu available", 380 digestlen); 381 return 0; 382 } 383 break; 384 case QCRYPTO_CIPHER_ALG_TWOFISH_128: 385 case QCRYPTO_CIPHER_ALG_TWOFISH_192: 386 case QCRYPTO_CIPHER_ALG_TWOFISH_256: 387 if (digestlen == qcrypto_cipher_get_key_len( 388 QCRYPTO_CIPHER_ALG_TWOFISH_128)) { 389 return QCRYPTO_CIPHER_ALG_TWOFISH_128; 390 } else if (digestlen == qcrypto_cipher_get_key_len( 391 QCRYPTO_CIPHER_ALG_TWOFISH_192)) { 392 return QCRYPTO_CIPHER_ALG_TWOFISH_192; 393 } else if (digestlen == qcrypto_cipher_get_key_len( 394 QCRYPTO_CIPHER_ALG_TWOFISH_256)) { 395 return QCRYPTO_CIPHER_ALG_TWOFISH_256; 396 } else { 397 error_setg(errp, "No Twofish cipher with key size %zu available", 398 digestlen); 399 return 0; 400 } 401 break; 402 default: 403 error_setg(errp, "Cipher %s not supported with essiv", 404 QCryptoCipherAlgorithm_lookup[cipher]); 405 return 0; 406 } 407 } 408 409 /* 410 * Given a key slot, and user password, this will attempt to unlock 411 * the master encryption key from the key slot. 412 * 413 * Returns: 414 * 0 if the key slot is disabled, or key could not be decrypted 415 * with the provided password 416 * 1 if the key slot is enabled, and key decrypted successfully 417 * with the provided password 418 * -1 if a fatal error occurred loading the key 419 */ 420 static int 421 qcrypto_block_luks_load_key(QCryptoBlock *block, 422 QCryptoBlockLUKSKeySlot *slot, 423 const char *password, 424 QCryptoCipherAlgorithm cipheralg, 425 QCryptoCipherMode ciphermode, 426 QCryptoHashAlgorithm hash, 427 QCryptoIVGenAlgorithm ivalg, 428 QCryptoCipherAlgorithm ivcipheralg, 429 QCryptoHashAlgorithm ivhash, 430 uint8_t *masterkey, 431 size_t masterkeylen, 432 QCryptoBlockReadFunc readfunc, 433 void *opaque, 434 Error **errp) 435 { 436 QCryptoBlockLUKS *luks = block->opaque; 437 uint8_t *splitkey; 438 size_t splitkeylen; 439 uint8_t *possiblekey; 440 int ret = -1; 441 ssize_t rv; 442 QCryptoCipher *cipher = NULL; 443 uint8_t keydigest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 444 QCryptoIVGen *ivgen = NULL; 445 size_t niv; 446 447 if (slot->active != QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED) { 448 return 0; 449 } 450 451 splitkeylen = masterkeylen * slot->stripes; 452 splitkey = g_new0(uint8_t, splitkeylen); 453 possiblekey = g_new0(uint8_t, masterkeylen); 454 455 /* 456 * The user password is used to generate a (possible) 457 * decryption key. This may or may not successfully 458 * decrypt the master key - we just blindly assume 459 * the key is correct and validate the results of 460 * decryption later. 461 */ 462 if (qcrypto_pbkdf2(hash, 463 (const uint8_t *)password, strlen(password), 464 slot->salt, QCRYPTO_BLOCK_LUKS_SALT_LEN, 465 slot->iterations, 466 possiblekey, masterkeylen, 467 errp) < 0) { 468 goto cleanup; 469 } 470 471 /* 472 * We need to read the master key material from the 473 * LUKS key material header. What we're reading is 474 * not the raw master key, but rather the data after 475 * it has been passed through AFSplit and the result 476 * then encrypted. 477 */ 478 rv = readfunc(block, 479 slot->key_offset * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 480 splitkey, splitkeylen, 481 errp, 482 opaque); 483 if (rv < 0) { 484 goto cleanup; 485 } 486 487 488 /* Setup the cipher/ivgen that we'll use to try to decrypt 489 * the split master key material */ 490 cipher = qcrypto_cipher_new(cipheralg, ciphermode, 491 possiblekey, masterkeylen, 492 errp); 493 if (!cipher) { 494 goto cleanup; 495 } 496 497 niv = qcrypto_cipher_get_iv_len(cipheralg, 498 ciphermode); 499 ivgen = qcrypto_ivgen_new(ivalg, 500 ivcipheralg, 501 ivhash, 502 possiblekey, masterkeylen, 503 errp); 504 if (!ivgen) { 505 goto cleanup; 506 } 507 508 509 /* 510 * The master key needs to be decrypted in the same 511 * way that the block device payload will be decrypted 512 * later. In particular we'll be using the IV generator 513 * to reset the encryption cipher every time the master 514 * key crosses a sector boundary. 