1 /* 2 * QEMU Crypto block device encryption LUKS format 3 * 4 * Copyright (c) 2015-2016 Red Hat, Inc. 5 * 6 * This library is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU Lesser General Public 8 * License as published by the Free Software Foundation; either 9 * version 2 of the License, or (at your option) any later version. 10 * 11 * This library is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 14 * Lesser General Public License for more details. 15 * 16 * You should have received a copy of the GNU Lesser General Public 17 * License along with this library; if not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include "qemu/osdep.h" 22 #include "qapi/error.h" 23 #include "qemu/bswap.h" 24 25 #include "crypto/block-luks.h" 26 27 #include "crypto/hash.h" 28 #include "crypto/afsplit.h" 29 #include "crypto/pbkdf.h" 30 #include "crypto/secret.h" 31 #include "crypto/random.h" 32 33 #ifdef CONFIG_UUID 34 #include <uuid/uuid.h> 35 #endif 36 37 #include "qemu/coroutine.h" 38 39 /* 40 * Reference for the LUKS format implemented here is 41 * 42 * docs/on-disk-format.pdf 43 * 44 * in 'cryptsetup' package source code 45 * 46 * This file implements the 1.2.1 specification, dated 47 * Oct 16, 2011. 48 */ 49 50 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS; 51 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader; 52 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot; 53 54 55 /* The following constants are all defined by the LUKS spec */ 56 #define QCRYPTO_BLOCK_LUKS_VERSION 1 57 58 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6 59 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32 60 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32 61 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32 62 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20 63 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32 64 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40 65 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8 66 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000 67 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000 68 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000 69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096 70 71 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD 72 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3 73 74 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL 75 76 static const char qcrypto_block_luks_magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN] = { 77 'L', 'U', 'K', 'S', 0xBA, 0xBE 78 }; 79 80 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap; 81 struct QCryptoBlockLUKSNameMap { 82 const char *name; 83 int id; 84 }; 85 86 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap; 87 struct QCryptoBlockLUKSCipherSizeMap { 88 uint32_t key_bytes; 89 int id; 90 }; 91 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap; 92 struct QCryptoBlockLUKSCipherNameMap { 93 const char *name; 94 const QCryptoBlockLUKSCipherSizeMap *sizes; 95 }; 96 97 98 static const QCryptoBlockLUKSCipherSizeMap 99 qcrypto_block_luks_cipher_size_map_aes[] = { 100 { 16, QCRYPTO_CIPHER_ALG_AES_128 }, 101 { 24, QCRYPTO_CIPHER_ALG_AES_192 }, 102 { 32, QCRYPTO_CIPHER_ALG_AES_256 }, 103 { 0, 0 }, 104 }; 105 106 static const QCryptoBlockLUKSCipherSizeMap 107 qcrypto_block_luks_cipher_size_map_cast5[] = { 108 { 16, QCRYPTO_CIPHER_ALG_CAST5_128 }, 109 { 0, 0 }, 110 }; 111 112 static const QCryptoBlockLUKSCipherSizeMap 113 qcrypto_block_luks_cipher_size_map_serpent[] = { 114 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128 }, 115 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192 }, 116 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256 }, 117 { 0, 0 }, 118 }; 119 120 static const QCryptoBlockLUKSCipherSizeMap 121 qcrypto_block_luks_cipher_size_map_twofish[] = { 122 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128 }, 123 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192 }, 124 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256 }, 125 { 0, 0 }, 126 }; 127 128 static const QCryptoBlockLUKSCipherNameMap 129 qcrypto_block_luks_cipher_name_map[] = { 130 { "aes", qcrypto_block_luks_cipher_size_map_aes }, 131 { "cast5", qcrypto_block_luks_cipher_size_map_cast5 }, 132 { "serpent", qcrypto_block_luks_cipher_size_map_serpent }, 133 { "twofish", qcrypto_block_luks_cipher_size_map_twofish }, 134 }; 135 136 137 /* 138 * This struct is written to disk in big-endian format, 139 * but operated upon in native-endian format. 140 */ 141 struct QCryptoBlockLUKSKeySlot { 142 /* state of keyslot, enabled/disable */ 143 uint32_t active; 144 /* iterations for PBKDF2 */ 145 uint32_t iterations; 146 /* salt for PBKDF2 */ 147 uint8_t salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 148 /* start sector of key material */ 149 uint32_t key_offset; 150 /* number of anti-forensic stripes */ 151 uint32_t stripes; 152 } QEMU_PACKED; 153 154 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot) != 48); 155 156 157 /* 158 * This struct is written to disk in big-endian format, 159 * but operated upon in native-endian format. 