contrib/cryptsetup/luks/keymanage.c

   1 /*
   2  * LUKS - Linux Unified Key Setup
   3  *
   4  * Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * version 2 as published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program; if not, write to the Free Software
  17  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18  */
  19
  20 #include <sys/types.h>
  21 #include <sys/stat.h>
  22 #include <sys/ioctl.h>
  23 #include <netinet/in.h>
  24 #include <fcntl.h>
  25 #include <errno.h>
  26 #include <unistd.h>
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29 #include <string.h>
  30 #include <ctype.h>
  31
  32 #include "luks.h"
  33 #include "af.h"
  34 #include "pbkdf.h"
  35 #include "random.h"
  36 #include <uuid.h>
  37 #include <../lib/internal.h>
  38
  39 #define div_round_up(a,b) ({           \
  40         typeof(a) __a = (a);          \
  41         typeof(b) __b = (b);          \
  42         (__a - 1) / __b + 1;        \
  43 })
  44
  45 static inline int round_up_modulo(int x, int m) {
  46         return div_round_up(x, m) * m;
  47 }
  48
  49 struct luks_masterkey *LUKS_alloc_masterkey(int keylength, const char *key)
  50 {
  51         struct luks_masterkey *mk=malloc(sizeof(*mk) + keylength);
  52         if(NULL == mk) return NULL;
  53         mk->keyLength=keylength;
  54         if (key)
  55                 memcpy(&mk->key, key, keylength);
  56         return mk;
  57 }
  58
  59 void LUKS_dealloc_masterkey(struct luks_masterkey *mk)
  60 {
  61         if(NULL != mk) {
  62                 memset(mk->key,0,mk->keyLength);
  63                 mk->keyLength=0;
  64                 free(mk);
  65         }
  66 }
  67
  68 struct luks_masterkey *LUKS_generate_masterkey(int keylength)
  69 {
  70         struct luks_masterkey *mk=LUKS_alloc_masterkey(keylength, NULL);
  71         if(NULL == mk) return NULL;
  72
  73         int r = getRandom(mk->key,keylength);
  74         if(r < 0) {
  75                 LUKS_dealloc_masterkey(mk);
  76                 return NULL;
  77         }
  78         return mk;
  79 }
  80
  81 int LUKS_hdr_backup(
  82         const char *backup_file,
  83         const char *device,
  84         struct luks_phdr *hdr,
  85         struct crypt_device *ctx)
  86 {
  87         int r = 0, devfd = -1;
  88         size_t buffer_size;
  89         char *buffer = NULL;
  90         struct stat st;
  91
  92         if(stat(backup_file, &st) == 0) {
  93                 log_err(ctx, _("Requested file %s already exist.\n"), backup_file);
  94                 return -EINVAL;
  95         }
  96
  97         r = LUKS_read_phdr(device, hdr, 0, ctx);
  98         if (r)
  99                 return r;
 100
 101         buffer_size = hdr->payloadOffset << SECTOR_SHIFT;
 102         buffer = safe_alloc(buffer_size);
 103         if (!buffer || buffer_size < LUKS_ALIGN_KEYSLOTS) {
 104                 r = -ENOMEM;
 105                 goto out;
 106         }
 107
 108         log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes).",
 109                 sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS);
 110
 111         devfd = open(device, O_RDONLY | O_DIRECT | O_SYNC);
 112         if(devfd == -1) {
 113                 log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
 114                 r = -EINVAL;
 115                 goto out;
 116         }
 117
 118         if(read_blockwise(devfd, buffer, buffer_size) < buffer_size) {
 119                 r = -EIO;
 120                 goto out;
 121         }
 122         close(devfd);
 123
 124         /* Wipe unused area, so backup cannot contain old signatures */
 125         memset(buffer + sizeof(*hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(*hdr));
 126
 127         devfd = creat(backup_file, S_IRUSR);
 128         if(devfd == -1) {
 129                 r = -EINVAL;
 130                 goto out;
 131         }
 132         if(write(devfd, buffer, buffer_size) < buffer_size) {
 133                 log_err(ctx, _("Cannot write header backup file %s.\n"), backup_file);
 134                 r = -EIO;
 135                 goto out;
 136         }
 137         close(devfd);
 138
 139         r = 0;
 140 out:
 141         if (devfd != -1)