515 */ 516 if (qcrypto_block_decrypt_helper(cipher, 517 niv, 518 ivgen, 519 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 520 0, 521 splitkey, 522 splitkeylen, 523 errp) < 0) { 524 goto cleanup; 525 } 526 527 /* 528 * Now we've decrypted the split master key, join 529 * it back together to get the actual master key. 530 */ 531 if (qcrypto_afsplit_decode(hash, 532 masterkeylen, 533 slot->stripes, 534 splitkey, 535 masterkey, 536 errp) < 0) { 537 goto cleanup; 538 } 539 540 541 /* 542 * We still don't know that the masterkey we got is valid, 543 * because we just blindly assumed the user's password 544 * was correct. This is where we now verify it. We are 545 * creating a hash of the master key using PBKDF and 546 * then comparing that to the hash stored in the key slot 547 * header 548 */ 549 if (qcrypto_pbkdf2(hash, 550 masterkey, masterkeylen, 551 luks->header.master_key_salt, 552 QCRYPTO_BLOCK_LUKS_SALT_LEN, 553 luks->header.master_key_iterations, 554 keydigest, G_N_ELEMENTS(keydigest), 555 errp) < 0) { 556 goto cleanup; 557 } 558 559 if (memcmp(keydigest, luks->header.master_key_digest, 560 QCRYPTO_BLOCK_LUKS_DIGEST_LEN) == 0) { 561 /* Success, we got the right master key */ 562 ret = 1; 563 goto cleanup; 564 } 565 566 /* Fail, user's password was not valid for this key slot, 567 * tell caller to try another slot */ 568 ret = 0; 569 570 cleanup: 571 qcrypto_ivgen_free(ivgen); 572 qcrypto_cipher_free(cipher); 573 g_free(splitkey); 574 g_free(possiblekey); 575 return ret; 576 } 577 578 579 /* 580 * Given a user password, this will iterate over all key 581 * slots and try to unlock each active key slot using the 582 * password until it successfully obtains a master key. 583 * 584 * Returns 0 if a key was loaded, -1 if no keys could be loaded 585 */ 586 static int 587 qcrypto_block_luks_find_key(QCryptoBlock *block, 588 const char *password, 589 QCryptoCipherAlgorithm cipheralg, 590 QCryptoCipherMode ciphermode, 591 QCryptoHashAlgorithm hash, 592 QCryptoIVGenAlgorithm ivalg, 593 QCryptoCipherAlgorithm ivcipheralg, 594 QCryptoHashAlgorithm ivhash, 595 uint8_t **masterkey, 596 size_t *masterkeylen, 597 QCryptoBlockReadFunc readfunc, 598 void *opaque, 599 Error **errp) 600 { 601 QCryptoBlockLUKS *luks = block->opaque; 602 size_t i; 603 int rv; 604 605 *masterkey = g_new0(uint8_t, luks->header.key_bytes); 606 *masterkeylen = luks->header.key_bytes; 607 608 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 609 rv = qcrypto_block_luks_load_key(block, 610 &luks->header.key_slots[i], 611 password, 612 cipheralg, 613 ciphermode, 614 hash, 615 ivalg, 616 ivcipheralg, 617 ivhash, 618 *masterkey, 619 *masterkeylen, 620 readfunc, 621 opaque, 622 errp); 623 if (rv < 0) { 624 goto error; 625 } 626 if (rv == 1) { 627 return 0; 628 } 629 } 630 631 error_setg(errp, "Invalid password, cannot unlock any keyslot"); 632 633 error: 634 g_free(*masterkey); 635 *masterkey = NULL; 636 *masterkeylen = 0; 637 return -1; 638 } 639 640 641 static int 642 qcrypto_block_luks_open(QCryptoBlock *block, 643 QCryptoBlockOpenOptions *options, 644 QCryptoBlockReadFunc readfunc, 645 void *opaque, 646 unsigned int flags, 647 Error **errp) 648 { 649 QCryptoBlockLUKS *luks; 650 Error *local_err = NULL; 651 int ret = 0; 652 size_t i; 653 ssize_t rv; 654 uint8_t *masterkey = NULL; 655 size_t masterkeylen; 656 char *ivgen_name, *ivhash_name; 657 QCryptoCipherMode ciphermode; 658 QCryptoCipherAlgorithm cipheralg; 659 QCryptoIVGenAlgorithm ivalg; 660 QCryptoCipherAlgorithm ivcipheralg; 661 QCryptoHashAlgorithm hash; 662 QCryptoHashAlgorithm ivhash; 663 char *password = NULL; 664 665 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 666 if (!options->u.luks.key_secret) { 667 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 668 return -1; 669 } 670 password = qcrypto_secret_lookup_as_utf8( 671 options->u.luks.key_secret, errp); 672 if (!password) { 673 return -1; 674 } 675 } 676 677 luks = g_new0(QCryptoBlockLUKS, 1); 678 block->opaque = luks; 679 680 /* Read the entire LUKS header, minus the key material from 681 * the underlying device */ 682 rv = readfunc(block, 0, 683 (uint8_t *)&luks->header, 684 sizeof(luks->header), 685 errp, 686 opaque); 687 if (rv < 0) { 688 ret = rv; 689 goto fail; 690 } 691 692 /* The header is always stored in big-endian format, so 693 * convert everything to native */ 694 be16_to_cpus(&luks->header.version); 695 be32_to_cpus(&luks->header.payload_offset); 696 be32_to_cpus(&luks->header.key_bytes); 697 be32_to_cpus(&luks->header.master_key_iterations); 698 699 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 700 be32_to_cpus(&luks->header.key_slots[i].active); 701 be32_to_cpus(&luks->header.key_slots[i].iterations); 702 be32_to_cpus(&luks->header.key_slots[i].key_offset); 703 be32_to_cpus(&luks->header.key_slots[i].stripes); 704 } 705 706 if (memcmp(luks->header.magic, qcrypto_block_luks_magic, 707 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) != 0) { 708 error_setg(errp, "Volume is not in LUKS format"); 709 ret = -EINVAL; 710 goto fail; 711 } 712 if (luks->header.version != QCRYPTO_BLOCK_LUKS_VERSION) { 713 error_setg(errp, "LUKS version %" PRIu32 " is not supported", 714 luks->header.version); 715 ret = -ENOTSUP; 716 goto fail; 717 } 718 719 /* 720 * The cipher_mode header contains a string that we have 721 * to further parse, of the format 722 * 723 * <cipher-mode>-<iv-generator>[:<iv-hash>] 724 * 725 * eg cbc-essiv:sha256, cbc-plain64 726 */ 727 ivgen_name = strchr(luks->header.cipher_mode, '-'); 728 if (!ivgen_name) { 729 ret = -EINVAL; 730 error_setg(errp, "Unexpected cipher mode string format %s", 731 luks->header.cipher_mode); 732 goto fail; 733 } 734 *ivgen_name = '\0'; 735 ivgen_name++; 736 737 ivhash_name = strchr(ivgen_name, ':'); 738 if (!ivhash_name) { 739 ivhash = 0; 740 } else { 741 *ivhash_name = '\0'; 742 ivhash_name++; 743 744 ivhash = qcrypto_block_luks_hash_name_lookup(ivhash_name, 745 &local_err); 746 if (local_err) { 747 ret = -ENOTSUP; 748 error_propagate(errp, local_err); 749 goto fail; 750 } 751 } 752 753 ciphermode = qcrypto_block_luks_cipher_mode_lookup(luks->header.cipher_mode, 754 &local_err); 755 if (local_err) { 756 ret = -ENOTSUP; 757 error_propagate(errp, local_err); 758 goto fail; 759 } 760 761 cipheralg = qcrypto_block_luks_cipher_name_lookup(luks->header.cipher_name, 762 ciphermode, 763 luks->header.key_bytes, 764 &local_err); 765 if (local_err) { 766 ret = -ENOTSUP; 767 error_propagate(errp, local_err); 768 goto fail; 769 } 770 771 hash = qcrypto_block_luks_hash_name_lookup(luks->header.hash_spec, 772 &local_err); 773 if (local_err) { 774 ret = -ENOTSUP; 775 error_propagate(errp, local_err); 776 goto fail; 777 } 778 779 ivalg = qcrypto_block_luks_ivgen_name_lookup(ivgen_name, 780 &local_err); 781 if (local_err) { 782 ret = -ENOTSUP; 783 error_propagate(errp, local_err); 784 goto fail; 785 } 786 787 if (ivalg == QCRYPTO_IVGEN_ALG_ESSIV) { 788 if (!ivhash_name) { 789 ret = -EINVAL; 790 error_setg(errp, "Missing IV generator hash specification"); 791 goto fail; 792 } 793 ivcipheralg = qcrypto_block_luks_essiv_cipher(cipheralg, 794 ivhash, 795 &local_err); 796 if (local_err) { 797 ret = -ENOTSUP; 798 error_propagate(errp, local_err); 799 goto fail; 800 } 801 } else { 802 /* Note we parsed the ivhash_name earlier in the cipher_mode 803 * spec string even with plain/plain64 ivgens, but we 804 * will ignore it, since it is irrelevant for these ivgens. 