160 */ 161 struct QCryptoBlockLUKSHeader { 162 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */ 163 char magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN]; 164 165 /* LUKS version, currently 1 */ 166 uint16_t version; 167 168 /* cipher name specification (aes, etc) */ 169 char cipher_name[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN]; 170 171 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */ 172 char cipher_mode[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN]; 173 174 /* hash specification (sha256, etc) */ 175 char hash_spec[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN]; 176 177 /* start offset of the volume data (in 512 byte sectors) */ 178 uint32_t payload_offset; 179 180 /* Number of key bytes */ 181 uint32_t key_bytes; 182 183 /* master key checksum after PBKDF2 */ 184 uint8_t master_key_digest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 185 186 /* salt for master key PBKDF2 */ 187 uint8_t master_key_salt[QCRYPTO_BLOCK_LUKS_SALT_LEN]; 188 189 /* iterations for master key PBKDF2 */ 190 uint32_t master_key_iterations; 191 192 /* UUID of the partition in standard ASCII representation */ 193 uint8_t uuid[QCRYPTO_BLOCK_LUKS_UUID_LEN]; 194 195 /* key slots */ 196 QCryptoBlockLUKSKeySlot key_slots[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS]; 197 } QEMU_PACKED; 198 199 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader) != 592); 200 201 202 struct QCryptoBlockLUKS { 203 QCryptoBlockLUKSHeader header; 204 }; 205 206 207 static int qcrypto_block_luks_cipher_name_lookup(const char *name, 208 QCryptoCipherMode mode, 209 uint32_t key_bytes, 210 Error **errp) 211 { 212 const QCryptoBlockLUKSCipherNameMap *map = 213 qcrypto_block_luks_cipher_name_map; 214 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 215 size_t i, j; 216 217 if (mode == QCRYPTO_CIPHER_MODE_XTS) { 218 key_bytes /= 2; 219 } 220 221 for (i = 0; i < maplen; i++) { 222 if (!g_str_equal(map[i].name, name)) { 223 continue; 224 } 225 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 226 if (map[i].sizes[j].key_bytes == key_bytes) { 227 return map[i].sizes[j].id; 228 } 229 } 230 } 231 232 error_setg(errp, "Algorithm %s with key size %d bytes not supported", 233 name, key_bytes); 234 return 0; 235 } 236 237 static const char * 238 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg, 239 Error **errp) 240 { 241 const QCryptoBlockLUKSCipherNameMap *map = 242 qcrypto_block_luks_cipher_name_map; 243 size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map); 244 size_t i, j; 245 for (i = 0; i < maplen; i++) { 246 for (j = 0; j < map[i].sizes[j].key_bytes; j++) { 247 if (map[i].sizes[j].id == alg) { 248 return map[i].name; 249 } 250 } 251 } 252 253 error_setg(errp, "Algorithm '%s' not supported", 254 QCryptoCipherAlgorithm_lookup[alg]); 255 return NULL; 256 } 257 258 /* XXX replace with qapi_enum_parse() in future, when we can 259 * make that function emit a more friendly error message */ 260 static int qcrypto_block_luks_name_lookup(const char *name, 261 const char *const *map, 262 size_t maplen, 263 const char *type, 264 Error **errp) 265 { 266 size_t i; 267 for (i = 0; i < maplen; i++) { 268 if (g_str_equal(map[i], name)) { 269 return i; 270 } 271 } 272 273 error_setg(errp, "%s %s not supported", type, name); 274 return 0; 275 } 276 277 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \ 278 qcrypto_block_luks_name_lookup(name, \ 279 QCryptoCipherMode_lookup, \ 280 QCRYPTO_CIPHER_MODE__MAX, \ 281 "Cipher mode", \ 282 errp) 283 284 #define qcrypto_block_luks_hash_name_lookup(name, errp) \ 285 qcrypto_block_luks_name_lookup(name, \ 286 QCryptoHashAlgorithm_lookup, \ 287 QCRYPTO_HASH_ALG__MAX, \ 288 "Hash algorithm", \ 289 errp) 290 291 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \ 292 qcrypto_block_luks_name_lookup(name, \ 293 QCryptoIVGenAlgorithm_lookup, \ 294 QCRYPTO_IVGEN_ALG__MAX, \ 295 "IV generator", \ 296 errp) 297 298 299 static bool 300 qcrypto_block_luks_has_format(const uint8_t *buf, 301 size_t buf_size) 302 { 303 const QCryptoBlockLUKSHeader *luks_header = (const void *)buf; 304 305 if (buf_size >= offsetof(QCryptoBlockLUKSHeader, cipher_name) && 306 memcmp(luks_header->magic, qcrypto_block_luks_magic, 307 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) == 0 && 308 be16_to_cpu(luks_header->version) == QCRYPTO_BLOCK_LUKS_VERSION) { 309 return true; 310 } else { 311 return false; 312 } 313 } 314 315 316 /** 317 * Deal with a quirk of dm-crypt usage of ESSIV. 