1 /* 2 * QEMU Crypto block device encryption LUKS format 3 * 4 * Copyright (c) 2015-2016 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "qapi/error.h" 23 #include "qemu/bswap.h" 24 25 #include "crypto/block-luks.h" 26 27 #include "crypto/hash.h" 28 #include "crypto/afsplit.h" 29 #include "crypto/pbkdf.h" 30 #include "crypto/secret.h" 31 #include "crypto/random.h" 32 33 #ifdef CONFIG_UUID 34 #include <uuid/uuid.h> 35 #endif 36 37 #include "qemu/coroutine.h" 38 39 /* 40 * Reference for the LUKS format implemented here is 41 * 42 * docs/on-disk-format.pdf 43 * 44 * in 'cryptsetup' package source code 45 * 46 * This file implements the 1.2.1 specification, dated 47 * Oct 16, 2011. 48 */ 49 50 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS; 51 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader; 52 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot; 53 54 55 /* The following constants are all defined by the LUKS spec */ 56 #define QCRYPTO_BLOCK_LUKS_VERSION 1 57 58 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6 59 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32 60 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32 61 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32 62 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20 63 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32 64 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40 65 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8 66 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000 67 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000 68 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000 69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096 70 71 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD 72 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3 73 74 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL 75 76 static const char qcrypto_block_luks_magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN] = { 77 'L', 'U', 'K', 'S', 0xBA, 0xBE 78 }; 79 80 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap; 81 struct QCryptoBlockLUKSNameMap { 82 const char *name; 83 int id; 84 }; 85 86 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap; 87 struct QCryptoBlockLUKSCipherSizeMap { 88 uint32_t key_bytes; 89 int id; 90 }; 91 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap; 92 struct QCryptoBlockLUKSCipherNameMap { 93 const char *name; 94 const QCryptoBlockLUKSCipherSizeMap *sizes; 95 }; 96 97 98 static const QCryptoBlockLUKSCipherSizeMap 99 qcrypto_block_luks_cipher_size_map_aes[] = { 100 { 16, QCRYPTO_CIPHER_ALG_AES_128 }, 101 { 24, QCRYPTO_CIPHER_ALG_AES_192 }, 102 { 32, QCRYPTO_CIPHER_ALG_AES_256 }, 103 { 0, 0 }, 104 }; 105 106 static const QCryptoBlockLUKSCipherSizeMap 107 qcrypto_block_luks_cipher_size_map_cast5[] = { 108 { 16, QCRYPTO_CIPHER_ALG_CAST5_128 }, 109 { 0, 0 }, 110 }; 111 112 static const QCryptoBlockLUKSCipherSizeMap 113 qcrypto_block_luks_cipher_size_map_serpent[] = { 114 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128 }, 115 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192 }, 116 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256 }, 117 { 0, 0 }, 118 }; 119 120 static const QCryptoBlockLUKSCipherSizeMap 121 qcrypto_block_luks_cipher_size_map_twofish[] = { 122 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128 }, 123 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192 }, 124 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256 }, 125 { 0, 0 }, 126 }; 127 128 static const QCryptoBlockLUKSCipherNameMap 129 qcrypto_block_luks_cipher_name_map[] = { 130 { "aes", qcrypto_block_luks_cipher_size_map_aes }, 131 { "cast5", qcrypto_block_luks_cipher_size_map_cast5 }, 132 { "serpent", qcrypto_block_luks_cipher_size_map_serpent }, 133 { "twofish", qcrypto_block_luks_cipher_size_map_twofish }, 134 }; 135 136 137 /* 138 * This struct is written to disk in big-endian format, 139 * but operated upon in native-endian format. 140 */ 141 struct QCryptoBlockLUKSKeySlot { 142 /* state of keyslot, enabled/disable */ 143 uint32_t active; 144 /* iterations for PBKDF2 */ 145 uint32_t iterations; 146 /* salt for PBKDF2 */ 147 uint8_t salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 148 /* start sector of key material */ 149 uint32_t key_offset; 150 /* number of anti-forensic stripes */ 151 uint32_t stripes; 152 } QEMU_PACKED; 153 154 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot) != 48); 155 156 157 /* 158 * This struct is written to disk in big-endian format, 159 * but operated upon in native-endian format. 