Georg/luksrku
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Refactoring of version code

Browse Source 
We want to introduce a new feature (volumes with discard support) which
will cause file incompatibility.  This means we need to prepare data
migration code. This prepares that change.
This commit is contained in:
Johannes Bauer 2021-06-26 23:27:57 +02:00
parent bd929be9fa
commit b0909557ad
8 changed files with 123 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -6,7 +6,7 @@ INSTALL_PREFIX := /usr/local/
CFLAGS := -Wall -Wextra -Wshadow -Wswitch -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Werror=implicit-function-declaration -Werror=format -Wno-unused-parameter CFLAGS := -Wall -Wextra -Wshadow -Wswitch -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Werror=implicit-function-declaration -Werror=format -Wno-unused-parameter
CFLAGS += -O3 -std=c11 -pthread -D_POSIX_SOURCE -D_POSIX_C_SOURCE=200112L -D_XOPEN_SOURCE=500 -DBUILD_REVISION='"$(BUILD_REVISION)"' CFLAGS += -O3 -std=c11 -pthread -D_POSIX_SOURCE -D_POSIX_C_SOURCE=200112L -D_XOPEN_SOURCE=500 -DBUILD_REVISION='"$(BUILD_REVISION)"'
CFLAGS += `pkg-config --cflags openssl` CFLAGS += `pkg-config --cflags openssl`
CFLAGS += -ggdb3 -DDEBUG -fsanitize=address -fsanitize=undefined -fsanitize=leak #CFLAGS += -ggdb3 -DDEBUG -fsanitize=address -fsanitize=undefined -fsanitize=leak
PYPGMOPTS := ../Python/pypgmopts/pypgmopts PYPGMOPTS := ../Python/pypgmopts/pypgmopts
LDFLAGS := `pkg-config --libs openssl` LDFLAGS := `pkg-config --libs openssl`

10
client.c
View File

@ -47,7 +47,7 @@
struct keyclient_t { struct keyclient_t {
const struct pgmopts_client_t *opts; const struct pgmopts_client_t *opts;
struct keydb_t *keydb; keydb_t *keydb;
bool volume_unlocked[MAX_VOLUMES_PER_HOST]; bool volume_unlocked[MAX_VOLUMES_PER_HOST];
unsigned char identifier[ASCII_UUID_BUFSIZE]; unsigned char identifier[ASCII_UUID_BUFSIZE];
double broadcast_start_time; double broadcast_start_time;
@ -61,7 +61,7 @@ static int psk_client_callback(SSL *ssl, const EVP_MD *md, const unsigned char *
return openssl_tls13_psk_establish_session(ssl, key_client->keydb->hosts[0].tls_psk, PSK_SIZE_BYTES, EVP_sha256(), sessptr); return openssl_tls13_psk_establish_session(ssl, key_client->keydb->hosts[0].tls_psk, PSK_SIZE_BYTES, EVP_sha256(), sessptr);
} }
static bool unlock_luks_volume(const struct volume_entry_t *volume, const struct msg_t *unlock_msg) { static bool unlock_luks_volume(const volume_entry_t *volume, const struct msg_t *unlock_msg) {
bool success = true; bool success = true;
char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES]; char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES];
if (ascii_encode(luks_passphrase, sizeof(luks_passphrase), unlock_msg->luks_passphrase_raw, sizeof(unlock_msg->luks_passphrase_raw))) { if (ascii_encode(luks_passphrase, sizeof(luks_passphrase), unlock_msg->luks_passphrase_raw, sizeof(unlock_msg->luks_passphrase_raw))) {
@ -75,8 +75,8 @@ static bool unlock_luks_volume(const struct volume_entry_t *volume, const struct
} }
static bool attempt_unlock_luks_volume(struct keyclient_t *keyclient, const struct msg_t *unlock_msg) { static bool attempt_unlock_luks_volume(struct keyclient_t *keyclient, const struct msg_t *unlock_msg) {
const struct host_entry_t *host = &keyclient->keydb->hosts[0]; const host_entry_t *host = &keyclient->keydb->hosts[0];
const struct volume_entry_t* volume = keydb_get_volume_by_uuid(host, unlock_msg->volume_uuid); const volume_entry_t* volume = keydb_get_volume_by_uuid(host, unlock_msg->volume_uuid);
char volume_uuid_str[ASCII_UUID_BUFSIZE]; char volume_uuid_str[ASCII_UUID_BUFSIZE];
sprintf_uuid(volume_uuid_str, unlock_msg->volume_uuid); sprintf_uuid(volume_uuid_str, unlock_msg->volume_uuid);
if (!volume) { if (!volume) {
@ -307,7 +307,7 @@ bool keyclient_start(const struct pgmopts_client_t *opts) {
break; break;
} }
struct host_entry_t *host = &keyclient.keydb->hosts[0]; host_entry_t *host = &keyclient.keydb->hosts[0];
if (host->volume_count == 0) { if (host->volume_count == 0) {
log_msg(LLVL_FATAL, "No volumes found in exported database %s.", opts->filename); log_msg(LLVL_FATAL, "No volumes found in exported database %s.", opts->filename);
success = false; success = false;