318 * 319 * When calculating ESSIV IVs, the cipher length used by ESSIV 320 * may be different from the cipher length used for the block 321 * encryption, becauses dm-crypt uses the hash digest length 322 * as the key size. ie, if you have AES 128 as the block cipher 323 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as 324 * the cipher since that gets a key length matching the digest 325 * size, not AES 128 with truncated digest as might be imagined 326 */ 327 static QCryptoCipherAlgorithm 328 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher, 329 QCryptoHashAlgorithm hash, 330 Error **errp) 331 { 332 size_t digestlen = qcrypto_hash_digest_len(hash); 333 size_t keylen = qcrypto_cipher_get_key_len(cipher); 334 if (digestlen == keylen) { 335 return cipher; 336 } 337 338 switch (cipher) { 339 case QCRYPTO_CIPHER_ALG_AES_128: 340 case QCRYPTO_CIPHER_ALG_AES_192: 341 case QCRYPTO_CIPHER_ALG_AES_256: 342 if (digestlen == qcrypto_cipher_get_key_len( 343 QCRYPTO_CIPHER_ALG_AES_128)) { 344 return QCRYPTO_CIPHER_ALG_AES_128; 345 } else if (digestlen == qcrypto_cipher_get_key_len( 346 QCRYPTO_CIPHER_ALG_AES_192)) { 347 return QCRYPTO_CIPHER_ALG_AES_192; 348 } else if (digestlen == qcrypto_cipher_get_key_len( 349 QCRYPTO_CIPHER_ALG_AES_256)) { 350 return QCRYPTO_CIPHER_ALG_AES_256; 351 } else { 352 error_setg(errp, "No AES cipher with key size %zu available", 353 digestlen); 354 return 0; 355 } 356 break; 357 case QCRYPTO_CIPHER_ALG_SERPENT_128: 358 case QCRYPTO_CIPHER_ALG_SERPENT_192: 359 case QCRYPTO_CIPHER_ALG_SERPENT_256: 360 if (digestlen == qcrypto_cipher_get_key_len( 361 QCRYPTO_CIPHER_ALG_SERPENT_128)) { 362 return QCRYPTO_CIPHER_ALG_SERPENT_128; 363 } else if (digestlen == qcrypto_cipher_get_key_len( 364 QCRYPTO_CIPHER_ALG_SERPENT_192)) { 365 return QCRYPTO_CIPHER_ALG_SERPENT_192; 366 } else if (digestlen == qcrypto_cipher_get_key_len( 367 QCRYPTO_CIPHER_ALG_SERPENT_256)) { 368 return QCRYPTO_CIPHER_ALG_SERPENT_256; 369 } else { 370 error_setg(errp, "No Serpent cipher with key size %zu available", 371 digestlen); 372 return 0; 373 } 374 break; 375 case QCRYPTO_CIPHER_ALG_TWOFISH_128: 376 case QCRYPTO_CIPHER_ALG_TWOFISH_192: 377 case QCRYPTO_CIPHER_ALG_TWOFISH_256: 378 if (digestlen == qcrypto_cipher_get_key_len( 379 QCRYPTO_CIPHER_ALG_TWOFISH_128)) { 380 return QCRYPTO_CIPHER_ALG_TWOFISH_128; 381 } else if (digestlen == qcrypto_cipher_get_key_len( 382 QCRYPTO_CIPHER_ALG_TWOFISH_192)) { 383 return QCRYPTO_CIPHER_ALG_TWOFISH_192; 384 } else if (digestlen == qcrypto_cipher_get_key_len( 385 QCRYPTO_CIPHER_ALG_TWOFISH_256)) { 386 return QCRYPTO_CIPHER_ALG_TWOFISH_256; 387 } else { 388 error_setg(errp, "No Twofish cipher with key size %zu available", 389 digestlen); 390 return 0; 391 } 392 break; 393 default: 394 error_setg(errp, "Cipher %s not supported with essiv", 395 QCryptoCipherAlgorithm_lookup[cipher]); 396 return 0; 397 } 398 } 399 400 /* 401 * Given a key slot, and user password, this will attempt to unlock 402 * the master encryption key from the key slot. 403 * 404 * Returns: 405 * 0 if the key slot is disabled, or key could not be decrypted 406 * with the provided password 407 * 1 if the key slot is enabled, and key decrypted successfully 408 * with the provided password 409 * -1 if a fatal error occurred loading the key 410 */ 411 static int 412 qcrypto_block_luks_load_key(QCryptoBlock *block, 413 QCryptoBlockLUKSKeySlot *slot, 414 const char *password, 415 QCryptoCipherAlgorithm cipheralg, 416 QCryptoCipherMode ciphermode, 417 QCryptoHashAlgorithm hash, 418 QCryptoIVGenAlgorithm ivalg, 419 QCryptoCipherAlgorithm ivcipheralg, 420 QCryptoHashAlgorithm ivhash, 421 uint8_t *masterkey, 422 size_t masterkeylen, 423 QCryptoBlockReadFunc readfunc, 424 void *opaque, 425 Error **errp) 426 { 427 QCryptoBlockLUKS *luks = block->opaque; 428 uint8_t *splitkey; 429 size_t splitkeylen; 430 uint8_t *possiblekey; 431 int ret = -1; 432 ssize_t rv; 433 QCryptoCipher *cipher = NULL; 434 uint8_t keydigest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN]; 435 QCryptoIVGen *ivgen = NULL; 436 size_t niv; 437 438 if (slot->active != QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED) { 439 return 0; 440 } 441 442 splitkeylen = masterkeylen * slot->stripes; 443 splitkey = g_new0(uint8_t, splitkeylen); 444 possiblekey = g_new0(uint8_t, masterkeylen); 445 446 /* 447 * The user password is used to generate a (possible) 448 * decryption key. This may or may not successfully 449 * decrypt the master key - we just blindly assume 450 * the key is correct and validate the results of 451 * decryption later. 452 */ 453 if (qcrypto_pbkdf2(hash, 454 (const uint8_t *)password, strlen(password), 455 slot->salt, QCRYPTO_BLOCK_LUKS_SALT_LEN, 456 slot->iterations, 457 possiblekey, masterkeylen, 458 errp) < 0) { 459 goto cleanup; 460 } 461 462 /* 463 * We need to read the master key material from the 464 * LUKS key material header. What we're reading is 465 * not the raw master key, but rather the data after 466 * it has been passed through AFSplit and the result 467 * then encrypted. 