Georg/luksrku
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: Georg:master
Branches Tags
Georg:master
Georg:devel_init
Georg:devel_initcpio
Georg:v0.04
Georg:v0.03
Georg:v0.02
Georg:v0.01
..
compare: Georg:v0.03
Branches Tags
Georg:devel_init
Georg:devel_initcpio
Georg:master
Georg:v0.04
Georg:v0.03
Georg:v0.02
Georg:v0.01

No commits in common. "master" and "v0.03" have entirely different histories.
master ... v0.03

17 changed files with 159 additions and 387 deletions
Show Stats Expand all files Collapse all files

2
Makefile
View File

@ -6,7 +6,7 @@ INSTALL_PREFIX := /usr/local/
CFLAGS := -Wall -Wextra -Wshadow -Wswitch -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Werror=implicit-function-declaration -Werror=format -Wno-unused-parameter
CFLAGS += -O3 -std=c11 -pthread -D_POSIX_SOURCE -D_POSIX_C_SOURCE=200112L -D_XOPEN_SOURCE=500 -DBUILD_REVISION='"$(BUILD_REVISION)"'
CFLAGS += `pkg-config --cflags openssl`
#CFLAGS += -ggdb3 -DDEBUG -fsanitize=address -fsanitize=undefined -fsanitize=leak
CFLAGS += -ggdb3 -DDEBUG -fsanitize=address -fsanitize=undefined -fsanitize=leak
PYPGMOPTS := ../Python/pypgmopts/pypgmopts
LDFLAGS := `pkg-config --libs openssl`

23
argparse_client.c
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:16
*/
#include <stdint.h>
@ -154,18 +154,21 @@ void argparse_client_show_syntax(void) {
fprintf(stderr, "Connects to a luksrku key server and unlocks local LUKS volumes.\n");
fprintf(stderr, "\n");
fprintf(stderr, "positional arguments:\n");
fprintf(stderr, " filename Exported database file to load TLS-PSKs and list of disks from.\n");
fprintf(stderr, " hostname When hostname is given, auto-searching for suitable servers is disabled and\n");
fprintf(stderr, " only a connection to the given hostname is attempted.\n");
fprintf(stderr, " filename Exported database file to load TLS-PSKs and list of\n");
fprintf(stderr, " disks from.\n");
fprintf(stderr, " hostname When hostname is given, auto-searching for suitable\n");
fprintf(stderr, " servers is disabled and only a connection to the given\n");
fprintf(stderr, " hostname is attempted.\n");
fprintf(stderr, "\n");
fprintf(stderr, "optional arguments:\n");
fprintf(stderr, " -t secs, --timeout secs\n");
fprintf(stderr, " When searching for a keyserver and not all volumes can be unlocked, abort\n");
fprintf(stderr, " after this period of time, given in seconds. Defaults to infinity. This\n");
fprintf(stderr, " argument can be specified as a host-based configuration parameter as well;\n");
fprintf(stderr, " the command-line argument always takes precedence.\n");
fprintf(stderr, " -p port, --port port Port that is used for both UDP and TCP communication. Defaults to 23170.\n");
fprintf(stderr, " --no-luks Do not call LUKS/cryptsetup. Useful for testing unlocking procedure.\n");
fprintf(stderr, " When searching for a keyserver and not all volumes can\n");
fprintf(stderr, " be unlocked, abort after this period of time, given in\n");
fprintf(stderr, " seconds. Defaults to 60 seconds.\n");
fprintf(stderr, " -p port, --port port Port that is used for both UDP and TCP communication.\n");
fprintf(stderr, " Defaults to 23170.\n");
fprintf(stderr, " --no-luks Do not call LUKS/cryptsetup. Useful for testing\n");
fprintf(stderr, " unlocking procedure.\n");
fprintf(stderr, " -v, --verbose Increase verbosity. Can be specified multiple times.\n");
}

4
argparse_client.h
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:16
*/
#ifndef __ARGPARSE_CLIENT_H__
@ -13,7 +13,7 @@
#include <stdbool.h>
#define ARGPARSE_CLIENT_DEFAULT_TIMEOUT 0
#define ARGPARSE_CLIENT_DEFAULT_TIMEOUT 60
#define ARGPARSE_CLIENT_DEFAULT_PORT 23170
#define ARGPARSE_CLIENT_DEFAULT_VERBOSE 0

2
argparse_edit.c
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:15
*/
#include <stdint.h>

2
argparse_edit.h
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:15
*/
#ifndef __ARGPARSE_EDIT_H__

9
argparse_server.c
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:15
*/
#include <stdint.h>
@ -133,9 +133,10 @@ void argparse_server_show_syntax(void) {
fprintf(stderr, " filename Database file to load keys from.\n");
fprintf(stderr, "\n");
fprintf(stderr, "optional arguments:\n");
fprintf(stderr, " -p port, --port port Port that is used for both UDP and TCP communication. Defaults to 23170.\n");
fprintf(stderr, " -s, --silent Do not answer UDP queries for clients trying to find a key server, only\n");
fprintf(stderr, " serve key database using TCP.\n");
fprintf(stderr, " -p port, --port port Port that is used for both UDP and TCP communication.\n");
fprintf(stderr, " Defaults to 23170.\n");
fprintf(stderr, " -s, --silent Do not answer UDP queries for clients trying to find a\n");
fprintf(stderr, " key server, only serve key database using TCP.\n");
fprintf(stderr, " -v, --verbose Increase verbosity. Can be specified multiple times.\n");
}

