qemu/crypto/block-luks.c
<<
>>
Prefs
   1/*
   2 * QEMU Crypto block device encryption LUKS format
   3 *
   4 * Copyright (c) 2015-2016 Red Hat, Inc.
   5 *
   6 * This library is free software; you can redistribute it and/or
   7 * modify it under the terms of the GNU Lesser General Public
   8 * License as published by the Free Software Foundation; either
   9 * version 2 of the License, or (at your option) any later version.
  10 *
  11 * This library is distributed in the hope that it will be useful,
  12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 * Lesser General Public License for more details.
  15 *
  16 * You should have received a copy of the GNU Lesser General Public
  17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18 *
  19 */
  20
  21#include "qemu/osdep.h"
  22#include "qapi/error.h"
  23#include "qemu/bswap.h"
  24
  25#include "block-luks.h"
  26
  27#include "crypto/hash.h"
  28#include "crypto/afsplit.h"
  29#include "crypto/pbkdf.h"
  30#include "crypto/secret.h"
  31#include "crypto/random.h"
  32#include "qemu/uuid.h"
  33
  34#include "qemu/coroutine.h"
  35
  36/*
  37 * Reference for the LUKS format implemented here is
  38 *
  39 *   docs/on-disk-format.pdf
  40 *
  41 * in 'cryptsetup' package source code
  42 *
  43 * This file implements the 1.2.1 specification, dated
  44 * Oct 16, 2011.
  45 */
  46
  47typedef struct QCryptoBlockLUKS QCryptoBlockLUKS;
  48typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader;
  49typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot;
  50
  51
  52/* The following constants are all defined by the LUKS spec */
  53#define QCRYPTO_BLOCK_LUKS_VERSION 1
  54
  55#define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6
  56#define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32
  57#define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32
  58#define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32
  59#define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20
  60#define QCRYPTO_BLOCK_LUKS_SALT_LEN 32
  61#define QCRYPTO_BLOCK_LUKS_UUID_LEN 40
  62#define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8
  63#define QCRYPTO_BLOCK_LUKS_STRIPES 4000
  64#define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000
  65#define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000
  66#define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096
  67
  68#define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD
  69#define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3
  70
  71#define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL
  72
  73static const char qcrypto_block_luks_magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN] = {
  74    'L', 'U', 'K', 'S', 0xBA, 0xBE
  75};
  76
  77typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap;
  78struct QCryptoBlockLUKSNameMap {
  79    const char *name;
  80    int id;
  81};
  82
  83typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap;
  84struct QCryptoBlockLUKSCipherSizeMap {
  85    uint32_t key_bytes;
  86    int id;
  87};
  88typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap;
  89struct QCryptoBlockLUKSCipherNameMap {
  90    const char *name;
  91    const QCryptoBlockLUKSCipherSizeMap *sizes;
  92};
  93
  94
  95static const QCryptoBlockLUKSCipherSizeMap
  96qcrypto_block_luks_cipher_size_map_aes[] = {
  97    { 16, QCRYPTO_CIPHER_ALG_AES_128 },
  98    { 24, QCRYPTO_CIPHER_ALG_AES_192 },
  99    { 32, QCRYPTO_CIPHER_ALG_AES_256 },
 100    { 0, 0 },
 101};
 102
 103static const QCryptoBlockLUKSCipherSizeMap
 104qcrypto_block_luks_cipher_size_map_cast5[] = {
 105    { 16, QCRYPTO_CIPHER_ALG_CAST5_128 },
 106    { 0, 0 },
 107};
 108
 109static const QCryptoBlockLUKSCipherSizeMap
 110qcrypto_block_luks_cipher_size_map_serpent[] = {
 111    { 16, QCRYPTO_CIPHER_ALG_SERPENT_128 },
 112    { 24, QCRYPTO_CIPHER_ALG_SERPENT_192 },
 113    { 32, QCRYPTO_CIPHER_ALG_SERPENT_256 },
 114    { 0, 0 },
 115};
 116
 117static const QCryptoBlockLUKSCipherSizeMap
 118qcrypto_block_luks_cipher_size_map_twofish[] = {
 119    { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128 },
 120    { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192 },
 121    { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256 },
 122    { 0, 0 },
 123};
 124
 125static const QCryptoBlockLUKSCipherNameMap
 126qcrypto_block_luks_cipher_name_map[] = {
 127    { "aes", qcrypto_block_luks_cipher_size_map_aes },
 128    { "cast5", qcrypto_block_luks_cipher_size_map_cast5 },
 129    { "serpent", qcrypto_block_luks_cipher_size_map_serpent },
 130    { "twofish", qcrypto_block_luks_cipher_size_map_twofish },
 131};
 132
 133
 134/*
 135 * This struct is written to disk in big-endian format,
 136 * but operated upon in native-endian format.
 137 */
 138struct QCryptoBlockLUKSKeySlot {
 139    /* state of keyslot, enabled/disable */
 140    uint32_t active;
 141    /* iterations for PBKDF2 */
 142    uint32_t iterations;
 143    /* salt for PBKDF2 */
 144    uint8_t salt[QCRYPTO_BLOCK_LUKS_SALT_LEN];
 145    /* start sector of key material */
 146    uint32_t key_offset;
 147    /* number of anti-forensic stripes */
 148    uint32_t stripes;
 149};
 150
 151QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot) != 48);
 152
 153
 154/*
 155 * This struct is written to disk in big-endian format,
 156 * but operated upon in native-endian format.