468 */ 469 rv = readfunc(block, 470 slot->key_offset * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 471 splitkey, splitkeylen, 472 errp, 473 opaque); 474 if (rv < 0) { 475 goto cleanup; 476 } 477 478 479 /* Setup the cipher/ivgen that we'll use to try to decrypt 480 * the split master key material */ 481 cipher = qcrypto_cipher_new(cipheralg, ciphermode, 482 possiblekey, masterkeylen, 483 errp); 484 if (!cipher) { 485 goto cleanup; 486 } 487 488 niv = qcrypto_cipher_get_iv_len(cipheralg, 489 ciphermode); 490 ivgen = qcrypto_ivgen_new(ivalg, 491 ivcipheralg, 492 ivhash, 493 possiblekey, masterkeylen, 494 errp); 495 if (!ivgen) { 496 goto cleanup; 497 } 498 499 500 /* 501 * The master key needs to be decrypted in the same 502 * way that the block device payload will be decrypted 503 * later. In particular we'll be using the IV generator 504 * to reset the encryption cipher every time the master 505 * key crosses a sector boundary. 506 */ 507 if (qcrypto_block_decrypt_helper(cipher, 508 niv, 509 ivgen, 510 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 511 0, 512 splitkey, 513 splitkeylen, 514 errp) < 0) { 515 goto cleanup; 516 } 517 518 /* 519 * Now we've decrypted the split master key, join 520 * it back together to get the actual master key. 521 */ 522 if (qcrypto_afsplit_decode(hash, 523 masterkeylen, 524 slot->stripes, 525 splitkey, 526 masterkey, 527 errp) < 0) { 528 goto cleanup; 529 } 530 531 532 /* 533 * We still don't know that the masterkey we got is valid, 534 * because we just blindly assumed the user's password 535 * was correct. This is where we now verify it. We are 536 * creating a hash of the master key using PBKDF and 537 * then comparing that to the hash stored in the key slot 538 * header 539 */ 540 if (qcrypto_pbkdf2(hash, 541 masterkey, masterkeylen, 542 luks->header.master_key_salt, 543 QCRYPTO_BLOCK_LUKS_SALT_LEN, 544 luks->header.master_key_iterations, 545 keydigest, G_N_ELEMENTS(keydigest), 546 errp) < 0) { 547 goto cleanup; 548 } 549 550 if (memcmp(keydigest, luks->header.master_key_digest, 551 QCRYPTO_BLOCK_LUKS_DIGEST_LEN) == 0) { 552 /* Success, we got the right master key */ 553 ret = 1; 554 goto cleanup; 555 } 556 557 /* Fail, user's password was not valid for this key slot, 558 * tell caller to try another slot */ 559 ret = 0; 560 561 cleanup: 562 qcrypto_ivgen_free(ivgen); 563 qcrypto_cipher_free(cipher); 564 g_free(splitkey); 565 g_free(possiblekey); 566 return ret; 567 } 568 569 570 /* 571 * Given a user password, this will iterate over all key 572 * slots and try to unlock each active key slot using the 573 * password until it successfully obtains a master key. 574 * 575 * Returns 0 if a key was loaded, -1 if no keys could be loaded 576 */ 577 static int 578 qcrypto_block_luks_find_key(QCryptoBlock *block, 579 const char *password, 580 QCryptoCipherAlgorithm cipheralg, 581 QCryptoCipherMode ciphermode, 582 QCryptoHashAlgorithm hash, 583 QCryptoIVGenAlgorithm ivalg, 584 QCryptoCipherAlgorithm ivcipheralg, 585 QCryptoHashAlgorithm ivhash, 586 uint8_t **masterkey, 587 size_t *masterkeylen, 588 QCryptoBlockReadFunc readfunc, 589 void *opaque, 590 Error **errp) 591 { 592 QCryptoBlockLUKS *luks = block->opaque; 593 size_t i; 594 int rv; 595 596 *masterkey = g_new0(uint8_t, luks->header.key_bytes); 597 *masterkeylen = luks->header.key_bytes; 598 599 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 600 rv = qcrypto_block_luks_load_key(block, 601 &luks->header.key_slots[i], 602 password, 603 cipheralg, 604 ciphermode, 605 hash, 606 ivalg, 607 ivcipheralg, 608 ivhash, 609 *masterkey, 610 *masterkeylen, 611 readfunc, 612 opaque, 613 errp); 614 if (rv < 0) { 615 goto error; 616 } 617 if (rv == 1) { 618 return 0; 619 } 620 } 621 622 error_setg(errp, "Invalid password, cannot unlock any keyslot"); 623 624 error: 625 g_free(*masterkey); 626 *masterkey = NULL; 627 *masterkeylen = 0; 628 return -1; 629 } 630 631 632 static int 633 qcrypto_block_luks_open(QCryptoBlock *block, 634 QCryptoBlockOpenOptions *options, 635 QCryptoBlockReadFunc readfunc, 636 void *opaque, 637 unsigned int flags, 638 Error **errp) 639 { 640 QCryptoBlockLUKS *luks; 641 Error *local_err = NULL; 642 int ret = 0; 643 size_t i; 644 ssize_t rv; 645 uint8_t *masterkey = NULL; 646 size_t masterkeylen; 647 char *ivgen_name, *ivhash_name; 648 QCryptoCipherMode ciphermode; 649 QCryptoCipherAlgorithm cipheralg; 650 QCryptoIVGenAlgorithm ivalg; 651 QCryptoCipherAlgorithm ivcipheralg; 652 QCryptoHashAlgorithm hash; 653 QCryptoHashAlgorithm ivhash; 654 char *password = NULL; 655 656 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 657 if (!options->u.luks.key_secret) { 658 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 659 return -1; 660 } 661 password = qcrypto_secret_lookup_as_utf8( 662 options->u.luks.key_secret, errp); 663 if (!password) { 664 return -1; 665 } 666 } 667 668 luks = g_new0(QCryptoBlockLUKS, 1); 669 block->opaque = luks; 670 671 /* Read the entire LUKS header, minus