* [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names
@ 2020-03-17 7:57 Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 2/6] cryptodisk: geli: " Denis 'GNUtoo' Carikli
` (5 more replies)
0 siblings, 6 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, Denis 'GNUtoo' Carikli
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/luks.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 410cd6f84..28585806a 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -65,8 +65,7 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
grub_size_t blocknumbers);
static grub_cryptodisk_t
-configure_ciphers (grub_disk_t disk, const char *check_uuid,
- int check_boot)
+luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
{
grub_cryptodisk_t newdev;
const char *iptr;
@@ -310,7 +309,7 @@ luks_recover_key (grub_disk_t source,
}
struct grub_cryptodisk_dev luks_crypto = {
- .scan = configure_ciphers,
+ .scan = luks_scan,
.recover_key = luks_recover_key
};
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv2][ 2/6] cryptodisk: geli: unify grub_cryptodisk_dev function names
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
@ 2020-03-17 7:57 ` Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers Denis 'GNUtoo' Carikli
` (4 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, Denis 'GNUtoo' Carikli
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/geli.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index e9d23299a..786682077 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -242,8 +242,7 @@ grub_util_get_geli_uuid (const char *dev)
#endif
static grub_cryptodisk_t
-configure_ciphers (grub_disk_t disk, const char *check_uuid,
- int boot_only)
+geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
{
grub_cryptodisk_t newdev;
struct grub_geli_phdr header;
@@ -580,7 +579,7 @@ recover_key (grub_disk_t source, grub_cryptodisk_t dev)
}
struct grub_cryptodisk_dev geli_crypto = {
- .scan = configure_ciphers,
+ .scan = geli_scan,
.recover_key = recover_key
};
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 2/6] cryptodisk: geli: " Denis 'GNUtoo' Carikli
@ 2020-03-17 7:57 ` Denis 'GNUtoo' Carikli
2020-04-04 10:59 ` Patrick Steinhardt
2020-04-04 11:05 ` Patrick Steinhardt
2020-03-17 7:57 ` [PATCHv2][ 4/6] cryptodisk: add support for LUKS1 " Denis 'GNUtoo' Carikli
` (3 subsequent siblings)
5 siblings, 2 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, John Lane, Denis 'GNUtoo' Carikli
From: John Lane <john@lane.uk.net>
Signed-off-by: John Lane <john@lane.uk.net>
GNUtoo@cyberdimension.org: rebase, patch split, small fixes, commit message
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/cryptodisk.c | 24 ++++++++++++++++++++----
grub-core/disk/geli.c | 8 ++++++--
grub-core/disk/luks.c | 7 ++++---
grub-core/disk/luks2.c | 7 ++++---
include/grub/cryptodisk.h | 6 ++++--
include/grub/file.h | 2 ++
6 files changed, 40 insertions(+), 14 deletions(-)
diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 1897acc4b..fa342fe44 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
/* TRANSLATORS: It's still restricted to cryptodisks only. */
{"all", 'a', 0, N_("Mount all."), 0, 0},
{"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
+ {"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING},
{0, 0, 0, 0, 0, 0}
};
@@ -970,6 +971,7 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
static int check_boot, have_it;
static char *search_uuid;
+static grub_file_t hdr;
static void
cryptodisk_close (grub_cryptodisk_t dev)
@@ -994,13 +996,13 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
FOR_CRYPTODISK_DEVS (cr)
{
- dev = cr->scan (source, search_uuid, check_boot);
+ dev = cr->scan (source, search_uuid, check_boot, hdr);
if (grub_errno)
return grub_errno;
if (!dev)
continue;
- err = cr->recover_key (source, dev);
+ err = cr->recover_key (source, dev, hdr);
if (err)
{
cryptodisk_close (dev);
@@ -1041,7 +1043,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const char *cheat)
FOR_CRYPTODISK_DEVS (cr)
{
- dev = cr->scan (source, search_uuid, check_boot);
+ dev = cr->scan (source, search_uuid, check_boot, 0);
if (grub_errno)
return grub_errno;
if (!dev)
@@ -1095,6 +1097,20 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
if (argc < 1 && !state[1].set && !state[2].set)
return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required");
+ if (state[3].set) /* Detached header */
+ {
+ if (state[0].set)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT,
+ N_("Cannot use UUID lookup with detached header"));
+
+ hdr = grub_file_open (state[3].arg,
+ GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER);
+ if (!hdr)
+ return grub_errno;
+ }
+ else
+ hdr = NULL;
+
have_it = 0;
if (state[0].set)
{
@@ -1302,7 +1318,7 @@ GRUB_MOD_INIT (cryptodisk)
{
grub_disk_dev_register (&grub_cryptodisk_dev);
cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
- N_("SOURCE|-u UUID|-a|-b"),
+ N_("SOURCE|-u UUID|-a|-b|-H file"),
N_("Mount a crypto device."), options);
grub_procfs_register ("luks_script", &luks_script);
}
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index 786682077..bec0bb877 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -52,6 +52,7 @@
#include <grub/dl.h>
#include <grub/err.h>
#include <grub/disk.h>
+#include <grub/file.h>
#include <grub/crypto.h>
#include <grub/partition.h>
#include <grub/i18n.h>
@@ -242,7 +243,8 @@ grub_util_get_geli_uuid (const char *dev)
#endif
static grub_cryptodisk_t
-geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
+geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
+ grub_file_t hdr __attribute__((__unused__)))
{
grub_cryptodisk_t newdev;
struct grub_geli_phdr header;
@@ -254,6 +256,7 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
grub_disk_addr_t sector;
grub_err_t err;
+
if (2 * GRUB_MD_SHA256->mdlen + 1 > GRUB_CRYPTODISK_MAX_UUID_LENGTH)
return NULL;
@@ -397,7 +400,8 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
}
static grub_err_t
-recover_key (grub_disk_t source, grub_cryptodisk_t dev)
+recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+ grub_file_t hdr __attribute__ ((unused)))
{
grub_size_t keysize;
grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 28585806a..e07a2fef1 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -65,7 +65,8 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
grub_size_t blocknumbers);
static grub_cryptodisk_t
-luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
+luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
+ grub_file_t hdr __attribute__((__unused__)))
{
grub_cryptodisk_t newdev;
const char *iptr;
@@ -149,8 +150,8 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
}
static grub_err_t
-luks_recover_key (grub_disk_t source,
- grub_cryptodisk_t dev)
+luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+ grub_file_t hdr __attribute__ ((unused)))
{
struct grub_luks_phdr header;
grub_size_t keysize;
diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
index 65c4f0aac..562208e05 100644
--- a/grub-core/disk/luks2.c
+++ b/grub-core/disk/luks2.c
@@ -342,7 +342,8 @@ luks2_read_header (grub_disk_t disk, grub_luks2_header_t *outhdr)
}
static grub_cryptodisk_t
-luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
+luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
+ grub_file_t hdr_file __attribute__((__unused__)))
{
grub_cryptodisk_t cryptodisk;
grub_luks2_header_t header;
@@ -523,8 +524,8 @@ luks2_decrypt_key (grub_uint8_t *out_key,
}
static grub_err_t
-luks2_recover_key (grub_disk_t disk,
- grub_cryptodisk_t crypt)
+luks2_recover_key (grub_disk_t disk, grub_cryptodisk_t crypt,
+ grub_file_t hdr_file __attribute__ ((unused)))
{
grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
char passphrase[MAX_PASSPHRASE], cipher[32];
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index e1b21e785..e24b1b8cb 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -20,6 +20,7 @@
#define GRUB_CRYPTODISK_HEADER 1
#include <grub/disk.h>
+#include <grub/file.h>
#include <grub/crypto.h>
#include <grub/list.h>
#ifdef GRUB_UTIL
@@ -107,8 +108,9 @@ struct grub_cryptodisk_dev
struct grub_cryptodisk_dev **prev;
grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
- int boot_only);
- grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev);
+ int boot_only, grub_file_t hdr);
+ grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
+ grub_file_t hdr);
};
typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
diff --git a/include/grub/file.h b/include/grub/file.h
index 31567483c..a7d7be853 100644
--- a/include/grub/file.h
+++ b/include/grub/file.h
@@ -90,6 +90,8 @@ enum grub_file_type
GRUB_FILE_TYPE_FONT,
/* File holding encryption key for encrypted ZFS. */
GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY,
+ /* File holiding the encryption metadata header */
+ GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER,
/* File we open n grub-fstest. */
GRUB_FILE_TYPE_FSTEST,
/* File we open n grub-mount. */
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv2][ 4/6] cryptodisk: add support for LUKS1 detached headers
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 2/6] cryptodisk: geli: " Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers Denis 'GNUtoo' Carikli
@ 2020-03-17 7:57 ` Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files Denis 'GNUtoo' Carikli
` (2 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, John Lane, Denis 'GNUtoo' Carikli
From: John Lane <john@lane.uk.net>
cryptsetup supports having a detached header through the
--header command line argument for both LUKS1 and LUKS2.
This adds support for LUKS1 detached headers.
