src/shared/cryptsetup-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include "alloc-util.h"
   4 #include "cryptsetup-util.h"
   5 #include "dlfcn-util.h"
   6 #include "log.h"
   7 #include "parse-util.h"
   8
   9 #if HAVE_LIBCRYPTSETUP
  10 static void *cryptsetup_dl = NULL;
  11
  12 int (*sym_crypt_activate_by_passphrase)(struct crypt_device *cd, const char *name, int keyslot, const char *passphrase, size_t passphrase_size, uint32_t flags);
  13 #if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
  14 int (*sym_crypt_activate_by_signed_key)(struct crypt_device *cd, const char *name, const char *volume_key, size_t volume_key_size, const char *signature, size_t signature_size, uint32_t flags);
  15 #endif
  16 int (*sym_crypt_activate_by_volume_key)(struct crypt_device *cd, const char *name, const char *volume_key, size_t volume_key_size, uint32_t flags);
  17 int (*sym_crypt_deactivate_by_name)(struct crypt_device *cd, const char *name, uint32_t flags);
  18 int (*sym_crypt_format)(struct crypt_device *cd, const char *type, const char *cipher, const char *cipher_mode, const char *uuid, const char *volume_key, size_t volume_key_size, void *params);
  19 void (*sym_crypt_free)(struct crypt_device *cd);
  20 const char *(*sym_crypt_get_cipher)(struct crypt_device *cd);
  21 const char *(*sym_crypt_get_cipher_mode)(struct crypt_device *cd);
  22 uint64_t (*sym_crypt_get_data_offset)(struct crypt_device *cd);
  23 const char *(*sym_crypt_get_device_name)(struct crypt_device *cd);
  24 const char *(*sym_crypt_get_dir)(void);
  25 const char *(*sym_crypt_get_type)(struct crypt_device *cd);
  26 const char *(*sym_crypt_get_uuid)(struct crypt_device *cd);
  27 int (*sym_crypt_get_verity_info)(struct crypt_device *cd, struct crypt_params_verity *vp);
  28 int (*sym_crypt_get_volume_key_size)(struct crypt_device *cd);
  29 int (*sym_crypt_init)(struct crypt_device **cd, const char *device);
  30 int (*sym_crypt_init_by_name)(struct crypt_device **cd, const char *name);
  31 int (*sym_crypt_keyslot_add_by_volume_key)(struct crypt_device *cd, int keyslot, const char *volume_key, size_t volume_key_size, const char *passphrase, size_t passphrase_size);
  32 int (*sym_crypt_keyslot_destroy)(struct crypt_device *cd, int keyslot);
  33 int (*sym_crypt_keyslot_max)(const char *type);
  34 int (*sym_crypt_load)(struct crypt_device *cd, const char *requested_type, void *params);
  35 int (*sym_crypt_resize)(struct crypt_device *cd, const char *name, uint64_t new_size);
  36 int (*sym_crypt_resume_by_passphrase)(struct crypt_device *cd, const char *name, int keyslot, const char *passphrase, size_t passphrase_size);
  37 int (*sym_crypt_set_data_device)(struct crypt_device *cd, const char *device);
  38 void (*sym_crypt_set_debug_level)(int level);
  39 void (*sym_crypt_set_log_callback)(struct crypt_device *cd, void (*log)(int level, const char *msg, void *usrptr), void *usrptr);
  40 #if HAVE_CRYPT_SET_METADATA_SIZE
  41 int (*sym_crypt_set_metadata_size)(struct crypt_device *cd, uint64_t metadata_size, uint64_t keyslots_size);
  42 #endif
  43 int (*sym_crypt_set_pbkdf_type)(struct crypt_device *cd, const struct crypt_pbkdf_type *pbkdf);
  44 int (*sym_crypt_suspend)(struct crypt_device *cd, const char *name);
  45 int (*sym_crypt_token_json_get)(struct crypt_device *cd, int token, const char **json);
  46 int (*sym_crypt_token_json_set)(struct crypt_device *cd, int token, const char *json);
  47 #if HAVE_CRYPT_TOKEN_MAX
  48 int (*sym_crypt_token_max)(const char *type);
  49 #endif
  50 crypt_token_info (*sym_crypt_token_status)(struct crypt_device *cd, int token, const char **type);
  51 int (*sym_crypt_volume_key_get)(struct crypt_device *cd, int keyslot, char *volume_key, size_t *volume_key_size, const char *passphrase, size_t passphrase_size);
  52
  53 static void cryptsetup_log_glue(int level, const char *msg, void *usrptr) {
  54
  55         switch (level) {
  56         case CRYPT_LOG_NORMAL:
  57                 level = LOG_NOTICE;
  58                 break;
  59         case CRYPT_LOG_ERROR:
  60                 level = LOG_ERR;
  61                 break;
  62         case CRYPT_LOG_VERBOSE:
  63                 level = LOG_INFO;
  64                 break;
  65         case CRYPT_LOG_DEBUG:
  66                 level = LOG_DEBUG;
  67                 break;
  68         default:
  69                 log_error("Unknown libcryptsetup log level: %d", level);
  70                 level = LOG_ERR;
  71         }
  72
  73         log_full(level, "%s", msg);
  74 }
  75
  76 void cryptsetup_enable_logging(struct crypt_device *cd) {
  77         /* It's OK to call this with a NULL parameter, in which case libcryptsetup will set the default log
  78          * function.