 157 */
 158struct QCryptoBlockLUKSHeader {
 159    /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */
 160    char magic[QCRYPTO_BLOCK_LUKS_MAGIC_LEN];
 161
 162    /* LUKS version, currently 1 */
 163    uint16_t version;
 164
 165    /* cipher name specification (aes, etc) */
 166    char cipher_name[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN];
 167
 168    /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */
 169    char cipher_mode[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN];
 170
 171    /* hash specification (sha256, etc) */
 172    char hash_spec[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN];
 173
 174    /* start offset of the volume data (in 512 byte sectors) */
 175    uint32_t payload_offset;
 176
 177    /* Number of key bytes */
 178    uint32_t key_bytes;
 179
 180    /* master key checksum after PBKDF2 */
 181    uint8_t master_key_digest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN];
 182
 183    /* salt for master key PBKDF2 */
 184    uint8_t master_key_salt[QCRYPTO_BLOCK_LUKS_SALT_LEN];
 185
 186    /* iterations for master key PBKDF2 */
 187    uint32_t master_key_iterations;
 188
 189    /* UUID of the partition in standard ASCII representation */
 190    uint8_t uuid[QCRYPTO_BLOCK_LUKS_UUID_LEN];
 191
 192    /* key slots */
 193    QCryptoBlockLUKSKeySlot key_slots[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS];
 194};
 195
 196QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader) != 592);
 197
 198
 199struct QCryptoBlockLUKS {
 200    QCryptoBlockLUKSHeader header;
 201
 202    /* Cache parsed versions of what's in header fields,
 203     * as we can't rely on QCryptoBlock.cipher being
 204     * non-NULL */
 205    QCryptoCipherAlgorithm cipher_alg;
 206    QCryptoCipherMode cipher_mode;
 207    QCryptoIVGenAlgorithm ivgen_alg;
 208    QCryptoHashAlgorithm ivgen_hash_alg;
 209    QCryptoHashAlgorithm hash_alg;
 210};
 211
 212
 213static int qcrypto_block_luks_cipher_name_lookup(const char *name,
 214                                                 QCryptoCipherMode mode,
 215                                                 uint32_t key_bytes,
 216                                                 Error **errp)
 217{
 218    const QCryptoBlockLUKSCipherNameMap *map =
 219        qcrypto_block_luks_cipher_name_map;
 220    size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map);
 221    size_t i, j;
 222
 223    if (mode == QCRYPTO_CIPHER_MODE_XTS) {
 224        key_bytes /= 2;
 225    }
 226
 227    for (i = 0; i < maplen; i++) {
 228        if (!g_str_equal(map[i].name, name)) {
 229            continue;
 230        }
 231        for (j = 0; j < map[i].sizes[j].key_bytes; j++) {
 232            if (map[i].sizes[j].key_bytes == key_bytes) {
 233                return map[i].sizes[j].id;
 234            }
 235        }
 236    }
 237
 238    error_setg(errp, "Algorithm %s with key size %d bytes not supported",
 239               name, key_bytes);
 240    return 0;
 241}
 242
 243static const char *
 244qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg,
 245                                     Error **errp)
 246{
 247    const QCryptoBlockLUKSCipherNameMap *map =
 248        qcrypto_block_luks_cipher_name_map;
 249    size_t maplen = G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map);
 250    size_t i, j;
 251    for (i = 0; i < maplen; i++) {
 252        for (j = 0; j < map[i].sizes[j].key_bytes; j++) {
 253            if (map[i].sizes[j].id == alg) {
 254                return map[i].name;
 255            }
 256        }
 257    }
 258
 259    error_setg(errp, "Algorithm '%s' not supported",
 260               QCryptoCipherAlgorithm_str(alg));
 261    return NULL;
 262}
 263
 264/* XXX replace with qapi_enum_parse() in future, when we can
 265 * make that function emit a more friendly error message */
 266static int qcrypto_block_luks_name_lookup(const char *name,
 267                                          const QEnumLookup *map,
 268                                          const char *type,
 269                                          Error **errp)
 270{
 271    int ret = qapi_enum_parse(map, name, -1, NULL);
 272
 273    if (ret < 0) {
 274        error_setg(errp, "%s %s not supported", type, name);
 275        return 0;
 276    }
 277    return ret;
 278}
 279
 280#define qcrypto_block_luks_cipher_mode_lookup(name, errp)               \
 281    qcrypto_block_luks_name_lookup(name,                                \
 282                                   &QCryptoCipherMode_lookup,           \
 283                                   "Cipher mode",                       \
 284                                   errp)
 285
 286#define qcrypto_block_luks_hash_name_lookup(name, errp)                 \
 287    qcrypto_block_luks_name_lookup(name,                                \
 288                                   &QCryptoHashAlgorithm_lookup,        \
 289                                   "Hash algorithm",                    \
 290                                   errp)
 291
 292#define qcrypto_block_luks_ivgen_name_lookup(name, errp)                \
 293    qcrypto_block_luks_name_lookup(name,                                \
 294                                   &QCryptoIVGenAlgorithm_lookup,       \
 295                                   "IV generator",                      \
 296                                   errp)
 297
 298
 299static bool
 300qcrypto_block_luks_has_format(const uint8_t *buf,
 301                              size_t buf_size)
 302{
 303    const QCryptoBlockLUKSHeader *luks_header = (const void *)buf;
 304
 305    if (buf_size >= offsetof(QCryptoBlockLUKSHeader, cipher_name) &&
 306        memcmp(luks_header->magic, qcrypto_block_luks_magic,
 307               QCRYPTO_BLOCK_LUKS_MAGIC_LEN) == 0 &&
 308        be16_to_cpu(luks_header->version) == QCRYPTO_BLOCK_LUKS_VERSION) {
 309        return true;
 310    } else {
 311        return false;
 312    }
 313}
 314
 315
 316/**
 317 * Deal with a quirk of dm-crypt usage of ESSIV.
 318 *
 319 * When calculating ESSIV IVs, the cipher length used by ESSIV
 320 * may be different from the cipher length used for the block
 321 * encryption, becauses dm-crypt uses the hash digest length
 322 * as the key size. ie, if you have AES 128 as the block cipher
 323 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
 324 * the cipher since that gets a key length matching the digest
 325 * size, not AES 128 with truncated digest as might be imagined
 326 */
 327static QCryptoCipherAlgorithm
 328qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher,
 329                                QCryptoHashAlgorithm hash,
 330                                Error **errp)
 331{
 332    size_t digestlen = qcrypto_hash_digest_len(hash);
 333    size_t keylen = qcrypto_cipher_get_key_len(cipher);
 334    if (digestlen == keylen) {
 335        return cipher;
 336    }
 337
 338    switch (cipher) {
 339    case QCRYPTO_CIPHER_ALG_AES_128:
 340    case QCRYPTO_CIPHER_ALG_AES_192:
 341    case QCRYPTO_CIPHER_ALG_AES_256:
 342        if (digestlen == qcrypto_cipher_get_key_len(
 343                QCRYPTO_CIPHER_ALG_AES_128)) {
 344            return QCRYPTO_CIPHER_ALG_AES_128;
 345        } else if (digestlen == qcrypto_cipher_get_key_len(
 346                       QCRYPTO_CIPHER_ALG_AES_192)) {
 347            return QCRYPTO_CIPHER_ALG_AES_192;
 348        } else if (digestlen == qcrypto_cipher_get_key_len(
 349                       QCRYPTO_CIPHER_ALG_AES_256)) {
 350            return QCRYPTO_CIPHER_ALG_AES_256;
 351        } else {
 352            error_setg(errp, "No AES cipher with key size %zu available",
 353                       digestlen);
 354            return 0;
 355        }
 356        break;
 357    case QCRYPTO_CIPHER_ALG_SERPENT_128:
 358    case QCRYPTO_CIPHER_ALG_SERPENT_192:
 359    case QCRYPTO_CIPHER_ALG_SERPENT_256:
 360        if (digestlen == qcrypto_cipher_get_key_len(
 361                QCRYPTO_CIPHER_ALG_SERPENT_128)) {
 362            return QCRYPTO_CIPHER_ALG_SERPENT_128;
 363        } else if (digestlen == qcrypto_cipher_get_key_len(
 364                       QCRYPTO_CIPHER_ALG_SERPENT_192)) {
 365            return QCRYPTO_CIPHER_ALG_SERPENT_192;
 366        } else if (digestlen == qcrypto_cipher_get_key_len(
 367                       QCRYPTO_CIPHER_ALG_SERPENT_256)) {
 368            return QCRYPTO_CIPHER_ALG_SERPENT_256;
 369        } else {
 370            error_setg(errp, "No Serpent cipher with key size %zu available",
 371                       digestlen);
 372            return 0;
 373        }
 374        break;
 375    case QCRYPTO_CIPHER_ALG_TWOFISH_128:
 376    case QCRYPTO_CIPHER_ALG_TWOFISH_192:
 377    case QCRYPTO_CIPHER_ALG_TWOFISH_256:
 378        if (digestlen == qcrypto_cipher_get_key_len(
 379                QCRYPTO_CIPHER_ALG_TWOFISH_128)) {
 380            return QCRYPTO_CIPHER_ALG_TWOFISH_128;
 381        } else if (digestlen == qcrypto_cipher_get_key_len(
 382                       QCRYPTO_CIPHER_ALG_TWOFISH_192)) {
 383            return QCRYPTO_CIPHER_ALG_TWOFISH_192;
 384        } else if (digestlen == qcrypto_cipher_get_key_len(
 385                       QCRYPTO_CIPHER_ALG_TWOFISH_256)) {
 386            return QCRYPTO_CIPHER_ALG_TWOFISH_256;
 387        } else {
 388            error_setg(errp, "No Twofish cipher with key size %zu available",
 389                       digestlen);
 390            return 0;
 391        }
 392        break;
 393    default:
 394        error_setg(errp, "Cipher %s not supported with essiv",
 395                   QCryptoCipherAlgorithm_str(cipher));
 396        return 0;
 397    }
 398}
 399
 400/*
 401 * Given a key slot, and user password, this will attempt to unlock
 402 * the master encryption key from the key slot.
