2 * Copyright (c) 2016 Konrad Witaszczyk <def@FreeBSD.org>
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
30 #include <sys/types.h>
31 #include <sys/capsicum.h>
32 #include <sys/endian.h>
33 #include <sys/kerneldump.h>
37 #include <capsicum_helpers.h>
44 #include <openssl/evp.h>
45 #include <openssl/pem.h>
46 #include <openssl/rsa.h>
47 #include <openssl/engine.h>
51 #define DECRYPTCORE_CRASHDIR "/var/crash"
58 "usage: decryptcore [-fLv] -p privatekeyfile -k keyfile -e encryptedcore -c core\n"
59 " decryptcore [-fLv] [-d crashdir] -p privatekeyfile -n dumpnr");
63 wait_for_process(pid_t pid)
67 if (waitpid(pid, &status, WUNTRACED | WEXITED) == -1) {
68 pjdlog_errno(LOG_ERR, "Unable to wait for a child process");
72 if (WIFEXITED(status))
73 return (WEXITSTATUS(status));
78 static struct kerneldumpkey *
81 struct kerneldumpkey *kdk;
85 PJDLOG_ASSERT(kfd >= 0);
87 kdksize = sizeof(*kdk);
88 kdk = calloc(1, kdksize);
90 pjdlog_errno(LOG_ERR, "Unable to allocate kernel dump key");
94 size = read(kfd, kdk, kdksize);
95 if (size == (ssize_t)kdksize) {
96 kdk->kdk_encryptedkeysize = dtoh32(kdk->kdk_encryptedkeysize);
97 kdksize += (size_t)kdk->kdk_encryptedkeysize;
98 kdk = realloc(kdk, kdksize);
100 pjdlog_errno(LOG_ERR, "Unable to reallocate kernel dump key");
103 size += read(kfd, &kdk->kdk_encryptedkey,
104 kdk->kdk_encryptedkeysize);
106 if (size != (ssize_t)kdksize) {
107 pjdlog_errno(LOG_ERR, "Unable to read key");
118 decrypt(int ofd, const char *privkeyfile, const char *keyfile,
121 uint8_t buf[KERNELDUMP_BUFFER_SIZE], key[KERNELDUMP_KEY_MAX_SIZE],
124 const EVP_CIPHER *cipher;
126 struct kerneldumpkey *kdk;
128 int ifd, kfd, olen, privkeysize;
132 PJDLOG_ASSERT(ofd >= 0);
133 PJDLOG_ASSERT(privkeyfile != NULL);
134 PJDLOG_ASSERT(keyfile != NULL);
135 PJDLOG_ASSERT(input != NULL);
141 * Decrypt a core dump in a child process so we can unlink a partially
142 * decrypted core if the child process fails.
146 pjdlog_errno(LOG_ERR, "Unable to create child process");
153 return (wait_for_process(pid) == 0);
156 kfd = open(keyfile, O_RDONLY);
158 pjdlog_errno(LOG_ERR, "Unable to open %s", keyfile);
161 ifd = open(input, O_RDONLY);
163 pjdlog_errno(LOG_ERR, "Unable to open %s", input);
166 fp = fopen(privkeyfile, "r");
168 pjdlog_errno(LOG_ERR, "Unable to open %s", privkeyfile);
173 * Obsolescent OpenSSL only knows about /dev/random, and needs to
174 * pre-seed before entering cap mode. For whatever reason,
175 * RSA_pub_encrypt uses the internal PRNG.
177 #if OPENSSL_VERSION_NUMBER < 0x10100000L
183 ERR_load_crypto_strings();
185 caph_cache_catpages();
186 if (caph_enter() < 0) {
187 pjdlog_errno(LOG_ERR, "Unable to enter capability mode");
192 if (privkey == NULL) {
193 pjdlog_error("Unable to allocate an RSA structure: %s",
194 ERR_error_string(ERR_get_error(), NULL));
197 ctx = EVP_CIPHER_CTX_new();
206 privkey = PEM_read_RSAPrivateKey(fp, &privkey, NULL, NULL);
208 if (privkey == NULL) {
209 pjdlog_error("Unable to read data from %s.", privkeyfile);
213 privkeysize = RSA_size(privkey);
214 if (privkeysize != (int)kdk->kdk_encryptedkeysize) {
215 pjdlog_error("RSA modulus size mismatch: equals %db and should be %ub.",
216 8 * privkeysize, 8 * kdk->kdk_encryptedkeysize);
220 switch (kdk->kdk_encryption) {
221 case KERNELDUMP_ENC_AES_256_CBC:
222 cipher = EVP_aes_256_cbc();
224 case KERNELDUMP_ENC_CHACHA20:
225 cipher = EVP_chacha20();
228 pjdlog_error("Invalid encryption algorithm.");
232 if (RSA_private_decrypt(kdk->kdk_encryptedkeysize,
233 kdk->kdk_encryptedkey, key, privkey,
234 RSA_PKCS1_OAEP_PADDING) != sizeof(key) &&
235 /* Fallback to deprecated, formerly-used PKCS 1.5 padding. */
236 RSA_private_decrypt(kdk->kdk_encryptedkeysize,
237 kdk->kdk_encryptedkey, key, privkey,
238 RSA_PKCS1_PADDING) != sizeof(key)) {
239 pjdlog_error("Unable to decrypt key: %s",
240 ERR_error_string(ERR_get_error(), NULL));
246 if (kdk->kdk_encryption == KERNELDUMP_ENC_CHACHA20) {
248 * OpenSSL treats the IV as 4 little-endian 32 bit integers.