805 * This is for compat with dm-crypt which will silently 806 * ignore hash names with these ivgens rather than report 807 * an error about the invalid usage 808 */ 809 ivcipheralg = cipheralg; 810 } 811 812 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 813 /* Try to find which key slot our password is valid for 814 * and unlock the master key from that slot. 815 */ 816 if (qcrypto_block_luks_find_key(block, 817 password, 818 cipheralg, ciphermode, 819 hash, 820 ivalg, 821 ivcipheralg, 822 ivhash, 823 &masterkey, &masterkeylen, 824 readfunc, opaque, 825 errp) < 0) { 826 ret = -EACCES; 827 goto fail; 828 } 829 830 /* We have a valid master key now, so can setup the 831 * block device payload decryption objects 832 */ 833 block->kdfhash = hash; 834 block->niv = qcrypto_cipher_get_iv_len(cipheralg, 835 ciphermode); 836 block->ivgen = qcrypto_ivgen_new(ivalg, 837 ivcipheralg, 838 ivhash, 839 masterkey, masterkeylen, 840 errp); 841 if (!block->ivgen) { 842 ret = -ENOTSUP; 843 goto fail; 844 } 845 846 block->cipher = qcrypto_cipher_new(cipheralg, 847 ciphermode, 848 masterkey, masterkeylen, 849 errp); 850 if (!block->cipher) { 851 ret = -ENOTSUP; 852 goto fail; 853 } 854 } 855 856 block->payload_offset = luks->header.payload_offset * 857 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 858 859 luks->cipher_alg = cipheralg; 860 luks->cipher_mode = ciphermode; 861 luks->ivgen_alg = ivalg; 862 luks->ivgen_hash_alg = ivhash; 863 luks->hash_alg = hash; 864 865 g_free(masterkey); 866 g_free(password); 867 868 return 0; 869 870 fail: 871 g_free(masterkey); 872 qcrypto_cipher_free(block->cipher); 873 qcrypto_ivgen_free(block->ivgen); 874 g_free(luks); 875 g_free(password); 876 return ret; 877 } 878 879 880 static int 881 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr, Error **errp) 882 { 883 #ifdef CONFIG_UUID 884 uuid_t uuid; 885 uuid_generate(uuid); 886 uuid_unparse(uuid, (char *)uuidstr); 887 return 0; 888 #else 889 error_setg(errp, "Unable to generate uuids on this platform"); 890 return -1; 891 #endif 892 } 893 894 static int 895 qcrypto_block_luks_create(QCryptoBlock *block, 896 QCryptoBlockCreateOptions *options, 897 QCryptoBlockInitFunc initfunc, 898 QCryptoBlockWriteFunc writefunc, 899 void *opaque, 900 Error **errp) 901 { 902 QCryptoBlockLUKS *luks; 903 QCryptoBlockCreateOptionsLUKS luks_opts; 904 Error *local_err = NULL; 905 uint8_t *masterkey = NULL; 906 uint8_t *slotkey = NULL; 907 uint8_t *splitkey = NULL; 908 size_t splitkeylen = 0; 909 size_t i; 910 QCryptoCipher *cipher = NULL; 911 QCryptoIVGen *ivgen = NULL; 912 char *password; 913 const char *cipher_alg; 914 const char *cipher_mode; 915 const char *ivgen_alg; 916 const char *ivgen_hash_alg = NULL; 917 const char *hash_alg; 918 char *cipher_mode_spec = NULL; 919 QCryptoCipherAlgorithm ivcipheralg = 0; 920 uint64_t iters; 921 922 memcpy(&luks_opts, &options->u.luks, sizeof(luks_opts)); 923 if (!luks_opts.has_iter_time) { 924 luks_opts.iter_time = 2000; 925 } 926 if (!luks_opts.has_cipher_alg) { 927 luks_opts.cipher_alg = QCRYPTO_CIPHER_ALG_AES_256; 928 } 929 if (!luks_opts.has_cipher_mode) { 930 luks_opts.cipher_mode = QCRYPTO_CIPHER_MODE_XTS; 931 } 932 if (!luks_opts.has_ivgen_alg) { 933 luks_opts.ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64; 934 } 935 if (!luks_opts.has_hash_alg) { 936 luks_opts.hash_alg = QCRYPTO_HASH_ALG_SHA256; 937 } 938 if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 939 if (!luks_opts.has_ivgen_hash_alg) { 940 luks_opts.ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256; 941 luks_opts.has_ivgen_hash_alg = true; 942 } 943 } 944 /* Note we're allowing ivgen_hash_alg to be set even for 945 * non-essiv iv generators that don't need a hash. It will 946 * be silently ignored, for compatibility with dm-crypt */ 947 948 if (!options->u.luks.key_secret) { 949 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 950 return -1; 951 } 952 password = qcrypto_secret_lookup_as_utf8(luks_opts.key_secret, errp); 953 if (!password) { 954 return -1; 955 } 956 957 luks = g_new0(QCryptoBlockLUKS, 1); 958 block->opaque = luks; 959 960 memcpy(luks->header.magic, qcrypto_block_luks_magic, 961 QCRYPTO_BLOCK_LUKS_MAGIC_LEN); 962 963 /* We populate the header in native endianness initially and 964 * then convert everything to big endian