 403 *
 404 * Returns:
 405 *    0 if the key slot is disabled, or key could not be decrypted
 406 *      with the provided password
 407 *    1 if the key slot is enabled, and key decrypted successfully
 408 *      with the provided password
 409 *   -1 if a fatal error occurred loading the key
 410 */
 411static int
 412qcrypto_block_luks_load_key(QCryptoBlock *block,
 413                            QCryptoBlockLUKSKeySlot *slot,
 414                            const char *password,
 415                            QCryptoCipherAlgorithm cipheralg,
 416                            QCryptoCipherMode ciphermode,
 417                            QCryptoHashAlgorithm hash,
 418                            QCryptoIVGenAlgorithm ivalg,
 419                            QCryptoCipherAlgorithm ivcipheralg,
 420                            QCryptoHashAlgorithm ivhash,
 421                            uint8_t *masterkey,
 422                            size_t masterkeylen,
 423                            QCryptoBlockReadFunc readfunc,
 424                            void *opaque,
 425                            Error **errp)
 426{
 427    QCryptoBlockLUKS *luks = block->opaque;
 428    uint8_t *splitkey;
 429    size_t splitkeylen;
 430    uint8_t *possiblekey;
 431    int ret = -1;
 432    ssize_t rv;
 433    QCryptoCipher *cipher = NULL;
 434    uint8_t keydigest[QCRYPTO_BLOCK_LUKS_DIGEST_LEN];
 435    QCryptoIVGen *ivgen = NULL;
 436    size_t niv;
 437
 438    if (slot->active != QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED) {
 439        return 0;
 440    }
 441
 442    splitkeylen = masterkeylen * slot->stripes;
 443    splitkey = g_new0(uint8_t, splitkeylen);
 444    possiblekey = g_new0(uint8_t, masterkeylen);
 445
 446    /*
 447     * The user password is used to generate a (possible)
 448     * decryption key. This may or may not successfully
 449     * decrypt the master key - we just blindly assume
 450     * the key is correct and validate the results of
 451     * decryption later.
 452     */
 453    if (qcrypto_pbkdf2(hash,
 454                       (const uint8_t *)password, strlen(password),
 455                       slot->salt, QCRYPTO_BLOCK_LUKS_SALT_LEN,
 456                       slot->iterations,
 457                       possiblekey, masterkeylen,
 458                       errp) < 0) {
 459        goto cleanup;
 460    }
 461
 462    /*
 463     * We need to read the master key material from the
 464     * LUKS key material header. What we're reading is
 465     * not the raw master key, but rather the data after
 466     * it has been passed through AFSplit and the result
 467     * then encrypted.
 468     */
 469    rv = readfunc(block,
 470                  slot->key_offset * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
 471                  splitkey, splitkeylen,
 472                  opaque,
 473                  errp);
 474    if (rv < 0) {
 475        goto cleanup;
 476    }
 477
 478
 479    /* Setup the cipher/ivgen that we'll use to try to decrypt
 480     * the split master key material */
 481    cipher = qcrypto_cipher_new(cipheralg, ciphermode,
 482                                possiblekey, masterkeylen,
 483                                errp);
 484    if (!cipher) {
 485        goto cleanup;
 486    }
 487
 488    niv = qcrypto_cipher_get_iv_len(cipheralg,
 489                                    ciphermode);
 490    ivgen = qcrypto_ivgen_new(ivalg,
 491                              ivcipheralg,
 492                              ivhash,
 493                              possiblekey, masterkeylen,
 494                              errp);
 495    if (!ivgen) {
 496        goto cleanup;
 497    }
 498
 499
 500    /*
 501     * The master key needs to be decrypted in the same
 502     * way that the block device payload will be decrypted
 503     * later. In particular we'll be using the IV generator
 504     * to reset the encryption cipher every time the master
 505     * key crosses a sector boundary.
 506     */
 507    if (qcrypto_block_cipher_decrypt_helper(cipher,
 508                                            niv,
 509                                            ivgen,
 510                                            QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
 511                                            0,
 512                                            splitkey,
 513                                            splitkeylen,
 514                                            errp) < 0) {
 515        goto cleanup;
 516    }
 517
 518    /*
 519     * Now we've decrypted the split master key, join
 520     * it back together to get the actual master key.
