[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached he
From: |
Denis 'GNUtoo' Carikli |
Subject: |
[PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers |
Date: |
Tue, 17 Mar 2020 08:57:37 +0100 |
From: John Lane <address@hidden>
Signed-off-by: John Lane <address@hidden>
address@hidden: rebase, patch split, small fixes, commit message
Signed-off-by: Denis 'GNUtoo' Carikli <address@hidden>
---
grub-core/disk/cryptodisk.c | 24 ++++++++++++++++++++----
grub-core/disk/geli.c | 8 ++++++--
grub-core/disk/luks.c | 7 ++++---
grub-core/disk/luks2.c | 7 ++++---
include/grub/cryptodisk.h | 6 ++++--
include/grub/file.h | 2 ++
6 files changed, 40 insertions(+), 14 deletions(-)
diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c
index 1897acc4b..fa342fe44 100644
--- a/grub-core/disk/cryptodisk.c
+++ b/grub-core/disk/cryptodisk.c
@@ -41,6 +41,7 @@ static const struct grub_arg_option options[] =
/* TRANSLATORS: It's still restricted to cryptodisks only. */
{"all", 'a', 0, N_("Mount all."), 0, 0},
{"boot", 'b', 0, N_("Mount all volumes with `boot' flag set."), 0, 0},
+ {"header", 'H', 0, N_("Read header from file"), 0, ARG_TYPE_STRING},
{0, 0, 0, 0, 0, 0}
};
@@ -970,6 +971,7 @@ grub_util_cryptodisk_get_uuid (grub_disk_t disk)
static int check_boot, have_it;
static char *search_uuid;
+static grub_file_t hdr;
static void
cryptodisk_close (grub_cryptodisk_t dev)
@@ -994,13 +996,13 @@ grub_cryptodisk_scan_device_real (const char *name,
grub_disk_t source)
FOR_CRYPTODISK_DEVS (cr)
{
- dev = cr->scan (source, search_uuid, check_boot);
+ dev = cr->scan (source, search_uuid, check_boot, hdr);
if (grub_errno)
return grub_errno;
if (!dev)
continue;
- err = cr->recover_key (source, dev);
+ err = cr->recover_key (source, dev, hdr);
if (err)
{
cryptodisk_close (dev);
@@ -1041,7 +1043,7 @@ grub_cryptodisk_cheat_mount (const char *sourcedev, const
char *cheat)
FOR_CRYPTODISK_DEVS (cr)
{
- dev = cr->scan (source, search_uuid, check_boot);
+ dev = cr->scan (source, search_uuid, check_boot, 0);
if (grub_errno)
return grub_errno;
if (!dev)
@@ -1095,6 +1097,20 @@ grub_cmd_cryptomount (grub_extcmd_context_t ctxt, int
argc, char **args)
if (argc < 1 && !state[1].set && !state[2].set)
return grub_error (GRUB_ERR_BAD_ARGUMENT, "device name required");
+ if (state[3].set) /* Detached header */
+ {
+ if (state[0].set)
+ return grub_error (GRUB_ERR_BAD_ARGUMENT,
+ N_("Cannot use UUID lookup with detached header"));
+
+ hdr = grub_file_open (state[3].arg,
+ GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER);
+ if (!hdr)
+ return grub_errno;
+ }
+ else
+ hdr = NULL;
+
have_it = 0;
if (state[0].set)
{
@@ -1302,7 +1318,7 @@ GRUB_MOD_INIT (cryptodisk)
{
grub_disk_dev_register (&grub_cryptodisk_dev);
cmd = grub_register_extcmd ("cryptomount", grub_cmd_cryptomount, 0,
- N_("SOURCE|-u UUID|-a|-b"),
+ N_("SOURCE|-u UUID|-a|-b|-H file"),
N_("Mount a crypto device."), options);
grub_procfs_register ("luks_script", &luks_script);
}
diff --git a/grub-core/disk/geli.c b/grub-core/disk/geli.c
index 786682077..bec0bb877 100644
--- a/grub-core/disk/geli.c
+++ b/grub-core/disk/geli.c
@@ -52,6 +52,7 @@
#include <grub/dl.h>
#include <grub/err.h>
#include <grub/disk.h>
+#include <grub/file.h>
#include <grub/crypto.h>
#include <grub/partition.h>
#include <grub/i18n.h>
@@ -242,7 +243,8 @@ grub_util_get_geli_uuid (const char *dev)
#endif
static grub_cryptodisk_t
-geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only)
+geli_scan (grub_disk_t disk, const char *check_uuid, int boot_only,
+ grub_file_t hdr __attribute__((__unused__)))
{
grub_cryptodisk_t newdev;
struct grub_geli_phdr header;
@@ -254,6 +256,7 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int
boot_only)
grub_disk_addr_t sector;
grub_err_t err;
+
if (2 * GRUB_MD_SHA256->mdlen + 1 > GRUB_CRYPTODISK_MAX_UUID_LENGTH)
return NULL;
@@ -397,7 +400,8 @@ geli_scan (grub_disk_t disk, const char *check_uuid, int
boot_only)
}