42
editor.c
View File

@ -45,7 +45,7 @@ enum cmd_returncode_t {
struct editor_context_t { struct editor_context_t {
bool running; bool running;
struct keydb_t *keydb; keydb_t *keydb;
char filename[MAX_FILENAME_LENGTH]; char filename[MAX_FILENAME_LENGTH];
char passphrase[MAX_PASSPHRASE_LENGTH]; char passphrase[MAX_PASSPHRASE_LENGTH];
}; };
@ -227,14 +227,14 @@ static enum cmd_returncode_t cmd_list(struct editor_context_t *ctx, const char *
printf("No key database loaded.\n"); printf("No key database loaded.\n");
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
printf("Keydb version %d, %s database, %d hosts.\n", ctx->keydb->keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count); printf("Keydb version %d, %s database, %d hosts.\n", ctx->keydb->common.keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
for (unsigned int i = 0; i < ctx->keydb->host_count; i++) { for (unsigned int i = 0; i < ctx->keydb->host_count; i++) {
const struct host_entry_t *host = &ctx->keydb->hosts[i]; const host_entry_t *host = &ctx->keydb->hosts[i];
char uuid[48]; char uuid[48];
sprintf_uuid(uuid, host->host_uuid); sprintf_uuid(uuid, host->host_uuid);
printf(" Host %d: \"%s\" UUID %s -- %d volumes:\n", i + 1, host->host_name, uuid, host->volume_count); printf(" Host %d: \"%s\" UUID %s -- %d volumes:\n", i + 1, host->host_name, uuid, host->volume_count);
for (unsigned int j = 0; j < host->volume_count; j++) { for (unsigned int j = 0; j < host->volume_count; j++) {
const struct volume_entry_t *volume = &host->volumes[j]; const volume_entry_t *volume = &host->volumes[j];
sprintf_uuid(uuid, volume->volume_uuid); sprintf_uuid(uuid, volume->volume_uuid);
printf(" Volume %d: \"%s\" UUID %s\n", j + 1, volume->devmapper_name, uuid); printf(" Volume %d: \"%s\" UUID %s\n", j + 1, volume->devmapper_name, uuid);
} }
@ -265,12 +265,12 @@ static enum cmd_returncode_t cmd_del_host(struct editor_context_t *ctx, const ch
return success ? COMMAND_SUCCESS : COMMAND_FAILURE; return success ? COMMAND_SUCCESS : COMMAND_FAILURE;
} }
static struct host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char *host_name) { static host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char *host_name) {
if (!ctx->keydb) { if (!ctx->keydb) {
fprintf(stderr, "No key database loaded.\n"); fprintf(stderr, "No key database loaded.\n");
return NULL; return NULL;
} }
struct host_entry_t *host = keydb_get_host_by_name(ctx->keydb, host_name); host_entry_t *host = keydb_get_host_by_name(ctx->keydb, host_name);
if (!host) { if (!host) {
fprintf(stderr, "No such host: %s\n", host_name); fprintf(stderr, "No such host: %s\n", host_name);
return NULL; return NULL;
@ -278,13 +278,13 @@ static struct host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char
return host; return host;
} }
static struct volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const char *host_name, const char *devmapper_name) { static volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const char *host_name, const char *devmapper_name) {
struct host_entry_t *host = cmd_gethost(ctx, host_name); host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) { if (!host) {
return NULL; return NULL;
} }
struct volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name); volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
if (!volume) { if (!volume) {
fprintf(stderr, "No such volume \"%s\" for host \"%s\"\n", devmapper_name, host_name); fprintf(stderr, "No such volume \"%s\" for host \"%s\"\n", devmapper_name, host_name);
return NULL; return NULL;
@ -294,11 +294,11 @@ static struct volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const
static enum cmd_returncode_t cmd_rekey_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) { static enum cmd_returncode_t cmd_rekey_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0]; const char *host_name = params[0];
struct host_entry_t *host = cmd_gethost(ctx, host_name); host_entry_t *host = cmd_gethost(ctx, host_name);
return host && keydb_rekey_host(host) ? COMMAND_SUCCESS : COMMAND_FAILURE; return host && keydb_rekey_host(host) ? COMMAND_SUCCESS : COMMAND_FAILURE;
} }
static enum cmd_returncode_t cmd_do_showkey_volume(struct volume_entry_t *volume) { static enum cmd_returncode_t cmd_do_showkey_volume(volume_entry_t *volume) {
char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES]; char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES];
if (!keydb_get_volume_luks_passphrase(volume, luks_passphrase, sizeof(luks_passphrase))) { if (!keydb_get_volume_luks_passphrase(volume, luks_passphrase, sizeof(luks_passphrase))) {
OPENSSL_cleanse(luks_passphrase, sizeof(luks_passphrase)); OPENSSL_cleanse(luks_passphrase, sizeof(luks_passphrase));
@ -315,7 +315,7 @@ static enum cmd_returncode_t cmd_do_showkey_volume(struct volume_entry_t *volume
static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) { static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0]; const char *host_name = params[0];
