From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1knI4r-0008Jm-Kq for mharc-grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:33 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:44914) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1knI4o-0008H5-JU for grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:30 -0500 Received: from cyberdimension.org ([80.67.179.20]:35256 helo=gnutoo.cyberdimension.org) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1knI4m-0005sp-7l for grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:30 -0500 Received: from gnutoo.cyberdimension.org (localhost [127.0.0.1]) by cyberdimension.org (OpenSMTPD) with ESMTP id c9cef875; Thu, 10 Dec 2020 09:14:04 +0000 (UTC) Received: from primarylaptop.localdomain (localhost.localdomain [::1]) by gnutoo.cyberdimension.org (OpenSMTPD) with ESMTP id c9166492; Thu, 10 Dec 2020 09:14:03 +0000 (UTC) From: Denis 'GNUtoo' Carikli To: Patrick Steinhardt , Daniel Kiper , Glenn Washburn Cc: The development of GNU GRUB , John Lane , Denis 'GNUtoo' Carikli Subject: [PATCH v7 3/6] cryptodisk: enable the backends to implement detached headers Date: Thu, 10 Dec 2020 10:14:56 +0100 Message-Id: <20201210091459.11154-4-GNUtoo@cyberdimension.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201210091459.11154-1-GNUtoo@cyberdimension.org> References: <20201210091459.11154-1-GNUtoo@cyberdimension.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=80.67.179.20; envelope-from=GNUtoo@cyberdimension.org; helo=gnutoo.cyberdimension.org X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 09:17:30 -0000 From: John Lane Signed-off-by: John Lane GNUtoo@cyberdimension.org: rebase, patch split, small fixes, commit message Signed-off-by: Denis 'GNUtoo' Carikli Reviewed-by: Patrick Steinhardt --- ChangeLog since v4: - Added Reviewed-by tag ChangeLog since v5: - No changes ChangeLog since v6: Rebase only. The rebase was needed due these commits: - 0eb44d319 luks2: Rename source disk variable named "disk" to "source" as in luks.c => disk was also renamed to source in this rebased patch. - ee12785f7 luks2: Strip dashes off of the UUID => No changes to this patch, it just shows in the context lines. --- grub-core/disk/cryptodisk.c | 24 ++++++++++++++++++++---- grub-core/disk/geli.c | 15 +++++++++++++-- grub-core/disk/luks.c | 14 +++++++++++--- grub-core/disk/luks2.c | 15 ++++++++++++--- include/grub/cryptodisk.h | 6 ++++-- include/grub/file.h | 2 ++ 6 files changed, 62 insertions(+), 14 deletions(-) diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c index 473c93976..fec949ad0 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c @@ -41,6 +41,7 @@ static const struct grub_arg_option options[] = /* TRANSLATORS: It's still restricted to cryptodisks only. */ {"all", 'a', 0, N_("Mount all."), 0, 0}, {"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0}, + {"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING}, {0, 0, 0, 0, 0, 0} }; @@ -967,6 +968,7 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk) static int check_boot, have_it; static char *search_uuid; +static grub_file_t hdr; static void cryptodisk_close (grub_cryptodisk_t dev) @@ -991,13 +993,13 @@ grub_cryptodisk_scan_device_real (const char *name, grub_disk_t source) FOR_CRYPTODISK_DEVS (cr) { - dev = cr->scan (source, search_uuid, check_boot); + dev = cr->scan (source, search_uuid, check_boot, hdr); if (grub_errno) return grub_errno; if (!dev) continue; - err = cr->recover_key (source, dev); + err = cr->recover_key (source, dev, hdr); if (err) { cryptodisk_close (dev); @@ -1038,7 +1040,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const char *cheat) FOR_CRYPTODISK_DEVS (cr) { - dev = cr->scan (source, search_uuid, check_boot); + dev = cr->scan (source, search_uuid, check_boot, NULL); if (grub_errno) return grub_errno; if (!dev) @@ -1092,6 +1094,20 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int argc, char **args) if (argc < 1 && !state[1].set && !state[2].set) return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required"); + if (state[3].set) /* Detached header */ + { + if (state[0].set) + return grub_error (GRUB_ERR_BAD_ARGUMENT, + N_("Cannot use UUID lookup with detached header")); + + hdr = grub_file_open (state[3].arg, + GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER); + if (!hdr) + return grub_errno; + } + else + hdr = NULL; + have_it = 0; if (state[0].set) { @@ -1299,7 +1315,7 @@ GRUB_MOD_INIT (cryptodisk) { grub_disk_dev_register (&grub_cryptodisk_dev); cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0, - N_("SOURCE|-u UUID|-a|-b"), + N_("SOURCE|-u UUID|-a|-b|-H file"), N_("Mount a crypto device."), options); grub_procfs_register ("luks_script", &luks_script); } diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c index 203a9081b..d4d537e05 100644 --- a/grub-core/disk/geli.c +++ b/grub-core/disk/geli.c @@ -52,6 +52,7 @@ #include #include #include +#include #include #include #include @@ -121,6 +122,7 @@ enum /* FIXME: support version 0. */ /* FIXME: support big-endian pre-version-4 