 142                 close(devfd);
 143         safe_free(buffer);
 144         return r;
 145 }
 146
 147 int LUKS_hdr_restore(
 148         const char *backup_file,
 149         const char *device,
 150         struct luks_phdr *hdr,
 151         struct crypt_device *ctx)
 152 {
 153         int r = 0, devfd = -1, diff_uuid = 0;
 154         size_t buffer_size;
 155         char *buffer = NULL, msg[200];
 156         struct stat st;
 157         struct luks_phdr hdr_file;
 158
 159         if(stat(backup_file, &st) < 0) {
 160                 log_err(ctx, _("Backup file %s doesn't exist.\n"), backup_file);
 161                 return -EINVAL;
 162         }
 163
 164         r = LUKS_read_phdr_backup(backup_file, device, &hdr_file, 0, ctx);
 165         buffer_size = hdr_file.payloadOffset << SECTOR_SHIFT;
 166
 167         if (r || buffer_size < LUKS_ALIGN_KEYSLOTS) {
 168                 log_err(ctx, _("Backup file do not contain valid LUKS header.\n"));
 169                 r = -EINVAL;
 170                 goto out;
 171         }
 172
 173         buffer = safe_alloc(buffer_size);
 174         if (!buffer) {
 175                 r = -ENOMEM;
 176                 goto out;
 177         }
 178
 179         devfd = open(backup_file, O_RDONLY);
 180         if(devfd == -1) {
 181                 log_err(ctx, _("Cannot open header backup file %s.\n"), backup_file);
 182                 r = -EINVAL;
 183                 goto out;
 184         }
 185
 186         if(read(devfd, buffer, buffer_size) < buffer_size) {
 187                 log_err(ctx, _("Cannot read header backup file %s.\n"), backup_file);
 188                 r = -EIO;
 189                 goto out;
 190         }
 191         close(devfd);
 192
 193         r = LUKS_read_phdr(device, hdr, 0, ctx);
 194         if (r == 0) {
 195                 log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device);
 196                 if(hdr->payloadOffset != hdr_file.payloadOffset ||
 197                    hdr->keyBytes != hdr_file.keyBytes) {
 198                         log_err(ctx, _("Data offset or key size differs on device and backup, restore failed.\n"));
 199                         r = -EINVAL;
 200                         goto out;
 201                 }
 202                 if (memcmp(hdr->uuid, hdr_file.uuid, UUID_STRING_L))
 203                         diff_uuid = 1;
 204         }
 205
 206         if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device,
 207                  r ? _("does not contain LUKS header. Replacing header can destroy data on that device.") :
 208                      _("already contains LUKS header. Replacing header will destroy existing keyslots."),
 209                      diff_uuid ? _("\nWARNING: real device header has different UUID than backup!") : "") < 0) {
 210                 r = -ENOMEM;
 211                 goto out;
 212         }
 213
 214         if (!crypt_confirm(ctx, msg)) {
 215                 r = -EINVAL;
 216                 goto out;
 217         }
 218
 219         log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes) to device %s.",
 220                 sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device);
 221
 222         devfd = open(device, O_WRONLY | O_DIRECT | O_SYNC);
 223         if(devfd == -1) {
 224                 log_err(ctx, _("Cannot open device %s.\n"), device);
 225                 r = -EINVAL;
 226                 goto out;
 227         }
 228
 229         if(write_blockwise(devfd, buffer, buffer_size) < buffer_size) {
 230                 r = -EIO;
 231                 goto out;
 232         }
 233         close(devfd);
 234
 235         /* Be sure to reload new data */
 236         r = LUKS_read_phdr(device, hdr, 0, ctx);
 237 out:
 238         if (devfd != -1)
 239                 close(devfd);
 240         safe_free(buffer);
 241         return r;
 242 }
 243
 244 static int _check_and_convert_hdr(const char *device,
 245                                   struct luks_phdr *hdr,
 246                                   int require_luks_device,
 247                                   struct crypt_device *ctx)
 248 {
 249         int r = 0;
 250         unsigned int i;
 251         char luksMagic[] = LUKS_MAGIC;
 252