struct host_entry_t *host = cmd_gethost(ctx, host_name); host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) { if (!host) {
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
@ -328,7 +328,7 @@ static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const
} }
uint8_t volume_uuid[16]; uint8_t volume_uuid[16];
parse_uuid(volume_uuid, volume_uuid_str); parse_uuid(volume_uuid, volume_uuid_str);
struct volume_entry_t *volume = keydb_add_volume(host, devmapper_name, volume_uuid); volume_entry_t *volume = keydb_add_volume(host, devmapper_name, volume_uuid);
if (volume) { if (volume) {
return cmd_do_showkey_volume(volume); return cmd_do_showkey_volume(volume);
} else { } else {
@ -340,7 +340,7 @@ static enum cmd_returncode_t cmd_del_volume(struct editor_context_t *ctx, const
const char *host_name = params[0]; const char *host_name = params[0];
const char *devmapper_name = params[1]; const char *devmapper_name = params[1];
struct host_entry_t *host = cmd_gethost(ctx, host_name); host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) { if (!host) {
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
@ -354,7 +354,7 @@ static enum cmd_returncode_t cmd_rekey_volume(struct editor_context_t *ctx, cons
const char *host_name = params[0]; const char *host_name = params[0];
const char *devmapper_name = params[1]; const char *devmapper_name = params[1];
struct volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name); volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
if (!volume) { if (!volume) {
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
@ -368,7 +368,7 @@ static enum cmd_returncode_t cmd_showkey_volume(struct editor_context_t *ctx, co
const char *host_name = params[0]; const char *host_name = params[0];
const char *devmapper_name = params[1]; const char *devmapper_name = params[1];
struct volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name); volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
if (!volume) { if (!volume) {
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
@ -417,12 +417,12 @@ static enum cmd_returncode_t cmd_save(struct editor_context_t *ctx, const char *
static enum cmd_returncode_t cmd_export(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) { static enum cmd_returncode_t cmd_export(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0]; const char *host_name = params[0];
const char *filename = params[1]; const char *filename = params[1];
struct host_entry_t *host = cmd_gethost(ctx, host_name); host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) { if (!host) {
return COMMAND_FAILURE; return COMMAND_FAILURE;
} }
struct keydb_t *pubdb = keydb_export_public(host); keydb_t *pubdb = keydb_export_public(host);
char passphrase[MAX_PASSPHRASE_LENGTH]; char passphrase[MAX_PASSPHRASE_LENGTH];
if (!query_passphrase("Client passphrase: ", passphrase, sizeof(passphrase))) { if (!query_passphrase("Client passphrase: ", passphrase, sizeof(passphrase))) {
fprintf(stderr, "Failed to read export passphrase.\n"); fprintf(stderr, "Failed to read export passphrase.\n");
@ -473,7 +473,7 @@ static enum cmd_returncode_t cmd_rawdump(struct editor_context_t *ctx, const cha
} }
fprintf(stderr, "Version %d, %s, %d hosts.\n", ctx->keydb->keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count); fprintf(stderr, "Version %d, %s, %d hosts.\n", ctx->keydb->keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
for (unsigned int i = 0; i < ctx->keydb->host_count; i++) { for (unsigned int i = 0; i < ctx->keydb->host_count; i++) {
struct host_entry_t *host = &ctx->keydb->hosts[i]; host_entry_t *host = &ctx->keydb->hosts[i];
fprintf(stderr, "Host %d:\n", i); fprintf(stderr, "Host %d:\n", i);
{ {
char host_uuid[ASCII_UUID_BUFSIZE]; char host_uuid[ASCII_UUID_BUFSIZE];
@ -488,8 +488,8 @@ static enum cmd_returncode_t cmd_rawdump(struct editor_context_t *ctx, const cha
dump_hexline(stderr, " tls_psk ", host->tls_psk, sizeof(host->tls_psk), false); dump_hexline(stderr, " tls_psk ", host->tls_psk, sizeof(host->tls_psk), false);
fprintf(stderr, " volume_count %u\n", host->volume_count); fprintf(stderr, " volume_count %u\n", host->volume_count);
for (unsigned int j = 0; j < MAX_VOLUMES_PER_HOST; j++) { for (unsigned int j = 0; j < MAX_VOLUMES_PER_HOST; j++) {
struct volume_entry_t *volume = &host->volumes[j]; volume_entry_t *volume = &host->volumes[j];
if (!is_zero(volume, sizeof(struct volume_entry_t))) { if (!is_zero(volume, sizeof(volume_entry_t))) {
fprintf(stderr, " Host %d / Volume %d:\n", i, j); fprintf(stderr, " Host %d / Volume %d:\n", i, j);
dump_hexline(stderr, " volume_uuid ", volume->volume_uuid, sizeof(volume->volume_uuid), false); dump_hexline(stderr, " volume_uuid ", volume->volume_uuid, sizeof(volume->volume_uuid), false);
dump_hexline(stderr, " devmapper_name ", volume->devmapper_name, sizeof(volume->devmapper_name), true); dump_hexline(stderr, " devmapper_name ", volume->devmapper_name, sizeof(volume->devmapper_name), true);