the key material from 672 * the underlying device */ 673 rv = readfunc(block, 0, 674 (uint8_t *)&luks->header, 675 sizeof(luks->header), 676 errp, 677 opaque); 678 if (rv < 0) { 679 ret = rv; 680 goto fail; 681 } 682 683 /* The header is always stored in big-endian format, so 684 * convert everything to native */ 685 be16_to_cpus(&luks->header.version); 686 be32_to_cpus(&luks->header.payload_offset); 687 be32_to_cpus(&luks->header.key_bytes); 688 be32_to_cpus(&luks->header.master_key_iterations); 689 690 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 691 be32_to_cpus(&luks->header.key_slots[i].active); 692 be32_to_cpus(&luks->header.key_slots[i].iterations); 693 be32_to_cpus(&luks->header.key_slots[i].key_offset); 694 be32_to_cpus(&luks->header.key_slots[i].stripes); 695 } 696 697 if (memcmp(luks->header.magic, qcrypto_block_luks_magic, 698 QCRYPTO_BLOCK_LUKS_MAGIC_LEN) != 0) { 699 error_setg(errp, "Volume is not in LUKS format"); 700 ret = -EINVAL; 701 goto fail; 702 } 703 if (luks->header.version != QCRYPTO_BLOCK_LUKS_VERSION) { 704 error_setg(errp, "LUKS version %" PRIu32 " is not supported", 705 luks->header.version); 706 ret = -ENOTSUP; 707 goto fail; 708 } 709 710 /* 711 * The cipher_mode header contains a string that we have 712 * to further parse, of the format 713 * 714 * <cipher-mode>-<iv-generator>[:<iv-hash>] 715 * 716 * eg cbc-essiv:sha256, cbc-plain64 717 */ 718 ivgen_name = strchr(luks->header.cipher_mode, '-'); 719 if (!ivgen_name) { 720 ret = -EINVAL; 721 error_setg(errp, "Unexpected cipher mode string format %s", 722 luks->header.cipher_mode); 723 goto fail; 724 } 725 *ivgen_name = '\0'; 726 ivgen_name++; 727 728 ivhash_name = strchr(ivgen_name, ':'); 729 if (!ivhash_name) { 730 ivhash = 0; 731 } else { 732 *ivhash_name = '\0'; 733 ivhash_name++; 734 735 ivhash = qcrypto_block_luks_hash_name_lookup(ivhash_name, 736 &local_err); 737 if (local_err) { 738 ret = -ENOTSUP; 739 error_propagate(errp, local_err); 740 goto fail; 741 } 742 } 743 744 ciphermode = qcrypto_block_luks_cipher_mode_lookup(luks->header.cipher_mode, 745 &local_err); 746 if (local_err) { 747 ret = -ENOTSUP; 748 error_propagate(errp, local_err); 749 goto fail; 750 } 751 752 cipheralg = qcrypto_block_luks_cipher_name_lookup(luks->header.cipher_name, 753 ciphermode, 754 luks->header.key_bytes, 755 &local_err); 756 if (local_err) { 757 ret = -ENOTSUP; 758 error_propagate(errp, local_err); 759 goto fail; 760 } 761 762 hash = qcrypto_block_luks_hash_name_lookup(luks->header.hash_spec, 763 &local_err); 764 if (local_err) { 765 ret = -ENOTSUP; 766 error_propagate(errp, local_err); 767 goto fail; 768 } 769 770 ivalg = qcrypto_block_luks_ivgen_name_lookup(ivgen_name, 771 &local_err); 772 if (local_err) { 773 ret = -ENOTSUP; 774 error_propagate(errp, local_err); 775 goto fail; 776 } 777 778 if (ivalg == QCRYPTO_IVGEN_ALG_ESSIV) { 779 ivcipheralg = qcrypto_block_luks_essiv_cipher(cipheralg, 780 ivhash, 781 &local_err); 782 if (local_err) { 783 ret = -ENOTSUP; 784 error_propagate(errp, local_err); 785 goto fail; 786 } 787 } else { 788 ivcipheralg = cipheralg; 789 } 790 791 if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) { 792 /* Try to find which key slot our password is valid for 793 * and unlock the master key from that slot. 794 */ 795 if (qcrypto_block_luks_find_key(block, 796 password, 797 cipheralg, ciphermode, 798 hash, 799 ivalg, 800 ivcipheralg, 801 ivhash, 802 &masterkey, &masterkeylen, 803 readfunc, opaque, 804 errp) < 0) { 805 ret = -EACCES; 806 goto fail; 807 } 808 809 /* We have a valid master key now, so can setup the 810 * block device payload decryption objects 811 */ 812 block->kdfhash = hash; 813 block->niv = qcrypto_cipher_get_iv_len(cipheralg, 814 ciphermode); 815 block->ivgen = qcrypto_ivgen_new(ivalg, 816 ivcipheralg, 817 ivhash, 818 masterkey, masterkeylen, 819 errp); 820 if (!block->ivgen) { 821 ret = -ENOTSUP; 822 goto fail; 823 } 824 825 block->cipher = qcrypto_cipher_new(cipheralg, 826 ciphermode, 827 masterkey, masterkeylen, 828 errp); 829 if (!block->cipher) { 830 ret = -ENOTSUP; 831 goto fail; 832 } 833 } 834 835 block->payload_offset = luks->header.payload_offset * 836 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 837 838 g_free(masterkey); 839 g_free(password); 840 841 return 0; 842 843 fail: 844 g_free(masterkey); 845 qcrypto_cipher_free(block->cipher); 846 qcrypto_ivgen_free(block->ivgen); 847 g_free(luks); 848 g_free(password); 849 return ret; 850 } 851 852 853 static int 854 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr, Error **errp) 855 { 856 #ifdef CONFIG_UUID 857 uuid_t uuid; 858 uuid_generate(uuid); 859 uuid_unparse(uuid, (char *)uuidstr); 860 return 0; 861 #else 862 error_setg(errp, "Unable to generate uuids on this platform"); 863 return -1; 864 #endif 865 } 866 867 static int 868 qcrypto_block_luks_create(QCryptoBlock *block, 869 QCryptoBlockCreateOptions *options, 870 QCryptoBlockInitFunc