Signed-off-by: John Lane <john@lane.uk.net>
GNUtoo@cyberdimension.org: rebase, small fixes, commit message
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/luks.c | 49 +++++++++++++++++++++++++++++++++----------
1 file changed, 38 insertions(+), 11 deletions(-)
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index e07a2fef1..0b20908ac 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -23,6 +23,7 @@
#include <grub/dl.h>
#include <grub/err.h>
#include <grub/disk.h>
+#include <grub/file.h>
#include <grub/crypto.h>
#include <grub/partition.h>
#include <grub/i18n.h>
@@ -66,7 +67,7 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
static grub_cryptodisk_t
luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
- grub_file_t hdr __attribute__((__unused__)))
+ grub_file_t hdr)
{
grub_cryptodisk_t newdev;
const char *iptr;
@@ -76,13 +77,23 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
char ciphername[sizeof (header.cipherName) + 1];
char ciphermode[sizeof (header.cipherMode) + 1];
char hashspec[sizeof (header.hashSpec) + 1];
- grub_err_t err;
+ grub_err_t err = GRUB_ERR_NONE;
if (check_boot)
return NULL;
/* Read the LUKS header. */
- err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
+ if (hdr)
+ {
+ if (grub_file_seek (hdr, 0) == (grub_off_t) -1)
+ return NULL;
+
+ if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
+ return NULL;
+ }
+ else
+ err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
+
if (err)
{
if (err == GRUB_ERR_OUT_OF_RANGE)
@@ -150,8 +161,7 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
}
static grub_err_t
-luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev,
- grub_file_t hdr __attribute__ ((unused)))
+luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr)
{
struct grub_luks_phdr header;
grub_size_t keysize;
@@ -160,11 +170,22 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev,
grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
unsigned i;
grub_size_t length;
- grub_err_t err;
+ grub_err_t err = GRUB_ERR_NONE;
grub_size_t max_stripes = 1;
char *tmp;
+ grub_uint32_t sector;
+
+ if (hdr)
+ {
+ if (grub_file_seek (hdr, 0) == (grub_off_t) -1)
+ return grub_errno;
+
+ if (grub_file_read (hdr, &header, sizeof (header)) != sizeof (header))
+ return grub_errno;
+ }
+ else
+ err = grub_disk_read (source, 0, 0, sizeof (header), &header);
- err = grub_disk_read (source, 0, 0, sizeof (header), &header);
if (err)
return err;
@@ -233,13 +254,19 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev,
return grub_crypto_gcry_error (gcry_err);
}
+ sector = grub_be_to_cpu32 (header.keyblock[i].keyMaterialOffset);
length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
/* Read and decrypt the key material from the disk. */
- err = grub_disk_read (source,
- grub_be_to_cpu32 (header.keyblock
- [i].keyMaterialOffset), 0,
- length, split_key);
+ if (hdr)
+ {
+ if (grub_file_seek (hdr, sector * 512))
+ return grub_errno;
+ if (grub_file_read (hdr, split_key, length) != (grub_ssize_t)length)
+ return grub_errno;
+ }
+ else
+ err = grub_disk_read (source, sector, 0, length, split_key);
if (err)
{
grub_free (split_key);
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
` (2 preceding siblings ...)
2020-03-17 7:57 ` [PATCHv2][ 4/6] cryptodisk: add support for LUKS1 " Denis 'GNUtoo' Carikli
@ 2020-03-17 7:57 ` Denis 'GNUtoo' Carikli
2020-04-04 11:16 ` Patrick Steinhardt
2020-03-17 7:57 ` [PATCHv2][ 6/6] cryptodisk: Add support for LUKS1 " Denis 'GNUtoo' Carikli
2020-03-17 8:10 ` [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
5 siblings, 1 reply; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, John Lane, Denis 'GNUtoo' Carikli
From: John Lane <john@lane.uk.net>
Signed-off-by: John Lane <john@lane.uk.net>
GNUtoo@cyberdimension.org: rebase, patch split, small fixes, commit message
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/cryptodisk.c | 71 ++++++++++++++++++++++++++++++++++++-
grub-core/disk/geli.c | 4 ++-
grub-core/disk/luks.c | 4 ++-
grub-core/disk/luks2.c | 4 ++-
include/grub/cryptodisk.h | 5 ++-
include/grub/file.h | 2 ++
6 files changed, 85 insertions(+), 5 deletions(-)
diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index fa342fe44..2adb224d0 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -42,6 +42,9 @@ static const struct grub_arg_option options[] =
{"all", 'a', 0, N_("Mount all."), 0, 0},
{"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