 253         if(memcmp(hdr->magic, luksMagic, LUKS_MAGIC_L)) { /* Check magic */
 254                 log_dbg("LUKS header not detected.");
 255                 if (require_luks_device)
 256                         log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
 257                 else
 258                         set_error(_("Device %s is not a valid LUKS device."), device);
 259                 r = -EINVAL;
 260         } else if((hdr->version = ntohs(hdr->version)) != 1) {  /* Convert every uint16/32_t item from network byte order */
 261                 log_err(ctx, _("Unsupported LUKS version %d.\n"), hdr->version);
 262                 r = -EINVAL;
 263         } else if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
 264                 log_err(ctx, _("Requested LUKS hash %s is not supported.\n"), hdr->hashSpec);
 265                 r = -EINVAL;
 266         } else {
 267                 hdr->payloadOffset      = ntohl(hdr->payloadOffset);
 268                 hdr->keyBytes           = ntohl(hdr->keyBytes);
 269                 hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
 270
 271                 for(i = 0; i < LUKS_NUMKEYS; ++i) {
 272                         hdr->keyblock[i].active             = ntohl(hdr->keyblock[i].active);
 273                         hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
 274                         hdr->keyblock[i].keyMaterialOffset  = ntohl(hdr->keyblock[i].keyMaterialOffset);
 275                         hdr->keyblock[i].stripes            = ntohl(hdr->keyblock[i].stripes);
 276                 }
 277         }
 278
 279         return r;
 280 }
 281
 282 static void _to_lower(char *str, unsigned max_len)
 283 {
 284         for(; *str && max_len; str++, max_len--)
 285                 if (isupper(*str))
 286                         *str = tolower(*str);
 287 }
 288
 289 static void LUKS_fix_header_compatible(struct luks_phdr *header)
 290 {
 291         /* Old cryptsetup expects "sha1", gcrypt allows case insensistive names,
 292          * so always convert hash to lower case in header */
 293         _to_lower(header->hashSpec, LUKS_HASHSPEC_L);
 294 }
 295
 296 int LUKS_read_phdr_backup(const char *backup_file,
 297                           const char *device,
 298                           struct luks_phdr *hdr,
 299                           int require_luks_device,
 300                           struct crypt_device *ctx)
 301 {
 302         int devfd = 0, r = 0;
 303
 304         log_dbg("Reading LUKS header of size %d from backup file %s",
 305                 sizeof(struct luks_phdr), backup_file);
 306
 307         devfd = open(backup_file, O_RDONLY);
 308         if(-1 == devfd) {
 309                 log_err(ctx, _("Cannot open file %s.\n"), device);
 310                 return -EINVAL;
 311         }
 312
 313         if(read(devfd, hdr, sizeof(struct luks_phdr)) < sizeof(struct luks_phdr))
 314                 r = -EIO;
 315         else {
 316                 LUKS_fix_header_compatible(hdr);
 317                 r = _check_and_convert_hdr(backup_file, hdr, require_luks_device, ctx);
 318         }
 319
 320         close(devfd);
 321         return r;
 322 }
 323
 324 int LUKS_read_phdr(const char *device,
 325                    struct luks_phdr *hdr,
 326                    int require_luks_device,
 327                    struct crypt_device *ctx)
 328 {
 329         int devfd = 0, r = 0;
 330         uint64_t size;
 331
 332         log_dbg("Reading LUKS header of size %d from device %s",
 333                 sizeof(struct luks_phdr), device);
 334
 335         devfd = open(device,O_RDONLY | O_DIRECT | O_SYNC);
 336         if(-1 == devfd) {
 337                 log_err(ctx, _("Cannot open device %s.\n"), device);
 338                 return -EINVAL;
 339         }
 340
 341         if(read_blockwise(devfd, hdr, sizeof(struct luks_phdr)) < sizeof(struct luks_phdr))
 342                 r = -EIO;
 343         else
 344                 r = _check_and_convert_hdr(device, hdr, require_luks_device, ctx);
 345
 346 #ifdef BLKGETSIZE64
 347         if (r == 0 && (ioctl(devfd, BLKGETSIZE64, &size) < 0 ||
 348             size < (uint64_t)hdr->payloadOffset)) {