 521     */
 522    if (qcrypto_afsplit_decode(hash,
 523                               masterkeylen,
 524                               slot->stripes,
 525                               splitkey,
 526                               masterkey,
 527                               errp) < 0) {
 528        goto cleanup;
 529    }
 530
 531
 532    /*
 533     * We still don't know that the masterkey we got is valid,
 534     * because we just blindly assumed the user's password
 535     * was correct. This is where we now verify it. We are
 536     * creating a hash of the master key using PBKDF and
 537     * then comparing that to the hash stored in the key slot
 538     * header
 539     */
 540    if (qcrypto_pbkdf2(hash,
 541                       masterkey, masterkeylen,
 542                       luks->header.master_key_salt,
 543                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
 544                       luks->header.master_key_iterations,
 545                       keydigest, G_N_ELEMENTS(keydigest),
 546                       errp) < 0) {
 547        goto cleanup;
 548    }
 549
 550    if (memcmp(keydigest, luks->header.master_key_digest,
 551               QCRYPTO_BLOCK_LUKS_DIGEST_LEN) == 0) {
 552        /* Success, we got the right master key */
 553        ret = 1;
 554        goto cleanup;
 555    }
 556
 557    /* Fail, user's password was not valid for this key slot,
 558     * tell caller to try another slot */
 559    ret = 0;
 560
 561 cleanup:
 562    qcrypto_ivgen_free(ivgen);
 563    qcrypto_cipher_free(cipher);
 564    g_free(splitkey);
 565    g_free(possiblekey);
 566    return ret;
 567}
 568
 569
 570/*
 571 * Given a user password, this will iterate over all key
 572 * slots and try to unlock each active key slot using the
 573 * password until it successfully obtains a master key.
 574 *
 575 * Returns 0 if a key was loaded, -1 if no keys could be loaded
 576 */
 577static int
 578qcrypto_block_luks_find_key(QCryptoBlock *block,
 579                            const char *password,
 580                            QCryptoCipherAlgorithm cipheralg,
 581                            QCryptoCipherMode ciphermode,
 582                            QCryptoHashAlgorithm hash,
 583                            QCryptoIVGenAlgorithm ivalg,
 584                            QCryptoCipherAlgorithm ivcipheralg,
 585                            QCryptoHashAlgorithm ivhash,
 586                            uint8_t **masterkey,
 587                            size_t *masterkeylen,
 588                            QCryptoBlockReadFunc readfunc,
 589                            void *opaque,
 590                            Error **errp)
 591{
 592    QCryptoBlockLUKS *luks = block->opaque;
 593    size_t i;
 594    int rv;
 595
 596    *masterkey = g_new0(uint8_t, luks->header.key_bytes);
 597    *masterkeylen = luks->header.key_bytes;
 598
 599    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
 600        rv = qcrypto_block_luks_load_key(block,
 601                                         &luks->header.key_slots[i],
 602                                         password,
 603                                         cipheralg,
 604                                         ciphermode,
 605                                         hash,
 606                                         ivalg,
 607                                         ivcipheralg,
 608                                         ivhash,
 609                                         *masterkey,
 610                                         *masterkeylen,
 611                                         readfunc,
 612                                         opaque,
 613                                         errp);
 614        if (rv < 0) {
 615            goto error;
 616        }
 617        if (rv == 1) {
 618            return 0;
 619        }
 620    }
 621
 622    error_setg(errp, "Invalid password, cannot unlock any keyslot");
 623
 624 error:
 625    g_free(*masterkey);
 626    *masterkey = NULL;
 627    *masterkeylen = 0;
 628    return -1;
 629}
 630
 631
 632static int
 633qcrypto_block_luks_open(QCryptoBlock *block,
 634                        QCryptoBlockOpenOptions *options,
 635                        const char *optprefix,
 636                        QCryptoBlockReadFunc readfunc,
 637                        void *opaque,
 638                        unsigned int flags,
 639                        size_t n_threads,
 640                        Error **errp)
 641{
 642    QCryptoBlockLUKS *luks;
 643    Error *local_err = NULL;
 644    int ret = 0;
 645    size_t i;
 646    ssize_t rv;
 647    uint8_t *masterkey = NULL;
 648    size_t masterkeylen;
 649    char *ivgen_name, *ivhash_name;
 650    QCryptoCipherMode ciphermode;
 651    QCryptoCipherAlgorithm cipheralg;
 652    QCryptoIVGenAlgorithm ivalg;
 653    QCryptoCipherAlgorithm ivcipheralg;
 654    QCryptoHashAlgorithm hash;
 655    QCryptoHashAlgorithm ivhash;
 656    char *password = NULL;
 657
 658    if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) {
 659        if (!options->u.luks.key_secret) {
 660            error_setg(errp, "Parameter '%skey-secret' is required for cipher",
 661                       optprefix ? optprefix : "");
 662            return -1;
 663        }
 664        password = qcrypto_secret_lookup_as_utf8(
 665            options->u.luks.key_secret, errp);
 666        if (!password) {
 667            return -1;
 668        }
 669    }
 670
 671    luks = g_new0(QCryptoBlockLUKS, 1);
 672    block->opaque = luks;
 673
 674    /* Read the entire LUKS header, minus the key material from
 675     * the underlying device */
 676    rv = readfunc(block, 0,
 677                  (uint8_t *)&luks->header,
 678                  sizeof(luks->header),
 679                  opaque,
 680                  errp);
 681    if (rv < 0) {
 682        ret = rv;
 683        goto fail;
 684    }
 685
 686    /* The header is always stored in big-endian format, so
 687     * convert everything to native */
 688    be16_to_cpus(&luks->header.version);
 689    be32_to_cpus(&luks->header.payload_offset);
 690    be32_to_cpus(&luks->header.key_bytes);
 691    be32_to_cpus(&luks->header.master_key_iterations);
 692
 693    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
 694        be32_to_cpus(&luks->header.key_slots[i].active);
 695        be32_to_cpus(&luks->header.key_slots[i].iterations);
 696        be32_to_cpus(&luks->header.key_slots[i].key_offset);
 697        be32_to_cpus(&luks->header.key_slots[i].stripes);
 698    }
 699
 700    if (memcmp(luks->header.magic, qcrypto_block_luks_magic,
 701               QCRYPTO_BLOCK_LUKS_MAGIC_LEN) != 0) {
 702        error_setg(errp, "Volume is not in LUKS format");
 703        ret = -EINVAL;
 704        goto fail;
 705    }
 706    if (luks->header.version != QCRYPTO_BLOCK_LUKS_VERSION) {
 707        error_setg(errp, "LUKS version %" PRIu32 " is not supported",
 708                   luks->header.version);
 709        ret = -ENOTSUP;
 710        goto fail;
 711    }
 712
 713    /*
 714     * The cipher_mode header contains a string that we have
 715     * to further parse, of the format
 716     *
 717     *    <cipher-mode>-<iv-generator>[:<iv-hash>]
 718     *
 719     * eg  cbc-essiv:sha256, cbc-plain64
 720     */
 721    ivgen_name = strchr(luks->header.cipher_mode, '-');
 722    if (!ivgen_name) {
 723        ret = -EINVAL;
 724        error_setg(errp, "Unexpected cipher mode string format %s",
 725                   luks->header.cipher_mode);