160 */ 161 struct QCryptoBlockLUKSHeader { 162 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */ 163 char magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN]; 164 165 /* LUKS version, currently 1 */ 166 uint16_t version; 167 168 /* cipher name specification (aes, etc) */ 169 char cipher_name[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN]; 170 171 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */ 172 char cipher_mode[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN]; 173 174 /* hash specification (sha256, etc) */ 175 char hash_spec[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN]; 176 177 /* start offset of the volume data (in 512 byte sectors) */ 178 uint32_t payload_offset; 179 180 /* Number of key bytes */ 181 uint32_t key_bytes; 182 183 /* master key checksum after PBKDF2 */ 184 uint8_t master_key_digest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 185 186 /* salt for master key PBKDF2 */ 187 uint8_t master_key_salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 188 189 /* iterations for master key PBKDF2 */ 190 uint32_t master_key_iterations; 191 192 /* UUID of the partition in standard ASCII representation */ 193 uint8_t uuid[QCRYPTO_BLOCK_LUKS_UUID_LEN]; 194 195 /* key slots */ 196 QCryptoBlockLUKSKeySlot key_slots[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS]; 197 } QEMU_PACKED; 198 199 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader) != 592); 200 201 202 struct QCryptoBlockLUKS { 203 QCryptoBlockLUKSHeader header; 204 }; 205 206 207 static int qcrypto_block_luks_cipher_name_lookup(const char *name, 208 QCryptoCipherMode mode, 209 uint32_t key_bytes, 210 Error **errp) 211 { 212 const QCryptoBlockLUKSCipherNameMap *map = 213 qcrypto_block_luks_cipher_name_map; 214 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 215 size_t i, j; 216 217 if (mode == QCRYPTO_CIPHER_MODE_XTS) { 218 key_bytes /= 2; 219 } 220 221 for (i = 0; i < maplen; i++) { 222 if (!g_str_equal(map[i].name, name)) { 223 continue; 224 } 225 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 226 if (map[i].sizes[j].key_bytes == key_bytes) { 227 return map[i].sizes[j].id; 228 } 229 } 230 } 231 232 error_setg(errp, "Algorithm %s with key size %d bytes not supported", 233 name, key_bytes); 234 return 0; 235 } 236 237 static const char * 238 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg, 239 Error **errp) 240 { 241 const QCryptoBlockLUKSCipherNameMap *map = 242 qcrypto_block_luks_cipher_name_map; 243 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 244 size_t i, j; 245 for (i = 0; i < maplen; i++) { 246 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 247 if (map[i].sizes[j].id == alg) { 248 return map[i].name; 249 } 250 } 251 } 252 253 error_setg(errp, "Algorithm '%s' not supported", 254 QCryptoCipherAlgorithm_lookup[alg]); 255 return NULL; 256 } 257 258 /* XXX replace with qapi_enum_parse() in future, when we can 259 * make that function emit a more friendly error message */ 260 static int qcrypto_block_luks_name_lookup(const char *name, 261 const char *const *map, 262 size_t maplen, 263 const char *type, 264 Error **errp) 265 { 266 size_t i; 267 for (i = 0; i < maplen; i++) { 268 if (g_str_equal(map[i], name)) { 269 return i; 270 } 271 } 272 273 error_setg(errp, "%s %s not supported", type, name); 274 return 0; 275 } 276 277 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \ 278 qcrypto_block_luks_name_lookup(name, \ 279 QCryptoCipherMode_lookup, \ 280 QCRYPTO_CIPHER_MODE__MAX, \ 281 "Cipher mode", \ 282 errp) 283 284 #define qcrypto_block_luks_hash_name_lookup(name, errp) \ 285 qcrypto_block_luks_name_lookup(name, \ 286 QCryptoHashAlgorithm_lookup, \ 287 QCRYPTO_HASH_ALG__MAX, \ 288 "Hash algorithm", \ 289 errp) 290 291 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \ 292 qcrypto_block_luks_name_lookup(name, \ 293 QCryptoIVGenAlgorithm_lookup, \ 294 QCRYPTO_IVGEN_ALG__MAX, \ 295 "IV generator", \ 296 errp) 297 298 299 static bool 300 qcrypto_block_luks_has_format(const uint8_t *buf, 301 size_t buf_size) 302 { 303 const QCryptoBlockLUKSHeader *luks_header = (const void *)buf; 304 305 if (buf_size >= offsetof(QCryptoBlockLUKSHeader, cipher_name) && 306 memcmp(luks_header->magic, qcrypto_block_luks_magic, 307 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) == 0 && 308 be16_to_cpu(luks_header->version) == QCRYPTO_BLOCK_LUKS_VERSION) { 309 return true; 310 } else { 311 return false; 312 } 313 } 314 315 316 /** 317 * Deal with a quirk of dm-crypt usage of ESSIV. 318 * 319 * When calculating ESSIV IVs, the cipher length used by ESSIV 320 * may be different from the cipher length used for the block 321 * encryption, becauses dm-crypt uses the hash digest length 322 * as the key size. ie, if you have AES 128 as the block cipher 323 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as 324 * the cipher since that gets a key length matching the digest 325 * size, not AES 128 with truncated digest as might be imagined 326 */ 327 static QCryptoCipherAlgorithm 328 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher, 329 QCryptoHashAlgorithm hash, 330 Error **errp) 331 { 332 size_t digestlen = qcrypto_hash_digest_len(hash); 333 size_t keylen = qcrypto_cipher_get_key_len(cipher); 334 if (digestlen == keylen) { 335 return cipher; 336 } 337 338 switch (cipher) { 339 case QCRYPTO_CIPHER_ALG_AES_128: 340 case QCRYPTO_CIPHER_ALG_AES_192: 341 case QCRYPTO_CIPHER_ALG_AES_256: 342 if (digestlen == qcrypto_cipher_get_key_len( 343 QCRYPTO_CIPHER_ALG_AES_128)) { 344 return QCRYPTO_CIPHER_ALG_AES_128; 345 } else if (digestlen == qcrypto_cipher_get_key_len( 346 QCRYPTO_CIPHER_ALG_AES_192)) { 347 return QCRYPTO_CIPHER_ALG_AES_192; 348 } else if (digestlen == qcrypto_cipher_get_key_len( 349 QCRYPTO_CIPHER_ALG_AES_256)) { 350 return QCRYPTO_CIPHER_ALG_AES_256; 351 } else { 352 error_setg(errp, "No AES cipher with key size %zu available", 353 digestlen); 354 return 0; 355 } 356 break; 357 case QCRYPTO_CIPHER_ALG_SERPENT_128: 358 case QCRYPTO_CIPHER_ALG_SERPENT_192: 359 case QCRYPTO_CIPHER_ALG_SERPENT_256: 360 if (digestlen == qcrypto_cipher_get_key_len( 361 QCRYPTO_CIPHER_ALG_SERPENT_128)) { 362 return QCRYPTO_CIPHER_ALG_SERPENT_128; 363 } else if (digestlen == qcrypto_cipher_get_key_len( 364 QCRYPTO_CIPHER_ALG_SERPENT_192)) { 365 return QCRYPTO_CIPHER_ALG_SERPENT_192; 366 } else if (digestlen == qcrypto_cipher_get_key_len( 367 QCRYPTO_CIPHER_ALG_SERPENT_256)) { 368 return QCRYPTO_CIPHER_ALG_SERPENT_256; 369 } else { 370 error_setg(errp, "No Serpent cipher with key size %zu available", 371 digestlen); 372 return 0; 373 } 374 break; 375 case QCRYPTO_CIPHER_ALG_TWOFISH_128: 376 case QCRYPTO_CIPHER_ALG_TWOFISH_192: 377 case QCRYPTO_CIPHER_ALG_TWOFISH_256: 378 if (digestlen == qcrypto_cipher_get_key_len( 379 QCRYPTO_CIPHER_ALG_TWOFISH_128)) { 380 return QCRYPTO_CIPHER_ALG_TWOFISH_128; 381 } else if (digestlen == qcrypto_cipher_get_key_len( 382 QCRYPTO_CIPHER_ALG_TWOFISH_192)) { 383 return QCRYPTO_CIPHER_ALG_TWOFISH_192; 384 } else if (digestlen == qcrypto_cipher_get_key_len( 385 QCRYPTO_CIPHER_ALG_TWOFISH_256)) { 386 return QCRYPTO_CIPHER_ALG_TWOFISH_256; 387 } else { 388 error_setg(errp, "No Twofish cipher with key size %zu available", 389 digestlen); 390 return 0; 391 } 392 break; 393 default: 394 error_setg(errp, "Cipher %s not supported with essiv", 395 QCryptoCipherAlgorithm_lookup[cipher]); 396 return 0; 397 } 398 } 399 400 /* 401 * Given a key slot, and user password, this will attempt to unlock 402 * the master encryption key from the key slot. 403 * 404 * Returns: 405 * 0 if the key slot is disabled, or key could not be decrypted 406 * with the provided password 407 * 1 if the key slot is enabled, and key decrypted successfully 408 * with the provided password 409 * -1 if a fatal error occurred loading the key 410 */ 411 static int 412 qcrypto_block_luks_load_key(QCryptoBlock *block, 413 QCryptoBlockLUKSKeySlot *slot, 414 const char *password, 415 QCryptoCipherAlgorithm cipheralg, 416 QCryptoCipherMode ciphermode, 417 QCryptoHashAlgorithm hash, 418 QCryptoIVGenAlgorithm ivalg, 419 QCryptoCipherAlgorithm ivcipheralg, 420 QCryptoHashAlgorithm ivhash, 421 uint8_t *masterkey, 422 size_t masterkeylen, 423 QCryptoBlockReadFunc readfunc, 424 void *opaque, 425 Error **errp) 426 { 427 QCryptoBlockLUKS *luks = block->opaque; 428 uint8_t *splitkey; 429 size_t splitkeylen; 430 uint8_t *possiblekey; 431 int ret = -1; 432 ssize_t rv; 433 QCryptoCipher *cipher = NULL; 434 uint8_t keydigest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 435 QCryptoIVGen *ivgen = NULL; 436 size_t niv; 437 438 if (slot->active != QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED) { 439 return 0; 440 } 441 442 splitkeylen = masterkeylen * slot->stripes; 443 splitkey = g_new0(uint8_t, splitkeylen); 444 possiblekey = g_new0(uint8_t, masterkeylen); 445 446 /* 447 * The user password is used to generate a (possible) 448 * decryption key. This may or may not successfully 449 * decrypt the master key - we just blindly assume 450 * the key is correct and validate the results of 451 * decryption later. 452 */ 453 if (qcrypto_pbkdf2(hash, 454 (const uint8_t *)password, strlen(password), 455 slot->salt, QCRYPTO_BLOCK_LUKS_SALT_LEN, 456 slot->iterations, 457 possiblekey, masterkeylen, 458 errp) < 0) { 459 goto cleanup; 460 } 461 462 /* 463 * We need to read the master key material from the 464 * LUKS key material header. What we're reading is 465 * not the raw master key, but rather the data after 466 * it has been passed through AFSplit and the result 467 * then encrypted. 468 */ 469 rv = readfunc(block, 470 slot->key_offset * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 471 splitkey, splitkeylen, 472 errp, 473 opaque); 474 if (rv < 0) { 475 goto cleanup; 476 } 477 478 479 /* Setup the cipher/ivgen that we'll use to try to decrypt 480 * the split master key material */ 481 cipher = qcrypto_cipher_new(cipheralg, ciphermode, 482 possiblekey, masterkeylen, 483 errp); 484 if (!cipher) { 485 goto cleanup; 486 } 487 488 niv = qcrypto_cipher_get_iv_len(cipheralg, 489 ciphermode); 490 ivgen = qcrypto_ivgen_new(ivalg, 491 ivcipheralg, 492 ivhash, 493 possiblekey, masterkeylen, 494 errp); 495 if (!ivgen) { 496 goto cleanup; 497 } 498 499 500 /* 501 * The master key needs to be decrypted in the same 502 * way that the block device payload will be decrypted 503 * later. In particular we'll be using the IV generator 504 * to reset the encryption cipher every time the master 505 * key crosses a sector boundary. 