 349                 log_err(ctx, _("LUKS header detected but device %s is too small.\n"), device);
 350                 r = -EINVAL;
 351         }
 352 #endif
 353         close(devfd);
 354
 355         return r;
 356 }
 357
 358 int LUKS_write_phdr(const char *device,
 359                     struct luks_phdr *hdr,
 360                     struct crypt_device *ctx)
 361 {
 362         int devfd = 0;
 363         unsigned int i;
 364         struct luks_phdr convHdr;
 365         int r;
 366
 367         log_dbg("Updating LUKS header of size %d on device %s",
 368                 sizeof(struct luks_phdr), device);
 369
 370         devfd = open(device,O_RDWR | O_DIRECT | O_SYNC);
 371         if(-1 == devfd) {
 372                 log_err(ctx, _("Cannot open device %s.\n"), device);
 373                 return -EINVAL;
 374         }
 375
 376         memcpy(&convHdr, hdr, sizeof(struct luks_phdr));
 377         memset(&convHdr._padding, 0, sizeof(convHdr._padding));
 378
 379         /* Convert every uint16/32_t item to network byte order */
 380         convHdr.version            = htons(hdr->version);
 381         convHdr.payloadOffset      = htonl(hdr->payloadOffset);
 382         convHdr.keyBytes           = htonl(hdr->keyBytes);
 383         convHdr.mkDigestIterations = htonl(hdr->mkDigestIterations);
 384         for(i = 0; i < LUKS_NUMKEYS; ++i) {
 385                 convHdr.keyblock[i].active             = htonl(hdr->keyblock[i].active);
 386                 convHdr.keyblock[i].passwordIterations = htonl(hdr->keyblock[i].passwordIterations);
 387                 convHdr.keyblock[i].keyMaterialOffset  = htonl(hdr->keyblock[i].keyMaterialOffset);
 388                 convHdr.keyblock[i].stripes            = htonl(hdr->keyblock[i].stripes);
 389         }
 390
 391         r = write_blockwise(devfd, &convHdr, sizeof(struct luks_phdr)) < sizeof(struct luks_phdr) ? -EIO : 0;
 392         if (r)
 393                 log_err(ctx, _("Error during update of LUKS header on device %s.\n"), device);
 394         close(devfd);
 395
 396         /* Re-read header from disk to be sure that in-memory and on-disk data are the same. */
 397         if (!r) {
 398                 r = LUKS_read_phdr(device, hdr, 1, ctx);
 399                 if (r)
 400                         log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"), device);
 401         }
 402
 403         return r;
 404 }
 405
 406 static int LUKS_PBKDF2_performance_check(const char *hashSpec,
 407                                          uint64_t *PBKDF2_per_sec,
 408                                          struct crypt_device *ctx)
 409 {
 410         if (!*PBKDF2_per_sec) {
 411                 if (PBKDF2_performance_check(hashSpec, PBKDF2_per_sec) < 0) {
 412                         log_err(ctx, _("Not compatible PBKDF2 options (using hash algorithm %s).\n"), hashSpec);
 413                         return -EINVAL;
 414                 }
 415                 log_dbg("PBKDF2: %" PRIu64 " iterations per second using hash %s.", *PBKDF2_per_sec, hashSpec);
 416         }
 417
 418         return 0;
 419 }
 420
 421 int LUKS_generate_phdr(struct luks_phdr *header,
 422                        const struct luks_masterkey *mk,
 423                        const char *cipherName, const char *cipherMode, const char *hashSpec,
 424                        const char *uuid, unsigned int stripes,
 425                        unsigned int alignPayload,
 426                        unsigned int alignOffset,
 427                        uint32_t iteration_time_ms,
 428                        uint64_t *PBKDF2_per_sec,
 429                        struct crypt_device *ctx)
 430 {
 431         unsigned int i=0;
 432         unsigned int blocksPerStripeSet = div_round_up(mk->keyLength*stripes,SECTOR_SIZE);
 433         int r;
 434         uint32_t ret;
 435         char luksMagic[] = LUKS_MAGIC;
 436         char *uu;
 437         uuid_t partitionUuid;
 438         int currentSector;
 439         int alignSectors = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE;
 440         if (alignPayload == 0)
 441                 alignPayload = alignSectors;
 442
 443         memset(header,0,sizeof(struct luks_phdr));
 444
 445         /* Set Magic */