{"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING},
+ {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
+ {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
+ {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
{0, 0, 0, 0, 0, 0}
};
@@ -972,6 +975,8 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
static int check_boot, have_it;
static char *search_uuid;
static grub_file_t hdr;
+static grub_uint8_t *key, keyfile_buffer[GRUB_CRYPTODISK_MAX_KEYFILE_SIZE];
+static grub_ssize_t key_size;
static void
cryptodisk_close (grub_cryptodisk_t dev)
@@ -1002,7 +1007,7 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
if (!dev)
continue;
- err = cr->recover_key (source, dev, hdr);
+ err = cr->recover_key (source, dev, hdr, key, key_size);
if (err)
{
cryptodisk_close (dev);
@@ -1112,6 +1117,70 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
hdr = NULL;
have_it = 0;
+ key = NULL;
+
+ if (state[4].set) /* keyfile */
+ {
+ grub_file_t keyfile;
+ int keyfile_offset;
+ grub_size_t requested_keyfile_size = 0;
+
+ if (state[5].set) /* keyfile-offset */
+ {
+ keyfile_offset = grub_strtoul (state[5].arg, 0, 0);
+
+ if (grub_errno != GRUB_ERR_NONE)
+ return grub_errno;
+ }
+ else
+ {
+ keyfile_offset = 0;
+ }
+
+ if (state[6].set) /* keyfile-size */
+ {
+ requested_keyfile_size = grub_strtoul(state[6].arg, 0, 0);
+
+ if (grub_errno != GRUB_ERR_NONE)
+ return grub_errno;
+
+ if (requested_keyfile_size > GRUB_CRYPTODISK_MAX_KEYFILE_SIZE)
+ return grub_error(GRUB_ERR_OUT_OF_RANGE,
+ N_("Key file size exceeds maximum (%llu)\n"), \
+ (unsigned long long) GRUB_CRYPTODISK_MAX_KEYFILE_SIZE);
+ }
+
+
+ keyfile = grub_file_open (state[4].arg,
+ GRUB_FILE_TYPE_CRYPTODISK_ENCRYPTION_KEY);
+ if (!keyfile)
+ return grub_errno;
+
+ if (grub_file_seek (keyfile, keyfile_offset) == (grub_off_t)-1)
+ return grub_errno;
+
+
+ if (state[6].set) /* keyfile-size */
+ {
+ if (requested_keyfile_size > (keyfile->size - keyfile_offset))
+ return grub_error (GRUB_ERR_FILE_READ_ERROR,
+ N_("Cannot read %llu bytes for key file (read %llu bytes)\n"),
+ (unsigned long long) requested_keyfile_size,
+ (unsigned long long) keyfile->size);
+
+ key_size = requested_keyfile_size;
+ }
+ else
+ {
+ key_size = keyfile->size - keyfile_offset;
+ }
+
+ if (grub_file_read (keyfile, keyfile_buffer, key_size) != key_size)
+ return grub_error (GRUB_ERR_FILE_READ_ERROR,
+ (N_("Error reading key file\n")));
+ key = keyfile_buffer;
+ }
+
if (state[0].set)
{
grub_cryptodisk_t dev;
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index bec0bb877..7b3f3e721 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -401,7 +401,9 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
static grub_err_t
recover_key (grub_disk_t source, grub_cryptodisk_t dev,
- grub_file_t hdr __attribute__ ((unused)))
+ grub_file_t hdr __attribute__ ((unused)),
+ grub_uint8_t *key __attribute__ ((unused)),
+ grub_size_t keyfile_size __attribute__ ((unused)))
{
grub_size_t keysize;
grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 0b20908ac..d0f65700d 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -161,7 +161,9 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
}
static grub_err_t
-luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr)
+luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr,
+ grub_uint8_t *keyfile_bytes __attribute__ ((unused)),
+ grub_size_t keyfile_bytes_size __attribute__ ((unused)))
{
struct grub_luks_phdr header;
grub_size_t keysize;
diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
index 562208e05..48fa93eb2 100644
--- a/grub-core/disk/luks2.c
+++ b/grub-core/disk/luks2.c
@@ -525,7 +525,9 @@ luks2_decrypt_key (grub_uint8_t *out_key,
static grub_err_t
luks2_recover_key (grub_disk_t disk, grub_cryptodisk_t crypt,
- grub_file_t hdr_file __attribute__ ((unused)))
+ grub_file_t hdr_file __attribute__ ((unused)),
+ grub_uint8_t *key __attribute__ ((unused)),
+ grub_size_t keyfile_size __attribute__ ((unused)))
{
grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
char passphrase[MAX_PASSPHRASE], cipher[32];
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index e24b1b8cb..6d2610f93 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -55,6 +55,8 @@ typedef enum
#define GRUB_CRYPTODISK_GF_BYTES (1U << GRUB_CRYPTODISK_GF_LOG_BYTES)
#define GRUB_CRYPTODISK_MAX_KEYLEN 128
+#define GRUB_CRYPTODISK_MAX_KEYFILE_SIZE 8192
+
struct grub_cryptodisk;
