]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/home/homectl-pkcs11.c
Merge pull request #26014 from yuwata/network-l2tp-fixes
[thirdparty/systemd.git] / src / home / homectl-pkcs11.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include "errno-util.h"
4 #include "format-table.h"
5 #include "hexdecoct.h"
6 #include "homectl-pkcs11.h"
7 #include "libcrypt-util.h"
8 #include "memory-util.h"
9 #include "openssl-util.h"
10 #include "pkcs11-util.h"
11 #include "random-util.h"
12 #include "strv.h"
13
14 static int add_pkcs11_encrypted_key(
15 JsonVariant **v,
16 const char *uri,
17 const void *encrypted_key, size_t encrypted_key_size,
18 const void *decrypted_key, size_t decrypted_key_size) {
19
20 _cleanup_(json_variant_unrefp) JsonVariant *l = NULL, *w = NULL, *e = NULL;
21 _cleanup_(erase_and_freep) char *base64_encoded = NULL, *hashed = NULL;
22 int r;
23
24 assert(v);
25 assert(uri);
26 assert(encrypted_key);
27 assert(encrypted_key_size > 0);
28 assert(decrypted_key);
29 assert(decrypted_key_size > 0);
30
31 /* Before using UNIX hashing on the supplied key we base64 encode it, since crypt_r() and friends
32 * expect a NUL terminated string, and we use a binary key */
33 r = base64mem(decrypted_key, decrypted_key_size, &base64_encoded);
34 if (r < 0)
35 return log_error_errno(r, "Failed to base64 encode secret key: %m");
36
37 r = hash_password(base64_encoded, &hashed);
38 if (r < 0)
39 return log_error_errno(errno_or_else(EINVAL), "Failed to UNIX hash secret key: %m");
40
41 r = json_build(&e, JSON_BUILD_OBJECT(
42 JSON_BUILD_PAIR("uri", JSON_BUILD_STRING(uri)),
43 JSON_BUILD_PAIR("data", JSON_BUILD_BASE64(encrypted_key, encrypted_key_size)),
44 JSON_BUILD_PAIR("hashedPassword", JSON_BUILD_STRING(hashed))));
45 if (r < 0)
46 return log_error_errno(r, "Failed to build encrypted JSON key object: %m");
47
48 w = json_variant_ref(json_variant_by_key(*v, "privileged"));
49 l = json_variant_ref(json_variant_by_key(w, "pkcs11EncryptedKey"));
50
51 r = json_variant_append_array(&l, e);
52 if (r < 0)
53 return log_error_errno(r, "Failed append PKCS#11 encrypted key: %m");
54
55 r = json_variant_set_field(&w, "pkcs11EncryptedKey", l);
56 if (r < 0)
57 return log_error_errno(r, "Failed to set PKCS#11 encrypted key: %m");
58
59 r = json_variant_set_field(v, "privileged", w);
60 if (r < 0)
61 return log_error_errno(r, "Failed to update privileged field: %m");
62
63 return 0;
64 }
65
66 static int add_pkcs11_token_uri(JsonVariant **v, const char *uri) {
67 _cleanup_(json_variant_unrefp) JsonVariant *w = NULL;
68 _cleanup_strv_free_ char **l = NULL;
69 int r;
70
71 assert(v);
72 assert(uri);
73
74 w = json_variant_ref(json_variant_by_key(*v, "pkcs11TokenUri"));
75 if (w) {
76 r = json_variant_strv(w, &l);
77 if (r < 0)
78 return log_error_errno(r, "Failed to parse PKCS#11 token list: %m");
79
80 if (strv_contains(l, uri))
81 return 0;
82 }
83
84 r = strv_extend(&l, uri);
85 if (r < 0)
86 return log_oom();
87
88 w = json_variant_unref(w);
89 r = json_variant_new_array_strv(&w, l);
90 if (r < 0)
91 return log_error_errno(r, "Failed to create PKCS#11 token URI JSON: %m");
92
93 r = json_variant_set_field(v, "pkcs11TokenUri", w);
94 if (r < 0)
95 return log_error_errno(r, "Failed to update PKCS#11 token URI list: %m");
96
97 return 0;
98 }
99
100 int identity_add_token_pin(JsonVariant **v, const char *pin) {
101 _cleanup_(json_variant_unrefp) JsonVariant *w = NULL, *l = NULL;
102 _cleanup_(strv_free_erasep) char **pins = NULL;