 446         memcpy(header->magic,luksMagic,LUKS_MAGIC_L);
 447         header->version=1;
 448         strncpy(header->cipherName,cipherName,LUKS_CIPHERNAME_L);
 449         strncpy(header->cipherMode,cipherMode,LUKS_CIPHERMODE_L);
 450         strncpy(header->hashSpec,hashSpec,LUKS_HASHSPEC_L);
 451
 452         header->keyBytes=mk->keyLength;
 453
 454         LUKS_fix_header_compatible(header);
 455
 456         log_dbg("Generating LUKS header version %d using hash %s, %s, %s, MK %d bytes",
 457                 header->version, header->hashSpec ,header->cipherName, header->cipherMode,
 458                 header->keyBytes);
 459
 460         r = getRandom(header->mkDigestSalt,LUKS_SALTSIZE);
 461         if(r < 0) {
 462                 log_err(ctx,  _("Cannot create LUKS header: reading random salt failed.\n"));
 463                 return r;
 464         }
 465
 466         if ((r = LUKS_PBKDF2_performance_check(header->hashSpec, PBKDF2_per_sec, ctx)))
 467                 return r;
 468
 469         /* Compute master key digest */
 470         iteration_time_ms /= 8;
 471         header->mkDigestIterations = at_least((uint32_t)(*PBKDF2_per_sec/1024) * iteration_time_ms,
 472                                               LUKS_MKD_ITERATIONS_MIN);
 473
 474         r = PBKDF2_HMAC(header->hashSpec,mk->key,mk->keyLength,
 475                         header->mkDigestSalt,LUKS_SALTSIZE,
 476                         header->mkDigestIterations,
 477                         header->mkDigest,LUKS_DIGESTSIZE);
 478         if(r < 0) {
 479                 log_err(ctx,  _("Cannot create LUKS header: header digest failed (using hash %s).\n"),
 480                         header->hashSpec);
 481                 return r;
 482         }
 483
 484         currentSector = round_up_modulo(LUKS_PHDR_SIZE, alignSectors);
 485         for(i = 0; i < LUKS_NUMKEYS; ++i) {
 486                 header->keyblock[i].active = LUKS_KEY_DISABLED;
 487                 header->keyblock[i].keyMaterialOffset = currentSector;
 488                 header->keyblock[i].stripes = stripes;
 489                 currentSector = round_up_modulo(currentSector + blocksPerStripeSet, alignSectors);
 490         }
 491         currentSector = round_up_modulo(currentSector, alignPayload);
 492
 493         /* alignOffset - offset from natural device alignment provided by topology info */
 494         header->payloadOffset = currentSector + alignOffset;
 495
 496         uuid_from_string(uuid, &partitionUuid, &ret);
 497         if (uuid && ret != uuid_s_ok) {
 498                 log_err(ctx, _("Wrong UUID format provided, generating new one.\n"));
 499                 uuid = NULL;
 500         }
 501         if (!uuid)
 502                 uuid_create(&partitionUuid, &ret);
 503         uuid_to_string(&partitionUuid, &uu, &ret);
 504         if (uu == NULL) {
 505                 log_err(ctx, _("Cannot allocate memory in uuid_to_string()\n"));
 506                 return -1;
 507         }
 508         memcpy(header->uuid, uu, UUID_STRING_L);
 509         free(uu);
 510
 511         log_dbg("Data offset %d, UUID %s, digest iterations %" PRIu32,
 512                 header->payloadOffset, header->uuid, header->mkDigestIterations);
 513
 514         return 0;
 515 }
 516
 517 int LUKS_set_key(const char *device, unsigned int keyIndex,
 518                  const char *password, size_t passwordLen,
 519                  struct luks_phdr *hdr, struct luks_masterkey *mk,
 520                  uint32_t iteration_time_ms,
 521                  uint64_t *PBKDF2_per_sec,
 522                  struct crypt_device *ctx)
 523 {
 524         char derivedKey[hdr->keyBytes];
 525         char *AfKey;
 526         unsigned int AFEKSize;
 527         uint64_t PBKDF2_temp;
 528         int r;
 529
 530         if(hdr->keyblock[keyIndex].active != LUKS_KEY_DISABLED) {
 531                 log_err(ctx,  _("Key slot %d active, purge first.\n"), keyIndex);
 532                 return -EINVAL;
 533         }
 534
 535         if(hdr->keyblock[keyIndex].stripes < LUKS_STRIPES) {
 536                 log_err(ctx, _("Key slot %d material includes too few stripes. Header manipulation?\n"),
 537                         keyIndex);
 538                  return -EINVAL;