84
keydb.c
View File

@ -34,22 +34,22 @@
#include "log.h" #include "log.h"
static unsigned int keydb_getsize_hostcount(unsigned int host_count) { static unsigned int keydb_getsize_hostcount(unsigned int host_count) {
return sizeof(struct keydb_t) + (host_count * sizeof(struct host_entry_t)); return sizeof(keydb_t) + (host_count * sizeof(host_entry_t));
} }
static unsigned int keydb_getsize(const struct keydb_t *keydb) { static unsigned int keydb_getsize(const keydb_t *keydb) {
return keydb_getsize_hostcount(keydb->host_count); return keydb_getsize_hostcount(keydb->host_count);
} }
struct keydb_t* keydb_new(void) { keydb_t* keydb_new(void) {
struct keydb_t *keydb = calloc(sizeof(struct keydb_t), 1); keydb_t *keydb = calloc(sizeof(keydb_t), 1);
keydb->keydb_version = KEYDB_VERSION; keydb->common.keydb_version = KEYDB_CURRENT_VERSION;
keydb->server_database = true; keydb->server_database = true;
return keydb; return keydb;
} }
struct keydb_t* keydb_export_public(struct host_entry_t *host) { keydb_t* keydb_export_public(host_entry_t *host) {
struct keydb_t *public_db = keydb_new(); keydb_t *public_db = keydb_new();
if (!public_db) { if (!public_db) {
return NULL; return NULL;
} }
@ -61,28 +61,28 @@ struct keydb_t* keydb_export_public(struct host_entry_t *host) {
} }
/* Copy over whole entry */ /* Copy over whole entry */
struct host_entry_t *public_host = &public_db->hosts[0]; host_entry_t *public_host = &public_db->hosts[0];
*public_host = *host; *public_host = *host;
/* But remove all LUKS passphrases of course, this is for the luksrku client */ /* But remove all LUKS passphrases of course, this is for the luksrku client */
for (unsigned int i = 0; i < host->volume_count; i++) { for (unsigned int i = 0; i < host->volume_count; i++) {
struct volume_entry_t *volume = &public_host->volumes[i]; volume_entry_t *volume = &public_host->volumes[i];
memset(volume->luks_passphrase_raw, 0, sizeof(volume->luks_passphrase_raw)); memset(volume->luks_passphrase_raw, 0, sizeof(volume->luks_passphrase_raw));
} }
return public_db; return public_db;
} }
void keydb_free(struct keydb_t *keydb) { void keydb_free(keydb_t *keydb) {
if (keydb) { if (keydb) {
OPENSSL_cleanse(keydb, keydb_getsize(keydb)); OPENSSL_cleanse(keydb, keydb_getsize(keydb));
free(keydb); free(keydb);
} }
} }
struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name) { volume_entry_t* keydb_get_volume_by_name(host_entry_t *host, const char *devmapper_name) {
for (unsigned int i = 0; i < host->volume_count; i++) { for (unsigned int i = 0; i < host->volume_count; i++) {
struct volume_entry_t *volume = &host->volumes[i]; volume_entry_t *volume = &host->volumes[i];
if (!strncasecmp(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1)) { if (!strncasecmp(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1)) {
return volume; return volume;
} }
@ -90,9 +90,9 @@ struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const
return NULL; return NULL;
} }
struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name) { host_entry_t* keydb_get_host_by_name(keydb_t *keydb, const char *host_name) {
for (unsigned int i = 0; i < keydb->host_count; i++) { for (unsigned int i = 0; i < keydb->host_count; i++) {
struct host_entry_t *host = &keydb->hosts[i]; host_entry_t *host = &keydb->hosts[i];
if (!strncasecmp(host->host_name, host_name, sizeof(host->host_name) - 1)) { if (!strncasecmp(host->host_name, host_name, sizeof(host->host_name) - 1)) {
return host; return host;
} }
@ -100,9 +100,9 @@ struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *h
return NULL; return NULL;
} }
const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]) { const volume_entry_t* keydb_get_volume_by_uuid(const host_entry_t *host, const uint8_t uuid[static 16]) {
for (unsigned int i = 0; i < host->volume_count; i++) { for (unsigned int i = 0; i < host->volume_count; i++) {
const struct volume_entry_t *volume = &host->volumes[i]; const volume_entry_t *volume = &host->volumes[i];
if (!memcmp(volume->volume_uuid, uuid, 16)) { if (!memcmp(volume->volume_uuid, uuid, 16)) {
return volume; return volume;
} }
@ -110,7 +110,7 @@ const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t
return NULL; return NULL;
} }
int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host) { int keydb_get_host_index(const keydb_t *keydb, const host_entry_t *host) {
int index = host - keydb->hosts; int index = host - keydb->hosts;
if (index < 0) { if (index < 0) {
return -1; return -1;
@ -120,7 +120,7 @@ int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t