506 */ 507 if (qcrypto_block_decrypt_helper(cipher, 508 niv, 509 ivgen, 510 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 511 0, 512 splitkey, 513 splitkeylen, 514 errp) < 0) { 515 goto cleanup; 516 } 517 518 /* 519 * Now we've decrypted the split master key, join 520 * it back together to get the actual master key. 521 */ 522 if (qcrypto_afsplit_decode(hash, 523 masterkeylen, 524 slot->stripes, 525 splitkey, 526 masterkey, 527 errp) < 0) { 528 goto cleanup; 529 } 530 531 532 /* 533 * We still don't know that the masterkey we got is valid, 534 * because we just blindly assumed the user's password 535 * was correct. This is where we now verify it. We are 536 * creating a hash of the master key using PBKDF and 537 * then comparing that to the hash stored in the key slot 538 * header 539 */ 540 if (qcrypto_pbkdf2(hash, 541 masterkey, masterkeylen, 542 luks->header.master_key_salt, 543 QCRYPTO_BLOCK_LUKS_SALT_LEN, 544 luks->header.master_key_iterations, 545 keydigest, G_N_ELEMENTS(keydigest), 546 errp) < 0) { 547 goto cleanup; 548 } 549 550 if (memcmp(keydigest, luks->header.master_key_digest, 551 QCRYPTO_BLOCK_LUKS_DIGEST_LEN) == 0) { 552 /* Success, we got the right master key */ 553 ret = 1; 554 goto cleanup; 555 } 556 557 /* Fail, user's password was not valid for this key slot, 558 * tell caller to try another slot */ 559 ret = 0; 560 561 cleanup: 562 qcrypto_ivgen_free(ivgen); 563 qcrypto_cipher_free(cipher); 564 g_free(splitkey); 565 g_free(possiblekey); 566 return ret; 567 } 568 569 570 /* 571 * Given a user password, this will iterate over all key 572 * slots and try to unlock each active key slot using the 573 * password until it successfully obtains a master key. 574 * 575 * Returns 0 if a key was loaded, -1 if no keys could be loaded 576 */ 577 static int 578 qcrypto_block_luks_find_key(QCryptoBlock *block, 579 const char *password, 580 QCryptoCipherAlgorithm cipheralg, 581 QCryptoCipherMode ciphermode, 582 QCryptoHashAlgorithm hash, 583 QCryptoIVGenAlgorithm ivalg, 584 QCryptoCipherAlgorithm ivcipheralg, 585 QCryptoHashAlgorithm ivhash, 586 uint8_t **masterkey, 587 size_t *masterkeylen, 588 QCryptoBlockReadFunc readfunc, 589 void *opaque, 590 Error **errp) 591 { 592 QCryptoBlockLUKS *luks = block->opaque; 593 size_t i; 594 int rv; 595 596 *masterkey = g_new0(uint8_t, luks->header.key_bytes); 597 *masterkeylen = luks->header.key_bytes; 598 599 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 600 rv = qcrypto_block_luks_load_key(block, 601 &luks->header.key_slots[i], 602 password, 603 cipheralg, 604 ciphermode, 605 hash, 606 ivalg, 607 ivcipheralg, 608 ivhash, 609 *masterkey, 610 *masterkeylen, 611 readfunc, 612 opaque, 613 errp); 614 if (rv < 0) { 615 goto error; 616 } 617 if (rv == 1) { 618 return 0; 619 } 620 } 621 622 error_setg(errp, "Invalid password, cannot unlock any keyslot"); 623 624 error: 625 g_free(*masterkey); 626 *masterkey = NULL; 627 *masterkeylen = 0; 628 return -1; 629 } 630 631 632 static int 633 qcrypto_block_luks_open(QCryptoBlock *block, 634 QCryptoBlockOpenOptions *options, 635 QCryptoBlockReadFunc readfunc, 636 void *opaque, 637 unsigned int flags, 638 Error **errp) 639 { 640 QCryptoBlockLUKS *luks; 641 Error *local_err = NULL; 642 int ret = 0; 643 size_t i; 644 ssize_t rv; 645 uint8_t *masterkey = NULL; 646 size_t masterkeylen; 647 char *ivgen_name, *ivhash_name; 648 QCryptoCipherMode ciphermode; 649 QCryptoCipherAlgorithm cipheralg; 650 QCryptoIVGenAlgorithm ivalg; 651 QCryptoCipherAlgorithm ivcipheralg; 652 QCryptoHashAlgorithm hash; 653 QCryptoHashAlgorithm ivhash; 654 char *password = NULL; 655 656 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 657 if (!options->u.luks.key_secret) { 658 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 659 return -1; 660 } 661 password = qcrypto_secret_lookup_as_utf8( 662 options->u.luks.key_secret, errp); 663 if (!password) { 664 return -1; 665 } 666 } 667 668 luks = g_new0(QCryptoBlockLUKS, 1); 669 block->opaque = luks; 670 671 /* Read the entire LUKS header, minus the key material from 672 * the underlying device */ 673 rv = readfunc(block, 0, 674 (uint8_t *)&luks->header, 675 sizeof(luks->header), 676 errp, 677 opaque); 678 if (rv < 0) { 679 ret = rv; 680 goto fail; 681 } 682 683 /* The header is always stored in big-endian format, so 684 * convert everything to native */ 685 be16_to_cpus(&luks->header.version); 686 be32_to_cpus(&luks->header.payload_offset); 687 be32_to_cpus(&luks->header.key_bytes); 688 be32_to_cpus(&luks->header.master_key_iterations); 689 690 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 691 be32_to_cpus(&luks->header.key_slots[i].active); 692 be32_to_cpus(&luks->header.key_slots[i].iterations); 