  79          *
  80          * Note that this is also called from dlopen_cryptsetup(), which we call here too. Sounds like an
  81          * endless loop, but isn't because we break it via the check for 'cryptsetup_dl' early in
  82          * dlopen_cryptsetup(). */
  83
  84         if (dlopen_cryptsetup() < 0)
  85                 return; /* If this fails, let's gracefully ignore the issue, this is just debug logging after
  86                          * all, and if this failed we already generated a debug log message that should help
  87                          * to track things down. */
  88
  89         sym_crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
  90         sym_crypt_set_debug_level(DEBUG_LOGGING ? CRYPT_DEBUG_ALL : CRYPT_DEBUG_NONE);
  91 }
  92
  93 int cryptsetup_set_minimal_pbkdf(struct crypt_device *cd) {
  94
  95         /* With CRYPT_PBKDF_NO_BENCHMARK flag set .time_ms member is ignored
  96          * while .iterations must be set at least to recommended minimum value. */
  97
  98         static const struct crypt_pbkdf_type minimal_pbkdf = {
  99                 .hash = "sha512",
 100                 .type = CRYPT_KDF_PBKDF2,
 101                 .iterations = 1000, /* recommended minimum count for pbkdf2
 102                                      * according to NIST SP 800-132, ch. 5.2 */
 103                 .flags = CRYPT_PBKDF_NO_BENCHMARK
 104         };
 105
 106         int r;
 107
 108         /* Sets a minimal PKBDF in case we already have a high entropy key. */
 109
 110         r = dlopen_cryptsetup();
 111         if (r < 0)
 112                 return r;
 113
 114         r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
 115         if (r < 0)
 116                 return r;
 117
 118         return 0;
 119 }
 120
 121 int cryptsetup_get_token_as_json(
 122                 struct crypt_device *cd,
 123                 int idx,
 124                 const char *verify_type,
 125                 JsonVariant **ret) {
 126
 127         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 128         const char *text;
 129         int r;
 130
 131         assert(cd);
 132
 133         /* Extracts and parses the LUKS2 JSON token data from a LUKS2 device. Optionally verifies the type of
 134          * the token. Returns:
 135          *
 136          *      -EINVAL → token index out of range or "type" field missing
 137          *      -ENOENT → token doesn't exist
 138          * -EMEDIUMTYPE → "verify_type" specified and doesn't match token's type
 139          */
 140
 141         r = dlopen_cryptsetup();
 142         if (r < 0)
 143                 return r;
 144
 145         r = sym_crypt_token_json_get(cd, idx, &text);
 146         if (r < 0)
 147                 return r;
 148
 149         r = json_parse(text, 0, &v, NULL, NULL);
 150         if (r < 0)
 151                 return r;
 152
 153         if (verify_type) {
 154                 JsonVariant *w;
 155
 156                 w = json_variant_by_key(v, "type");
 157                 if (!w)
 158                         return -EINVAL;
 159
 160                 if (!streq_ptr(json_variant_string(w), verify_type))
 161                         return -EMEDIUMTYPE;
 162         }
 163
 164         if (ret)
 165                 *ret = TAKE_PTR(v);
 166
 167         return 0;
 168 }
 169
 170 int cryptsetup_add_token_json(struct crypt_device *cd, JsonVariant *v) {
 171         _cleanup_free_ char *text = NULL;
 172         int r;
 173
 174         r = dlopen_cryptsetup();
 175         if (r < 0)
 176                 return r;
 177
 178         r = json_variant_format(v, 0, &text);
 179         if (r < 0)
 180                 return log_debug_errno(r, "Failed to format token data for LUKS: %m");
 181
 182         log_debug("Adding token text <%s>", text);
 183
 184         r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
 185         if (r < 0)
 186                 return log_debug_errno(r, "Failed to write token data to LUKS: %m");
 187
 188         return 0;
 189 }
 190 #endif
 191
 192 int dlopen_cryptsetup(void) {
 193 #if HAVE_LIBCRYPTSETUP
 194         int r;
 195
 196         r = dlopen_many_sym_or_warn(