return index; return index;
} }
int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume) { int keydb_get_volume_index(const host_entry_t *host, const volume_entry_t *volume) {
int index = volume - host->volumes; int index = volume - host->volumes;
if (index < 0) { if (index < 0) {
return -1; return -1;
@ -130,9 +130,9 @@ int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_
return index; return index;
} }
const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]) { const host_entry_t* keydb_get_host_by_uuid(const keydb_t *keydb, const uint8_t uuid[static 16]) {
for (unsigned int i = 0; i < keydb->host_count; i++) { for (unsigned int i = 0; i < keydb->host_count; i++) {
const struct host_entry_t *host = &keydb->hosts[i]; const host_entry_t *host = &keydb->hosts[i];
if (!memcmp(host->host_uuid, uuid, 16)) { if (!memcmp(host->host_uuid, uuid, 16)) {
return host; return host;
} }
@ -140,26 +140,26 @@ const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, c
return NULL; return NULL;
} }
bool keydb_add_host(struct keydb_t **keydb, const char *host_name) { bool keydb_add_host(keydb_t **keydb, const char *host_name) {
if (strlen(host_name) > MAX_HOST_NAME_LENGTH - 1) { if (strlen(host_name) > MAX_HOST_NAME_LENGTH - 1) {
log_msg(LLVL_ERROR, "Host name \"%s\" exceeds maximum length of %d characters.", host_name, MAX_HOST_NAME_LENGTH - 1); log_msg(LLVL_ERROR, "Host name \"%s\" exceeds maximum length of %d characters.", host_name, MAX_HOST_NAME_LENGTH - 1);
return false; return false;
} }
struct keydb_t *old_keydb = *keydb; keydb_t *old_keydb = *keydb;
if (keydb_get_host_by_name(old_keydb, host_name)) { if (keydb_get_host_by_name(old_keydb, host_name)) {
log_msg(LLVL_ERROR, "Host name \"%s\" already present in key database.", host_name); log_msg(LLVL_ERROR, "Host name \"%s\" already present in key database.", host_name);
return false; return false;
} }
struct keydb_t *new_keydb = realloc(old_keydb, keydb_getsize_hostcount(old_keydb->host_count + 1)); keydb_t *new_keydb = realloc(old_keydb, keydb_getsize_hostcount(old_keydb->host_count + 1));
if (!new_keydb) { if (!new_keydb) {
return false; return false;
} }
*keydb = new_keydb; *keydb = new_keydb;
struct host_entry_t *host = &new_keydb->hosts[new_keydb->host_count]; host_entry_t *host = &new_keydb->hosts[new_keydb->host_count];
memset(host, 0, sizeof(struct host_entry_t)); memset(host, 0, sizeof(host_entry_t));
if (!uuid_randomize(host->host_uuid)) { if (!uuid_randomize(host->host_uuid)) {
/* We keep the reallocation but do not increase the host count */ /* We keep the reallocation but do not increase the host count */
return false; return false;
@ -174,9 +174,9 @@ bool keydb_add_host(struct keydb_t **keydb, const char *host_name) {
return true; return true;
} }
bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name) { bool keydb_del_host_by_name(keydb_t **keydb, const char *host_name) {
struct keydb_t *old_keydb = *keydb; keydb_t *old_keydb = *keydb;
struct host_entry_t *host = keydb_get_host_by_name(old_keydb, host_name); host_entry_t *host = keydb_get_host_by_name(old_keydb, host_name);
if (!host) { if (!host) {
log_msg(LLVL_ERROR, "No such host: \"%s\"", host_name); log_msg(LLVL_ERROR, "No such host: \"%s\"", host_name);
return false; return false;
@ -189,16 +189,16 @@ bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name) {
} }
/* We keep the memory for now and do not realloc */ /* We keep the memory for now and do not realloc */
array_remove(old_keydb->hosts, sizeof(struct host_entry_t), old_keydb->host_count, host_index); array_remove(old_keydb->hosts, sizeof(host_entry_t), old_keydb->host_count, host_index);
old_keydb->host_count--; old_keydb->host_count--;
return true; return true;
} }
bool keydb_rekey_host(struct host_entry_t *host) { bool keydb_rekey_host(host_entry_t *host) {
return buffer_randomize(host->tls_psk, sizeof(host->tls_psk)); return buffer_randomize(host->tls_psk, sizeof(host->tls_psk));
} }
struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]) { volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]) {
if (strlen(devmapper_name) > MAX_DEVMAPPER_NAME_LENGTH - 1) { if (strlen(devmapper_name) > MAX_DEVMAPPER_NAME_LENGTH - 1) {
log_msg(LLVL_ERROR, "Device mapper name \"%s\" exceeds maximum length of %d characters.", devmapper_name, MAX_DEVMAPPER_NAME_LENGTH - 1); log_msg(LLVL_ERROR, "Device mapper name \"%s\" exceeds maximum length of %d characters.", devmapper_name, MAX_DEVMAPPER_NAME_LENGTH - 1);
return false; return false;