2
argparse_server.h
View File

@ -5,7 +5,7 @@
*
* Do not edit it by hand, your changes will be overwritten.
*
* Generated at: 2021-06-27 13:24:40
* Generated at: 2019-10-25 20:39:15
*/
#ifndef __ARGPARSE_SERVER_H__

42
client.c
View File

@ -47,7 +47,7 @@
struct keyclient_t {
const struct pgmopts_client_t *opts;
keydb_t *keydb;
struct keydb_t *keydb;
bool volume_unlocked[MAX_VOLUMES_PER_HOST];
unsigned char identifier[ASCII_UUID_BUFSIZE];
double broadcast_start_time;
@ -61,12 +61,11 @@ static int psk_client_callback(SSL *ssl, const EVP_MD *md, const unsigned char *
return openssl_tls13_psk_establish_session(ssl, key_client->keydb->hosts[0].tls_psk, PSK_SIZE_BYTES, EVP_sha256(), sessptr);
}
static bool unlock_luks_volume(const volume_entry_t *volume, const struct msg_t *unlock_msg) {
static bool unlock_luks_volume(const struct volume_entry_t *volume, const struct msg_t *unlock_msg) {
bool success = true;
char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES];
if (ascii_encode(luks_passphrase, sizeof(luks_passphrase), unlock_msg->luks_passphrase_raw, sizeof(unlock_msg->luks_passphrase_raw))) {
bool allow_discards = volume->volume_flags & VOLUME_FLAG_ALLOW_DISCARDS;
success = open_luks_device(volume->volume_uuid, volume->devmapper_name, luks_passphrase, strlen(luks_passphrase), allow_discards);
success = open_luks_device(volume->volume_uuid, volume->devmapper_name, luks_passphrase, strlen(luks_passphrase));
} else {
log_msg(LLVL_FATAL, "Failed to transcribe raw LUKS passphrase to text form.");
success = false;
@ -76,8 +75,8 @@ static bool unlock_luks_volume(const volume_entry_t *volume, const struct msg_t
}
static bool attempt_unlock_luks_volume(struct keyclient_t *keyclient, const struct msg_t *unlock_msg) {
const host_entry_t *host = &keyclient->keydb->hosts[0];
const volume_entry_t* volume = keydb_get_volume_by_uuid(host, unlock_msg->volume_uuid);
const struct host_entry_t *host = &keyclient->keydb->hosts[0];
const struct volume_entry_t* volume = keydb_get_volume_by_uuid(host, unlock_msg->volume_uuid);
char volume_uuid_str[ASCII_UUID_BUFSIZE];
sprintf_uuid(volume_uuid_str, unlock_msg->volume_uuid);
if (!volume) {
@ -225,29 +224,16 @@ static bool all_volumes_unlocked(struct keyclient_t *keyclient) {
return locked_volume_count(keyclient) == 0;
}
static unsigned int determine_timeout(struct keyclient_t *keyclient) {
unsigned int client_timeout_secs = 0;
if (keyclient->opts->timeout_seconds) {
/* Command line always has precedence */
client_timeout_secs = keyclient->opts->timeout_seconds;
} else {
/* Alternatively, take the one in the configuration file */
client_timeout_secs = keyclient->keydb->hosts[0].client_default_timeout_secs;
}
return client_timeout_secs;
}
static bool abort_searching_for_keyserver(struct keyclient_t *keyclient) {
if (all_volumes_unlocked(keyclient)) {
log_msg(LLVL_DEBUG, "All volumes unlocked successfully.");
return true;
}
unsigned int client_timeout_secs = determine_timeout(keyclient);
if (client_timeout_secs) {
if (keyclient->opts->timeout_seconds) {
double time_passed = now() - keyclient->broadcast_start_time;
if (time_passed >= client_timeout_secs) {
log_msg(LLVL_WARNING, "Could not unlock all volumes after %u seconds, giving up. %d volumes still locked.", client_timeout_secs, locked_volume_count(keyclient));
if (time_passed >= keyclient->opts->timeout_seconds) {
log_msg(LLVL_WARNING, "Could not unlock all volumes after %u seconds, giving up. %d volumes still locked.", keyclient->opts->timeout_seconds, locked_volume_count(keyclient));
return true;
}
}
@ -256,21 +242,11 @@ static bool abort_searching_for_keyserver(struct keyclient_t *keyclient) {
}
static bool broadcast_for_keyserver(struct keyclient_t *keyclient) {
{
unsigned int client_timeout_secs = determine_timeout(keyclient);
if (client_timeout_secs) {
log_msg(LLVL_DEBUG, "Searching luksrku keyserver, will give up after %u seconds", client_timeout_secs);
} else {
log_msg(LLVL_DEBUG, "Searching luksrku keyserver, will not give up until all volumes unlocked");
}
}
int sd = create_udp_socket(0, true, 1000);
if (sd == -1) {
return false;
}
keyclient->broadcast_start_time = now();
struct udp_query_t query;
memcpy(query.magic, UDP_MESSAGE_MAGIC, sizeof(query.magic));
@ -331,7 +307,7 @@ bool keyclient_start(const struct pgmopts_client_t *opts) {
break;
}
host_entry_t *host = &keyclient.keydb->hosts[0];
struct host_entry_t *host = &keyclient.keydb->hosts[0];
if (host->volume_count == 0) {
log_msg(LLVL_FATAL, "No volumes found in exported database %s.", opts->filename);
success = false;