just before writing 965 * it out to disk 966 */ 967 luks->header.version = QCRYPTO_BLOCK_LUKS_VERSION; 968 if (qcrypto_block_luks_uuid_gen(luks->header.uuid, 969 errp) < 0) { 970 goto error; 971 } 972 973 cipher_alg = qcrypto_block_luks_cipher_alg_lookup(luks_opts.cipher_alg, 974 errp); 975 if (!cipher_alg) { 976 goto error; 977 } 978 979 cipher_mode = QCryptoCipherMode_lookup[luks_opts.cipher_mode]; 980 ivgen_alg = QCryptoIVGenAlgorithm_lookup[luks_opts.ivgen_alg]; 981 if (luks_opts.has_ivgen_hash_alg) { 982 ivgen_hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.ivgen_hash_alg]; 983 cipher_mode_spec = g_strdup_printf("%s-%s:%s", cipher_mode, ivgen_alg, 984 ivgen_hash_alg); 985 } else { 986 cipher_mode_spec = g_strdup_printf("%s-%s", cipher_mode, ivgen_alg); 987 } 988 hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.hash_alg]; 989 990 991 if (strlen(cipher_alg) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN) { 992 error_setg(errp, "Cipher name '%s' is too long for LUKS header", 993 cipher_alg); 994 goto error; 995 } 996 if (strlen(cipher_mode_spec) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN) { 997 error_setg(errp, "Cipher mode '%s' is too long for LUKS header", 998 cipher_mode_spec); 999 goto error; 1000 } 1001 if (strlen(hash_alg) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN) { 1002 error_setg(errp, "Hash name '%s' is too long for LUKS header", 1003 hash_alg); 1004 goto error; 1005 } 1006 1007 if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 1008 ivcipheralg = qcrypto_block_luks_essiv_cipher(luks_opts.cipher_alg, 1009 luks_opts.ivgen_hash_alg, 1010 &local_err); 1011 if (local_err) { 1012 error_propagate(errp, local_err); 1013 goto error; 1014 } 1015 } else { 1016 ivcipheralg = luks_opts.cipher_alg; 1017 } 1018 1019 strcpy(luks->header.cipher_name, cipher_alg); 1020 strcpy(luks->header.cipher_mode, cipher_mode_spec); 1021 strcpy(luks->header.hash_spec, hash_alg); 1022 1023 luks->header.key_bytes = qcrypto_cipher_get_key_len(luks_opts.cipher_alg); 1024 if (luks_opts.cipher_mode == QCRYPTO_CIPHER_MODE_XTS) { 1025 luks->header.key_bytes *= 2; 1026 } 1027 1028 /* Generate the salt used for hashing the master key 1029 * with PBKDF later 1030 */ 1031 if (qcrypto_random_bytes(luks->header.master_key_salt, 1032 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1033 errp) < 0) { 1034 goto error; 1035 } 1036 1037 /* Generate random master key */ 1038 masterkey = g_new0(uint8_t, luks->header.key_bytes); 1039 if (qcrypto_random_bytes(masterkey, 1040 luks->header.key_bytes, errp) < 0) { 1041 goto error; 1042 } 1043 1044 1045 /* Setup the block device payload encryption objects */ 1046 block->cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1047 luks_opts.cipher_mode, 1048 masterkey, luks->header.key_bytes, 1049 errp); 1050 if (!block->cipher) { 1051 goto error; 1052 } 1053 1054 block->kdfhash = luks_opts.hash_alg; 1055 block->niv = qcrypto_cipher_get_iv_len(luks_opts.cipher_alg, 1056 luks_opts.cipher_mode); 1057 block->ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1058 ivcipheralg, 1059 luks_opts.ivgen_hash_alg, 1060 masterkey, luks->header.key_bytes, 1061 errp); 1062 1063 if (!block->ivgen) { 1064 goto error; 1065 } 1066 1067 1068 /* Determine how many iterations we need to hash the master 1069 * key, in order to have 1 second of compute time used 1070 */ 1071 iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1072 masterkey, luks->header.key_bytes, 1073 luks->header.master_key_salt, 1074 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1075 QCRYPTO_BLOCK_LUKS_DIGEST_LEN, 1076 &local_err); 1077 if (local_err) { 1078 error_propagate(errp, local_err); 1079 goto error; 1080 } 1081 1082 if (iters > (ULLONG_MAX / luks_opts.iter_time)) { 1083 error_setg_errno(errp, ERANGE, 1084 "PBKDF iterations %llu too large to scale", 1085 (unsigned long long)iters); 1086 goto error; 1087 } 1088 1089 /* iter_time was in