initfunc, 871 QCryptoBlockWriteFunc writefunc, 872 void *opaque, 873 Error **errp) 874 { 875 QCryptoBlockLUKS *luks; 876 QCryptoBlockCreateOptionsLUKS luks_opts; 877 Error *local_err = NULL; 878 uint8_t *masterkey = NULL; 879 uint8_t *slotkey = NULL; 880 uint8_t *splitkey = NULL; 881 size_t splitkeylen = 0; 882 size_t i; 883 QCryptoCipher *cipher = NULL; 884 QCryptoIVGen *ivgen = NULL; 885 char *password; 886 const char *cipher_alg; 887 const char *cipher_mode; 888 const char *ivgen_alg; 889 const char *ivgen_hash_alg = NULL; 890 const char *hash_alg; 891 char *cipher_mode_spec = NULL; 892 QCryptoCipherAlgorithm ivcipheralg = 0; 893 894 memcpy(&luks_opts, &options->u.luks, sizeof(luks_opts)); 895 if (!luks_opts.has_cipher_alg) { 896 luks_opts.cipher_alg = QCRYPTO_CIPHER_ALG_AES_256; 897 } 898 if (!luks_opts.has_cipher_mode) { 899 luks_opts.cipher_mode = QCRYPTO_CIPHER_MODE_XTS; 900 } 901 if (!luks_opts.has_ivgen_alg) { 902 luks_opts.ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64; 903 } 904 if (!luks_opts.has_hash_alg) { 905 luks_opts.hash_alg = QCRYPTO_HASH_ALG_SHA256; 906 } 907 908 if (!options->u.luks.key_secret) { 909 error_setg(errp, "Parameter 'key-secret' is required for cipher"); 910 return -1; 911 } 912 password = qcrypto_secret_lookup_as_utf8(luks_opts.key_secret, errp); 913 if (!password) { 914 return -1; 915 } 916 917 luks = g_new0(QCryptoBlockLUKS, 1); 918 block->opaque = luks; 919 920 memcpy(luks->header.magic, qcrypto_block_luks_magic, 921 QCRYPTO_BLOCK_LUKS_MAGIC_LEN); 922 923 /* We populate the header in native endianness initially and 924 * then convert everything to big endian just before writing 925 * it out to disk 926 */ 927 luks->header.version = QCRYPTO_BLOCK_LUKS_VERSION; 928 if (qcrypto_block_luks_uuid_gen(luks->header.uuid, 929 errp) < 0) { 930 goto error; 931 } 932 933 cipher_alg = qcrypto_block_luks_cipher_alg_lookup(luks_opts.cipher_alg, 934 errp); 935 if (!cipher_alg) { 936 goto error; 937 } 938 939 cipher_mode = QCryptoCipherMode_lookup[luks_opts.cipher_mode]; 940 ivgen_alg = QCryptoIVGenAlgorithm_lookup[luks_opts.ivgen_alg]; 941 if (luks_opts.has_ivgen_hash_alg) { 942 ivgen_hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.ivgen_hash_alg]; 943 cipher_mode_spec = g_strdup_printf("%s-%s:%s", cipher_mode, ivgen_alg, 944 ivgen_hash_alg); 945 } else { 946 cipher_mode_spec = g_strdup_printf("%s-%s", cipher_mode, ivgen_alg); 947 } 948 hash_alg = QCryptoHashAlgorithm_lookup[luks_opts.hash_alg]; 949 950 951 if (strlen(cipher_alg) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN) { 952 error_setg(errp, "Cipher name '%s' is too long for LUKS header", 953 cipher_alg); 954 goto error; 955 } 956 if (strlen(cipher_mode_spec) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN) { 957 error_setg(errp, "Cipher mode '%s' is too long for LUKS header", 958 cipher_mode_spec); 959 goto error; 960 } 961 if (strlen(hash_alg) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN) { 962 error_setg(errp, "Hash name '%s' is too long for LUKS header", 963 hash_alg); 964 goto error; 965 } 966 967 if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) { 968 ivcipheralg = qcrypto_block_luks_essiv_cipher(luks_opts.cipher_alg, 969 luks_opts.ivgen_hash_alg, 970 &local_err); 971 if (local_err) { 972 error_propagate(errp, local_err); 973 goto error; 974 } 975 } else { 976 ivcipheralg = luks_opts.cipher_alg; 977 } 978 979 strcpy(luks->header.cipher_name, cipher_alg); 980 strcpy(luks->header.cipher_mode, cipher_mode_spec); 981 strcpy(luks->header.hash_spec, hash_alg); 982 983 luks->header.key_bytes = qcrypto_cipher_get_key_len(luks_opts.cipher_alg); 984 if (luks_opts.cipher_mode == QCRYPTO_CIPHER_MODE_XTS) { 985 luks->header.key_bytes *= 2; 986 } 987 988 /* Generate the salt used for hashing the master key 989 * with PBKDF later 990 */ 991 if (qcrypto_random_bytes(luks->header.master_key_salt, 992 QCRYPTO_BLOCK_LUKS_SALT_LEN, 993 errp) < 0) { 994 goto error; 995 } 996 997 /* Generate random master key */ 998 masterkey = g_new0(uint8_t, luks->header.key_bytes); 999 if (qcrypto_random_bytes(masterkey, 1000 luks->header.key_bytes, errp) < 0) { 1001 goto error; 1002 } 1003 1004 1005 /* Setup the block device payload encryption objects */ 1006 block->cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1007 luks_opts.cipher_mode, 1008 masterkey, luks->header.key_bytes, 1009 errp); 1010 if (!block->cipher) { 1011 goto error; 1012 } 1013 1014 block->kdfhash = luks_opts.hash_alg; 1015 block->niv = qcrypto_cipher_get_iv_len(luks_opts.cipher_alg, 1016 luks_opts.cipher_mode); 1017 block->ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1018 ivcipheralg, 1019 luks_opts.ivgen_hash_alg, 1020 masterkey, luks->header.key_bytes, 1021 errp); 1022 1023 if (!block->ivgen) { 1024 goto error; 1025 } 1026 1027 1028 /* Determine how many iterations we need to hash the master 1029 * key, in order to have 1 second of compute