 539         }
 540
 541         log_dbg("Calculating data for key slot %d", keyIndex);
 542
 543         if ((r = LUKS_PBKDF2_performance_check(hdr->hashSpec, PBKDF2_per_sec, ctx)))
 544                 return r;
 545
 546         /*
 547          * Avoid floating point operation
 548          * Final iteration count is at least LUKS_SLOT_ITERATIONS_MIN
 549          */
 550         PBKDF2_temp = (*PBKDF2_per_sec / 2) * (uint64_t)iteration_time_ms;
 551         PBKDF2_temp /= 1024;
 552         if (PBKDF2_temp > UINT32_MAX)
 553                 PBKDF2_temp = UINT32_MAX;
 554         hdr->keyblock[keyIndex].passwordIterations = at_least((uint32_t)PBKDF2_temp,
 555                                                               LUKS_SLOT_ITERATIONS_MIN);
 556
 557         log_dbg("Key slot %d use %d password iterations.", keyIndex, hdr->keyblock[keyIndex].passwordIterations);
 558
 559         r = getRandom(hdr->keyblock[keyIndex].passwordSalt, LUKS_SALTSIZE);
 560         if(r < 0) return r;
 561
 562 //      assert((mk->keyLength % TWOFISH_BLOCKSIZE) == 0); FIXME
 563
 564         r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
 565                         hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
 566                         hdr->keyblock[keyIndex].passwordIterations,
 567                         derivedKey, hdr->keyBytes);
 568         if(r < 0) return r;
 569
 570         /*
 571          * AF splitting, the masterkey stored in mk->key is splitted to AfMK
 572          */
 573         AFEKSize = hdr->keyblock[keyIndex].stripes*mk->keyLength;
 574         AfKey = (char *)malloc(AFEKSize);
 575         if(AfKey == NULL) return -ENOMEM;
 576
 577         log_dbg("Using hash %s for AF in key slot %d, %d stripes",
 578                 hdr->hashSpec, keyIndex, hdr->keyblock[keyIndex].stripes);
 579         r = AF_split(mk->key,AfKey,mk->keyLength,hdr->keyblock[keyIndex].stripes,hdr->hashSpec);
 580         if(r < 0) goto out;
 581
 582         log_dbg("Updating key slot %d [0x%04x] area on device %s.", keyIndex,
 583                 hdr->keyblock[keyIndex].keyMaterialOffset << 9, device);
 584         /* Encryption via dm */
 585         r = LUKS_encrypt_to_storage(AfKey,
 586                                     AFEKSize,
 587                                     hdr,
 588                                     derivedKey,
 589                                     hdr->keyBytes,
 590                                     device,
 591                                     hdr->keyblock[keyIndex].keyMaterialOffset,
 592                                     ctx);
 593         if(r < 0) {
 594                 if(!get_error())
 595                         log_err(ctx, _("Failed to write to key storage.\n"));
 596                 goto out;
 597         }
 598
 599         /* Mark the key as active in phdr */
 600         r = LUKS_keyslot_set(hdr, (int)keyIndex, 1);
 601         if(r < 0) goto out;
 602
 603         r = LUKS_write_phdr(device, hdr, ctx);
 604         if(r < 0) goto out;
 605
 606         r = 0;
 607 out:
 608         free(AfKey);
 609         return r;
 610 }
 611
 612 /* Check whether a master key is invalid. */
 613 int LUKS_verify_master_key(const struct luks_phdr *hdr,
 614                            const struct luks_masterkey *mk)
 615 {
 616         char checkHashBuf[LUKS_DIGESTSIZE];
 617
 618         if (PBKDF2_HMAC(hdr->hashSpec, mk->key, mk->keyLength,
 619                         hdr->mkDigestSalt, LUKS_SALTSIZE,
 620                         hdr->mkDigestIterations, checkHashBuf,
 621                         LUKS_DIGESTSIZE) < 0)
 622                 return -EINVAL;
 623
 624         if (memcmp(checkHashBuf, hdr->mkDigest, LUKS_DIGESTSIZE))
 625                 return -EPERM;
 626
 627         return 0;
 628 }
 629
 630 /* Try to open a particular key slot */
 631 static int LUKS_open_key(const char *device,
 632                   unsigned int keyIndex,
 633                   const char *password,
 634                   size_t passwordLen,
 635                   struct luks_phdr *hdr,
 636                   struct luks_masterkey *mk,
 637                   struct crypt_device *ctx)
 638 {
 639         crypt_keyslot_info ki = LUKS_keyslot_info(hdr, keyIndex);
