From dce9c1b323a99fc45fa0ba73aab657034ba47d43 Mon Sep 17 00:00:00 2001 From: Johannes Bauer Date: Fri, 25 Oct 2019 17:46:21 +0200 Subject: [PATCH] Vaulted keydb should work, but it's not used yet All the methods are implemented to get the vaulted key database running, but it's not in use yet. --- keydb.c | 57 ++++++++++++++++++++-------------- keydb.h | 5 +-- vaulted_keydb.c | 82 +++++++++++++++++++++++++++++++++++++++---------- vaulted_keydb.h | 2 ++ 4 files changed, 105 insertions(+), 41 deletions(-) diff --git a/keydb.c b/keydb.c index a655a3d..465ab77 100644 --- a/keydb.c +++ b/keydb.c @@ -80,29 +80,24 @@ void keydb_free(struct keydb_t *keydb) { } } -static int keydb_get_volume_index_by_name(struct host_entry_t *host, const char *devmapper_name) { +struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name) { for (unsigned int i = 0; i < host->volume_count; i++) { struct volume_entry_t *volume = &host->volumes[i]; if (!strncasecmp(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1)) { - return i; + return volume; } } - return -1; + return NULL; } -static int keydb_get_host_index_by_name(struct keydb_t *keydb, const char *host_name) { +struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name) { for (unsigned int i = 0; i < keydb->host_count; i++) { struct host_entry_t *host = &keydb->hosts[i]; if (!strncasecmp(host->host_name, host_name, sizeof(host->host_name) - 1)) { - return i; + return host; } } - return -1; -} - -struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name) { - const int index = keydb_get_volume_index_by_name(host, devmapper_name); - return (index >= 0) ? &host->volumes[index] : NULL; + return NULL; } const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]) { @@ -115,19 +110,24 @@ const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t return NULL; } -int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume) { - int offset = volume - host->volumes; - if (offset < 0) { +int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host) { + int index = host - keydb->hosts; + if (index < 0) { return -1; - } else if ((unsigned int)offset >= host->volume_count) { + } else if ((unsigned int)index >= keydb ->host_count) { return -1; } - return offset; + return index; } -struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name) { - const int index = keydb_get_host_index_by_name(keydb, host_name); - return (index >= 0) ? &keydb->hosts[index] : NULL; +int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume) { + int index = volume - host->volumes; + if (index < 0) { + return -1; + } else if ((unsigned int)index >= host->volume_count) { + return -1; + } + return index; } const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]) { @@ -176,12 +176,18 @@ bool keydb_add_host(struct keydb_t **keydb, const char *host_name) { bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name) { struct keydb_t *old_keydb = *keydb; - int host_index = keydb_get_host_index_by_name(old_keydb, host_name); - if (host_index == -1) { + struct host_entry_t *host = keydb_get_host_by_name(old_keydb, host_name); + if (!host) { log_msg(LLVL_ERROR, "No such host: \"%s\"", host_name); return false; } + int host_index = keydb_get_host_index(old_keydb, host); + if (host_index < 0) { + log_msg(LLVL_FATAL, "Fatal error determining host index of \"%s\" for host \"%s\".", host_name); + return false; + } + /* We keep the memory for now and do not realloc */ array_remove(old_keydb->hosts, sizeof(struct host_entry_t), old_keydb->host_count, host_index); old_keydb->host_count--; @@ -219,11 +225,16 @@ struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *d } bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name) { - int index = keydb_get_volume_index_by_name(host, devmapper_name); - if (index == -1) { + struct volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name); + if (!volume) { log_msg(LLVL_ERROR, "No such volume \"%s\" for host \"%s\".", devmapper_name, host->host_name); return false; } + int index = keydb_get_volume_index(host, volume); + if (index < 0) { + log_msg(LLVL_FATAL, "Fatal error determining volume index of \"%s\" for host \"%s\".", devmapper_name, host->host_name); + return false; + } if (!array_remove(host->volumes, sizeof(struct volume_entry_t), host->volume_count, index)) { log_msg(LLVL_ERROR, "Failed to remove \"%s\" of host \"%s\".", devmapper_name, host->host_name); return false; diff --git a/keydb.h b/keydb.h index e62855c..0b1e38a 100644 --- a/keydb.h +++ b/keydb.h @@ -58,9 +58,10 @@ struct keydb_t* keydb_new(void); struct keydb_t* keydb_export_public(struct host_entry_t *host); void keydb_free(struct keydb_t *keydb); struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name); -const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]); -int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume); struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name); +const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]); +int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host); +int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume); const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]); bool keydb_add_host(struct keydb_t **keydb, const char *host_name); bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name); diff --git a/vaulted_keydb.c b/vaulted_keydb.c