millis, but count_iters reported for secs */ 1090 iters = iters * luks_opts.iter_time / 1000; 1091 1092 /* Why /= 8 ? That matches cryptsetup, but there's no 1093 * explanation why they chose /= 8... Probably so that 1094 * if all 8 keyslots are active we only spend 1 second 1095 * in total time to check all keys */ 1096 iters /= 8; 1097 if (iters > UINT32_MAX) { 1098 error_setg_errno(errp, ERANGE, 1099 "PBKDF iterations %llu larger than %u", 1100 (unsigned long long)iters, UINT32_MAX); 1101 goto error; 1102 } 1103 iters = MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS); 1104 luks->header.master_key_iterations = iters; 1105 1106 /* Hash the master key, saving the result in the LUKS 1107 * header. This hash is used when opening the encrypted 1108 * device to verify that the user password unlocked a 1109 * valid master key 1110 */ 1111 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1112 masterkey, luks->header.key_bytes, 1113 luks->header.master_key_salt, 1114 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1115 luks->header.master_key_iterations, 1116 luks->header.master_key_digest, 1117 QCRYPTO_BLOCK_LUKS_DIGEST_LEN, 1118 errp) < 0) { 1119 goto error; 1120 } 1121 1122 1123 /* Although LUKS has multiple key slots, we're just going 1124 * to use the first key slot */ 1125 splitkeylen = luks->header.key_bytes * QCRYPTO_BLOCK_LUKS_STRIPES; 1126 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1127 luks->header.key_slots[i].active = i == 0 ? 1128 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED : 1129 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED; 1130 luks->header.key_slots[i].stripes = QCRYPTO_BLOCK_LUKS_STRIPES; 1131 1132 /* This calculation doesn't match that shown in the spec, 1133 * but instead follows the cryptsetup implementation. 1134 */ 1135 luks->header.key_slots[i].key_offset = 1136 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1137 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1138 (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1139 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1140 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * i); 1141 } 1142 1143 if (qcrypto_random_bytes(luks->header.key_slots[0].salt, 1144 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1145 errp) < 0) { 1146 goto error; 1147 } 1148 1149 /* Again we determine how many iterations are required to 1150 * hash the user password while consuming 1 second of compute 1151 * time */ 1152 iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1153 (uint8_t *)password, strlen(password), 1154 luks->header.key_slots[0].salt, 1155 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1156 luks->header.key_bytes, 1157 &local_err); 1158 if (local_err) { 1159 error_propagate(errp, local_err); 1160 goto error; 1161 } 1162 1163 if (iters > (ULLONG_MAX / luks_opts.iter_time)) { 1164 error_setg_errno(errp, ERANGE, 1165 "PBKDF iterations %llu too large to scale", 1166 (unsigned long long)iters); 1167 goto error; 1168 } 1169 1170 /* iter_time was in millis, but count_iters reported for secs */ 1171 iters = iters * luks_opts.iter_time / 1000; 1172 1173 if (iters > UINT32_MAX) { 1174 error_setg_errno(errp, ERANGE, 1175 "PBKDF iterations %llu larger than %u", 1176 (unsigned long long)iters, UINT32_MAX); 1177 goto error; 1178 } 1179 1180 luks->header.key_slots[0].iterations = 1181 MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS); 1182 1183 1184 /* Generate a key that we'll use to encrypt the master 1185 * key, from the user's password 1186 */ 1187 slotkey = g_new0(uint8_t, luks->header.key_bytes); 1188 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1189 (uint8_t *)password, strlen(password), 1190 luks->header.key_slots[0].salt, 1191 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1192 luks->header.key_slots[0].iterations, 1193 slotkey, luks->header.key_bytes, 1194 errp) < 0) { 1195 goto error; 1196 } 1197 1198 1199 /* Setup the encryption objects needed to encrypt the 1200 * master key material 1201 */ 1202 cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1203 luks_opts.cipher_mode, 1204 slotkey, luks->header.key_bytes, 1205 errp); 1206 if (!cipher) { 1207 goto error; 1208 } 1209 1210 ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1211 ivcipheralg, 1212 luks_opts.ivgen_hash_alg, 1213 slotkey, luks->header.key_bytes, 1214 errp); 1215 if (!ivgen) { 1216 goto error; 1217 } 1218 1219 /* Before storing the master key, we need to vastly 1220 * increase its size, as protection against forensic 1221 * disk data recovery */ 1222 splitkey = g_new0(uint8_t, splitkeylen); 1223 1224 if (qcrypto_afsplit_encode(luks_opts.hash_alg, 1225 luks->header.key_bytes, 1226 luks->header.key_slots[0].stripes, 1227 masterkey, 1228 splitkey, 1229 errp) < 0) { 1230 goto error; 1231 } 1232 1233 /* Now we encrypt the split master key with the key generated 1234 * from the user's password, before storing it */ 1235 if (qcrypto_block_encrypt_helper(cipher, block->niv, ivgen, 1236 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1237 0, 1238 splitkey, 1239 splitkeylen, 1240 errp) < 0) { 1241 goto error; 1242 } 1243 1244 1245 /* The total size of the LUKS headers is the partition header + key 1246 * slot headers, rounded up to the nearest sector, combined with 1247 * the size of each master key material region, also rounded up 1248 * to the nearest sector */ 1249 luks->header.payload_offset = 1250 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1251 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1252 (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1253 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1254 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * 1255 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS); 1256 1257 block->payload_offset = luks->header.payload_offset * 1258 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 1259 1260 /* Reserve header space to match payload offset */ 1261 initfunc(block, block->payload_offset, &local_err, opaque); 1262 if (local_err) { 1263 error_propagate(errp, local_err); 1264 goto error; 1265 } 1266 1267 /* Everything on disk uses Big Endian, so flip header fields 1268 * before writing them */ 1269 cpu_to_be16s(&luks->header.version); 1270 cpu_to_be32s(&luks->header.payload_offset); 1271 cpu_to_be32s(&luks->header.key_bytes); 1272 cpu_to_be32s(&luks->header.master_key_iterations); 1273 1274 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1275 cpu_to_be32s(&luks->header.key_slots[i].active); 1276 cpu_to_be32s(&luks->header.key_slots[i].iterations); 1277 cpu_to_be32s(&luks->header.key_slots[i].key_offset); 1278 cpu_to_be32s(&luks->header.key_slots[i].stripes); 1279 } 1280 1281 1282 /* Write out the partition header and key slot headers */ 1283 writefunc(block, 0, 1284 (const uint8_t *)&luks->header, 1285 sizeof(luks->header), 1286 &local_err, 1287 opaque); 1288 1289 /* Delay checking local_err until we've byte-swapped */ 1290 1291 /* Byte swap the header back to native, in case we need 1292 * to read it again later */ 1293 be16_to_cpus(&luks->header.version); 1294 be32_to_cpus(&luks->header.payload_offset); 1295 be32_to_cpus(&luks->header.key_bytes); 1296 be32_to_cpus(&luks->header.master_key_iterations); 1297 1298 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1299 be32_to_cpus(&luks->header.key_slots[i].active); 1300 be32_to_cpus(&luks->header.key_slots[i].iterations); 1301 be32_to_cpus(&luks->header.key_slots[i].key_offset); 1302 be32_to_cpus(&luks->header.key_slots[i].stripes); 1303 } 1304 1305 if (local_err) { 1306 error_propagate(errp, local_err); 1307 goto error; 1308 } 1309 1310 /* Write out the master key material, starting at the 1311 * sector immediately following the partition header. */ 1312 if (writefunc(block, 1313 luks->header.key_slots[0].key_offset * 1314 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1315 