typedef gcry_err_code_t
@@ -110,7 +112,8 @@ struct grub_cryptodisk_dev
grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
int boot_only, grub_file_t hdr);
grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
- grub_file_t hdr);
+ grub_file_t hdr, grub_uint8_t *key,
+ grub_size_t keyfile_size);
};
typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
diff --git a/include/grub/file.h b/include/grub/file.h
index a7d7be853..97678aa45 100644
--- a/include/grub/file.h
+++ b/include/grub/file.h
@@ -92,6 +92,8 @@ enum grub_file_type
GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY,
/* File holiding the encryption metadata header */
GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER,
+ /* File holiding the encryption key */
+ GRUB_FILE_TYPE_CRYPTODISK_ENCRYPTION_KEY,
/* File we open n grub-fstest. */
GRUB_FILE_TYPE_FSTEST,
/* File we open n grub-mount. */
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCHv2][ 6/6] cryptodisk: Add support for LUKS1 key files
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
` (3 preceding siblings ...)
2020-03-17 7:57 ` [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files Denis 'GNUtoo' Carikli
@ 2020-03-17 7:57 ` Denis 'GNUtoo' Carikli
2020-03-17 8:10 ` [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
5 siblings, 0 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 7:57 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper
Cc: The development of GNU GRUB, Denis 'GNUtoo' Carikli, John Lane
cryptsetup supports key files thourh the --key-file
--header command line argument for both LUKS1 and LUKS2.
This adds support for LUKS1 key files.
Signed-off-by: John Lane <john@lane.uk.net>
GNUtoo@cyberdimension.org: rebase, fixes, commit message
Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
---
grub-core/disk/luks.c | 42 +++++++++++++++++++++++++++---------------
1 file changed, 27 insertions(+), 15 deletions(-)
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index d0f65700d..376895259 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -162,13 +162,14 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
static grub_err_t
luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr,
- grub_uint8_t *keyfile_bytes __attribute__ ((unused)),
- grub_size_t keyfile_bytes_size __attribute__ ((unused)))
+ grub_uint8_t *keyfile_bytes, grub_size_t keyfile_bytes_size)
{
struct grub_luks_phdr header;
grub_size_t keysize;
grub_uint8_t *split_key = NULL;
- char passphrase[MAX_PASSPHRASE] = "";
+ char interactive_passphrase[MAX_PASSPHRASE] = "";
+ grub_uint8_t *passphrase;
+ grub_size_t passphrase_length;
grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
unsigned i;
grub_size_t length;
@@ -205,18 +206,29 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr,
if (!split_key)
return grub_errno;
- /* Get the passphrase from the user. */
- tmp = NULL;
- if (source->partition)
- tmp = grub_partition_get_name (source->partition);
- grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
- source->partition ? "," : "", tmp ? : "",
- dev->uuid);
- grub_free (tmp);
- if (!grub_password_get (passphrase, MAX_PASSPHRASE))
+ if (keyfile_bytes)
{
- grub_free (split_key);
- return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+ /* Use bytestring from key file as passphrase */
+ passphrase = keyfile_bytes;
+ passphrase_length = keyfile_bytes_size;
+ }
+ else
+ {
+ /* Get the passphrase from the user. */
+ tmp = NULL;
+ if (source->partition)
+ tmp = grub_partition_get_name (source->partition);
+ grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
+ source->partition ? "," : "", tmp ? : "", dev->uuid);
+ grub_free (tmp);
+ if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE))
+ {
+ grub_free (split_key);
+ return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
+ }
+
+ passphrase = (grub_uint8_t *)interactive_passphrase;
+ passphrase_length = grub_strlen (interactive_passphrase);
}
/* Try to recover master key from each active keyslot. */
@@ -234,7 +246,7 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr,
/* Calculate the PBKDF2 of the user supplied passphrase. */
gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
- grub_strlen (passphrase),
+ passphrase_length,
header.keyblock[i].passwordSalt,
sizeof (header.keyblock[i].passwordSalt),
grub_be_to_cpu32 (header.keyblock[i].
--
2.25.1
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
` (4 preceding siblings ...)