index a84e492..6f0955c 100644 --- a/vaulted_keydb.c +++ b/vaulted_keydb.c @@ -35,7 +35,7 @@ static struct luks_passphrase_vault_entry_t *vaulted_keydb_get_luks_passphrase_f return ((struct luks_passphrase_vault_entry_t*)vkeydb->luks_passphrase_vault->data) + host_index; } -static void copy_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *src) { +static void move_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *src) { for (unsigned int i = 0; i < src->host_count; i++) { struct host_entry_t *host = &src->hosts[i]; @@ -54,15 +54,67 @@ static void copy_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *s } } -static void erase_key_data_from_keydb(struct keydb_t *keydb) { - for (unsigned int i = 0; i < keydb->host_count; i++) { - struct host_entry_t *host = &keydb->hosts[i]; - OPENSSL_cleanse(host->tls_psk, PSK_SIZE_BYTES); - for (unsigned int j = 0; j < host->volume_count; j++) { - struct volume_entry_t *volume = &host->volumes[j]; - OPENSSL_cleanse(volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES); - } +bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host) { + int host_index = keydb_get_host_index(vaulted_keydb->keydb, host); + if (host_index < 0) { + log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry."); + return false; } + + /* Get a pointer into the vaulted structure */ + struct tls_psk_vault_entry_t *entry = vaulted_keydb_get_tls_psk_for_hostindex(vaulted_keydb, host_index); + + /* Then decrypt vault */ + if (!vault_open(vaulted_keydb->tls_psk_vault)) { + log_msg(LLVL_FATAL, "Unable to open TLS-PSK vault of vaulted key db entry."); + return false; + } + + /* Copy out the data we need */ + memcpy(dest, &entry->tls_psk, PSK_SIZE_BYTES); + + /* And close it back up */ + if (!vault_close(vaulted_keydb->tls_psk_vault)) { + OPENSSL_cleanse(dest, PSK_SIZE_BYTES); + log_msg(LLVL_FATAL, "Unable to close TLS-PSK vault of vaulted key db entry."); + return false; + } + + return true; +} + +bool vaulted_keydb_get_volume_luks_passphase_raw(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[LUKS_PASSPHRASE_RAW_SIZE_BYTES], const struct host_entry_t *host, const struct volume_entry_t *volume) { + int host_index = keydb_get_host_index(vaulted_keydb->keydb, host); + if (host_index < 0) { + log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry."); + return false; + } + + int volume_index = keydb_get_volume_index(host, volume); + if (volume_index < 0) { + log_msg(LLVL_FATAL, "Unable to retrieve volume index for vaulted key db entry."); + return false; + } + + /* Get a pointer into the vaulted structure */ + struct luks_passphrase_vault_entry_t *entry = vaulted_keydb_get_luks_passphrase_for_hostindex(vaulted_keydb, host_index); + + /* Then decrypt vault */ + if (!vault_open(vaulted_keydb->luks_passphrase_vault)) { + log_msg(LLVL_FATAL, "Unable to open LUKS passphrase vault of vaulted key db entry."); + return false; + } + + /* Copy out the data we need */ + memcpy(dest, &entry->volumes[volume_index].luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES); + + /* And close it back up */ + if (!vault_close(vaulted_keydb->luks_passphrase_vault)) { + OPENSSL_cleanse(dest, PSK_SIZE_BYTES); + log_msg(LLVL_FATAL, "Unable to close LUKS passphrase vault of vaulted key db entry."); + return false; + } + return true; } struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb) { @@ -74,25 +126,23 @@ struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb) { vaulted_keydb->keydb = keydb; - vaulted_keydb->tls_psk_vault = vault_init(sizeof(struct tls_psk_vault_entry_t) * keydb->host_count, 0.1); + vaulted_keydb->tls_psk_vault = vault_init(sizeof(struct tls_psk_vault_entry_t) * keydb->host_count, 0.025); if (!vaulted_keydb->tls_psk_vault) { log_msg(LLVL_FATAL, "Unable to create TLS-PSK vault"); vaulted_keydb_free(vaulted_keydb); return NULL; } - vaulted_keydb->luks_passphrase_vault = vault_init(sizeof(struct luks_passphrase_vault_entry_t) * keydb->host_count, 0.1); + vaulted_keydb->luks_passphrase_vault = vault_init(sizeof(struct luks_passphrase_vault_entry_t) * keydb->host_count, 0.025); if (!vaulted_keydb->luks_passphrase_vault) { log_msg(LLVL_FATAL, "Unable to create LUKS passphrase vault"); vaulted_keydb_free(vaulted_keydb); return NULL; } - /* Now copy over data from the original KeyDB */ - copy_data_into_vault(vaulted_keydb, keydb); - - /* Then erase original key data */ - erase_key_data_from_keydb(keydb); + /* Now move data from the original keydb into the vaulted keydb (erase + * original keys) */ + move_data_into_vault(vaulted_keydb, keydb); /* Finally, close the vaults */ if (!vault_close(vaulted_keydb->tls_psk_vault)) { diff --git a/vaulted_keydb.h b/vaulted_keydb.h index 1751e6b..99c7228 100644 --- a/vaulted_keydb.h +++ b/vaulted_keydb.h @@ -44,6 +44,8 @@ struct vaulted_keydb_t { }; /*************** AUTO GENERATED SECTION FOLLOWS ***************/ +bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host); +bool vaulted_keydb_get_volume_luks_passphase_raw(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[LUKS_PASSPHRASE_RAW_SIZE_BYTES], const struct host_entry_t *host, const struct volume_entry_t *volume); struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb); void vaulted_keydb_free(struct vaulted_keydb_t *vaulted_keydb); /*************** AUTO GENERATED SECTION ENDS ***************/