131
editor.c
View File

@ -45,7 +45,7 @@ enum cmd_returncode_t {
struct editor_context_t {
bool running;
keydb_t *keydb;
struct keydb_t *keydb;
char filename[MAX_FILENAME_LENGTH];
char passphrase[MAX_PASSPHRASE_LENGTH];
};
@ -65,12 +65,10 @@ static enum cmd_returncode_t cmd_list(struct editor_context_t *ctx, const char *
static enum cmd_returncode_t cmd_add_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_del_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_rekey_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_host_param(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_del_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_rekey_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_showkey_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_flag_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_open(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_save(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
static enum cmd_returncode_t cmd_export(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params);
@ -119,14 +117,6 @@ static const struct editor_command_t commands[] = {
.max_params = 1,
.description = "Re-keys the TLS PSK of a given host",
},
{
.cmdnames = { "host_param" },
.callback = cmd_host_param,
.param_names = "[hostname] timeout [value]",
.min_params = 3,
.max_params = 3,
.description = "Set a parameter of a host (currently only timeout supported)",
},
{
.cmdnames = { "add_volume" },
.callback = cmd_add_volume,
@ -159,14 +149,6 @@ static const struct editor_command_t commands[] = {
.max_params = 2,
.description = "Shows the LUKS passphrase of a volume of a hostname",
},
{
.cmdnames = { "flag_volume" },
.callback = cmd_flag_volume,
.param_names = "[hostname] [devmappername] [(+-)(allow_discards)]",
.min_params = 3,
.max_params = 3,
.description = "Edits the flags of a volume",
},
{
.cmdnames = { "open", "load" },
.callback = cmd_open,
@ -245,30 +227,16 @@ static enum cmd_returncode_t cmd_list(struct editor_context_t *ctx, const char *
printf("No key database loaded.\n");
return COMMAND_FAILURE;
}
printf("Keydb version %d, %s database, %d hosts.\n", ctx->keydb->common.keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
printf("Keydb version %d, %s database, %d hosts.\n", ctx->keydb->keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
for (unsigned int i = 0; i < ctx->keydb->host_count; i++) {
const host_entry_t *host = &ctx->keydb->hosts[i];
const struct host_entry_t *host = &ctx->keydb->hosts[i];
char uuid[48];
sprintf_uuid(uuid, host->host_uuid);
printf(" Host %d: \"%s\" UUID %s -- %d volumes, ", i + 1, host->host_name, uuid, host->volume_count);
if (!host->client_default_timeout_secs) {
printf("no default timeout");
} else {
printf("default timeout %d secs", host->client_default_timeout_secs);
}
printf(":\n");
printf(" Host %d: \"%s\" UUID %s -- %d volumes:\n", i + 1, host->host_name, uuid, host->volume_count);
for (unsigned int j = 0; j < host->volume_count; j++) {
const volume_entry_t *volume = &host->volumes[j];
const struct volume_entry_t *volume = &host->volumes[j];
sprintf_uuid(uuid, volume->volume_uuid);
printf(" Volume %d: \"%s\" UUID %s ", j + 1, volume->devmapper_name, uuid);
if (volume->volume_flags == 0) {
printf("defaults");
} else {
if (volume->volume_flags & VOLUME_FLAG_ALLOW_DISCARDS) {
printf("allow_discards ");
}
}
printf("\n");
printf(" Volume %d: \"%s\" UUID %s\n", j + 1, volume->devmapper_name, uuid);
}
}
return COMMAND_SUCCESS;
@ -297,12 +265,12 @@ static enum cmd_returncode_t cmd_del_host(struct editor_context_t *ctx, const ch
return success ? COMMAND_SUCCESS : COMMAND_FAILURE;
}
static host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char *host_name) {
static struct host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char *host_name) {
if (!ctx->keydb) {
fprintf(stderr, "No key database loaded.\n");
return NULL;
}
host_entry_t *host = keydb_get_host_by_name(ctx->keydb, host_name);
struct host_entry_t *host = keydb_get_host_by_name(ctx->keydb, host_name);
if (!host) {
fprintf(stderr, "No such host: %s\n", host_name);
return NULL;
@ -310,13 +278,13 @@ static host_entry_t* cmd_gethost(struct editor_context_t *ctx, const char *host_
return host;
}
static volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const char *host_name, const char *devmapper_name) {
host_entry_t *host = cmd_gethost(ctx, host_name);
static struct volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const char *host_name, const char *devmapper_name) {
struct host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) {
return NULL;
}
volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
struct volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
if (!volume) {
fprintf(stderr, "No such volume \"%s\" for host \"%s\"\n", devmapper_name, host_name);
return NULL;
@ -326,30 +294,11 @@ static volume_entry_t* cmd_getvolume(struct editor_context_t *ctx, const char *h
static enum cmd_returncode_t cmd_rekey_host(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0];
host_entry_t *host = cmd_gethost(ctx, host_name);
struct host_entry_t *host = cmd_gethost(ctx, host_name);
return host && keydb_rekey_host(host) ? COMMAND_SUCCESS : COMMAND_FAILURE;
}
static enum cmd_returncode_t cmd_host_param(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0];
const char *param = params[1];
const char *value = params[2];
host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) {
return COMMAND_FAILURE;
}