 726        goto fail;
 727    }
 728    *ivgen_name = '\0';
 729    ivgen_name++;
 730
 731    ivhash_name = strchr(ivgen_name, ':');
 732    if (!ivhash_name) {
 733        ivhash = 0;
 734    } else {
 735        *ivhash_name = '\0';
 736        ivhash_name++;
 737
 738        ivhash = qcrypto_block_luks_hash_name_lookup(ivhash_name,
 739                                                     &local_err);
 740        if (local_err) {
 741            ret = -ENOTSUP;
 742            error_propagate(errp, local_err);
 743            goto fail;
 744        }
 745    }
 746
 747    ciphermode = qcrypto_block_luks_cipher_mode_lookup(luks->header.cipher_mode,
 748                                                       &local_err);
 749    if (local_err) {
 750        ret = -ENOTSUP;
 751        error_propagate(errp, local_err);
 752        goto fail;
 753    }
 754
 755    cipheralg = qcrypto_block_luks_cipher_name_lookup(luks->header.cipher_name,
 756                                                      ciphermode,
 757                                                      luks->header.key_bytes,
 758                                                      &local_err);
 759    if (local_err) {
 760        ret = -ENOTSUP;
 761        error_propagate(errp, local_err);
 762        goto fail;
 763    }
 764
 765    hash = qcrypto_block_luks_hash_name_lookup(luks->header.hash_spec,
 766                                               &local_err);
 767    if (local_err) {
 768        ret = -ENOTSUP;
 769        error_propagate(errp, local_err);
 770        goto fail;
 771    }
 772
 773    ivalg = qcrypto_block_luks_ivgen_name_lookup(ivgen_name,
 774                                                 &local_err);
 775    if (local_err) {
 776        ret = -ENOTSUP;
 777        error_propagate(errp, local_err);
 778        goto fail;
 779    }
 780
 781    if (ivalg == QCRYPTO_IVGEN_ALG_ESSIV) {
 782        if (!ivhash_name) {
 783            ret = -EINVAL;
 784            error_setg(errp, "Missing IV generator hash specification");
 785            goto fail;
 786        }
 787        ivcipheralg = qcrypto_block_luks_essiv_cipher(cipheralg,
 788                                                      ivhash,
 789                                                      &local_err);
 790        if (local_err) {
 791            ret = -ENOTSUP;
 792            error_propagate(errp, local_err);
 793            goto fail;
 794        }
 795    } else {
 796        /* Note we parsed the ivhash_name earlier in the cipher_mode
 797         * spec string even with plain/plain64 ivgens, but we
 798         * will ignore it, since it is irrelevant for these ivgens.
 799         * This is for compat with dm-crypt which will silently
 800         * ignore hash names with these ivgens rather than report
 801         * an error about the invalid usage
 802         */
 803        ivcipheralg = cipheralg;
 804    }
 805
 806    if (!(flags & QCRYPTO_BLOCK_OPEN_NO_IO)) {
 807        /* Try to find which key slot our password is valid for
 808         * and unlock the master key from that slot.
 809         */
 810        if (qcrypto_block_luks_find_key(block,
 811                                        password,
 812                                        cipheralg, ciphermode,
 813                                        hash,
 814                                        ivalg,
 815                                        ivcipheralg,
 816                                        ivhash,
 817                                        &masterkey, &masterkeylen,
 818                                        readfunc, opaque,
 819                                        errp) < 0) {
 820            ret = -EACCES;
 821            goto fail;
 822        }
 823
 824        /* We have a valid master key now, so can setup the
 825         * block device payload decryption objects
 826         */
 827        block->kdfhash = hash;
 828        block->niv = qcrypto_cipher_get_iv_len(cipheralg,
 829                                               ciphermode);
 830        block->ivgen = qcrypto_ivgen_new(ivalg,
 831                                         ivcipheralg,
 832                                         ivhash,
 833                                         masterkey, masterkeylen,
 834                                         errp);
 835        if (!block->ivgen) {
 836            ret = -ENOTSUP;
 837            goto fail;
 838        }
 839
 840        ret = qcrypto_block_init_cipher(block, cipheralg, ciphermode,
 841                                        masterkey, masterkeylen, n_threads,
 842                                        errp);
 843        if (ret < 0) {
 844            ret = -ENOTSUP;
 845            goto fail;
 846        }
 847    }
 848
 849    block->sector_size = QCRYPTO_BLOCK_LUKS_SECTOR_SIZE;
 850    block->payload_offset = luks->header.payload_offset *
 851        block->sector_size;
 852
 853    luks->cipher_alg = cipheralg;
 854    luks->cipher_mode = ciphermode;
 855    luks->ivgen_alg = ivalg;
 856    luks->ivgen_hash_alg = ivhash;
 857    luks->hash_alg = hash;
 858
 859    g_free(masterkey);
 860    g_free(password);
 861
 862    return 0;
 863
 864 fail:
 865    g_free(masterkey);
 866    qcrypto_block_free_cipher(block);
 867    qcrypto_ivgen_free(block->ivgen);
 868    g_free(luks);
 869    g_free(password);
 870    return ret;
 871}
 872
 873
 874static void
 875qcrypto_block_luks_uuid_gen(uint8_t *uuidstr)
 876{
 877    QemuUUID uuid;
 878    qemu_uuid_generate(&uuid);
 879    qemu_uuid_unparse(&uuid, (char *)uuidstr);
 880}
 881
 882static int
 883qcrypto_block_luks_create(QCryptoBlock *block,
 884                          QCryptoBlockCreateOptions *options,
 885                          const char *optprefix,
 886                          QCryptoBlockInitFunc initfunc,
 887                          QCryptoBlockWriteFunc writefunc,
 888                          void *opaque,
 889                          Error **errp)
 890{
 891    QCryptoBlockLUKS *luks;
 892    QCryptoBlockCreateOptionsLUKS luks_opts;
 893    Error *local_err = NULL;
 894    uint8_t *masterkey = NULL;
 895    uint8_t *slotkey = NULL;
 896    uint8_t *splitkey = NULL;
 897    size_t splitkeylen = 0;
 898    size_t i;
 899    QCryptoCipher *cipher = NULL;
 900    QCryptoIVGen *ivgen = NULL;
 901    char *password;
 902    const char *cipher_alg;
 903    const char *cipher_mode;
 904    const char *ivgen_alg;
 905    const char *ivgen_hash_alg = NULL;
 906    const char *hash_alg;
 907    char *cipher_mode_spec = NULL;
 908    QCryptoCipherAlgorithm ivcipheralg = 0;
 909    uint64_t iters;
 910
 911    memcpy(&luks_opts, &options->u.luks, sizeof(luks_opts));
 912    if (!luks_opts.has_iter_time) {
 913        luks_opts.iter_time = 2000;
 914    }
 915    if (!luks_opts.has_cipher_alg) {
 916        luks_opts.cipher_alg = QCRYPTO_CIPHER_ALG_AES_256;
 917    }
 918    if (!luks_opts.has_cipher_mode) {
 919        luks_opts.cipher_mode = QCRYPTO_CIPHER_MODE_XTS;
 920    }
 921    if (!luks_opts.has_ivgen_alg) {
 922        luks_opts.ivgen_alg = QCRYPTO_IVGEN_ALG_PLAIN64;
 923    }
 924    if (!luks_opts.has_hash_alg) {
 925        luks_opts.hash_alg = QCRYPTO_HASH_ALG_SHA256;
 926    }
 927    if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) {
 928        if (!luks_opts.has_ivgen_hash_alg) {
 929            luks_opts.ivgen_hash_alg = QCRYPTO_HASH_ALG_SHA256;
 930            luks_opts.has_ivgen_hash_alg = true;
 931        }
 932    }
 933    /* Note we're allowing ivgen_hash_alg to be set even for