 640         char derivedKey[hdr->keyBytes];
 641         char *AfKey;
 642         size_t AFEKSize;
 643         int r;
 644
 645         log_dbg("Trying to open key slot %d [%d].", keyIndex, (int)ki);
 646
 647         if (ki < CRYPT_SLOT_ACTIVE)
 648                 return -ENOENT;
 649
 650         // assert((mk->keyLength % TWOFISH_BLOCKSIZE) == 0); FIXME
 651
 652         AFEKSize = hdr->keyblock[keyIndex].stripes*mk->keyLength;
 653         AfKey = (char *)malloc(AFEKSize);
 654         if(AfKey == NULL) return -ENOMEM;
 655
 656         r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
 657                         hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
 658                         hdr->keyblock[keyIndex].passwordIterations,
 659                         derivedKey, hdr->keyBytes);
 660         if(r < 0) goto out;
 661
 662         log_dbg("Reading key slot %d area.", keyIndex);
 663         r = LUKS_decrypt_from_storage(AfKey,
 664                                       AFEKSize,
 665                                       hdr,
 666                                       derivedKey,
 667                                       hdr->keyBytes,
 668                                       device,
 669                                       hdr->keyblock[keyIndex].keyMaterialOffset,
 670                                       ctx);
 671         if(r < 0) {
 672                 log_err(ctx, _("Failed to read from key storage.\n"));
 673                 goto out;
 674         }
 675
 676         r = AF_merge(AfKey,mk->key,mk->keyLength,hdr->keyblock[keyIndex].stripes,hdr->hashSpec);
 677         if(r < 0) goto out;
 678
 679         r = LUKS_verify_master_key(hdr, mk);
 680         if (r >= 0)
 681                 log_verbose(ctx, _("Key slot %d unlocked.\n"), keyIndex);
 682 out:
 683         free(AfKey);
 684         return r;
 685 }
 686
 687 int LUKS_open_key_with_hdr(const char *device,
 688                            int keyIndex,
 689                            const char *password,
 690                            size_t passwordLen,
 691                            struct luks_phdr *hdr,
 692                            struct luks_masterkey **mk,
 693                            struct crypt_device *ctx)
 694 {
 695         unsigned int i;
 696         int r;
 697
 698         *mk = LUKS_alloc_masterkey(hdr->keyBytes, NULL);
 699
 700         if (keyIndex >= 0)
 701                 return LUKS_open_key(device, keyIndex, password, passwordLen, hdr, *mk, ctx);
 702
 703         for(i = 0; i < LUKS_NUMKEYS; i++) {
 704                 r = LUKS_open_key(device, i, password, passwordLen, hdr, *mk, ctx);
 705                 if(r == 0)
 706                         return i;
 707
 708                 /* Do not retry for errors that are no -EPERM or -ENOENT,
 709                    former meaning password wrong, latter key slot inactive */
 710                 if ((r != -EPERM) && (r != -ENOENT))
 711                         return r;
 712         }
 713         /* Warning, early returns above */
 714         log_err(ctx, _("No key available with this passphrase.\n"));
 715         return -EPERM;
 716 }
 717
 718 /*
 719  * Wipe patterns according to Gutmann's Paper
 720  */
 721
 722 static void wipeSpecial(char *buffer, size_t buffer_size, unsigned int turn)
 723 {
 724         unsigned int i;
 725
 726         unsigned char write_modes[][3] = {
 727                 {"\x55\x55\x55"}, {"\xaa\xaa\xaa"}, {"\x92\x49\x24"},
 728                 {"\x49\x24\x92"}, {"\x24\x92\x49"}, {"\x00\x00\x00"},
 729                 {"\x11\x11\x11"}, {"\x22\x22\x22"}, {"\x33\x33\x33"},
 730                 {"\x44\x44\x44"}, {"\x55\x55\x55"}, {"\x66\x66\x66"},
 731                 {"\x77\x77\x77"}, {"\x88\x88\x88"}, {"\x99\x99\x99"},
 732                 {"\xaa\xaa\xaa"}, {"\xbb\xbb\xbb"}, {"\xcc\xcc\xcc"},
 733                 {"\xdd\xdd\xdd"}, {"\xee\xee\xee"}, {"\xff\xff\xff"},
 734                 {"\x92\x49\x24"}, {"\x49\x24\x92"}, {"\x24\x92\x49"},
 735                 {"\x6d\xb6\xdb"}, {"\xb6\xdb\x6d"}, {"\xdb\x6d\xb6"}
 736         };
 737
 738         for(i = 0; i < buffer_size / 3; ++i) {
 739                 memcpy(buffer, write_modes[turn], 3);
 740                 buffer += 3;