@ -213,7 +213,7 @@ struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *d
return NULL; return NULL;
} }
struct volume_entry_t *volume = &host->volumes[host->volume_count]; volume_entry_t *volume = &host->volumes[host->volume_count];
memcpy(volume->volume_uuid, volume_uuid, 16); memcpy(volume->volume_uuid, volume_uuid, 16);
strncpy(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1); strncpy(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1);
if (!buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw))) { if (!buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw))) {
@ -224,8 +224,8 @@ struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *d
return volume; return volume;
} }
bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name) { bool keydb_del_volume(host_entry_t *host, const char *devmapper_name) {
struct volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name); volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
if (!volume) { if (!volume) {
log_msg(LLVL_ERROR, "No such volume \"%s\" for host \"%s\".", devmapper_name, host->host_name); log_msg(LLVL_ERROR, "No such volume \"%s\" for host \"%s\".", devmapper_name, host->host_name);
return false; return false;
@ -235,7 +235,7 @@ bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name) {
log_msg(LLVL_FATAL, "Fatal error determining volume index of \"%s\" for host \"%s\".", devmapper_name, host->host_name); log_msg(LLVL_FATAL, "Fatal error determining volume index of \"%s\" for host \"%s\".", devmapper_name, host->host_name);
return false; return false;
} }
if (!array_remove(host->volumes, sizeof(struct volume_entry_t), host->volume_count, index)) { if (!array_remove(host->volumes, sizeof(volume_entry_t), host->volume_count, index)) {
log_msg(LLVL_ERROR, "Failed to remove \"%s\" of host \"%s\".", devmapper_name, host->host_name); log_msg(LLVL_ERROR, "Failed to remove \"%s\" of host \"%s\".", devmapper_name, host->host_name);
return false; return false;
} }
@ -243,15 +243,15 @@ bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name) {
return true; return true;
} }
bool keydb_rekey_volume(struct volume_entry_t *volume) { bool keydb_rekey_volume(volume_entry_t *volume) {
return buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw)); return buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw));
} }
bool keydb_get_volume_luks_passphrase(const struct volume_entry_t *volume, char *dest, unsigned int dest_buffer_size) { bool keydb_get_volume_luks_passphrase(const volume_entry_t *volume, char *dest, unsigned int dest_buffer_size) {
return ascii_encode(dest, dest_buffer_size, volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw)); return ascii_encode(dest, dest_buffer_size, volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw));
} }
bool keydb_write(const struct keydb_t *keydb, const char *filename, const char *passphrase) { bool keydb_write(const keydb_t *keydb, const char *filename, const char *passphrase) {
enum kdf_t kdf; enum kdf_t kdf;
if ((!passphrase) || (strlen(passphrase) == 0)) { if ((!passphrase) || (strlen(passphrase) == 0)) {
/* For empty password, we can also use garbage KDF */ /* For empty password, we can also use garbage KDF */
@ -266,15 +266,15 @@ static bool passphrase_callback(char *buffer, unsigned int bufsize) {
return query_passphrase("Database passphrase: ", buffer, bufsize); return query_passphrase("Database passphrase: ", buffer, bufsize);
} }
struct keydb_t* keydb_read(const char *filename) { keydb_t* keydb_read(const char *filename) {
struct decrypted_file_t decrypted_file = read_encrypted_file(filename, passphrase_callback); struct decrypted_file_t decrypted_file = read_encrypted_file(filename, passphrase_callback);
if (!decrypted_file.success) { if (!decrypted_file.success) {
return NULL; return NULL;
} }
struct keydb_t *keydb = (struct keydb_t*)decrypted_file.data; keydb_t *keydb = (keydb_t*)decrypted_file.data;
if (keydb->keydb_version != KEYDB_VERSION) { if (keydb->common.keydb_version != KEYDB_CURRENT_VERSION) {
log_msg(LLVL_ERROR, "keydb in %s could be read, but is of version %u (we expected %u).", filename, keydb->keydb_version, KEYDB_VERSION); log_msg(LLVL_ERROR, "keydb in %s could be read, but is of version %u (we expected %u).", filename, keydb->common.keydb_version, KEYDB_CURRENT_VERSION);
OPENSSL_cleanse(decrypted_file.data, decrypted_file.data_length); OPENSSL_cleanse(decrypted_file.data, decrypted_file.data_length);
free(decrypted_file.data); free(decrypted_file.data);
return NULL; return NULL;