 197                         &cryptsetup_dl, "libcryptsetup.so.12", LOG_DEBUG,
 198                         DLSYM_ARG(crypt_activate_by_passphrase),
 199 #if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
 200                         DLSYM_ARG(crypt_activate_by_signed_key),
 201 #endif
 202                         DLSYM_ARG(crypt_activate_by_volume_key),
 203                         DLSYM_ARG(crypt_deactivate_by_name),
 204                         DLSYM_ARG(crypt_format),
 205                         DLSYM_ARG(crypt_free),
 206                         DLSYM_ARG(crypt_get_cipher),
 207                         DLSYM_ARG(crypt_get_cipher_mode),
 208                         DLSYM_ARG(crypt_get_data_offset),
 209                         DLSYM_ARG(crypt_get_device_name),
 210                         DLSYM_ARG(crypt_get_dir),
 211                         DLSYM_ARG(crypt_get_type),
 212                         DLSYM_ARG(crypt_get_uuid),
 213                         DLSYM_ARG(crypt_get_verity_info),
 214                         DLSYM_ARG(crypt_get_volume_key_size),
 215                         DLSYM_ARG(crypt_init),
 216                         DLSYM_ARG(crypt_init_by_name),
 217                         DLSYM_ARG(crypt_keyslot_add_by_volume_key),
 218                         DLSYM_ARG(crypt_keyslot_destroy),
 219                         DLSYM_ARG(crypt_keyslot_max),
 220                         DLSYM_ARG(crypt_load),
 221                         DLSYM_ARG(crypt_resize),
 222                         DLSYM_ARG(crypt_resume_by_passphrase),
 223                         DLSYM_ARG(crypt_set_data_device),
 224                         DLSYM_ARG(crypt_set_debug_level),
 225                         DLSYM_ARG(crypt_set_log_callback),
 226 #if HAVE_CRYPT_SET_METADATA_SIZE
 227                         DLSYM_ARG(crypt_set_metadata_size),
 228 #endif
 229                         DLSYM_ARG(crypt_set_pbkdf_type),
 230                         DLSYM_ARG(crypt_suspend),
 231                         DLSYM_ARG(crypt_token_json_get),
 232                         DLSYM_ARG(crypt_token_json_set),
 233 #if HAVE_CRYPT_TOKEN_MAX
 234                         DLSYM_ARG(crypt_token_max),
 235 #endif
 236                         DLSYM_ARG(crypt_token_status),
 237                         DLSYM_ARG(crypt_volume_key_get));
 238         if (r <= 0)
 239                 return r;
 240
 241         /* Redirect the default logging calls of libcryptsetup to our own logging infra. (Note that
 242          * libcryptsetup also maintains per-"struct crypt_device" log functions, which we'll also set
 243          * whenever allocating a "struct crypt_device" context. Why set both? To be defensive: maybe some
 244          * other code loaded into this process also changes the global log functions of libcryptsetup, who
 245          * knows? And if so, we still want our own objects to log via our own infra, at the very least.) */
 246         cryptsetup_enable_logging(NULL);
 247         return 1;
 248 #else
 249         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "cryptsetup support is not compiled in.");
 250 #endif
 251 }
 252
 253 int cryptsetup_get_keyslot_from_token(JsonVariant *v) {
 254         int keyslot, r;
 255         JsonVariant *w;
 256
 257         /* Parses the "keyslots" field of a LUKS2 token object. The field can be an array, but here we assume
 258          * that it contains a single element only, since that's the only way we ever generate it
 259          * ourselves. */
 260
 261         w = json_variant_by_key(v, "keyslots");
 262         if (!w)
 263                 return -ENOENT;
 264         if (!json_variant_is_array(w) || json_variant_elements(w) != 1)
 265                 return -EMEDIUMTYPE;
 266
 267         w = json_variant_by_index(w, 0);
 268         if (!w)
 269                 return -ENOENT;
 270         if (!json_variant_is_string(w))
 271                 return -EMEDIUMTYPE;
 272
 273         r = safe_atoi(json_variant_string(w), &keyslot);
 274         if (r < 0)
 275                 return r;
 276         if (keyslot < 0)
 277                 return -EINVAL;
 278
 279         return keyslot;
 280 }