volumes. */ +/* FIXME: support for detached headers. */ /* FIXME: support for keyfiles. */ /* FIXME: support for HMAC. */ const char *algorithms[] = { @@ -242,7 +244,8 @@ grub_util_get_geli_uuid (const char *dev) #endif static grub_cryptodisk_t -geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only) +geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only, + grub_file_t hdr) { grub_cryptodisk_t newdev; struct grub_geli_phdr header; @@ -254,6 +257,10 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only) grub_disk_addr_t sector; grub_err_t err; + /* Detached headers are not implemented yet */ + if (hdr) + return NULL; + if (2 * GRUB_MD_SHA256->mdlen + 1 > GRUB_CRYPTODISK_MAX_UUID_LENGTH) return NULL; @@ -397,7 +404,7 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only) } static grub_err_t -geli_recover_key (grub_disk_t source, grub_cryptodisk_t dev) +geli_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr) { grub_size_t keysize; grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN]; @@ -413,6 +420,10 @@ geli_recover_key (grub_disk_t source, grub_cryptodisk_t dev) grub_disk_addr_t sector; grub_err_t err; + /* Detached headers are not implemented yet */ + if (hdr) + return GRUB_ERR_NOT_IMPLEMENTED_YET; + if (dev->cipher->cipher->blocksize > GRUB_CRYPTO_MAX_CIPHER_BLOCKSIZE) return grub_error (GRUB_ERR_BUG, "cipher block is too long"); diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c index 229036d1d..40cc162fb 100644 --- a/grub-core/disk/luks.c +++ b/grub-core/disk/luks.c @@ -65,7 +65,8 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src, grub_size_t blocknumbers); static grub_cryptodisk_t -luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot) +luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot, + grub_file_t hdr) { grub_cryptodisk_t newdev; const char *iptr; @@ -77,6 +78,10 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot) char hashspec[sizeof (header.hashSpec) + 1]; grub_err_t err; + /* Detached headers are not implemented yet */ + if (hdr) + return NULL; + if (check_boot) return NULL; @@ -150,8 +155,7 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot) } static grub_err_t -luks_recover_key (grub_disk_t source, - grub_cryptodisk_t dev) +luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr) { struct grub_luks_phdr header; grub_size_t keysize; @@ -164,6 +168,10 @@ luks_recover_key (grub_disk_t source, grub_size_t max_stripes = 1; char *tmp; + /* Detached headers are not implemented yet */ + if (hdr) + return GRUB_ERR_NOT_IMPLEMENTED_YET; + err = grub_disk_read (source, 0, 0, sizeof (header), &header); if (err) return err; diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c index d96764a02..237b2aa77 100644 --- a/grub-core/disk/luks2.c +++ b/grub-core/disk/luks2.c @@ -342,13 +342,18 @@ luks2_read_header (grub_disk_t disk, grub_luks2_header_t *outhdr) } static grub_cryptodisk_t -luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot) +luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot, + grub_file_t hdr_file) { grub_cryptodisk_t cryptodisk; grub_luks2_header_t header; char uuid[sizeof (header.uuid) + 1]; grub_size_t i, j; + /* Detached headers are not implemented yet */ + if (hdr_file) + return NULL; + if (check_boot) return NULL; @@ -530,8 +535,8 @@ luks2_decrypt_key (grub_uint8_t *out_key, } static grub_err_t -luks2_recover_key (grub_disk_t source, - grub_cryptodisk_t crypt) +luks2_recover_key (grub_disk_t source, grub_cryptodisk_t crypt, + grub_file_t hdr_file) { grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN]; char passphrase[MAX_PASSPHRASE], cipher[32]; @@ -545,6 +550,10 @@ luks2_recover_key (grub_disk_t source, grub_json_t *json = NULL, keyslots; grub_err_t ret; + /* Detached headers are not implemented yet */ + if (hdr_file) + return GRUB_ERR_NOT_IMPLEMENTED_YET; + ret = luks2_read_header (source, &header); if (ret) return ret; diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h index c9bf7597a..d6f2f6e2c 100644 --- a/include/grub/cryptodisk.h +++ b/include/grub/cryptodisk.h @@ -20,6 +20,7 @@ #define GRUB_CRYPTODISK_HEADER 1 #include +#include #include #include #ifdef GRUB_UTIL @@ -112,8 +113,9 @@ struct grub_cryptodisk_dev struct grub_cryptodisk_dev **prev; grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid, - int boot_only); - grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev); + int boot_only, grub_file_t hdr); + grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev, + grub_file_t hdr); }; typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t; diff --git a/include/grub/file.h b/include/grub/file.h index 31567483c..a7d7be853 100644 --- a/include/grub/file.h +++ b/include/grub/file.h @@ -90,6 +90,8 @@ enum grub_file_type GRUB_FILE_TYPE_FONT, /* File holding encryption key for encrypted ZFS. */ GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY, + /* File holiding the encryption metadata header */ + GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER, /* File we open n grub-fstest. */ GRUB_FILE_TYPE_FSTEST, /* File we open n grub-mount. */ -- 2.29.2