Skip to content

Commit

Permalink
Store keyring type in volume key.
Browse files Browse the repository at this point in the history 
The key_decripion always contains only a key name,
keyring then contains type of keyring as defned un keyring utils.

For now, only LOGON type is used in commands, it will be extended later.
  • Loading branch information
@mbroz
mbroz committed Nov 25, 2024
1 parent 6be70a0 commit 9575dad
Show file tree
Hide file tree
Showing 6 changed files with 38 additions and 21 deletions.
4 changes: 3 additions & 1 deletion lib/internal.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -53,14 +53,16 @@ struct volume_key {
int id;
size_t keylength;
const char *key_description;
key_type_t keyring;
struct volume_key *next;
char key[];
};

struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key);
struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, size_t keylength);
void crypt_free_volume_key(struct volume_key *vk);
int crypt_volume_key_set_description(struct volume_key *key, const char *key_description);
int crypt_volume_key_set_description(struct volume_key *key,
const char *key_description, key_type_t keyring);
void crypt_volume_key_set_id(struct volume_key *vk, int id);
int crypt_volume_key_get_id(const struct volume_key *vk);
void crypt_volume_key_add_next(struct volume_key **vks, struct volume_key *vk);
Expand Down
28 changes: 18 additions & 10 deletions lib/libdevmapper.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -591,12 +591,16 @@ static char *get_dm_crypt_params(const struct dm_target *tgt, uint32_t flags)
if (null_cipher)
hexkey = crypt_bytes_to_hex(0, NULL);
else if (flags & CRYPT_ACTIVATE_KEYRING_KEY) {
keystr_len = strlen(tgt->u.crypt.vk->key_description) + int_log10(tgt->u.crypt.vk->keylength) + 10;
if (!tgt->u.crypt.vk->key_description || tgt->u.crypt.vk->keyring == INVALID_KEY)
goto out;
keystr_len = strlen(tgt->u.crypt.vk->key_description) +
int_log10(tgt->u.crypt.vk->keylength) +
24 /* type and separators */;
hexkey = crypt_safe_alloc(keystr_len);
if (!hexkey)
goto out;
r = snprintf(hexkey, keystr_len, ":%zu:logon:%s", tgt->u.crypt.vk->keylength,
tgt->u.crypt.vk->key_description);
r = snprintf(hexkey, keystr_len, ":%zu:%s:%s", tgt->u.crypt.vk->keylength,
key_type_name(tgt->u.crypt.vk->keyring), tgt->u.crypt.vk->key_description);
if (r < 0 || r >= keystr_len)
goto out;
} else
Expand Down Expand Up @@ -1977,7 +1981,7 @@ static int _dm_target_query_crypt(struct crypt_device *cd, uint32_t get_flags,
uint32_t *act_flags)
{
uint64_t val64;
char *rcipher, *rintegrity, *key_, *rdevice, *endp, buffer[3], *arg, *key_desc;
char *rcipher, *rintegrity, *key_, *rdevice, *endp, buffer[3], *arg, *key_desc, keyring[16];
unsigned int i, val;
int r;
size_t key_size;
Expand Down Expand Up @@ -2102,15 +2106,19 @@ static int _dm_target_query_crypt(struct crypt_device *cd, uint32_t get_flags,
if (key_[0] == ':') {
/* :<key_size>:<key_type>:<key_description> */
key_desc = NULL;
r = -ENOMEM;
endp = strpbrk(key_ + 1, ":");
if (endp)
key_desc = strpbrk(endp + 1, ":");
if (!key_desc) {
r = -ENOMEM;
if (!endp)
goto err;
}
key_desc = strpbrk(endp + 1, ":");
if (!key_desc)
goto err;
memcpy(keyring, endp + 1, key_desc - endp - 1);
keyring[key_desc - endp - 1] = '\0';
key_desc++;
crypt_volume_key_set_description(vk, key_desc);
r = crypt_volume_key_set_description(vk, key_desc, key_type_by_name(keyring));
if (r < 0)
goto err;
} else {
buffer[2] = '\0';
for(i = 0; i < vk->keylength; i++) {
Expand Down
4 changes: 2 additions & 2 deletions lib/luks2/luks2_digest.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -419,7 +419,7 @@ int LUKS2_key_description_by_segment(struct crypt_device *cd,
char *desc = get_key_description_by_digest(cd, LUKS2_digest_by_segment(hdr, segment));
int r;