if (!strcasecmp(param, "timeout")) {
host->client_default_timeout_secs = atoi(value);
} else {
fprintf(stderr, "Invalid parameter: %s\n", param);
return COMMAND_FAILURE;
}
return COMMAND_SUCCESS;
}
static enum cmd_returncode_t cmd_do_showkey_volume(volume_entry_t *volume) {
static enum cmd_returncode_t cmd_do_showkey_volume(struct volume_entry_t *volume) {
char luks_passphrase[LUKS_PASSPHRASE_TEXT_SIZE_BYTES];
if (!keydb_get_volume_luks_passphrase(volume, luks_passphrase, sizeof(luks_passphrase))) {
OPENSSL_cleanse(luks_passphrase, sizeof(luks_passphrase));
@ -366,7 +315,7 @@ static enum cmd_returncode_t cmd_do_showkey_volume(volume_entry_t *volume) {
static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0];
host_entry_t *host = cmd_gethost(ctx, host_name);
struct host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) {
return COMMAND_FAILURE;
}
@ -379,7 +328,7 @@ static enum cmd_returncode_t cmd_add_volume(struct editor_context_t *ctx, const
}
uint8_t volume_uuid[16];
parse_uuid(volume_uuid, volume_uuid_str);
volume_entry_t *volume = keydb_add_volume(host, devmapper_name, volume_uuid);
struct volume_entry_t *volume = keydb_add_volume(host, devmapper_name, volume_uuid);
if (volume) {
return cmd_do_showkey_volume(volume);
} else {
@ -391,7 +340,7 @@ static enum cmd_returncode_t cmd_del_volume(struct editor_context_t *ctx, const
const char *host_name = params[0];
const char *devmapper_name = params[1];
host_entry_t *host = cmd_gethost(ctx, host_name);
struct host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) {
return COMMAND_FAILURE;
}
@ -405,7 +354,7 @@ static enum cmd_returncode_t cmd_rekey_volume(struct editor_context_t *ctx, cons
const char *host_name = params[0];
const char *devmapper_name = params[1];
volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
struct volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
if (!volume) {
return COMMAND_FAILURE;
}
@ -419,7 +368,7 @@ static enum cmd_returncode_t cmd_showkey_volume(struct editor_context_t *ctx, co
const char *host_name = params[0];
const char *devmapper_name = params[1];
volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
struct volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
if (!volume) {
return COMMAND_FAILURE;
}
@ -427,38 +376,6 @@ static enum cmd_returncode_t cmd_showkey_volume(struct editor_context_t *ctx, co
return cmd_do_showkey_volume(volume);
}
static enum cmd_returncode_t cmd_flag_volume(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0];
const char *devmapper_name = params[1];
const char *flag_str = params[2];
volume_entry_t *volume = cmd_getvolume(ctx, host_name, devmapper_name);
if (!volume) {
return COMMAND_FAILURE;
}
if ((flag_str[0] != '+') && (flag_str[0] != '-')) {
fprintf(stderr, "Flag string must start with '+' or '-' for adding or removing a flag.\n");
return COMMAND_FAILURE;
}
unsigned int flag_value = 0;
if (!strcasecmp(flag_str + 1, "allow_discards")) {
flag_value = VOLUME_FLAG_ALLOW_DISCARDS;
} else {
fprintf(stderr, "Invalid flag '%s': allowed is only 'allow_discards'.\n", flag_str + 1);
return COMMAND_FAILURE;
}
if (flag_str[0] == '+') {
volume->volume_flags |= flag_value;
} else {
volume->volume_flags &= ~flag_value;
}
return COMMAND_SUCCESS;
}
static enum cmd_returncode_t cmd_open(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
if (ctx->keydb) {
keydb_free(ctx->keydb);
@ -500,12 +417,12 @@ static enum cmd_returncode_t cmd_save(struct editor_context_t *ctx, const char *
static enum cmd_returncode_t cmd_export(struct editor_context_t *ctx, const char *cmdname, unsigned int param_cnt, char **params) {
const char *host_name = params[0];
const char *filename = params[1];
host_entry_t *host = cmd_gethost(ctx, host_name);
struct host_entry_t *host = cmd_gethost(ctx, host_name);
if (!host) {
return COMMAND_FAILURE;
}
keydb_t *pubdb = keydb_export_public(host);
struct keydb_t *pubdb = keydb_export_public(host);
char passphrase[MAX_PASSPHRASE_LENGTH];
if (!query_passphrase("Client passphrase: ", passphrase, sizeof(passphrase))) {
fprintf(stderr, "Failed to read export passphrase.\n");
@ -554,9 +471,9 @@ static enum cmd_returncode_t cmd_rawdump(struct editor_context_t *ctx, const cha
if (!ctx->keydb) {
return COMMAND_SUCCESS;
}
fprintf(stderr, "Version %d, %s, %d hosts.\n", ctx->keydb->common.keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
fprintf(stderr, "Version %d, %s, %d hosts.\n", ctx->keydb->keydb_version, ctx->keydb->server_database ? "server" : "client", ctx->keydb->host_count);
for (unsigned int i = 0; i < ctx->keydb->host_count; i++) {
host_entry_t *host = &ctx->keydb->hosts[i];
struct host_entry_t *host = &ctx->keydb->hosts[i];
fprintf(stderr, "Host %d:\n", i);
{
char host_uuid[ASCII_UUID_BUFSIZE];
@ -571,8 +488,8 @@ static enum cmd_returncode_t cmd_rawdump(struct editor_context_t *ctx, const cha
dump_hexline(stderr, " tls_psk ", host->tls_psk, sizeof(host->tls_psk), false);
fprintf(stderr, " volume_count %u\n", host->volume_count);
for (unsigned int j = 0; j < MAX_VOLUMES_PER_HOST; j++) {
volume_entry_t *volume = &host->volumes[j];
if (!is_zero(volume, sizeof(volume_entry_t))) {
struct volume_entry_t *volume = &host->volumes[j];
if (!is_zero(volume, sizeof(struct volume_entry_t))) {
fprintf(stderr, " Host %d / Volume %d:\n", i, j);
dump_hexline(stderr, " volume_uuid ", volume->volume_uuid, sizeof(volume->volume_uuid), false);
dump_hexline(stderr, " devmapper_name ", volume->devmapper_name, sizeof(volume->devmapper_name), true);