2020-03-17 7:57 ` [PATCHv2][ 6/6] cryptodisk: Add support for LUKS1 " Denis 'GNUtoo' Carikli
@ 2020-03-17 8:10 ` Denis 'GNUtoo' Carikli
2020-04-03 16:02 ` Daniel Kiper
5 siblings, 1 reply; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-03-17 8:10 UTC (permalink / raw)
To: Patrick Steinhardt, Daniel Kiper; +Cc: The development of GNU GRUB
[-- Attachment #1: Type: text/plain, Size: 693 bytes --]
I'm sorry to have taken so long.
I ended up being sidetracked with other functionalities I wanted to add
as well along the way, which I'll probably address another time.
I also forgot to use --compose for sending the patches.
As for the changes between the V1 and this one, beside addressing the
comments the main changes are that:
- I've split the patch set between the generic part and the backend
specific part (like luks1).
- I've renamed the GRUB_FILE_TYPE to match the fact that the file type
could also be used in geli if it's implemented there.
- I've also added two tiny patches to unify function names as it makes
the code easier to read afterward.
Denis.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names
2020-03-17 8:10 ` [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
@ 2020-04-03 16:02 ` Daniel Kiper
2020-04-03 23:44 ` Denis 'GNUtoo' Carikli
0 siblings, 1 reply; 12+ messages in thread
From: Daniel Kiper @ 2020-04-03 16:02 UTC (permalink / raw)
To: Denis 'GNUtoo' Carikli
Cc: Patrick Steinhardt, Daniel Kiper, The development of GNU GRUB
On Tue, Mar 17, 2020 at 09:10:02AM +0100, Denis 'GNUtoo' Carikli wrote:
> I'm sorry to have taken so long.
>
> I ended up being sidetracked with other functionalities I wanted to add
> as well along the way, which I'll probably address another time.
No problem...
> I also forgot to use --compose for sending the patches.
>
> As for the changes between the V1 and this one, beside addressing the
> comments the main changes are that:
> - I've split the patch set between the generic part and the backend
> specific part (like luks1).
> - I've renamed the GRUB_FILE_TYPE to match the fact that the file type
> could also be used in geli if it's implemented there.
> - I've also added two tiny patches to unify function names as it makes
> the code easier to read afterward.
Sorry, this is not 2.06 material for me. However, I am happy to take it
after the release.
Patrick, could you take closer look at the patchset in the mean time?
Daniel
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names
2020-04-03 16:02 ` Daniel Kiper
@ 2020-04-03 23:44 ` Denis 'GNUtoo' Carikli
0 siblings, 0 replies; 12+ messages in thread
From: Denis 'GNUtoo' Carikli @ 2020-04-03 23:44 UTC (permalink / raw)
To: Daniel Kiper
Cc: Patrick Steinhardt, Daniel Kiper, The development of GNU GRUB
[-- Attachment #1: Type: text/plain, Size: 559 bytes --]
On Fri, 3 Apr 2020 18:02:41 +0200
Daniel Kiper <dkiper@net-space.pl> wrote:
> Sorry, this is not 2.06 material for me.
It's not a big issue for my use cases. In the worst case I can just
backport the patches in the 2.06 packages and/or rely on -git packages
until the next release.
In the other hand, I want to avoid having to maintain out of tree
patches, and having such features in GRUB at some point would probably
be very useful for many other people as well.
> However, I am happy to take it after the release.
Thanks a lot.
Denis.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers
2020-03-17 7:57 ` [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers Denis 'GNUtoo' Carikli
@ 2020-04-04 10:59 ` Patrick Steinhardt
2020-04-04 11:05 ` Patrick Steinhardt
1 sibling, 0 replies; 12+ messages in thread
From: Patrick Steinhardt @ 2020-04-04 10:59 UTC (permalink / raw)
To: Denis 'GNUtoo' Carikli
Cc: Daniel Kiper, The development of GNU GRUB, John Lane
[-- Attachment #1: Type: text/plain, Size: 1331 bytes --]
On Tue, Mar 17, 2020 at 08:57:37AM +0100, Denis 'GNUtoo' Carikli wrote:
[snip]
> @@ -1041,7 +1043,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const char *cheat)
>
> FOR_CRYPTODISK_DEVS (cr)
> {
> - dev = cr->scan (source, search_uuid, check_boot);
> + dev = cr->scan (source, search_uuid, check_boot, 0);
The added argument is a pointer, right? In that case you should use
`NULL` instead of `0`.