time used 1030 */ 1031 luks->header.master_key_iterations = 1032 qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1033 masterkey, luks->header.key_bytes, 1034 luks->header.master_key_salt, 1035 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1036 &local_err); 1037 if (local_err) { 1038 error_propagate(errp, local_err); 1039 goto error; 1040 } 1041 1042 /* Why /= 8 ? That matches cryptsetup, but there's no 1043 * explanation why they chose /= 8... Probably so that 1044 * if all 8 keyslots are active we only spend 1 second 1045 * in total time to check all keys */ 1046 luks->header.master_key_iterations /= 8; 1047 luks->header.master_key_iterations = MAX( 1048 luks->header.master_key_iterations, 1049 QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS); 1050 1051 1052 /* Hash the master key, saving the result in the LUKS 1053 * header. This hash is used when opening the encrypted 1054 * device to verify that the user password unlocked a 1055 * valid master key 1056 */ 1057 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1058 masterkey, luks->header.key_bytes, 1059 luks->header.master_key_salt, 1060 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1061 luks->header.master_key_iterations, 1062 luks->header.master_key_digest, 1063 QCRYPTO_BLOCK_LUKS_DIGEST_LEN, 1064 errp) < 0) { 1065 goto error; 1066 } 1067 1068 1069 /* Although LUKS has multiple key slots, we're just going 1070 * to use the first key slot */ 1071 splitkeylen = luks->header.key_bytes * QCRYPTO_BLOCK_LUKS_STRIPES; 1072 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1073 luks->header.key_slots[i].active = i == 0 ? 1074 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED : 1075 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED; 1076 luks->header.key_slots[i].stripes = QCRYPTO_BLOCK_LUKS_STRIPES; 1077 1078 /* This calculation doesn't match that shown in the spec, 1079 * but instead follows the cryptsetup implementation. 1080 */ 1081 luks->header.key_slots[i].key_offset = 1082 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1083 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1084 (ROUND_UP(((splitkeylen + (QCRYPTO_BLOCK_LUKS_SECTOR_SIZE - 1)) / 1085 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1086 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1087 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * i); 1088 } 1089 1090 if (qcrypto_random_bytes(luks->header.key_slots[0].salt, 1091 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1092 errp) < 0) { 1093 goto error; 1094 } 1095 1096 /* Again we determine how many iterations are required to 1097 * hash the user password while consuming 1 second of compute 1098 * time */ 1099 luks->header.key_slots[0].iterations = 1100 qcrypto_pbkdf2_count_iters(luks_opts.hash_alg, 1101 (uint8_t *)password, strlen(password), 1102 luks->header.key_slots[0].salt, 1103 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1104 &local_err); 1105 if (local_err) { 1106 error_propagate(errp, local_err); 1107 goto error; 1108 } 1109 /* Why /= 2 ? That matches cryptsetup, but there's no 1110 * explanation why they chose /= 2... */ 1111 luks->header.key_slots[0].iterations /= 2; 1112 luks->header.key_slots[0].iterations = MAX( 1113 luks->header.key_slots[0].iterations, 1114 QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS); 1115 1116 1117 /* Generate a key that we'll use to encrypt the master 1118 * key, from the user's password 1119 */ 1120 slotkey = g_new0(uint8_t, luks->header.key_bytes); 1121 if (qcrypto_pbkdf2(luks_opts.hash_alg, 1122 (uint8_t *)password, strlen(password), 1123 luks->header.key_slots[0].salt, 1124 QCRYPTO_BLOCK_LUKS_SALT_LEN, 1125 luks->header.key_slots[0].iterations, 1126 slotkey, luks->header.key_bytes, 1127 errp) < 0) { 1128 goto error; 1129 } 1130 1131 1132 /* Setup the encryption objects needed to encrypt the 1133 * master key material 1134 */ 1135 cipher = qcrypto_cipher_new(luks_opts.cipher_alg, 1136 luks_opts.cipher_mode, 1137 slotkey, luks->header.key_bytes, 1138 errp); 1139 if (!cipher) { 1140 goto error; 1141 } 1142 1143 ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg, 1144 ivcipheralg, 1145 luks_opts.ivgen_hash_alg, 1146 slotkey, luks->header.key_bytes, 1147 errp); 1148 if (!ivgen) { 1149 goto error; 1150 } 1151 1152 /* Before storing the master key, we need to vastly 1153 * increase its size, as protection against forensic 1154 * disk data recovery */ 1155 splitkey = g_new0(uint8_t, splitkeylen); 1156 1157 if (qcrypto_afsplit_encode(luks_opts.hash_alg, 1158 luks->header.key_bytes, 1159 luks->header.key_slots[0].stripes, 1160 masterkey, 1161 splitkey, 1162 errp) < 0) { 1163 goto error; 1164 } 1165 1166 /* Now we encrypt the split master key with the key generated 1167 * from the user's password, before storing it */ 1168 if (qcrypto_block_encrypt_helper(cipher, block->niv, ivgen, 1169 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1170 