693 be32_to_cpus(&luks->header.key_slots[i].key_offset); 694 be32_to_cpus(&luks->header.key_slots[i].stripes); 695 } 696 697 if (memcmp(luks->header.magic, qcrypto_block_luks_magic, 698 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) != 0) { 699 error_setg(errp, "Volume is not in LUKS format"); 700 ret = -EINVAL; 701 goto fail; 702 } 703 if (luks->header.version != QCRYPTO_BLOCK_LUKS_VERSION) { 704 error_setg(errp, "LUKS version %" PRIu32 " is not supported", 705 luks->header.version); 706 ret = -ENOTSUP; 707 goto fail; 708 } 709 710 /* 711 * The cipher_mode header contains a string that we have 712 * to further parse, of the format 713 * 714 * <cipher-mode>-<iv-generator>[:<iv-hash>] 715 * 716 * eg cbc-essiv:sha256, cbc-plain64 717 */ 718 ivgen_name = strchr(luks->header.cipher_mode, '-'); 719 if (!ivgen_name) { 720 ret = -EINVAL; 721 error_setg(errp, "Unexpected cipher mode string format %s", 722 luks->header.cipher_mode); 723 goto fail; 724 } 725 *ivgen_name = '\0'; 726 ivgen_name++; 727 728 ivhash_name = strchr(ivgen_name, ':'); 729 if (!ivhash_name) { 730 ivhash = 0; 731 } else { 732 *ivhash_name = '\0'; 733 ivhash_name++; 734 735 ivhash = qcrypto_block_luks_hash_name_lookup(ivhash_name, 736 &local_err); 737 if (local_err) { 738 ret = -ENOTSUP; 739 error_propagate(errp, local_err); 740 goto fail; 741 } 742 } 743 744 ciphermode = qcrypto_block_luks_cipher_mode_lookup(luks->header.cipher_mode, 745 &local_err); 746 if (local_err) { 747 ret = -ENOTSUP; 748 error_propagate(errp, local_err); 749 goto fail; 750 } 751 752 cipheralg = qcrypto_block_luks_cipher_name_lookup(luks->header.cipher_name, 753 ciphermode, 754 luks->header.key_bytes, 755 &local_err); 756 if (local_err) { 757 ret = -ENOTSUP; 758 error_propagate(errp, local_err); 759 goto fail; 760 } 761 762 hash = qcrypto_block_luks_hash_name_lookup(luks->header.hash_spec, 763 &local_err); 764 if (local_err) { 765 ret = -ENOTSUP; 766 error_propagate(errp, local_err); 767 goto fail; 768 } 769 770 ivalg = qcrypto_block_luks_ivgen_name_lookup(ivgen_name, 771 &local_err); 772 if (local_err) { 773 ret = -ENOTSUP; 774 error_propagate(errp, local_err); 775 goto fail; 776 } 777 778 if (ivalg == QCRYPTO_IVGEN_ALG_ESSIV) { 779 if (!ivhash_name) { 780 ret = -EINVAL; 781 error_setg(errp, "Missing IV generator hash specification"); 782 goto fail; 783 } 784 ivcipheralg = qcrypto_block_luks_essiv_cipher(cipheralg, 785 ivhash, 786 &local_err); 787 if (local_err) { 788 ret = -ENOTSUP; 789 error_propagate(errp, local_err); 790 goto fail; 791 } 792 } else { 793 /* Note we parsed the ivhash_name earlier in the cipher_mode 794 * spec string even with plain/plain64 ivgens, but we 795 * will ignore it, since it is irrelevant for these ivgens. 796 * This is for compat with dm-crypt which will silently 797 * ignore hash names with these ivgens rather than report 798 * an error about the invalid usage 799 */ 800 ivcipheralg = cipheralg; 801 } 802 803 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 804 /* Try to find which key slot our password is valid for 805 * and unlock the master key from that slot. 806 */ 807 if (qcrypto_block_luks_find_key(block, 808 password, 809 cipheralg, ciphermode, 810 hash, 811 ivalg, 812 ivcipheralg, 813 ivhash, 814 &masterkey, &masterkeylen, 815 readfunc, opaque, 816 errp) < 0) { 817 ret = -EACCES; 818 goto fail; 819 } 820 821 /* We have a valid master key now, so can setup the 822 * block device payload decryption objects 823 */ 824 block->kdfhash = hash; 825 block->niv = qcrypto_cipher_get_iv_len(cipheralg, 826 ciphermode); 827 block->ivgen = qcrypto_ivgen_new(ivalg, 828 ivcipheralg, 829 ivhash, 830 masterkey, masterkeylen, 831 errp); 832 if (!block->ivgen) { 833 ret = -ENOTSUP; 834 goto fail; 835 } 836 837 block->cipher = qcrypto_cipher_new(cipheralg, 838 ciphermode, 839 masterkey, masterkeylen, 840 errp); 841 if (!block->cipher) { 842 ret = -ENOTSUP; 843 goto fail; 844 } 845 } 846 847 block->payload_offset = luks->header.payload_offset * 848 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 849 850 g_free(masterkey); 851 g_free(password); 852 853 return 0; 854 855 fail: 856 g_free(masterkey); 857 qcrypto_cipher_free(block->cipher); 858 qcrypto_ivgen_free(block->ivgen); 859 g_free(luks); 860 g_free(password); 861 return ret; 862 } 863 864 865 static int 866 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr, Error **errp) 867 { 868 #ifdef CONFIG_UUID 869 uuid_t uuid; 870 uuid_generate(uuid); 871 uuid_unparse(uuid, (char *)uuidstr); 872 return 0; 873 #else 874 error_setg(errp, "Unable to generate uuids on this platform"); 875 return -1; 876 #endif 877 } 878 879 static int 880 qcrypto_block_luks_create(QCryptoBlock *block, 881 QCryptoBlockCreateOptions *options, 882 QCryptoBlockInitFunc initfunc, 883 QCryptoBlockWriteFunc writefunc, 884 void *opaque, 885 Error **errp) 886 { 887 QCryptoBlockLUKS *luks; 888 QCryptoBlockCreateOptionsLUKS luks_opts; 889 Error *local_err = NULL; 890 uint8_t *masterkey = NULL; 891 uint8_t *slotkey = NULL; 892 uint8_t *splitkey = NULL; 893 size_t splitkeylen = 0; 894 size_t i; 895 QCryptoCipher *cipher = NULL; 896 QCryptoIVGen *ivgen = NULL; 897 char *password; 898 const char *cipher_alg; 899 const char *cipher_mode; 900 const char *ivgen_alg; 901 const char *ivgen_hash_alg = NULL; 902 const char *hash_alg; 903 char *cipher_mode_spec = NULL; 904 QCryptoCipherAlgorithm ivcipheralg = 0; 905 906 memcpy(&luks_opts, &options->u.luks, sizeof(luks_opts)); 907 if (!luks_opts.has_cipher_alg) { 908 luks_opts.cipher_alg = QCRYPTO_CIPHER_ALG_AES_256; 909 } 910 if (!luks_opts.has_cipher_mode) { 911 luks_opts.cipher_mode = QCRYPTO_CIPHER_MODE_XTS; 912 } 913 if (!luks_opts.has_ivgen_alg) { 914 luks_opts.ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64; 915 } 916 if (!luks_opts.has_hash_alg) { 917 luks_opts.hash_alg = QCRYPTO_HASH_ALG_SHA256; 918 } 919 if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 920 if (!luks_opts.has_ivgen_hash_alg) { 921 luks_opts.ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256; 922 luks_opts.has_ivgen_hash_alg = true; 923 } 924 } 925 /* Note we're allowing ivgen_hash_alg to be set even for 926 * non-essiv iv generators that don't need a hash. It will 927 * be silently ignored, for compatibility with dm-crypt */ 928 929 if (!options->u.luks.key_secret) { 930 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 931 return -1; 932 } 933 password = qcrypto_secret_lookup_as_utf8(luks_opts.key_secret, errp); 934 if (!password) { 935 return -1; 936 } 937 938 luks = g_new0(QCryptoBlockLUKS, 1); 939 block->opaque = luks; 940 941 memcpy(luks->header.magic, qcrypto_block_luks_magic, 942 QCRYPTO_BLOCK_LUKS_MAGIC_LEN); 943 944 /* We populate the header in native endianness initially and 945 * then convert everything to big endian just before writing 946 * it out to disk 947 */ 948 luks->header.version = QCRYPTO_BLOCK_LUKS_VERSION; 949 if (qcrypto_block_luks_uuid_gen(luks->header.uuid, 950 errp) < 0) { 951 goto error; 952 } 953 954 cipher_alg = qcrypto_block_luks_cipher_alg_lookup(luks_opts.cipher_alg, 955 errp); 956 if (!cipher_alg) { 957 goto error; 958 } 959 960 cipher_mode = QCryptoCipherMode_lookup[luks_opts.cipher_mode]; 961 ivgen_alg = QCryptoIVGenAlgorithm_lookup[luks_opts.ivgen_alg]; 962 if (luks_opts.has_ivgen_hash_alg) { 963 ivgen_hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.ivgen_hash_alg]; 964 cipher_mode_spec = g_strdup_printf("%s-%s:%s", cipher_mode, ivgen_alg, 965 ivgen_hash_alg); 966 } else { 967 cipher_mode_spec = g_strdup_printf("%s-%s", cipher_mode, ivgen_alg); 968 } 969 hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.hash_alg]; 970 971 972 if (strlen(cipher_alg) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN) { 973 error_setg(errp, "Cipher name '%s' is too long for LUKS header", 974 cipher_alg); 975 goto error; 976 } 977 if (strlen(cipher_mode_spec) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN) { 978 error_setg(errp, "Cipher mode '%s' is too long for LUKS header", 979 cipher_mode_spec); 980 goto error; 981 } 982 if (strlen(hash_alg) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN) { 983 error_setg(errp, "Hash name '%s' is too long for LUKS header", 984 hash_alg); 985 goto error; 986 } 987 988 if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 989 ivcipheralg = qcrypto_block_luks_essiv_cipher(luks_opts.cipher_alg, 990 luks_opts.ivgen_hash_alg, 991 &local_err); 992 if (local_err) { 993 error_propagate(errp, local_err); 994 goto error; 995 } 996 } else { 997 ivcipheralg = luks_opts.cipher_alg; 998 } 999 1000 strcpy(luks->header.cipher_name, cipher_alg); 1001 strcpy(luks->header.cipher_mode, cipher_mode_spec); 1002 strcpy(luks->header.hash_spec, hash_alg); 1003 1004 luks->header.key_bytes = qcrypto_cipher_get_key_len(luks_opts.cipher_alg); 1005 if (luks_opts.cipher_mode == QCRYPTO_CIPHER_MODE_XTS) { 1006 luks->header.key_bytes *= 2; 1007 } 1008 1009 /* Generate the salt used for hashing the master key 1010 * with PBKDF later 1011 */ 1012 if (qcrypto_random_bytes(luks->header.master_key_salt, 1013 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1014 errp) < 0) { 1015 goto error; 1016 } 1017 1018 /* Generate random master key */ 1019 masterkey = g_new0(uint8_t, luks->header.key_bytes); 1020 if (qcrypto_random_bytes(masterkey, 1021 luks->header.key_bytes, errp) < 0) { 1022 goto error; 1023 } 1024 1025 1026 /* Setup the block device payload encryption objects */ 1027 block->cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1028 luks_opts.cipher_mode, 1029 masterkey, luks->header.key_bytes, 1030 errp); 1031 if (!block->cipher) { 1032 goto error; 1033 } 1034 1035 block->kdfhash = luks_opts.hash_alg; 1036 block->niv = qcrypto_cipher_get_iv_len(luks_opts.cipher_alg, 1037 luks_opts.cipher_mode); 1038 block->ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1039 ivcipheralg, 1040 luks_opts.ivgen_hash_alg, 1041 masterkey, luks->header.key_bytes, 