173
keydb.c
View File

@ -33,39 +33,23 @@
#include "uuid.h"
#include "log.h"
static unsigned int keydb_getsize_v3_hostcount(unsigned int host_count) {
return sizeof(struct keydb_v3_t) + (host_count * sizeof(struct host_entry_v3_t));
}
static unsigned int keydb_getsize_v3(const struct keydb_v3_t *keydb) {
return keydb_getsize_v3_hostcount(keydb->host_count);
}
static unsigned int keydb_getsize_v2_hostcount(unsigned int host_count) {
return sizeof(struct keydb_v2_t) + (host_count * sizeof(struct host_entry_v2_t));
}
static unsigned int keydb_getsize_v2(const struct keydb_v2_t *keydb) {
return keydb_getsize_v2_hostcount(keydb->host_count);
}
static unsigned int keydb_getsize_hostcount(unsigned int host_count) {
return keydb_getsize_v3_hostcount(host_count);
return sizeof(struct keydb_t) + (host_count * sizeof(struct host_entry_t));
}
static unsigned int keydb_getsize(const keydb_t *keydb) {
return keydb_getsize_v3(keydb);
static unsigned int keydb_getsize(const struct keydb_t *keydb) {
return keydb_getsize_hostcount(keydb->host_count);
}
keydb_t* keydb_new(void) {
keydb_t *keydb = calloc(sizeof(keydb_t), 1);
keydb->common.keydb_version = KEYDB_CURRENT_VERSION;
struct keydb_t* keydb_new(void) {
struct keydb_t *keydb = calloc(sizeof(struct keydb_t), 1);
keydb->keydb_version = KEYDB_VERSION;
keydb->server_database = true;
return keydb;
}
keydb_t* keydb_export_public(host_entry_t *host) {
keydb_t *public_db = keydb_new();
struct keydb_t* keydb_export_public(struct host_entry_t *host) {
struct keydb_t *public_db = keydb_new();
if (!public_db) {
return NULL;
}
@ -77,28 +61,28 @@ keydb_t* keydb_export_public(host_entry_t *host) {
}
/* Copy over whole entry */
host_entry_t *public_host = &public_db->hosts[0];
struct host_entry_t *public_host = &public_db->hosts[0];
*public_host = *host;
/* But remove all LUKS passphrases of course, this is for the luksrku client */
for (unsigned int i = 0; i < host->volume_count; i++) {
volume_entry_t *volume = &public_host->volumes[i];
struct volume_entry_t *volume = &public_host->volumes[i];
memset(volume->luks_passphrase_raw, 0, sizeof(volume->luks_passphrase_raw));
}
return public_db;
}
void keydb_free(keydb_t *keydb) {
void keydb_free(struct keydb_t *keydb) {
if (keydb) {
OPENSSL_cleanse(keydb, keydb_getsize(keydb));
free(keydb);
}
}
volume_entry_t* keydb_get_volume_by_name(host_entry_t *host, const char *devmapper_name) {
struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name) {
for (unsigned int i = 0; i < host->volume_count; i++) {
volume_entry_t *volume = &host->volumes[i];
struct volume_entry_t *volume = &host->volumes[i];
if (!strncasecmp(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1)) {
return volume;
}
@ -106,9 +90,9 @@ volume_entry_t* keydb_get_volume_by_name(host_entry_t *host, const char *devmapp
return NULL;
}
host_entry_t* keydb_get_host_by_name(keydb_t *keydb, const char *host_name) {
struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name) {
for (unsigned int i = 0; i < keydb->host_count; i++) {
host_entry_t *host = &keydb->hosts[i];
struct host_entry_t *host = &keydb->hosts[i];
if (!strncasecmp(host->host_name, host_name, sizeof(host->host_name) - 1)) {
return host;
}
@ -116,9 +100,9 @@ host_entry_t* keydb_get_host_by_name(keydb_t *keydb, const char *host_name) {
return NULL;
}
const volume_entry_t* keydb_get_volume_by_uuid(const host_entry_t *host, const uint8_t uuid[static 16]) {
const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]) {
for (unsigned int i = 0; i < host->volume_count; i++) {
const volume_entry_t *volume = &host->volumes[i];
const struct volume_entry_t *volume = &host->volumes[i];
if (!memcmp(volume->volume_uuid, uuid, 16)) {
return volume;
}
@ -126,7 +110,7 @@ const volume_entry_t* keydb_get_volume_by_uuid(const host_entry_t *host, const u
return NULL;
}
int keydb_get_host_index(const keydb_t *keydb, const host_entry_t *host) {
int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host) {
int index = host - keydb->hosts;
if (index < 0) {
return -1;
@ -136,7 +120,7 @@ int keydb_get_host_index(const keydb_t *keydb, const host_entry_t *host) {
return index;
}
int keydb_get_volume_index(const host_entry_t *host, const volume_entry_t *volume) {
int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume) {
int index = volume - host->volumes;
if (index < 0) {
return -1;
@ -146,9 +130,9 @@ int keydb_get_volume_index(const host_entry_t *host, const volume_entry_t *volum
