]>
Commit | Line | Data |
---|---|---|
8710a681 LP |
1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
2 | ||
3 | #include "cryptenroll-pkcs11.h" | |
4 | #include "hexdecoct.h" | |
5 | #include "json.h" | |
6 | #include "memory-util.h" | |
7 | #include "openssl-util.h" | |
8 | #include "pkcs11-util.h" | |
8710a681 LP |
9 | |
10 | int enroll_pkcs11( | |
11 | struct crypt_device *cd, | |
12 | const void *volume_key, | |
13 | size_t volume_key_size, | |
14 | const char *uri) { | |
15 | ||
16 | _cleanup_(erase_and_freep) void *decrypted_key = NULL; | |
17 | _cleanup_(erase_and_freep) char *base64_encoded = NULL; | |
18 | _cleanup_(json_variant_unrefp) JsonVariant *v = NULL; | |
19 | _cleanup_free_ char *keyslot_as_string = NULL; | |
876206f2 VS |
20 | size_t decrypted_key_size, saved_key_size; |
21 | _cleanup_free_ void *saved_key = NULL; | |
8710a681 | 22 | _cleanup_(X509_freep) X509 *cert = NULL; |
5e476b85 | 23 | ssize_t base64_encoded_size; |
8710a681 | 24 | const char *node; |
8710a681 LP |
25 | int keyslot, r; |
26 | ||
27 | assert_se(cd); | |
28 | assert_se(volume_key); | |
29 | assert_se(volume_key_size > 0); | |
30 | assert_se(uri); | |
31 | ||
32 | assert_se(node = crypt_get_device_name(cd)); | |
33 | ||
34 | r = pkcs11_acquire_certificate(uri, "volume enrollment operation", "drive-harddisk", &cert, NULL); | |
35 | if (r < 0) | |
36 | return r; | |
37 | ||
876206f2 | 38 | r = x509_generate_volume_keys(cert, &decrypted_key, &decrypted_key_size, &saved_key, &saved_key_size); |
8710a681 | 39 | if (r < 0) |
876206f2 | 40 | return log_error_errno(r, "Failed to generate volume keys: %m"); |
8710a681 LP |
41 | |
42 | /* Let's base64 encode the key to use, for compat with homed (and it's easier to type it in by | |
43 | * keyboard, if that might ever end up being necessary.) */ | |
5e476b85 LP |
44 | base64_encoded_size = base64mem(decrypted_key, decrypted_key_size, &base64_encoded); |
45 | if (base64_encoded_size < 0) | |
46 | return log_error_errno(base64_encoded_size, "Failed to base64 encode secret key: %m"); | |
8710a681 LP |
47 | |
48 | r = cryptsetup_set_minimal_pbkdf(cd); | |
49 | if (r < 0) | |
50 | return log_error_errno(r, "Failed to set minimal PBKDF: %m"); | |
51 | ||
52 | keyslot = crypt_keyslot_add_by_volume_key( | |
53 | cd, | |
54 | CRYPT_ANY_SLOT, | |
55 | volume_key, | |
56 | volume_key_size, | |
57 | base64_encoded, | |
5e476b85 | 58 | base64_encoded_size); |
8710a681 LP |
59 | if (keyslot < 0) |
60 | return log_error_errno(keyslot, "Failed to add new PKCS#11 key to %s: %m", node); | |
61 | ||
62 | if (asprintf(&keyslot_as_string, "%i", keyslot) < 0) | |
63 | return log_oom(); | |
64 | ||
65 | r = json_build(&v, | |
66 | JSON_BUILD_OBJECT( | |
0cdf6b14 | 67 | JSON_BUILD_PAIR("type", JSON_BUILD_CONST_STRING("systemd-pkcs11")), |
8710a681 LP |
68 | JSON_BUILD_PAIR("keyslots", JSON_BUILD_ARRAY(JSON_BUILD_STRING(keyslot_as_string))), |
69 | JSON_BUILD_PAIR("pkcs11-uri", JSON_BUILD_STRING(uri)), | |
876206f2 | 70 | JSON_BUILD_PAIR("pkcs11-key", JSON_BUILD_BASE64(saved_key, saved_key_size)))); |
8710a681 LP |
71 | if (r < 0) |
72 | return log_error_errno(r, "Failed to prepare PKCS#11 JSON token object: %m"); | |
73 | ||
74 | r = cryptsetup_add_token_json(cd, v); | |
75 | if (r < 0) | |
76 | return log_error_errno(r, "Failed to add PKCS#11 JSON token to LUKS2 header: %m"); | |
77 | ||
78 | log_info("New PKCS#11 token enrolled as key slot %i.", keyslot); | |
79 | return keyslot; | |
80 | } |