103 int r;
104
105 assert(v);
106
107 if (isempty(pin))
108 return 0;
109
110 w = json_variant_ref(json_variant_by_key(*v, "secret"));
111 l = json_variant_ref(json_variant_by_key(w, "tokenPin"));
112
113 r = json_variant_strv(l, &pins);
114 if (r < 0)
115 return log_error_errno(r, "Failed to convert PIN array: %m");
116
117 if (strv_contains(pins, pin))
118 return 0;
119
120 r = strv_extend(&pins, pin);
121 if (r < 0)
122 return log_oom();
123
124 strv_uniq(pins);
125
126 l = json_variant_unref(l);
127
128 r = json_variant_new_array_strv(&l, pins);
129 if (r < 0)
130 return log_error_errno(r, "Failed to allocate new PIN array JSON: %m");
131
132 json_variant_sensitive(l);
133
134 r = json_variant_set_field(&w, "tokenPin", l);
135 if (r < 0)
136 return log_error_errno(r, "Failed to update PIN field: %m");
137
138 r = json_variant_set_field(v, "secret", w);
139 if (r < 0)
140 return log_error_errno(r, "Failed to update secret object: %m");
141
142 return 1;
143 }
144
145 static int acquire_pkcs11_certificate(
146 const char *uri,
147 const char *askpw_friendly_name,
148 const char *askpw_icon_name,
149 X509 **ret_cert,
150 char **ret_pin_used) {
151 #if HAVE_P11KIT
152 return pkcs11_acquire_certificate(uri, askpw_friendly_name, askpw_icon_name, ret_cert, ret_pin_used);
153 #else
154 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
155 "PKCS#11 tokens not supported on this build.");
156 #endif
157 }
158
159 int identity_add_pkcs11_key_data(JsonVariant **v, const char *uri) {
160 _cleanup_(erase_and_freep) void *decrypted_key = NULL, *encrypted_key = NULL;
161 _cleanup_(erase_and_freep) char *pin = NULL;
162 size_t decrypted_key_size, encrypted_key_size;
163 _cleanup_(X509_freep) X509 *cert = NULL;
164 EVP_PKEY *pkey;
165 int r;
166
167 assert(v);
168
169 r = acquire_pkcs11_certificate(uri, "home directory operation", "user-home", &cert, &pin);
170 if (r < 0)
171 return r;
172
173 pkey = X509_get0_pubkey(cert);
174 if (!pkey)
175 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to extract public key from X.509 certificate.");
176
177 r = rsa_pkey_to_suitable_key_size(pkey, &decrypted_key_size);
178 if (r < 0)
179 return log_error_errno(r, "Failed to extract RSA key size from X509 certificate.");
180
181 log_debug("Generating %zu bytes random key.", decrypted_key_size);
182
183 decrypted_key = malloc(decrypted_key_size);
184 if (!decrypted_key)
185 return log_oom();
186
187 r = crypto_random_bytes(decrypted_key, decrypted_key_size);
188 if (r < 0)
189 return log_error_errno(r, "Failed to generate random key: %m");
190
191 r = rsa_encrypt_bytes(pkey, decrypted_key, decrypted_key_size, &encrypted_key, &encrypted_key_size);
192 if (r < 0)
193 return log_error_errno(r, "Failed to encrypt key: %m");
194
195 /* Add the token URI to the public part of the record. */
196 r = add_pkcs11_token_uri(v, uri);
197 if (r < 0)
198 return r;
199
200 /* Include the encrypted version of the random key we just generated in the privileged part of the record */
201 r = add_pkcs11_encrypted_key(
202 v,
203 uri,
204 encrypted_key, encrypted_key_size,
205 decrypted_key, decrypted_key_size);
206 if (r < 0)
207 return r;
208
209 /* If we acquired the PIN also include it in the secret section of the record, so that systemd-homed
210 * can use it if it needs to, given that it likely needs to decrypt the key again to pass to LUKS or
211 * fscrypt. */
212 r = identity_add_token_pin(v, pin);
213 if (r < 0)
214 return r;
215
216 return 0;
217 }