 934     * non-essiv iv generators that don't need a hash. It will
 935     * be silently ignored, for compatibility with dm-crypt */
 936
 937    if (!options->u.luks.key_secret) {
 938        error_setg(errp, "Parameter '%skey-secret' is required for cipher",
 939                   optprefix ? optprefix : "");
 940        return -1;
 941    }
 942    password = qcrypto_secret_lookup_as_utf8(luks_opts.key_secret, errp);
 943    if (!password) {
 944        return -1;
 945    }
 946
 947    luks = g_new0(QCryptoBlockLUKS, 1);
 948    block->opaque = luks;
 949
 950    memcpy(luks->header.magic, qcrypto_block_luks_magic,
 951           QCRYPTO_BLOCK_LUKS_MAGIC_LEN);
 952
 953    /* We populate the header in native endianness initially and
 954     * then convert everything to big endian just before writing
 955     * it out to disk
 956     */
 957    luks->header.version = QCRYPTO_BLOCK_LUKS_VERSION;
 958    qcrypto_block_luks_uuid_gen(luks->header.uuid);
 959
 960    cipher_alg = qcrypto_block_luks_cipher_alg_lookup(luks_opts.cipher_alg,
 961                                                      errp);
 962    if (!cipher_alg) {
 963        goto error;
 964    }
 965
 966    cipher_mode = QCryptoCipherMode_str(luks_opts.cipher_mode);
 967    ivgen_alg = QCryptoIVGenAlgorithm_str(luks_opts.ivgen_alg);
 968    if (luks_opts.has_ivgen_hash_alg) {
 969        ivgen_hash_alg = QCryptoHashAlgorithm_str(luks_opts.ivgen_hash_alg);
 970        cipher_mode_spec = g_strdup_printf("%s-%s:%s", cipher_mode, ivgen_alg,
 971                                           ivgen_hash_alg);
 972    } else {
 973        cipher_mode_spec = g_strdup_printf("%s-%s", cipher_mode, ivgen_alg);
 974    }
 975    hash_alg = QCryptoHashAlgorithm_str(luks_opts.hash_alg);
 976
 977
 978    if (strlen(cipher_alg) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN) {
 979        error_setg(errp, "Cipher name '%s' is too long for LUKS header",
 980                   cipher_alg);
 981        goto error;
 982    }
 983    if (strlen(cipher_mode_spec) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN) {
 984        error_setg(errp, "Cipher mode '%s' is too long for LUKS header",
 985                   cipher_mode_spec);
 986        goto error;
 987    }
 988    if (strlen(hash_alg) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN) {
 989        error_setg(errp, "Hash name '%s' is too long for LUKS header",
 990                   hash_alg);
 991        goto error;
 992    }
 993
 994    if (luks_opts.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) {
 995        ivcipheralg = qcrypto_block_luks_essiv_cipher(luks_opts.cipher_alg,
 996                                                      luks_opts.ivgen_hash_alg,
 997                                                      &local_err);
 998        if (local_err) {
 999            error_propagate(errp, local_err);
1000            goto error;
1001        }
1002    } else {
1003        ivcipheralg = luks_opts.cipher_alg;
1004    }
1005
1006    strcpy(luks->header.cipher_name, cipher_alg);
1007    strcpy(luks->header.cipher_mode, cipher_mode_spec);
1008    strcpy(luks->header.hash_spec, hash_alg);
1009
1010    luks->header.key_bytes = qcrypto_cipher_get_key_len(luks_opts.cipher_alg);
1011    if (luks_opts.cipher_mode == QCRYPTO_CIPHER_MODE_XTS) {
1012        luks->header.key_bytes *= 2;
1013    }
1014
1015    /* Generate the salt used for hashing the master key
1016     * with PBKDF later
1017     */
1018    if (qcrypto_random_bytes(luks->header.master_key_salt,
1019                             QCRYPTO_BLOCK_LUKS_SALT_LEN,
1020                             errp) < 0) {
1021        goto error;
1022    }
1023
1024    /* Generate random master key */
1025    masterkey = g_new0(uint8_t, luks->header.key_bytes);
1026    if (qcrypto_random_bytes(masterkey,
1027                             luks->header.key_bytes, errp) < 0) {
1028        goto error;
1029    }
1030
1031
1032    /* Setup the block device payload encryption objects */
1033    if (qcrypto_block_init_cipher(block, luks_opts.cipher_alg,
1034                                  luks_opts.cipher_mode, masterkey,
1035                                  luks->header.key_bytes, 1, errp) < 0) {
1036        goto error;
1037    }
1038
1039    block->kdfhash = luks_opts.hash_alg;
1040    block->niv = qcrypto_cipher_get_iv_len(luks_opts.cipher_alg,
1041                                           luks_opts.cipher_mode);
1042    block->ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg,
1043                                     ivcipheralg,
1044                                     luks_opts.ivgen_hash_alg,
1045                                     masterkey, luks->header.key_bytes,
1046                                     errp);
1047
1048    if (!block->ivgen) {
1049        goto error;
1050    }
1051
1052
1053    /* Determine how many iterations we need to hash the master
1054     * key, in order to have 1 second of compute time used
1055     */
1056    iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
1057                                       masterkey, luks->header.key_bytes,
1058                                       luks->header.master_key_salt,
1059                                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
1060                                       QCRYPTO_BLOCK_LUKS_DIGEST_LEN,
1061                                       &local_err);
1062    if (local_err) {
1063        error_propagate(errp, local_err);
1064        goto error;
1065    }
1066
1067    if (iters > (ULLONG_MAX / luks_opts.iter_time)) {
1068        error_setg_errno(errp, ERANGE,
1069                         "PBKDF iterations %llu too large to scale",
1070                         (unsigned long long)iters);
1071        goto error;
1072    }
1073
1074    /* iter_time was in millis, but count_iters reported for secs */
1075    iters = iters * luks_opts.iter_time / 1000;
1076
1077    /* Why /= 8 ?  That matches cryptsetup, but there's no
1078     * explanation why they chose /= 8... Probably so that
1079     * if all 8 keyslots are active we only spend 1 second
1080     * in total time to check all keys */
1081    iters /= 8;
1082    if (iters > UINT32_MAX) {
1083        error_setg_errno(errp, ERANGE,
1084                         "PBKDF iterations %llu larger than %u",
1085                         (unsigned long long)iters, UINT32_MAX);
1086        goto error;
1087    }
1088    iters = MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS);
1089    luks->header.master_key_iterations = iters;
1090
1091    /* Hash the master key, saving the result in the LUKS
1092     * header. This hash is used when opening the encrypted
1093     * device to verify that the user password unlocked a
1094     * valid master key
1095     */
1096    if (qcrypto_pbkdf2(luks_opts.hash_alg,
1097                       masterkey, luks->header.key_bytes,
1098                       luks->header.master_key_salt,
1099                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
1100                       luks->header.master_key_iterations,
1101                       luks->header.master_key_digest,
1102                       QCRYPTO_BLOCK_LUKS_DIGEST_LEN,
1103                       errp) < 0) {
1104        goto error;
1105    }
1106
1107
1108    /* Although LUKS has multiple key slots, we're just going
1109     * to use the first key slot */
1110    splitkeylen = luks->header.key_bytes * QCRYPTO_BLOCK_LUKS_STRIPES;
1111    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
1112        luks->header.key_slots[i].active = i == 0 ?