> if (grub_errno)
> return grub_errno;
> if (!dev)
[snip]
> @@ -52,6 +52,7 @@
> #include <grub/dl.h>
> #include <grub/err.h>
> #include <grub/disk.h>
> +#include <grub/file.h>
> #include <grub/crypto.h>
> #include <grub/partition.h>
> #include <grub/i18n.h>
> @@ -242,7 +243,8 @@ grub_util_get_geli_uuid (const char *dev)
> #endif
>
> static grub_cryptodisk_t
> -geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
> +geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
> + grub_file_t hdr __attribute__((__unused__)))
> {
> grub_cryptodisk_t newdev;
> struct grub_geli_phdr header;
> @@ -254,6 +256,7 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
> grub_disk_addr_t sector;
> grub_err_t err;
>
> +
This added newline looks like an accidental change.
Patrick
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers
2020-03-17 7:57 ` [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers Denis 'GNUtoo' Carikli
2020-04-04 10:59 ` Patrick Steinhardt
@ 2020-04-04 11:05 ` Patrick Steinhardt
1 sibling, 0 replies; 12+ messages in thread
From: Patrick Steinhardt @ 2020-04-04 11:05 UTC (permalink / raw)
To: Denis 'GNUtoo' Carikli
Cc: Daniel Kiper, The development of GNU GRUB, John Lane
[-- Attachment #1: Type: text/plain, Size: 742 bytes --]
On Tue, Mar 17, 2020 at 08:57:37AM +0100, Denis 'GNUtoo' Carikli wrote:
> From: John Lane <john@lane.uk.net>
> @@ -242,7 +243,8 @@ grub_util_get_geli_uuid (const char *dev)
> #endif
>
> static grub_cryptodisk_t
> -geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
> +geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
> + grub_file_t hdr __attribute__((__unused__)))
> {
> grub_cryptodisk_t newdev;
> struct grub_geli_phdr header;
Hmm. So in case any of the backends gets a non-NULL `hdr` that it can't
support, shouldn't we return an error? Otherwise the backend might do
something the user didn't intend to do when using `cryptomount -H` e.g.
for LUKS2 or Geli.
Patrick
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files
2020-03-17 7:57 ` [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files Denis 'GNUtoo' Carikli
@ 2020-04-04 11:16 ` Patrick Steinhardt
0 siblings, 0 replies; 12+ messages in thread
From: Patrick Steinhardt @ 2020-04-04 11:16 UTC (permalink / raw)
To: Denis 'GNUtoo' Carikli
Cc: Daniel Kiper, The development of GNU GRUB, John Lane
[-- Attachment #1: Type: text/plain, Size: 5486 bytes --]
On Tue, Mar 17, 2020 at 08:57:39AM +0100, Denis 'GNUtoo' Carikli wrote:
> From: John Lane <john@lane.uk.net>
>
> Signed-off-by: John Lane <john@lane.uk.net>
> GNUtoo@cyberdimension.org: rebase, patch split, small fixes, commit message
> Signed-off-by: Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
> ---
> grub-core/disk/cryptodisk.c | 71 ++++++++++++++++++++++++++++++++++++-
> grub-core/disk/geli.c | 4 ++-
> grub-core/disk/luks.c | 4 ++-
> grub-core/disk/luks2.c | 4 ++-
> include/grub/cryptodisk.h | 5 ++-
> include/grub/file.h | 2 ++
> 6 files changed, 85 insertions(+), 5 deletions(-)
>
> diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
> index fa342fe44..2adb224d0 100644
> --- a/grub-core/disk/cryptodisk.c
> +++ b/grub-core/disk/cryptodisk.c
> @@ -42,6 +42,9 @@ static const struct grub_arg_option options[] =
> {"all", 'a', 0, N_("Mount all."), 0, 0},
> {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
> {"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING},
> + {"keyfile", 'k', 0, N_("Key file"), 0, ARG_TYPE_STRING},
> + {"keyfile-offset", 'O', 0, N_("Key file offset (bytes)"), 0, ARG_TYPE_INT},
> + {"keyfile-size", 'S', 0, N_("Key file data size (bytes)"), 0, ARG_TYPE_INT},
> {0, 0, 0, 0, 0, 0}
> };
>
> @@ -972,6 +975,8 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
> static int check_boot, have_it;
> static char *search_uuid;
> static grub_file_t hdr;
> +static grub_uint8_t *key, keyfile_buffer[GRUB_CRYPTODISK_MAX_KEYFILE_SIZE];
> +static grub_ssize_t key_size;
>
> static void
> cryptodisk_close (grub_cryptodisk_t dev)
> @@ -1002,7 +1007,7 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source)
> if (!dev)
> continue;
>
> - err = cr->recover_key (source, dev, hdr);
> + err = cr->recover_key (source, dev, hdr, key, key_size);
> if (err)
> {
> cryptodisk_close (dev);
> @@ -1112,6 +1117,70 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args)
> hdr = NULL;
>
> have_it = 0;
> + key = NULL;
> +
> + if (state[4].set) /* keyfile */
> + {
> + grub_file_t keyfile;
> + int keyfile_offset;
> + grub_size_t requested_keyfile_size = 0;
> +
> + if (state[5].set) /* keyfile-offset */
> + {
> + keyfile_offset = grub_strtoul (state[5].arg, 0, 0);
We should pass in an `endptr` argument here to check that the argument
didn't have any trailing gargabe. Otherwise we might accept parameters
like "1234foobar".