return index;
}
const host_entry_t* keydb_get_host_by_uuid(const keydb_t *keydb, const uint8_t uuid[static 16]) {
const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]) {
for (unsigned int i = 0; i < keydb->host_count; i++) {
const host_entry_t *host = &keydb->hosts[i];
const struct host_entry_t *host = &keydb->hosts[i];
if (!memcmp(host->host_uuid, uuid, 16)) {
return host;
}
@ -156,26 +140,26 @@ const host_entry_t* keydb_get_host_by_uuid(const keydb_t *keydb, const uint8_t u
return NULL;
}
bool keydb_add_host(keydb_t **keydb, const char *host_name) {
bool keydb_add_host(struct keydb_t **keydb, const char *host_name) {
if (strlen(host_name) > MAX_HOST_NAME_LENGTH - 1) {
log_msg(LLVL_ERROR, "Host name \"%s\" exceeds maximum length of %d characters.", host_name, MAX_HOST_NAME_LENGTH - 1);
return false;
}
keydb_t *old_keydb = *keydb;
struct keydb_t *old_keydb = *keydb;
if (keydb_get_host_by_name(old_keydb, host_name)) {
log_msg(LLVL_ERROR, "Host name \"%s\" already present in key database.", host_name);
return false;
}
keydb_t *new_keydb = realloc(old_keydb, keydb_getsize_hostcount(old_keydb->host_count + 1));
struct keydb_t *new_keydb = realloc(old_keydb, keydb_getsize_hostcount(old_keydb->host_count + 1));
if (!new_keydb) {
return false;
}
*keydb = new_keydb;
host_entry_t *host = &new_keydb->hosts[new_keydb->host_count];
memset(host, 0, sizeof(host_entry_t));
struct host_entry_t *host = &new_keydb->hosts[new_keydb->host_count];
memset(host, 0, sizeof(struct host_entry_t));
if (!uuid_randomize(host->host_uuid)) {
/* We keep the reallocation but do not increase the host count */
return false;
@ -190,9 +174,9 @@ bool keydb_add_host(keydb_t **keydb, const char *host_name) {
return true;
}
bool keydb_del_host_by_name(keydb_t **keydb, const char *host_name) {
keydb_t *old_keydb = *keydb;
host_entry_t *host = keydb_get_host_by_name(old_keydb, host_name);
bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name) {
struct keydb_t *old_keydb = *keydb;
struct host_entry_t *host = keydb_get_host_by_name(old_keydb, host_name);
if (!host) {
log_msg(LLVL_ERROR, "No such host: \"%s\"", host_name);
return false;
@ -205,16 +189,16 @@ bool keydb_del_host_by_name(keydb_t **keydb, const char *host_name) {
}
/* We keep the memory for now and do not realloc */
array_remove(old_keydb->hosts, sizeof(host_entry_t), old_keydb->host_count, host_index);
array_remove(old_keydb->hosts, sizeof(struct host_entry_t), old_keydb->host_count, host_index);
old_keydb->host_count--;
return true;
}
bool keydb_rekey_host(host_entry_t *host) {
bool keydb_rekey_host(struct host_entry_t *host) {
return buffer_randomize(host->tls_psk, sizeof(host->tls_psk));
}
volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]) {
struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]) {
if (strlen(devmapper_name) > MAX_DEVMAPPER_NAME_LENGTH - 1) {
log_msg(LLVL_ERROR, "Device mapper name \"%s\" exceeds maximum length of %d characters.", devmapper_name, MAX_DEVMAPPER_NAME_LENGTH - 1);
return false;
@ -229,7 +213,7 @@ volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name,
return NULL;
}
volume_entry_t *volume = &host->volumes[host->volume_count];
struct volume_entry_t *volume = &host->volumes[host->volume_count];
memcpy(volume->volume_uuid, volume_uuid, 16);
strncpy(volume->devmapper_name, devmapper_name, sizeof(volume->devmapper_name) - 1);
if (!buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw))) {
@ -240,8 +224,8 @@ volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name,
return volume;
}
bool keydb_del_volume(host_entry_t *host, const char *devmapper_name) {
volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name) {
struct volume_entry_t *volume = keydb_get_volume_by_name(host, devmapper_name);
if (!volume) {
log_msg(LLVL_ERROR, "No such volume \"%s\" for host \"%s\".", devmapper_name, host->host_name);
return false;
@ -251,7 +235,7 @@ bool keydb_del_volume(host_entry_t *host, const char *devmapper_name) {
log_msg(LLVL_FATAL, "Fatal error determining volume index of \"%s\" for host \"%s\".", devmapper_name, host->host_name);
return false;
}
if (!array_remove(host->volumes, sizeof(volume_entry_t), host->volume_count, index)) {
if (!array_remove(host->volumes, sizeof(struct volume_entry_t), host->volume_count, index)) {
log_msg(LLVL_ERROR, "Failed to remove \"%s\" of host \"%s\".", devmapper_name, host->host_name);
return false;
}