1113            QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED :
1114            QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED;
1115        luks->header.key_slots[i].stripes = QCRYPTO_BLOCK_LUKS_STRIPES;
1116
1117        /* This calculation doesn't match that shown in the spec,
1118         * but instead follows the cryptsetup implementation.
1119         */
1120        luks->header.key_slots[i].key_offset =
1121            (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET /
1122             QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) +
1123            (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE),
1124                      (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET /
1125                       QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) * i);
1126    }
1127
1128    if (qcrypto_random_bytes(luks->header.key_slots[0].salt,
1129                             QCRYPTO_BLOCK_LUKS_SALT_LEN,
1130                             errp) < 0) {
1131        goto error;
1132    }
1133
1134    /* Again we determine how many iterations are required to
1135     * hash the user password while consuming 1 second of compute
1136     * time */
1137    iters = qcrypto_pbkdf2_count_iters(luks_opts.hash_alg,
1138                                       (uint8_t *)password, strlen(password),
1139                                       luks->header.key_slots[0].salt,
1140                                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
1141                                       luks->header.key_bytes,
1142                                       &local_err);
1143    if (local_err) {
1144        error_propagate(errp, local_err);
1145        goto error;
1146    }
1147
1148    if (iters > (ULLONG_MAX / luks_opts.iter_time)) {
1149        error_setg_errno(errp, ERANGE,
1150                         "PBKDF iterations %llu too large to scale",
1151                         (unsigned long long)iters);
1152        goto error;
1153    }
1154
1155    /* iter_time was in millis, but count_iters reported for secs */
1156    iters = iters * luks_opts.iter_time / 1000;
1157
1158    if (iters > UINT32_MAX) {
1159        error_setg_errno(errp, ERANGE,
1160                         "PBKDF iterations %llu larger than %u",
1161                         (unsigned long long)iters, UINT32_MAX);
1162        goto error;
1163    }
1164
1165    luks->header.key_slots[0].iterations =
1166        MAX(iters, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS);
1167
1168
1169    /* Generate a key that we'll use to encrypt the master
1170     * key, from the user's password
1171     */
1172    slotkey = g_new0(uint8_t, luks->header.key_bytes);
1173    if (qcrypto_pbkdf2(luks_opts.hash_alg,
1174                       (uint8_t *)password, strlen(password),
1175                       luks->header.key_slots[0].salt,
1176                       QCRYPTO_BLOCK_LUKS_SALT_LEN,
1177                       luks->header.key_slots[0].iterations,
1178                       slotkey, luks->header.key_bytes,
1179                       errp) < 0) {
1180        goto error;
1181    }
1182
1183
1184    /* Setup the encryption objects needed to encrypt the
1185     * master key material
1186     */
1187    cipher = qcrypto_cipher_new(luks_opts.cipher_alg,
1188                                luks_opts.cipher_mode,
1189                                slotkey, luks->header.key_bytes,
1190                                errp);
1191    if (!cipher) {
1192        goto error;
1193    }
1194
1195    ivgen = qcrypto_ivgen_new(luks_opts.ivgen_alg,
1196                              ivcipheralg,
1197                              luks_opts.ivgen_hash_alg,
1198                              slotkey, luks->header.key_bytes,
1199                              errp);
1200    if (!ivgen) {
1201        goto error;
1202    }
1203
1204    /* Before storing the master key, we need to vastly
1205     * increase its size, as protection against forensic
1206     * disk data recovery */
1207    splitkey = g_new0(uint8_t, splitkeylen);
1208
1209    if (qcrypto_afsplit_encode(luks_opts.hash_alg,
1210                               luks->header.key_bytes,
1211                               luks->header.key_slots[0].stripes,
1212                               masterkey,
1213                               splitkey,
1214                               errp) < 0) {
1215        goto error;
1216    }
1217
1218    /* Now we encrypt the split master key with the key generated
1219     * from the user's password, before storing it */
1220    if (qcrypto_block_cipher_encrypt_helper(cipher, block->niv, ivgen,
1221                                            QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
1222                                            0,
1223                                            splitkey,
1224                                            splitkeylen,
1225                                            errp) < 0) {
1226        goto error;
1227    }
1228
1229
1230    /* The total size of the LUKS headers is the partition header + key
1231     * slot headers, rounded up to the nearest sector, combined with
1232     * the size of each master key material region, also rounded up
1233     * to the nearest sector */
1234    luks->header.payload_offset =
1235        (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET /
1236         QCRYPTO_BLOCK_LUKS_SECTOR_SIZE) +
1237        (ROUND_UP(DIV_ROUND_UP(splitkeylen, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE),
1238                  (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET /
1239                   QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) *
1240         QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS);
1241
1242    block->sector_size = QCRYPTO_BLOCK_LUKS_SECTOR_SIZE;
1243    block->payload_offset = luks->header.payload_offset *
1244        block->sector_size;
1245
1246    /* Reserve header space to match payload offset */
1247    initfunc(block, block->payload_offset, opaque, &local_err);
1248    if (local_err) {
1249        error_propagate(errp, local_err);
1250        goto error;
1251    }
1252
1253    /* Everything on disk uses Big Endian, so flip header fields
1254     * before writing them */
1255    cpu_to_be16s(&luks->header.version);
1256    cpu_to_be32s(&luks->header.payload_offset);
1257    cpu_to_be32s(&luks->header.key_bytes);
1258    cpu_to_be32s(&luks->header.master_key_iterations);
1259
1260    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
1261        cpu_to_be32s(&luks->header.key_slots[i].active);