splitkey, splitkeylen, 1316 errp, 1317 opaque) != splitkeylen) { 1318 goto error; 1319 } 1320 1321 luks->cipher_alg = luks_opts.cipher_alg; 1322 luks->cipher_mode = luks_opts.cipher_mode; 1323 luks->ivgen_alg = luks_opts.ivgen_alg; 1324 luks->ivgen_hash_alg = luks_opts.ivgen_hash_alg; 1325 luks->hash_alg = luks_opts.hash_alg; 1326 1327 memset(masterkey, 0, luks->header.key_bytes); 1328 g_free(masterkey); 1329 memset(slotkey, 0, luks->header.key_bytes); 1330 g_free(slotkey); 1331 g_free(splitkey); 1332 g_free(password); 1333 g_free(cipher_mode_spec); 1334 1335 qcrypto_ivgen_free(ivgen); 1336 qcrypto_cipher_free(cipher); 1337 1338 return 0; 1339 1340 error: 1341 if (masterkey) { 1342 memset(masterkey, 0, luks->header.key_bytes); 1343 } 1344 g_free(masterkey); 1345 if (slotkey) { 1346 memset(slotkey, 0, luks->header.key_bytes); 1347 } 1348 g_free(slotkey); 1349 g_free(splitkey); 1350 g_free(password); 1351 g_free(cipher_mode_spec); 1352 1353 qcrypto_ivgen_free(ivgen); 1354 qcrypto_cipher_free(cipher); 1355 1356 g_free(luks); 1357 return -1; 1358 } 1359 1360 1361 static int qcrypto_block_luks_get_info(QCryptoBlock *block, 1362 QCryptoBlockInfo *info, 1363 Error **errp) 1364 { 1365 QCryptoBlockLUKS *luks = block->opaque; 1366 QCryptoBlockInfoLUKSSlot *slot; 1367 QCryptoBlockInfoLUKSSlotList *slots = NULL, **prev = &info->u.luks.slots; 1368 size_t i; 1369 1370 info->u.luks.cipher_alg = luks->cipher_alg; 1371 info->u.luks.cipher_mode = luks->cipher_mode; 1372 info->u.luks.ivgen_alg = luks->ivgen_alg; 1373 if (info->u.luks.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 1374 info->u.luks.has_ivgen_hash_alg = true; 1375 info->u.luks.ivgen_hash_alg = luks->ivgen_hash_alg; 1376 } 1377 info->u.luks.hash_alg = luks->hash_alg; 1378 info->u.luks.payload_offset = block->payload_offset; 1379 info->u.luks.master_key_iters = luks->header.master_key_iterations; 1380 info->u.luks.uuid = g_strndup((const char *)luks->header.uuid, 1381 sizeof(luks->header.uuid)); 1382 1383 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1384 slots = g_new0(QCryptoBlockInfoLUKSSlotList, 1); 1385 *prev = slots; 1386 1387 slots->value = slot = g_new0(QCryptoBlockInfoLUKSSlot, 1); 1388 slot->active = luks->header.key_slots[i].active == 1389 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED; 1390 slot->key_offset = luks->header.key_slots[i].key_offset 1391 * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 1392 if (slot->active) { 1393 slot->has_iters = true; 1394 slot->iters = luks->header.key_slots[i].iterations; 1395 slot->has_stripes = true; 1396 slot->stripes = luks->header.key_slots[i].stripes; 1397 } 1398 1399 prev = &slots->next; 1400 } 1401 1402 return 0; 1403 } 1404 1405 1406 static void qcrypto_block_luks_cleanup(QCryptoBlock *block) 1407 { 1408 g_free(block->opaque); 1409 } 1410 1411 1412 static int 1413 qcrypto_block_luks_decrypt(QCryptoBlock *block, 1414 uint64_t startsector, 1415 uint8_t *buf, 1416 size_t len, 1417 Error **errp) 1418 { 1419 return qcrypto_block_decrypt_helper(block->cipher, 1420 block->niv, block->ivgen, 1421 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1422 startsector, buf, len, errp); 1423 } 1424 1425 1426 static int 1427 qcrypto_block_luks_encrypt(QCryptoBlock *block, 1428 uint64_t startsector, 1429 uint8_t *buf, 1430 size_t len, 1431 Error **errp) 1432 { 1433 return qcrypto_block_encrypt_helper(block->cipher, 1434 block->niv, block->ivgen, 1435 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1436 startsector, buf, len, errp); 1437 } 1438 1439 1440 const QCryptoBlockDriver qcrypto_block_driver_luks = { 1441 .open = qcrypto_block_luks_open, 1442 .create = qcrypto_block_luks_create, 1443 .get_info = qcrypto_block_luks_get_info, 1444 .cleanup = qcrypto_block_luks_cleanup, 1445 .decrypt = qcrypto_block_luks_decrypt, 1446 .encrypt = qcrypto_block_luks_encrypt, 1447 .has_format = qcrypto_block_luks_has_format, 1448 }; 1449