@ -259,15 +243,15 @@ bool keydb_del_volume(host_entry_t *host, const char *devmapper_name) {
return true;
}
bool keydb_rekey_volume(volume_entry_t *volume) {
bool keydb_rekey_volume(struct volume_entry_t *volume) {
return buffer_randomize(volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw));
}
bool keydb_get_volume_luks_passphrase(const volume_entry_t *volume, char *dest, unsigned int dest_buffer_size) {
bool keydb_get_volume_luks_passphrase(const struct volume_entry_t *volume, char *dest, unsigned int dest_buffer_size) {
return ascii_encode(dest, dest_buffer_size, volume->luks_passphrase_raw, sizeof(volume->luks_passphrase_raw));
}
bool keydb_write(const keydb_t *keydb, const char *filename, const char *passphrase) {
bool keydb_write(const struct keydb_t *keydb, const char *filename, const char *passphrase) {
enum kdf_t kdf;
if ((!passphrase) || (strlen(passphrase) == 0)) {
/* For empty password, we can also use garbage KDF */
@ -282,81 +266,26 @@ static bool passphrase_callback(char *buffer, unsigned int bufsize) {
return query_passphrase("Database passphrase: ", buffer, bufsize);
}
static bool keydb_migrate_v2_to_v3(void **keydb_data, unsigned int *keydb_data_size) {
log_msg(LLVL_INFO, "Migrating keydb version 2 to version 3");
struct keydb_v2_t *old_db = *((struct keydb_v2_t **)keydb_data);
unsigned int new_db_size = keydb_getsize_v3_hostcount(old_db->host_count);
struct keydb_v3_t *new_db = calloc(1, new_db_size);
if (!new_db) {
log_msg(LLVL_ERROR, "keydb migration failed to allocate %d bytes of memory", new_db_size);
return false;
}
*new_db = (struct keydb_v3_t) {
.common.keydb_version = 3,
.server_database = old_db->server_database,
.host_count = old_db->host_count,
};
for (unsigned int i = 0; i < new_db->host_count; i++) {
/* Do not copy over host_flags or volumes */
memcpy(&new_db->hosts[i], &old_db->hosts[i], sizeof(old_db->hosts[i]) - sizeof(old_db->hosts[i].volumes));
for (unsigned int j = 0; j < new_db->hosts[i].volume_count; j++) {
/* Do not copy over volume_flags */
memcpy(&new_db->hosts[i].volumes[j], &old_db->hosts[i].volumes[j], sizeof(old_db->hosts[i].volumes[j]));
}
}
OPENSSL_cleanse(old_db, *keydb_data_size);
free(old_db);
*keydb_data = new_db;
*keydb_data_size = new_db_size;
return true;
}
static keydb_t* keydb_migrate(void **keydb_data, unsigned int *keydb_data_size) {
struct keydb_common_header_t *header;
header = *((struct keydb_common_header_t**)keydb_data);
if (header->keydb_version == 2) {
if (*keydb_data_size != keydb_getsize_v2(*keydb_data)) {
log_msg(LLVL_ERROR, "keydb version 2 has wrong size (%u bytes, but expected %u bytes).", *keydb_data_size, keydb_getsize_v2(*keydb_data));
return NULL;
}
if (!keydb_migrate_v2_to_v3(keydb_data, keydb_data_size)) {
log_msg(LLVL_ERROR, "keydb version 2 to 3 migration failed.");
return NULL;
}
}
header = *((struct keydb_common_header_t**)keydb_data);
if (header->keydb_version == 3) {
if (*keydb_data_size != keydb_getsize_v3(*keydb_data)) {
log_msg(LLVL_ERROR, "keydb version 3 has wrong size (%u bytes, but expected %u bytes).", *keydb_data_size, keydb_getsize_v3(*keydb_data));
return NULL;
}
}
header = *((struct keydb_common_header_t**)keydb_data);
if (header->keydb_version != KEYDB_CURRENT_VERSION) {
log_msg(LLVL_ERROR, "keydb could be read, but is of version %u (we expected %u).", header->keydb_version, KEYDB_CURRENT_VERSION);
return NULL;
}
return *((keydb_t**)keydb_data);
}
keydb_t* keydb_read(const char *filename) {
struct keydb_t* keydb_read(const char *filename) {
struct decrypted_file_t decrypted_file = read_encrypted_file(filename, passphrase_callback);
if (!decrypted_file.success) {
return NULL;
}
keydb_t *keydb = keydb_migrate(&decrypted_file.data, &decrypted_file.data_length);
if (!keydb) {
struct keydb_t *keydb = (struct keydb_t*)decrypted_file.data;
if (keydb->keydb_version != KEYDB_VERSION) {
log_msg(LLVL_ERROR, "keydb in %s could be read, but is of version %u (we expected %u).", filename, keydb->keydb_version, KEYDB_VERSION);
OPENSSL_cleanse(decrypted_file.data, decrypted_file.data_length);
free(decrypted_file.data);
return NULL;
}
if (decrypted_file.data_length != keydb_getsize(keydb)) {
log_msg(LLVL_ERROR, "keydb in %s could be read, but was %u bytes long (we expected %u).", filename, decrypted_file.data_length, keydb_getsize(keydb));
OPENSSL_cleanse(decrypted_file.data, decrypted_file.data_length);
free(decrypted_file.data);
return NULL;
}
return keydb;
}