1262        cpu_to_be32s(&luks->header.key_slots[i].iterations);
1263        cpu_to_be32s(&luks->header.key_slots[i].key_offset);
1264        cpu_to_be32s(&luks->header.key_slots[i].stripes);
1265    }
1266
1267
1268    /* Write out the partition header and key slot headers */
1269    writefunc(block, 0,
1270              (const uint8_t *)&luks->header,
1271              sizeof(luks->header),
1272              opaque,
1273              &local_err);
1274
1275    /* Delay checking local_err until we've byte-swapped */
1276
1277    /* Byte swap the header back to native, in case we need
1278     * to read it again later */
1279    be16_to_cpus(&luks->header.version);
1280    be32_to_cpus(&luks->header.payload_offset);
1281    be32_to_cpus(&luks->header.key_bytes);
1282    be32_to_cpus(&luks->header.master_key_iterations);
1283
1284    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
1285        be32_to_cpus(&luks->header.key_slots[i].active);
1286        be32_to_cpus(&luks->header.key_slots[i].iterations);
1287        be32_to_cpus(&luks->header.key_slots[i].key_offset);
1288        be32_to_cpus(&luks->header.key_slots[i].stripes);
1289    }
1290
1291    if (local_err) {
1292        error_propagate(errp, local_err);
1293        goto error;
1294    }
1295
1296    /* Write out the master key material, starting at the
1297     * sector immediately following the partition header. */
1298    if (writefunc(block,
1299                  luks->header.key_slots[0].key_offset *
1300                  QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
1301                  splitkey, splitkeylen,
1302                  opaque,
1303                  errp) != splitkeylen) {
1304        goto error;
1305    }
1306
1307    luks->cipher_alg = luks_opts.cipher_alg;
1308    luks->cipher_mode = luks_opts.cipher_mode;
1309    luks->ivgen_alg = luks_opts.ivgen_alg;
1310    luks->ivgen_hash_alg = luks_opts.ivgen_hash_alg;
1311    luks->hash_alg = luks_opts.hash_alg;
1312
1313    memset(masterkey, 0, luks->header.key_bytes);
1314    g_free(masterkey);
1315    memset(slotkey, 0, luks->header.key_bytes);
1316    g_free(slotkey);
1317    g_free(splitkey);
1318    g_free(password);
1319    g_free(cipher_mode_spec);
1320
1321    qcrypto_ivgen_free(ivgen);
1322    qcrypto_cipher_free(cipher);
1323
1324    return 0;
1325
1326 error:
1327    if (masterkey) {
1328        memset(masterkey, 0, luks->header.key_bytes);
1329    }
1330    g_free(masterkey);
1331    if (slotkey) {
1332        memset(slotkey, 0, luks->header.key_bytes);
1333    }
1334    g_free(slotkey);
1335    g_free(splitkey);
1336    g_free(password);
1337    g_free(cipher_mode_spec);
1338
1339    qcrypto_ivgen_free(ivgen);
1340    qcrypto_cipher_free(cipher);
1341
1342    qcrypto_block_free_cipher(block);
1343    qcrypto_ivgen_free(block->ivgen);
1344
1345    g_free(luks);
1346    return -1;
1347}
1348
1349
1350static int qcrypto_block_luks_get_info(QCryptoBlock *block,
1351                                       QCryptoBlockInfo *info,
1352                                       Error **errp)
1353{
1354    QCryptoBlockLUKS *luks = block->opaque;
1355    QCryptoBlockInfoLUKSSlot *slot;
1356    QCryptoBlockInfoLUKSSlotList *slots = NULL, **prev = &info->u.luks.slots;
1357    size_t i;
1358
1359    info->u.luks.cipher_alg = luks->cipher_alg;
1360    info->u.luks.cipher_mode = luks->cipher_mode;
1361    info->u.luks.ivgen_alg = luks->ivgen_alg;
1362    if (info->u.luks.ivgen_alg == QCRYPTO_IVGEN_ALG_ESSIV) {
1363        info->u.luks.has_ivgen_hash_alg = true;
1364        info->u.luks.ivgen_hash_alg = luks->ivgen_hash_alg;
1365    }
1366    info->u.luks.hash_alg = luks->hash_alg;
1367    info->u.luks.payload_offset = block->payload_offset;
1368    info->u.luks.master_key_iters = luks->header.master_key_iterations;
1369    info->u.luks.uuid = g_strndup((const char *)luks->header.uuid,
1370                                  sizeof(luks->header.uuid));
1371
1372    for (i = 0; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS; i++) {
1373        slots = g_new0(QCryptoBlockInfoLUKSSlotList, 1);
1374        *prev = slots;
1375
1376        slots->value = slot = g_new0(QCryptoBlockInfoLUKSSlot, 1);
1377        slot->active = luks->header.key_slots[i].active ==
1378            QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED;
1379        slot->key_offset = luks->header.key_slots[i].key_offset
1380             * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE;
1381        if (slot->active) {
1382            slot->has_iters = true;
1383            slot->iters = luks->header.key_slots[i].iterations;
1384            slot->has_stripes = true;
1385            slot->stripes = luks->header.key_slots[i].stripes;
1386        }
1387
1388        prev = &slots->next;
1389    }
1390
1391    return 0;
1392}
1393
1394
1395static void qcrypto_block_luks_cleanup(QCryptoBlock *block)
1396{
1397    g_free(block->opaque);
1398}
1399
1400
1401static int
1402qcrypto_block_luks_decrypt(QCryptoBlock *block,
1403                           uint64_t offset,
1404                           uint8_t *buf,
1405                           size_t len,
1406                           Error **errp)
1407{
1408    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));
1409    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));
1410    return qcrypto_block_decrypt_helper(block,
1411                                        QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
1412                                        offset, buf, len, errp);
1413}
1414
1415
1416static int
1417qcrypto_block_luks_encrypt(QCryptoBlock *block,
1418                           uint64_t offset,
1419                           uint8_t *buf,
1420                           size_t len,
1421                           Error **errp)
1422{
1423    assert(QEMU_IS_ALIGNED(offset, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));
1424    assert(QEMU_IS_ALIGNED(len, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE));
1425    return qcrypto_block_encrypt_helper(block,
1426                                        QCRYPTO_BLOCK_LUKS_SECTOR_SIZE,
1427                                        offset, buf, len, errp);
1428}
1429
1430
1431const QCryptoBlockDriver qcrypto_block_driver_luks = {
1432    .open = qcrypto_block_luks_open,
1433    .create = qcrypto_block_luks_create,
1434    .get_info = qcrypto_block_luks_get_info,
1435    .cleanup = qcrypto_block_luks_cleanup,
1436    .decrypt = qcrypto_block_luks_decrypt,
1437    .encrypt = qcrypto_block_luks_encrypt,
1438    .has_format = qcrypto_block_luks_has_format,
1439};
1440