> +
> + if (grub_errno != GRUB_ERR_NONE)
> + return grub_errno;
> + }
> + else
> + {
> + keyfile_offset = 0;
> + }
> +
> + if (state[6].set) /* keyfile-size */
> + {
> + requested_keyfile_size = grub_strtoul(state[6].arg, 0, 0);
The same applies here.
> + if (grub_errno != GRUB_ERR_NONE)
> + return grub_errno;
> +
> + if (requested_keyfile_size > GRUB_CRYPTODISK_MAX_KEYFILE_SIZE)
> + return grub_error(GRUB_ERR_OUT_OF_RANGE,
> + N_("Key file size exceeds maximum (%llu)\n"), \
> + (unsigned long long) GRUB_CRYPTODISK_MAX_KEYFILE_SIZE);
> + }
Should we return an error in case `requested_keyfile_size == 0`?
> + keyfile = grub_file_open (state[4].arg,
> + GRUB_FILE_TYPE_CRYPTODISK_ENCRYPTION_KEY);
> + if (!keyfile)
> + return grub_errno;
> +
> + if (grub_file_seek (keyfile, keyfile_offset) == (grub_off_t)-1)
> + return grub_errno;
> +
> +
> + if (state[6].set) /* keyfile-size */
> + {
> + if (requested_keyfile_size > (keyfile->size - keyfile_offset))
> + return grub_error (GRUB_ERR_FILE_READ_ERROR,
> + N_("Cannot read %llu bytes for key file (read %llu bytes)\n"),
> + (unsigned long long) requested_keyfile_size,
> + (unsigned long long) keyfile->size);
> +
> + key_size = requested_keyfile_size;
> + }
Instead of checking `state[6].set` we could use `requested_keyfile_size`
here, which might be a bit easier to read. I also think the error
message could be improved a bit as we didn't yet try to read, but it
sounds like we did. How about "Keyfile is too small (requested %llu
bytes, but the file only has %llu bytes)".
> + else
> + {
> + key_size = keyfile->size - keyfile_offset;
> + }
> +
> + if (grub_file_read (keyfile, keyfile_buffer, key_size) != key_size)
> + return grub_error (GRUB_ERR_FILE_READ_ERROR,
> + (N_("Error reading key file\n")));
> + key = keyfile_buffer;
> + }
> +
> if (state[0].set)
> {
> grub_cryptodisk_t dev;
> diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
> index bec0bb877..7b3f3e721 100644
> --- a/grub-core/disk/geli.c
> +++ b/grub-core/disk/geli.c
> @@ -401,7 +401,9 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
>
> static grub_err_t
> recover_key (grub_disk_t source, grub_cryptodisk_t dev,
> - grub_file_t hdr __attribute__ ((unused)))
> + grub_file_t hdr __attribute__ ((unused)),
> + grub_uint8_t *key __attribute__ ((unused)),
> + grub_size_t keyfile_size __attribute__ ((unused)))
> {
The same thought applies here as for the `hdr` attribute: in case a key
or keyfile size was passed but the backend doesn't support it, I think
we should return an error.
Patrick
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2020-04-04 11:16 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-17 7:57 [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 2/6] cryptodisk: geli: " Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers Denis 'GNUtoo' Carikli
2020-04-04 10:59 ` Patrick Steinhardt
2020-04-04 11:05 ` Patrick Steinhardt
2020-03-17 7:57 ` [PATCHv2][ 4/6] cryptodisk: add support for LUKS1 " Denis 'GNUtoo' Carikli
2020-03-17 7:57 ` [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files Denis 'GNUtoo' Carikli
2020-04-04 11:16 ` Patrick Steinhardt
2020-03-17 7:57 ` [PATCHv2][ 6/6] cryptodisk: Add support for LUKS1 " Denis 'GNUtoo' Carikli
2020-03-17 8:10 ` [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names Denis 'GNUtoo' Carikli
2020-04-03 16:02 ` Daniel Kiper
2020-04-03 23:44 ` Denis 'GNUtoo' Carikli
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.