1042 errp); 1043 1044 if (!block->ivgen) { 1045 goto error; 1046 } 1047 1048 1049 /* Determine how many iterations we need to hash the master 1050 * key, in order to have 1 second of compute time used 1051 */ 1052 luks->header.master_key_iterations = 1053 qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1054 masterkey, luks->header.key_bytes, 1055 luks->header.master_key_salt, 1056 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1057 &local_err); 1058 if (local_err) { 1059 error_propagate(errp, local_err); 1060 goto error; 1061 } 1062 1063 /* Why /= 8 ? That matches cryptsetup, but there's no 1064 * explanation why they chose /= 8... Probably so that 1065 * if all 8 keyslots are active we only spend 1 second 1066 * in total time to check all keys */ 1067 luks->header.master_key_iterations /= 8; 1068 luks->header.master_key_iterations = MAX( 1069 luks->header.master_key_iterations, 1070 QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS); 1071 1072 1073 /* Hash the master key, saving the result in the LUKS 1074 * header. This hash is used when opening the encrypted 1075 * device to verify that the user password unlocked a 1076 * valid master key 1077 */ 1078 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1079 masterkey, luks->header.key_bytes, 1080 luks->header.master_key_salt, 1081 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1082 luks->header.master_key_iterations, 1083 luks->header.master_key_digest, 1084 QCRYPTO_BLOCK_LUKS_DIGEST_LEN, 1085 errp) < 0) { 1086 goto error; 1087 } 1088 1089 1090 /* Although LUKS has multiple key slots, we're just going 1091 * to use the first key slot */ 1092 splitkeylen = luks->header.key_bytes * QCRYPTO_BLOCK_LUKS_STRIPES; 1093 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1094 luks->header.key_slots[i].active = i == 0 ? 1095 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED : 1096 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED; 1097 luks->header.key_slots[i].stripes = QCRYPTO_BLOCK_LUKS_STRIPES; 1098 1099 /* This calculation doesn't match that shown in the spec, 1100 * but instead follows the cryptsetup implementation. 1101 */ 1102 luks->header.key_slots[i].key_offset = 1103 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1104 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1105 (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1106 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1107 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * i); 1108 } 1109 1110 if (qcrypto_random_bytes(luks->header.key_slots[0].salt, 1111 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1112 errp) < 0) { 1113 goto error; 1114 } 1115 1116 /* Again we determine how many iterations are required to 1117 * hash the user password while consuming 1 second of compute 1118 * time */ 1119 luks->header.key_slots[0].iterations = 1120 qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1121 (uint8_t *)password, strlen(password), 1122 luks->header.key_slots[0].salt, 1123 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1124 &local_err); 1125 if (local_err) { 1126 error_propagate(errp, local_err); 1127 goto error; 1128 } 1129 /* Why /= 2 ? That matches cryptsetup, but there's no 1130 * explanation why they chose /= 2... */ 1131 luks->header.key_slots[0].iterations /= 2; 1132 luks->header.key_slots[0].iterations = MAX( 1133 luks->header.key_slots[0].iterations, 1134 QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS); 1135 1136 1137 /* Generate a key that we'll use to encrypt the master 1138 * key, from the user's password 1139 */ 1140 slotkey = g_new0(uint8_t, luks->header.key_bytes); 1141 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1142 (uint8_t *)password, strlen(password), 1143 luks->header.key_slots[0].salt, 1144 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1145 luks->header.key_slots[0].iterations, 1146 slotkey, luks->header.key_bytes, 1147 errp) < 0) { 1148 goto error; 1149 } 1150 1151 1152 /* Setup the encryption objects needed to encrypt the 1153 * master key material 1154 */ 1155 cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1156 luks_opts.cipher_mode, 1157 slotkey, luks->header.key_bytes, 1158 errp); 1159 if (!cipher) { 1160 goto error; 1161 } 1162 1163 ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1164 ivcipheralg, 1165 luks_opts.ivgen_hash_alg, 1166 slotkey, luks->header.key_bytes, 1167 errp); 1168 if (!ivgen) { 1169 goto error; 1170 } 1171 1172 /* Before storing the master key, we need to vastly 1173 * increase its size, as protection against forensic 1174 * disk data recovery */ 1175 splitkey = g_new0(uint8_t, splitkeylen); 1176 1177 if (qcrypto_afsplit_encode(luks_opts.hash_alg, 1178 luks->header.key_bytes, 1179 luks->header.key_slots[0].stripes, 1180 masterkey, 1181 splitkey, 1182 errp) < 0) { 1183 goto error; 1184 } 1185 1186 /* Now we encrypt the split master key with the key generated 1187 * from the user's password, before storing