250 * The first two represent a 64-bit counter, where the low half
251 * is the first 32-bit word.
253 * Start at counter block zero...
255 memset(chachaiv, 0, 4 * 2);
257 * And use the IV specified by the dump.
259 memcpy(&chachaiv[4 * 2], kdk->kdk_iv, 4 * 2);
260 EVP_DecryptInit_ex(ctx, cipher, NULL, key, chachaiv);
262 EVP_DecryptInit_ex(ctx, cipher, NULL, key, kdk->kdk_iv);
263 EVP_CIPHER_CTX_set_padding(ctx, 0);
265 explicit_bzero(key, sizeof(key));
268 bytes = read(ifd, buf, sizeof(buf));
270 pjdlog_errno(LOG_ERR, "Unable to read data from %s",
276 if (EVP_DecryptUpdate(ctx, buf, &olen, buf,
278 pjdlog_error("Unable to decrypt core.");
282 if (EVP_DecryptFinal_ex(ctx, buf, &olen) == 0) {
283 pjdlog_error("Unable to decrypt core.");
288 if (olen > 0 && write(ofd, buf, olen) != olen) {
289 pjdlog_errno(LOG_ERR, "Unable to write core");
294 explicit_bzero(buf, sizeof(buf));
295 EVP_CIPHER_CTX_free(ctx);
298 explicit_bzero(key, sizeof(key));
299 explicit_bzero(buf, sizeof(buf));
302 EVP_CIPHER_CTX_free(ctx);
307 main(int argc, char **argv)
309 char core[PATH_MAX], encryptedcore[PATH_MAX], keyfile[PATH_MAX];
310 const char *crashdir, *dumpnr, *privatekey;
311 int ch, debug, error, ofd;
313 bool force, usesyslog;
317 pjdlog_init(PJDLOG_MODE_STD);
318 pjdlog_prefix_set("(decryptcore) ");
324 *encryptedcore = '\0';
329 while ((ch = getopt(argc, argv, "Lc:d:e:fk:n:p:v")) != -1) {
335 if (strlcpy(core, optarg, sizeof(core)) >= sizeof(core))
336 pjdlog_exitx(1, "Core file path is too long.");
342 if (strlcpy(encryptedcore, optarg,
343 sizeof(encryptedcore)) >= sizeof(encryptedcore)) {
344 pjdlog_exitx(1, "Encrypted core file path is too long.");
351 if (strlcpy(keyfile, optarg, sizeof(keyfile)) >=
353 pjdlog_exitx(1, "Key file path is too long.");
375 /* Verify mutually exclusive options. */
376 if ((crashdir != NULL || dumpnr != NULL) &&
377 (*keyfile != '\0' || *encryptedcore != '\0' || *core != '\0')) {
382 * Set key, encryptedcore and core file names using crashdir and dumpnr.
384 if (dumpnr != NULL) {
385 for (ii = 0; ii < strnlen(dumpnr, PATH_MAX); ii++) {
386 if (isdigit((int)dumpnr[ii]) == 0)
390 if (crashdir == NULL)
391 crashdir = DECRYPTCORE_CRASHDIR;
392 PJDLOG_VERIFY(snprintf(keyfile, sizeof(keyfile),
393 "%s/key.%s", crashdir, dumpnr) > 0);
394 PJDLOG_VERIFY(snprintf(core, sizeof(core),
395 "%s/vmcore.%s", crashdir, dumpnr) > 0);
396 PJDLOG_VERIFY(snprintf(encryptedcore, sizeof(encryptedcore),
397 "%s/vmcore_encrypted.%s", crashdir, dumpnr) > 0);
400 if (privatekey == NULL || *keyfile == '\0' || *encryptedcore == '\0' ||
406 pjdlog_mode_set(PJDLOG_MODE_SYSLOG);
407 pjdlog_debug_set(debug);
409 if (force && unlink(core) == -1 && errno != ENOENT) {
410 pjdlog_errno(LOG_ERR, "Unable to remove old core");
413 ofd = open(core, O_WRONLY | O_CREAT | O_EXCL, 0600);
415 pjdlog_errno(LOG_ERR, "Unable to open %s", core);
419 if (!decrypt(ofd, privatekey, keyfile, encryptedcore)) {
420 if (unlink(core) == -1 && errno != ENOENT)
421 pjdlog_errno(LOG_ERR, "Unable to remove core");