From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1ndnmU-00061s-Gd for mharc-grub-devel@gnu.org; Mon, 11 Apr 2022 02:44:10 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:40470) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1ndnm1-0005tK-1L for grub-devel@gnu.org; Mon, 11 Apr 2022 02:43:41 -0400 Received: from mail-qt1-x831.google.com ([2607:f8b0:4864:20::831]:46595) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1ndnly-0004jH-QW for grub-devel@gnu.org; Mon, 11 Apr 2022 02:43:40 -0400 Received: by mail-qt1-x831.google.com with SMTP id z15so6340175qtj.13 for ; Sun, 10 Apr 2022 23:43:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficientek-com.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4VxAp0oe+8hvD7rB1yUx4EeJLzcQrUdP9lUQfIaudI4=; b=QAEcY92Kg9VWth/6HJbGcpgEbLVl+5avEXKyYgd7iWc0jzxITJ9JNRyBronMKh6n03 WArJQs5jzOXYndmuDEclzZYY01po52Yo2+Gwnyk3cWyM2gF69blMo6iUxWwL0dO+u5/X VGiDHEvKAwKkwg5upn9+5rx+9BvVwKHhIX0x7fWMzD9Rg04hz7OQ9bN7uCKA/P900uM+ /om4UD5Www1sp5BPb6y2IkdjbrArVIdDxAds6dp9qqUlcojYl+//ZR8W1hUISG7lq6j4 qkrDEYVFm74b59ceszSXqa2zE/xEiEmaD1BBA35xoJiyyCA28G9MPXWYem6mSTJ+n8ZC aPhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4VxAp0oe+8hvD7rB1yUx4EeJLzcQrUdP9lUQfIaudI4=; b=ZR49BiubLnDno6dzMJFwVP7Qkib04iFpvBikZS9saM98ZUjTi/lgAHqnvbGosw2oaa HA4VZyhDIJR6EnTp6mmHV2DjV2Q3v0qyKl4VqLJBNpotYJ7yy+myaf1v3szST5hFudhD XO7rPaZHqYzUtCmOzsN62tM/RhOxIm8/cYz9t4TJoVrIJy2D6LhmFkINbUTom+i7ud2x MnvxYk3GGB8isugN15WQubbFuo26LaQ+RXbbctX6XSjVgNXjVGhB1Er+BHpoi8H8P6jn PRBn3ux2F/Et2EKqnxBGV52/Dpg1HgWLwXFttHfhXgTrfTUpDc2EWGiD3CKePAvr1H0G o92A== X-Gm-Message-State: AOAM533p4xOIK9vUWRoWQ6IS1AtoE0OAAVQH1AJErH5y9ecOBX14eC4K aKDsOWK4efwyO2uuptcWXpLbn28qa2EFmg== X-Google-Smtp-Source: ABdhPJwK9KO3MpV/ep9I+egRSTzUfnQkoc2k3EfKLGDl7uMWkqhw7fBVgV91I/ZMIy1DoyLHv8hsGA== X-Received: by 2002:a05:622a:5081:b0:2eb:d9c6:d1a9 with SMTP id fp1-20020a05622a508100b002ebd9c6d1a9mr14577123qtb.490.1649659417455; Sun, 10 Apr 2022 23:43:37 -0700 (PDT) Received: from localhost.localdomain (yal.riseup.net. [199.58.83.9]) by smtp.gmail.com with ESMTPSA id i19-20020a05620a27d300b0069c1c7986eesm1662307qkp.89.2022.04.10.23.43.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 10 Apr 2022 23:43:37 -0700 (PDT) From: Glenn Washburn To: grub-devel@gnu.org, Daniel Kiper Cc: Denis 'GNUtoo' Carikli , Patrick Steinhardt , John Lane , Glenn Washburn Subject: [PATCH v9 6/7] luks2: Add detached header support Date: Mon, 11 Apr 2022 06:40:27 +0000 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::831; envelope-from=development@efficientek.com; helo=mail-qt1-x831.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2022 06:43:41 -0000 X-List-Received-Date: Mon, 11 Apr 2022 06:43:41 -0000 If a header file is given to the LUKS2 backend, use that file as the LUKS2 header, instead of looking for it on the disk. Signed-off-by: Glenn Washburn --- grub-core/disk/luks2.c | 67 ++++++++++++++++++++++++++++++------------ 1 file changed, 49 insertions(+), 18 deletions(-) diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c index 349462c61a..af5bc4fc82 100644 --- a/grub-core/disk/luks2.c +++ b/grub-core/disk/luks2.c @@ -313,13 +313,22 @@ luks2_get_keyslot (grub_luks2_keyslot_t *k, grub_luks2_digest_t *d, grub_luks2_s /* Determine whether to use primary or secondary header */ static grub_err_t -luks2_read_header (grub_disk_t disk, grub_luks2_header_t *outhdr) +luks2_read_header (grub_disk_t disk, grub_file_t hdr_file, grub_luks2_header_t *outhdr) { grub_luks2_header_t primary, secondary, *header = &primary; - grub_err_t ret; + grub_err_t ret = GRUB_ERR_NONE; /* Read the primary LUKS header. */ - ret = grub_disk_read (disk, 0, 0, sizeof (primary), &primary); + if (hdr_file) + { + if (grub_file_seek (hdr_file, 0) == (grub_off_t) -1) + ret = grub_errno; + + else if (grub_file_read (hdr_file, &primary, sizeof (primary)) != sizeof (primary)) + ret = grub_errno; + } + else + ret = grub_disk_read (disk, 0, 0, sizeof (primary), &primary); if (ret) return ret; @@ -329,7 +338,16 @@ luks2_read_header (grub_disk_t disk, grub_luks2_header_t *outhdr) return GRUB_ERR_BAD_SIGNATURE; /* Read the secondary header. */ - ret = grub_disk_read (disk, 0, grub_be_to_cpu64 (primary.hdr_size), sizeof (secondary), &secondary); + if (hdr_file) + { + if (grub_file_seek (hdr_file, grub_be_to_cpu64 (primary.hdr_size)) == (grub_off_t) -1) + ret = grub_errno; + + else if (grub_file_read (hdr_file, &secondary, sizeof (secondary)) != sizeof (secondary)) + ret = grub_errno; + } + else + ret = grub_disk_read (disk, 0, grub_be_to_cpu64 (primary.hdr_size), sizeof (secondary), &secondary); if (ret) return ret; @@ -353,14 +371,10 @@ luks2_scan (grub_disk_t disk, grub_cryptomount_args_t cargs) char uuid[sizeof (header.uuid) + 1]; grub_size_t i, j; - /* Detached headers are not implemented yet */ - if (cargs->hdr_file) - return NULL; - if (cargs->check_boot) return NULL; - if (luks2_read_header (disk, &header)) + if (luks2_read_header (disk, cargs->hdr_file, &header)) { grub_errno = GRUB_ERR_NONE; return NULL; @@ -427,6 +441,7 @@ luks2_verify_key (grub_luks2_digest_t *d, grub_uint8_t *candidate_key, static grub_err_t luks2_decrypt_key (grub_uint8_t *out_key, grub_disk_t source, grub_cryptodisk_t crypt, + grub_cryptomount_args_t cargs, grub_luks2_keyslot_t *k, const grub_uint8_t *passphrase, grub_size_t passphraselen) { @@ -502,7 +517,17 @@ luks2_decrypt_key (grub_uint8_t *out_key, } grub_errno = GRUB_ERR_NONE; - ret = grub_disk_read (source, 0, k->area.offset, k->area.size, split_key); + if (cargs->hdr_file) + { + if (grub_file_seek (cargs->hdr_file, k->area.offset) == (grub_off_t) -1) + ret = grub_errno; + + else if (grub_file_read (cargs->hdr_file, split_key, k->area.size) != k->area.size) + ret = grub_errno; + } + else + ret = grub_disk_read (source, 0, k->area.offset, k->area.size, split_key); + if (ret) { grub_error (GRUB_ERR_IO, "Read error: %s\n", grub_errmsg); @@ -564,11 +589,7 @@ luks2_recover_key (grub_disk_t source, if (cargs->key_data == NULL || cargs->key_len == 0) return grub_error (GRUB_ERR_BAD_ARGUMENT, "no key data"); - /* Detached headers are not implemented yet */ - if (cargs->hdr_file) - return GRUB_ERR_NOT_IMPLEMENTED_YET; - - ret = luks2_read_header (source, &header); + ret = luks2_read_header (source, cargs->hdr_file, &header); if (ret) return ret; @@ -577,8 +598,18 @@ luks2_recover_key (grub_disk_t source, return GRUB_ERR_OUT_OF_MEMORY; /* Read the JSON area. */ - ret = grub_disk_read (source, 0, grub_be_to_cpu64 (header.hdr_offset) + sizeof (header), - grub_be_to_cpu64 (header.hdr_size) - sizeof (header), json_header); + if (cargs->hdr_file) + { + if (grub_file_seek (cargs->hdr_file, grub_be_to_cpu64 (header.hdr_offset) + sizeof (header)) == (grub_off_t) -1) + ret = grub_errno; + + else if (grub_file_read (cargs->hdr_file, json_header, grub_be_to_cpu64 (header.hdr_size) - sizeof (header)) != (grub_be_to_cpu64 (header.hdr_size) - sizeof (header))) + ret = grub_errno; + } + else + ret = grub_disk_read (source, 0, grub_be_to_cpu64 (header.hdr_offset) + sizeof (header), + grub_be_to_cpu64 (header.hdr_size) - sizeof (header), json_header); + if (ret) goto err; @@ -716,7 +747,7 @@ luks2_recover_key (grub_disk_t source, crypt->total_sectors = max_crypt_sectors - crypt->offset_sectors; } - ret = luks2_decrypt_key (candidate_key, source, crypt, &keyslot, + ret = luks2_decrypt_key (candidate_key, source, crypt, cargs, &keyslot, cargs->key_data, cargs->key_len); if (ret) { -- 2.25.1