it */ 1188 if (qcrypto_block_encrypt_helper(cipher, block->niv, ivgen, 1189 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1190 0, 1191 splitkey, 1192 splitkeylen, 1193 errp) < 0) { 1194 goto error; 1195 } 1196 1197 1198 /* The total size of the LUKS headers is the partition header + key 1199 * slot headers, rounded up to the nearest sector, combined with 1200 * the size of each master key material region, also rounded up 1201 * to the nearest sector */ 1202 luks->header.payload_offset = 1203 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1204 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1205 (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1206 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1207 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * 1208 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS); 1209 1210 block->payload_offset = luks->header.payload_offset * 1211 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 1212 1213 /* Reserve header space to match payload offset */ 1214 initfunc(block, block->payload_offset, &local_err, opaque); 1215 if (local_err) { 1216 error_propagate(errp, local_err); 1217 goto error; 1218 } 1219 1220 /* Everything on disk uses Big Endian, so flip header fields 1221 * before writing them */ 1222 cpu_to_be16s(&luks->header.version); 1223 cpu_to_be32s(&luks->header.payload_offset); 1224 cpu_to_be32s(&luks->header.key_bytes); 1225 cpu_to_be32s(&luks->header.master_key_iterations); 1226 1227 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1228 cpu_to_be32s(&luks->header.key_slots[i].active); 1229 cpu_to_be32s(&luks->header.key_slots[i].iterations); 1230 cpu_to_be32s(&luks->header.key_slots[i].key_offset); 1231 cpu_to_be32s(&luks->header.key_slots[i].stripes); 1232 } 1233 1234 1235 /* Write out the partition header and key slot headers */ 1236 writefunc(block, 0, 1237 (const uint8_t *)&luks->header, 1238 sizeof(luks->header), 1239 &local_err, 1240 opaque); 1241 1242 /* Delay checking local_err until we've byte-swapped */ 1243 1244 /* Byte swap the header back to native, in case we need 1245 * to read it again later */ 1246 be16_to_cpus(&luks->header.version); 1247 be32_to_cpus(&luks->header.payload_offset); 1248 be32_to_cpus(&luks->header.key_bytes); 1249 be32_to_cpus(&luks->header.master_key_iterations); 1250 1251 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1252 be32_to_cpus(&luks->header.key_slots[i].active); 1253 be32_to_cpus(&luks->header.key_slots[i].iterations); 1254 be32_to_cpus(&luks->header.key_slots[i].key_offset); 1255 be32_to_cpus(&luks->header.key_slots[i].stripes); 1256 } 1257 1258 if (local_err) { 1259 error_propagate(errp, local_err); 1260 goto error; 1261 } 1262 1263 /* Write out the master key material, starting at the 1264 * sector immediately following the partition header. */ 1265 if (writefunc(block, 1266 luks->header.key_slots[0].key_offset * 1267 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1268 splitkey, splitkeylen, 1269 errp, 1270 opaque) != splitkeylen) { 1271 goto error; 1272 } 1273 1274 memset(masterkey, 0, luks->header.key_bytes); 1275 g_free(masterkey); 1276 memset(slotkey, 0, luks->header.key_bytes); 1277 g_free(slotkey); 1278 g_free(splitkey); 1279 g_free(password); 1280 g_free(cipher_mode_spec); 1281 1282 qcrypto_ivgen_free(ivgen); 1283 qcrypto_cipher_free(cipher); 1284 1285 return 0; 1286 1287 error: 1288 if (masterkey) { 1289 memset(masterkey, 0, luks->header.key_bytes); 1290 } 1291 g_free(masterkey); 1292 if (slotkey) { 1293 memset(slotkey, 0, luks->header.key_bytes); 1294 } 1295 g_free(slotkey); 1296 g_free(splitkey); 1297 g_free(password); 1298 g_free(cipher_mode_spec); 1299 1300 qcrypto_ivgen_free(ivgen); 1301 qcrypto_cipher_free(cipher); 1302 1303 g_free(luks); 1304 return -1; 1305 } 1306 1307 1308 static void qcrypto_block_luks_cleanup(QCryptoBlock *block) 1309 { 1310 g_free(block->opaque); 1311 } 1312 1313 1314 static int 1315 qcrypto_block_luks_decrypt(QCryptoBlock *block, 1316 uint64_t startsector, 1317 uint8_t *buf, 1318 size_t len, 1319 Error **errp) 1320 { 1321 return qcrypto_block_decrypt_helper(block->cipher, 1322 block->niv, block->ivgen, 1323 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1324 startsector, buf, len, errp); 1325 } 1326 1327 1328 static int 1329 qcrypto_block_luks_encrypt(QCryptoBlock *block, 1330 uint64_t startsector, 1331 uint8_t *buf, 1332 size_t len, 1333 Error **errp) 1334 { 1335 return qcrypto_block_encrypt_helper(block->cipher, 1336 block->niv, block->ivgen, 1337 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1338 startsector, buf, len, errp); 1339 } 1340 1341 1342 const QCryptoBlockDriver qcrypto_block_driver_luks = { 1343 .open = qcrypto_block_luks_open, 1344 .create = qcrypto_block_luks_create, 1345 .cleanup = qcrypto_block_luks_cleanup, 1346 .decrypt = qcrypto_block_luks_decrypt, 1347 .encrypt = qcrypto_block_luks_encrypt, 1348 .has_format = qcrypto_block_luks_has_format, 1349 }; 1350