0, 1171 splitkey, 1172 splitkeylen, 1173 errp) < 0) { 1174 goto error; 1175 } 1176 1177 1178 /* The total size of the LUKS headers is the partition header + key 1179 * slot headers, rounded up to the nearest sector, combined with 1180 * the size of each master key material region, also rounded up 1181 * to the nearest sector */ 1182 luks->header.payload_offset = 1183 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1184 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) + 1185 (ROUND_UP(((splitkeylen + (QCRYPTO_BLOCK_LUKS_SECTOR_SIZE - 1)) / 1186 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE), 1187 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET / 1188 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * 1189 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS); 1190 1191 block->payload_offset = luks->header.payload_offset * 1192 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE; 1193 1194 /* Reserve header space to match payload offset */ 1195 initfunc(block, block->payload_offset, &local_err, opaque); 1196 if (local_err) { 1197 error_propagate(errp, local_err); 1198 goto error; 1199 } 1200 1201 /* Everything on disk uses Big Endian, so flip header fields 1202 * before writing them */ 1203 cpu_to_be16s(&luks->header.version); 1204 cpu_to_be32s(&luks->header.payload_offset); 1205 cpu_to_be32s(&luks->header.key_bytes); 1206 cpu_to_be32s(&luks->header.master_key_iterations); 1207 1208 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1209 cpu_to_be32s(&luks->header.key_slots[i].active); 1210 cpu_to_be32s(&luks->header.key_slots[i].iterations); 1211 cpu_to_be32s(&luks->header.key_slots[i].key_offset); 1212 cpu_to_be32s(&luks->header.key_slots[i].stripes); 1213 } 1214 1215 1216 /* Write out the partition header and key slot headers */ 1217 writefunc(block, 0, 1218 (const uint8_t *)&luks->header, 1219 sizeof(luks->header), 1220 &local_err, 1221 opaque); 1222 1223 /* Delay checking local_err until we've byte-swapped */ 1224 1225 /* Byte swap the header back to native, in case we need 1226 * to read it again later */ 1227 be16_to_cpus(&luks->header.version); 1228 be32_to_cpus(&luks->header.payload_offset); 1229 be32_to_cpus(&luks->header.key_bytes); 1230 be32_to_cpus(&luks->header.master_key_iterations); 1231 1232 for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) { 1233 be32_to_cpus(&luks->header.key_slots[i].active); 1234 be32_to_cpus(&luks->header.key_slots[i].iterations); 1235 be32_to_cpus(&luks->header.key_slots[i].key_offset); 1236 be32_to_cpus(&luks->header.key_slots[i].stripes); 1237 } 1238 1239 if (local_err) { 1240 error_propagate(errp, local_err); 1241 goto error; 1242 } 1243 1244 /* Write out the master key material, starting at the 1245 * sector immediately following the partition header. */ 1246 if (writefunc(block, 1247 luks->header.key_slots[0].key_offset * 1248 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1249 splitkey, splitkeylen, 1250 errp, 1251 opaque) != splitkeylen) { 1252 goto error; 1253 } 1254 1255 memset(masterkey, 0, luks->header.key_bytes); 1256 g_free(masterkey); 1257 memset(slotkey, 0, luks->header.key_bytes); 1258 g_free(slotkey); 1259 g_free(splitkey); 1260 g_free(password); 1261 g_free(cipher_mode_spec); 1262 1263 qcrypto_ivgen_free(ivgen); 1264 qcrypto_cipher_free(cipher); 1265 1266 return 0; 1267 1268 error: 1269 if (masterkey) { 1270 memset(masterkey, 0, luks->header.key_bytes); 1271 } 1272 g_free(masterkey); 1273 if (slotkey) { 1274 memset(slotkey, 0, luks->header.key_bytes); 1275 } 1276 g_free(slotkey); 1277 g_free(splitkey); 1278 g_free(password); 1279 g_free(cipher_mode_spec); 1280 1281 qcrypto_ivgen_free(ivgen); 1282 qcrypto_cipher_free(cipher); 1283 1284 g_free(luks); 1285 return -1; 1286 } 1287 1288 1289 static void qcrypto_block_luks_cleanup(QCryptoBlock *block) 1290 { 1291 g_free(block->opaque); 1292 } 1293 1294 1295 static int 1296 qcrypto_block_luks_decrypt(QCryptoBlock *block, 1297 uint64_t startsector, 1298 uint8_t *buf, 1299 size_t len, 1300 Error **errp) 1301 { 1302 return qcrypto_block_decrypt_helper(block->cipher, 1303 block->niv, block->ivgen, 1304 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1305 startsector, buf, len, errp); 1306 } 1307 1308 1309 static int 1310 qcrypto_block_luks_encrypt(QCryptoBlock *block, 1311 uint64_t startsector, 1312 uint8_t *buf, 1313 size_t len, 1314 Error **errp) 1315 { 1316 return qcrypto_block_encrypt_helper(block->cipher, 1317 block->niv, block->ivgen, 1318 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE, 1319 startsector, buf, len, errp); 1320 } 1321 1322 1323 const QCryptoBlockDriver qcrypto_block_driver_luks = { 1324 .open = qcrypto_block_luks_open, 1325 .create = qcrypto_block_luks_create, 1326 .cleanup = qcrypto_block_luks_cleanup, 1327 .decrypt = qcrypto_block_luks_decrypt, 1328 .encrypt = qcrypto_block_luks_encrypt, 1329 .has_format = qcrypto_block_luks_has_format, 1330 }; 1331