 741         }
 742 }
 743
 744 static int wipe(const char *device, unsigned int from, unsigned int to)
 745 {
 746         int devfd;
 747         char *buffer;
 748         unsigned int i;
 749         unsigned int bufLen = (to - from) * SECTOR_SIZE;
 750         int r = 0;
 751
 752         devfd = open(device, O_RDWR | O_DIRECT | O_SYNC);
 753         if(devfd == -1)
 754                 return -EINVAL;
 755
 756         buffer = (char *) malloc(bufLen);
 757         if(!buffer) return -ENOMEM;
 758
 759         for(i = 0; i < 39; ++i) {
 760                 if     (i >=  0 && i <  5) getRandom(buffer, bufLen);
 761                 else if(i >=  5 && i < 32) wipeSpecial(buffer, bufLen, i - 5);
 762                 else if(i >= 32 && i < 38) getRandom(buffer, bufLen);
 763                 else if(i >= 38 && i < 39) memset(buffer, 0xFF, bufLen);
 764
 765                 if(write_lseek_blockwise(devfd, buffer, bufLen, from * SECTOR_SIZE) < 0) {
 766                         r = -EIO;
 767                         break;
 768                 }
 769         }
 770
 771         free(buffer);
 772         close(devfd);
 773
 774         return r;
 775 }
 776
 777 int LUKS_del_key(const char *device,
 778                  unsigned int keyIndex,
 779                  struct luks_phdr *hdr,
 780                  struct crypt_device *ctx)
 781 {
 782         unsigned int startOffset, endOffset, stripesLen;
 783         int r;
 784
 785         r = LUKS_read_phdr(device, hdr, 1, ctx);
 786         if (r)
 787                 return r;
 788
 789         r = LUKS_keyslot_set(hdr, keyIndex, 0);
 790         if (r) {
 791                 log_err(ctx, _("Key slot %d is invalid, please select keyslot between 0 and %d.\n"),
 792                         keyIndex, LUKS_NUMKEYS - 1);
 793                 return r;
 794         }
 795
 796         /* secure deletion of key material */
 797         startOffset = hdr->keyblock[keyIndex].keyMaterialOffset;
 798         stripesLen = hdr->keyBytes * hdr->keyblock[keyIndex].stripes;
 799         endOffset = startOffset + div_round_up(stripesLen, SECTOR_SIZE);
 800
 801         r = wipe(device, startOffset, endOffset);
 802         if (r) {
 803                 log_err(ctx, _("Cannot wipe device %s.\n"), device);
 804                 return r;
 805         }
 806
 807         r = LUKS_write_phdr(device, hdr, ctx);
 808
 809         return r;
 810 }
 811
 812 crypt_keyslot_info LUKS_keyslot_info(struct luks_phdr *hdr, int keyslot)
 813 {
 814         int i;
 815
 816         if(keyslot >= LUKS_NUMKEYS || keyslot < 0)
 817                 return CRYPT_SLOT_INVALID;
 818
 819         if (hdr->keyblock[keyslot].active == LUKS_KEY_DISABLED)
 820                 return CRYPT_SLOT_INACTIVE;
 821
 822         if (hdr->keyblock[keyslot].active != LUKS_KEY_ENABLED)
 823                 return CRYPT_SLOT_INVALID;
 824
 825         for(i = 0; i < LUKS_NUMKEYS; i++)
 826                 if(i != keyslot && hdr->keyblock[i].active == LUKS_KEY_ENABLED)
 827                         return CRYPT_SLOT_ACTIVE;
 828
 829         return CRYPT_SLOT_ACTIVE_LAST;
 830 }
 831
 832 int LUKS_keyslot_find_empty(struct luks_phdr *hdr)
 833 {
 834         int i;
 835
 836         for (i = 0; i < LUKS_NUMKEYS; i++)
 837                 if(hdr->keyblock[i].active == LUKS_KEY_DISABLED)
 838                         break;
 839
 840         if (i == LUKS_NUMKEYS)
 841                 return -EINVAL;
 842
 843         return i;
 844 }
 845
 846 int LUKS_keyslot_active_count(struct luks_phdr *hdr)
 847 {
 848         int i, num = 0;
 849
 850         for (i = 0; i < LUKS_NUMKEYS; i++)
 851                 if(hdr->keyblock[i].active == LUKS_KEY_ENABLED)
 852                         num++;
 853
 854         return num;
 855 }
 856
 857 int LUKS_keyslot_set(struct luks_phdr *hdr, int keyslot, int enable)
 858 {
 859         crypt_keyslot_info ki = LUKS_keyslot_info(hdr, keyslot);
 860
 861         if (ki == CRYPT_SLOT_INVALID)
 862                 return -EINVAL;
 863
 864         hdr->keyblock[keyslot].active = enable ? LUKS_KEY_ENABLED : LUKS_KEY_DISABLED;
 865         log_dbg("Key slot %d was %s in LUKS header.", keyslot, enable ? "enabled" : "disabled");
 866         return 0;
 867 }