64
keydb.h
View File

@ -30,48 +30,62 @@
#include "file_encryption.h" #include "file_encryption.h"
#include "global.h" #include "global.h"
#define KEYDB_VERSION 2 #define KEYDB_CURRENT_VERSION 2
struct volume_entry_t { enum volume_flag_t {
VOLUME_FLAG_ALLOW_DISCARD = (1 << 0),
};
struct keydb_common_header_t {
unsigned int keydb_version;
};
struct volume_entry_v2_t {
uint8_t volume_uuid[16]; /* UUID of crypt_LUKS volume */ uint8_t volume_uuid[16]; /* UUID of crypt_LUKS volume */
char devmapper_name[MAX_DEVMAPPER_NAME_LENGTH]; /* dmsetup name when unlocked. Zero-terminated string. */ char devmapper_name[MAX_DEVMAPPER_NAME_LENGTH]; /* dmsetup name when unlocked. Zero-terminated string. */
uint8_t luks_passphrase_raw[LUKS_PASSPHRASE_RAW_SIZE_BYTES]; /* LUKS passphrase used to unlock volume; raw byte data */ uint8_t luks_passphrase_raw[LUKS_PASSPHRASE_RAW_SIZE_BYTES]; /* LUKS passphrase used to unlock volume; raw byte data */
}; };
struct host_entry_t { struct host_entry_v2_t {
uint8_t host_uuid[16]; /* Host UUID */ uint8_t host_uuid[16]; /* Host UUID */
char host_name[MAX_HOST_NAME_LENGTH]; /* Descriptive name of host */ char host_name[MAX_HOST_NAME_LENGTH]; /* Descriptive name of host */
uint8_t tls_psk[PSK_SIZE_BYTES]; /* Raw byte data of TLS-PSK that is used */ uint8_t tls_psk[PSK_SIZE_BYTES]; /* Raw byte data of TLS-PSK that is used */
unsigned int volume_count; /* Number of volumes of this host */ unsigned int volume_count; /* Number of volumes of this host */
struct volume_entry_t volumes[MAX_VOLUMES_PER_HOST]; /* Volumes of this host */ struct volume_entry_v2_t volumes[MAX_VOLUMES_PER_HOST]; /* Volumes of this host */
}; };
struct keydb_t { struct keydb_v2_t {
unsigned int keydb_version; struct keydb_common_header_t common;
bool server_database; bool server_database;
unsigned int host_count; unsigned int host_count;
struct host_entry_t hosts[]; struct host_entry_v2_t hosts[];
}; };
typedef struct volume_entry_v2_t volume_entry_t;
typedef struct host_entry_v2_t host_entry_t;
typedef struct keydb_v2_t keydb_t;
/*************** AUTO GENERATED SECTION FOLLOWS ***************/ /*************** AUTO GENERATED SECTION FOLLOWS ***************/
struct keydb_t* keydb_new(void); keydb_t* keydb_new(void);
struct keydb_t* keydb_export_public(struct host_entry_t *host); keydb_t* keydb_export_public(host_entry_t *host);
void keydb_free(struct keydb_t *keydb); void keydb_free(keydb_t *keydb);
struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name); volume_entry_t* keydb_get_volume_by_name(host_entry_t *host, const char *devmapper_name);
struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name); host_entry_t* keydb_get_host_by_name(keydb_t *keydb, const char *host_name);
const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]); const volume_entry_t* keydb_get_volume_by_uuid(const host_entry_t *host, const uint8_t uuid[static 16]);
int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host); int keydb_get_host_index(const keydb_t *keydb, const host_entry_t *host);
int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume); int keydb_get_volume_index(const host_entry_t *host, const volume_entry_t *volume);
const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]); const host_entry_t* keydb_get_host_by_uuid(const keydb_t *keydb, const uint8_t uuid[static 16]);
bool keydb_add_host(struct keydb_t **keydb, const char *host_name); bool keydb_add_host(keydb_t **keydb, const char *host_name);
bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name); bool keydb_del_host_by_name(keydb_t **keydb, const char *host_name);
bool keydb_rekey_host(struct host_entry_t *host); bool keydb_rekey_host(host_entry_t *host);
struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]); volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]);
bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name); bool keydb_del_volume(host_entry_t *host, const char *devmapper_name);
bool keydb_rekey_volume(struct volume_entry_t *volume); bool keydb_rekey_volume(volume_entry_t *volume);
bool keydb_get_volume_luks_passphrase(const struct volume_entry_t *volume, char *dest, unsigned int dest_buffer_size); bool keydb_get_volume_luks_passphrase(const volume_entry_t *volume, char *dest, unsigned int dest_buffer_size);
bool keydb_write(const struct keydb_t *keydb, const char *filename, const char *passphrase); bool keydb_write(const keydb_t *keydb, const char *filename, const char *passphrase);
struct keydb_t* keydb_read(const char *filename); keydb_t* keydb_read(const char *filename);
/*************** AUTO GENERATED SECTION ENDS ***************/ /*************** AUTO GENERATED SECTION ENDS ***************/
#endif #endif

10
server.c
View File

@ -52,7 +52,7 @@
#include "vaulted_keydb.h" #include "vaulted_keydb.h"
struct keyserver_t { struct keyserver_t {
struct keydb_t* keydb; keydb_t* keydb;
struct vaulted_keydb_t *vaulted_keydb; struct vaulted_keydb_t *vaulted_keydb;
struct generic_tls_ctx_t gctx; struct generic_tls_ctx_t gctx;
const struct pgmopts_server_t *opts; const struct pgmopts_server_t *opts;
@ -61,14 +61,14 @@ struct keyserver_t {
struct client_thread_ctx_t { struct client_thread_ctx_t {
struct generic_tls_ctx_t *gctx; struct generic_tls_ctx_t *gctx;
const struct keydb_t *keydb; const keydb_t *keydb;
struct vaulted_keydb_t *vaulted_keydb; struct vaulted_keydb_t *vaulted_keydb;
const struct host_entry_t *host; const host_entry_t *host;
int fd; int fd;
}; };
struct udp_listen_thread_ctx_t { struct udp_listen_thread_ctx_t {
const struct keydb_t *keydb; const keydb_t *keydb;
int udp_sd; int udp_sd;
unsigned int port; unsigned int port;
}; };
@ -165,7 +165,7 @@ static void client_handler_thread(void *vctx) {
* client by filling the UUID fields */ * client by filling the UUID fields */
struct msg_t msgs[client->host->volume_count]; struct msg_t msgs[client->host->volume_count];
for (unsigned int i = 0; i < client->host->volume_count; i++) { for (unsigned int i = 0; i < client->host->volume_count; i++) {
const struct volume_entry_t *volume = &client->host->volumes[i]; const volume_entry_t *volume = &client->host->volumes[i];
memcpy(msgs[i].volume_uuid, volume->volume_uuid, 16); memcpy(msgs[i].volume_uuid, volume->volume_uuid, 16);
} }