r = crypt_volume_key_set_description(vk, desc);
r = crypt_volume_key_set_description(vk, desc, LOGON_KEY);
free(desc);
return r;
}
Expand All @@ -430,7 +430,7 @@ int LUKS2_volume_key_load_in_keyring_by_digest(struct crypt_device *cd,
char *desc = get_key_description_by_digest(cd, digest);
int r;

r = crypt_volume_key_set_description(vk, desc);
r = crypt_volume_key_set_description(vk, desc, LOGON_KEY);
if (!r)
r = crypt_volume_key_load_in_keyring(cd, vk);

Expand Down
8 changes: 6 additions & 2 deletions lib/setup.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3353,7 +3353,9 @@ static int _reload_device(struct crypt_device *cd, const char *name,
sdmd->flags &= ~CRYPT_ACTIVATE_READONLY;

if (tgt->type == DM_CRYPT && sdmd->flags & CRYPT_ACTIVATE_KEYRING_KEY) {
r = crypt_volume_key_set_description(tgt->u.crypt.vk, src->u.crypt.vk->key_description);
r = crypt_volume_key_set_description(tgt->u.crypt.vk,
src->u.crypt.vk->key_description,
src->u.crypt.vk->keyring);
if (r)
goto out;
} else if (tgt->type == DM_CRYPT) {
Expand Down Expand Up @@ -3473,7 +3475,9 @@ static int _reload_device_with_integrity(struct crypt_device *cd,
sdmdi->flags &= ~CRYPT_ACTIVATE_READONLY;

if (sdmd->flags & CRYPT_ACTIVATE_KEYRING_KEY) {
r = crypt_volume_key_set_description(tgt->u.crypt.vk, src->u.crypt.vk->key_description);
r = crypt_volume_key_set_description(tgt->u.crypt.vk,
src->u.crypt.vk->key_description,
src->u.crypt.vk->keyring);
if (r)
goto out;
} else {
Expand Down
10 changes: 5 additions & 5 deletions lib/utils_keyring.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@ static const struct {
key_type_t type;
const char *type_name;
} key_types[] = {
{ LOGON_KEY, "logon" },
{ USER_KEY, "user" },
{ BIG_KEY, "big_key" },
{ TRUSTED_KEY, "trusted" },
{ ENCRYPTED_KEY, "encrypted" },
{ LOGON_KEY, "logon" },
{ USER_KEY, "user" },
{ BIG_KEY, "big_key" },
{ TRUSTED_KEY, "trusted" },
{ ENCRYPTED_KEY, "encrypted" },
};

#include <linux/keyctl.h>
Expand Down
5 changes: 4 additions & 1 deletion lib/volumekey.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key)
return NULL;

vk->key_description = NULL;
vk->keyring = INVALID_KEY;
vk->keylength = keylength;
vk->id = KEY_NOT_VERIFIED;
vk->next = NULL;
Expand All @@ -40,13 +41,15 @@ struct volume_key *crypt_alloc_volume_key(size_t keylength, const char *key)
return vk;
}

int crypt_volume_key_set_description(struct volume_key *vk, const char *key_description)
int crypt_volume_key_set_description(struct volume_key *vk,
const char *key_description, key_type_t keyring)
{
if (!vk)
return -EINVAL;

free(CONST_CAST(void*)vk->key_description);
vk->key_description = NULL;
vk->keyring = keyring;
if (key_description && !(vk->key_description = strdup(key_description)))
return -ENOMEM;

Expand Down

0 comments on commit 9575dad

Please sign in to comment.