static grub_err_t
-recover_key (grub_disk_t source, grub_cryptodisk_t dev)
+recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+ grub_file_t hdr __attribute__ ((unused)))
{
grub_size_t keysize;
grub_uint8_t digest[GRUB_CRYPTO_MAX_MDLEN];
diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
index 28585806a..e07a2fef1 100644
--- a/grub-core/disk/luks.c
+++ b/grub-core/disk/luks.c
@@ -65,7 +65,8 @@ gcry_err_code_t AF_merge (const gcry_md_spec_t * hash,
grub_uint8_t * src,
grub_size_t blocknumbers);
static grub_cryptodisk_t
-luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
+luks_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
+ grub_file_t hdr __attribute__((__unused__)))
{
grub_cryptodisk_t newdev;
const char *iptr;
@@ -149,8 +150,8 @@ luks_scan (grub_disk_t disk, const char *check_uuid, int
check_boot)
}
static grub_err_t
-luks_recover_key (grub_disk_t source,
- grub_cryptodisk_t dev)
+luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev,
+ grub_file_t hdr __attribute__ ((unused)))
{
struct grub_luks_phdr header;
grub_size_t keysize;
diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c
index 65c4f0aac..562208e05 100644
--- a/grub-core/disk/luks2.c
+++ b/grub-core/disk/luks2.c
@@ -342,7 +342,8 @@ luks2_read_header (grub_disk_t disk, grub_luks2_header_t
*outhdr)
}
static grub_cryptodisk_t
-luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot)
+luks2_scan (grub_disk_t disk, const char *check_uuid, int check_boot,
+ grub_file_t hdr_file __attribute__((__unused__)))
{
grub_cryptodisk_t cryptodisk;
grub_luks2_header_t header;
@@ -523,8 +524,8 @@ luks2_decrypt_key (grub_uint8_t *out_key,
}
static grub_err_t
-luks2_recover_key (grub_disk_t disk,
- grub_cryptodisk_t crypt)
+luks2_recover_key (grub_disk_t disk, grub_cryptodisk_t crypt,
+ grub_file_t hdr_file __attribute__ ((unused)))
{
grub_uint8_t candidate_key[GRUB_CRYPTODISK_MAX_KEYLEN];
char passphrase[MAX_PASSPHRASE], cipher[32];
diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h
index e1b21e785..e24b1b8cb 100644
--- a/include/grub/cryptodisk.h
+++ b/include/grub/cryptodisk.h
@@ -20,6 +20,7 @@
#define GRUB_CRYPTODISK_HEADER 1
#include <grub/disk.h>
+#include <grub/file.h>
#include <grub/crypto.h>
#include <grub/list.h>
#ifdef GRUB_UTIL
@@ -107,8 +108,9 @@ struct grub_cryptodisk_dev
struct grub_cryptodisk_dev **prev;
grub_cryptodisk_t (*scan) (grub_disk_t disk, const char *check_uuid,
- int boot_only);
- grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev);
+ int boot_only, grub_file_t hdr);
+ grub_err_t (*recover_key) (grub_disk_t disk, grub_cryptodisk_t dev,
+ grub_file_t hdr);
};
typedef struct grub_cryptodisk_dev *grub_cryptodisk_dev_t;
diff --git a/include/grub/file.h b/include/grub/file.h
index 31567483c..a7d7be853 100644
--- a/include/grub/file.h
+++ b/include/grub/file.h
@@ -90,6 +90,8 @@ enum grub_file_type
GRUB_FILE_TYPE_FONT,
/* File holding encryption key for encrypted ZFS. */
GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY,
+ /* File holiding the encryption metadata header */
+ GRUB_FILE_TYPE_CRYPTODISK_DETACHED_HEADER,
/* File we open n grub-fstest. */
GRUB_FILE_TYPE_FSTEST,
/* File we open n grub-mount. */
--
2.25.1
- [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names, Denis 'GNUtoo' Carikli, 2020/03/17
- [PATCHv2][ 2/6] cryptodisk: geli: unify grub_cryptodisk_dev function names, Denis 'GNUtoo' Carikli, 2020/03/17
- [PATCHv2][ 4/6] cryptodisk: add support for LUKS1 detached headers, Denis 'GNUtoo' Carikli, 2020/03/17
- [PATCHv2][ 6/6] cryptodisk: Add support for LUKS1 key files, Denis 'GNUtoo' Carikli, 2020/03/17
- [PATCHv2][ 3/6] cryptodisk: enable the backends to implement detached headers,
Denis 'GNUtoo' Carikli <=
- [PATCHv2][ 5/6] cryptodisk: enable the backends to implement key files, Denis 'GNUtoo' Carikli, 2020/03/17
- Re: [PATCHv2][ 1/6] cryptodisk: luks: unify grub_cryptodisk_dev function names, Denis 'GNUtoo' Carikli, 2020/03/17