12
vaulted_keydb.c
View File

@ -35,9 +35,9 @@ static struct luks_passphrase_vault_entry_t *vaulted_keydb_get_luks_passphrase_f
return ((struct luks_passphrase_vault_entry_t*)vkeydb->luks_passphrase_vault->data) + host_index; return ((struct luks_passphrase_vault_entry_t*)vkeydb->luks_passphrase_vault->data) + host_index;
} }
static void move_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *src) { static void move_data_into_vault(struct vaulted_keydb_t *dest, keydb_t *src) {
for (unsigned int i = 0; i < src->host_count; i++) { for (unsigned int i = 0; i < src->host_count; i++) {
struct host_entry_t *host = &src->hosts[i]; host_entry_t *host = &src->hosts[i];
/* Copy over TLS-PSK and remove original */ /* Copy over TLS-PSK and remove original */
struct tls_psk_vault_entry_t *dest_tls_psk = vaulted_keydb_get_tls_psk_for_hostindex(dest, i); struct tls_psk_vault_entry_t *dest_tls_psk = vaulted_keydb_get_tls_psk_for_hostindex(dest, i);
@ -47,14 +47,14 @@ static void move_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *s
/* Copy over all LUKS keys and remove originals */ /* Copy over all LUKS keys and remove originals */
struct luks_passphrase_vault_entry_t *dest_luks_passphrase = vaulted_keydb_get_luks_passphrase_for_hostindex(dest, i); struct luks_passphrase_vault_entry_t *dest_luks_passphrase = vaulted_keydb_get_luks_passphrase_for_hostindex(dest, i);
for (unsigned int j = 0; j < host->volume_count; j++) { for (unsigned int j = 0; j < host->volume_count; j++) {
struct volume_entry_t *volume = &host->volumes[j]; volume_entry_t *volume = &host->volumes[j];
memcpy(&dest_luks_passphrase->volumes[j].luks_passphrase_raw, volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES); memcpy(&dest_luks_passphrase->volumes[j].luks_passphrase_raw, volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES);
OPENSSL_cleanse(volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES); OPENSSL_cleanse(volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES);
} }
} }
} }
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host) { bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const host_entry_t *host) {
int host_index = keydb_get_host_index(vaulted_keydb->keydb, host); int host_index = keydb_get_host_index(vaulted_keydb->keydb, host);
if (host_index < 0) { if (host_index < 0) {
log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry."); log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry.");
@ -83,7 +83,7 @@ bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t de
return true; return true;
} }
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *vctx, unsigned int volume_index, const void *source), void *copy_ctx, const struct host_entry_t *host) { bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *vctx, unsigned int volume_index, const void *source), void *copy_ctx, const host_entry_t *host) {
int host_index = keydb_get_host_index(vaulted_keydb->keydb, host); int host_index = keydb_get_host_index(vaulted_keydb->keydb, host);
if (host_index < 0) { if (host_index < 0) {
log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry."); log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry.");
@ -112,7 +112,7 @@ bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulte
return true; return true;
} }
struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb) { struct vaulted_keydb_t *vaulted_keydb_new(keydb_t *keydb) {
struct vaulted_keydb_t *vaulted_keydb = calloc(1, sizeof(struct vaulted_keydb_t)); struct vaulted_keydb_t *vaulted_keydb = calloc(1, sizeof(struct vaulted_keydb_t));
if (!vaulted_keydb) { if (!vaulted_keydb) {
log_msg(LLVL_FATAL, "Unable to calloc(3) vaulted keydb"); log_msg(LLVL_FATAL, "Unable to calloc(3) vaulted keydb");

8
vaulted_keydb.h
View File

@ -38,15 +38,15 @@ struct luks_passphrase_vault_entry_t {
}; };
struct vaulted_keydb_t { struct vaulted_keydb_t {
struct keydb_t *keydb; keydb_t *keydb;
struct vault_t *tls_psk_vault; struct vault_t *tls_psk_vault;
struct vault_t *luks_passphrase_vault; struct vault_t *luks_passphrase_vault;
}; };
/*************** AUTO GENERATED SECTION FOLLOWS ***************/ /*************** AUTO GENERATED SECTION FOLLOWS ***************/
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host); bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const host_entry_t *host);
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *ctx, unsigned int volume_index, const void *source), void *copy_ctx, const struct host_entry_t *host); bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *ctx, unsigned int volume_index, const void *source), void *copy_ctx, const host_entry_t *host);
struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb); struct vaulted_keydb_t *vaulted_keydb_new(keydb_t *keydb);
void vaulted_keydb_free(struct vaulted_keydb_t *vaulted_keydb); void vaulted_keydb_free(struct vaulted_keydb_t *vaulted_keydb);
/*************** AUTO GENERATED SECTION ENDS ***************/ /*************** AUTO GENERATED SECTION ENDS ***************/