108
keydb.h
View File

@ -30,92 +30,48 @@
#include "file_encryption.h"
#include "global.h"
#define ALIGNED __attribute__ ((aligned(4)))
#define KEYDB_VERSION 2
enum volume_flag_t {
VOLUME_FLAG_ALLOW_DISCARDS = (1 << 0),
struct volume_entry_t {
uint8_t volume_uuid[16]; /* UUID of crypt_LUKS volume */
char devmapper_name[MAX_DEVMAPPER_NAME_LENGTH]; /* dmsetup name when unlocked. Zero-terminated string. */
uint8_t luks_passphrase_raw[LUKS_PASSPHRASE_RAW_SIZE_BYTES]; /* LUKS passphrase used to unlock volume; raw byte data */
};
/* Unused so far */
enum host_flag_t {
HOST_FLAG_UNUSED = 0,
struct host_entry_t {
uint8_t host_uuid[16]; /* Host UUID */
char host_name[MAX_HOST_NAME_LENGTH]; /* Descriptive name of host */
uint8_t tls_psk[PSK_SIZE_BYTES]; /* Raw byte data of TLS-PSK that is used */
unsigned int volume_count; /* Number of volumes of this host */
struct volume_entry_t volumes[MAX_VOLUMES_PER_HOST]; /* Volumes of this host */
};
struct keydb_common_header_t {
struct keydb_t {
unsigned int keydb_version;
} ALIGNED;
struct volume_entry_v2_t {
uint8_t volume_uuid[16]; /* UUID of crypt_LUKS volume */
char devmapper_name[MAX_DEVMAPPER_NAME_LENGTH]; /* dmsetup name when unlocked. Zero-terminated string. */
uint8_t luks_passphrase_raw[LUKS_PASSPHRASE_RAW_SIZE_BYTES]; /* LUKS passphrase used to unlock volume; raw byte data */
} ALIGNED;
struct host_entry_v2_t {
uint8_t host_uuid[16]; /* Host UUID */
char host_name[MAX_HOST_NAME_LENGTH]; /* Descriptive name of host */
uint8_t tls_psk[PSK_SIZE_BYTES]; /* Raw byte data of TLS-PSK that is used */
unsigned int volume_count; /* Number of volumes of this host */
struct volume_entry_v2_t volumes[MAX_VOLUMES_PER_HOST]; /* Volumes of this host */
} ALIGNED;
struct keydb_v2_t {
struct keydb_common_header_t common;
bool server_database;
unsigned int host_count;
struct host_entry_v2_t hosts[];
} ALIGNED;
struct volume_entry_v3_t {
uint8_t volume_uuid[16]; /* UUID of crypt_LUKS volume */
char devmapper_name[MAX_DEVMAPPER_NAME_LENGTH]; /* dmsetup name when unlocked. Zero-terminated string. */
uint8_t luks_passphrase_raw[LUKS_PASSPHRASE_RAW_SIZE_BYTES]; /* LUKS passphrase used to unlock volume; raw byte data */
unsigned int volume_flags; /* Bitset of enum volume_flag_t */
} ALIGNED;
struct host_entry_v3_t {
uint8_t host_uuid[16]; /* Host UUID */
char host_name[MAX_HOST_NAME_LENGTH]; /* Descriptive name of host */
uint8_t tls_psk[PSK_SIZE_BYTES]; /* Raw byte data of TLS-PSK that is used */
unsigned int volume_count; /* Number of volumes of this host */
unsigned int client_default_timeout_secs; /* Client gives up by default if not everything unlocked after this time */
unsigned int host_flags; /* Bitset of enum host_flag_t */
struct volume_entry_v3_t volumes[MAX_VOLUMES_PER_HOST]; /* Volumes of this host */
} ALIGNED;
struct keydb_v3_t {
struct keydb_common_header_t common;
bool server_database;
unsigned int host_count;
struct host_entry_v3_t hosts[];
} ALIGNED;
#define KEYDB_CURRENT_VERSION 3
typedef struct volume_entry_v3_t volume_entry_t;
typedef struct host_entry_v3_t host_entry_t;
typedef struct keydb_v3_t keydb_t;
struct host_entry_t hosts[];
};
/*************** AUTO GENERATED SECTION FOLLOWS ***************/
keydb_t* keydb_new(void);
keydb_t* keydb_export_public(host_entry_t *host);
void keydb_free(keydb_t *keydb);
volume_entry_t* keydb_get_volume_by_name(host_entry_t *host, const char *devmapper_name);
host_entry_t* keydb_get_host_by_name(keydb_t *keydb, const char *host_name);
const volume_entry_t* keydb_get_volume_by_uuid(const host_entry_t *host, const uint8_t uuid[static 16]);
int keydb_get_host_index(const keydb_t *keydb, const host_entry_t *host);
int keydb_get_volume_index(const host_entry_t *host, const volume_entry_t *volume);
const host_entry_t* keydb_get_host_by_uuid(const keydb_t *keydb, const uint8_t uuid[static 16]);
bool keydb_add_host(keydb_t **keydb, const char *host_name);
bool keydb_del_host_by_name(keydb_t **keydb, const char *host_name);
bool keydb_rekey_host(host_entry_t *host);
volume_entry_t* keydb_add_volume(host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]);
bool keydb_del_volume(host_entry_t *host, const char *devmapper_name);
bool keydb_rekey_volume(volume_entry_t *volume);
bool keydb_get_volume_luks_passphrase(const volume_entry_t *volume, char *dest, unsigned int dest_buffer_size);
bool keydb_write(const keydb_t *keydb, const char *filename, const char *passphrase);
keydb_t* keydb_read(const char *filename);
struct keydb_t* keydb_new(void);
struct keydb_t* keydb_export_public(struct host_entry_t *host);
void keydb_free(struct keydb_t *keydb);
struct volume_entry_t* keydb_get_volume_by_name(struct host_entry_t *host, const char *devmapper_name);
struct host_entry_t* keydb_get_host_by_name(struct keydb_t *keydb, const char *host_name);
const struct volume_entry_t* keydb_get_volume_by_uuid(const struct host_entry_t *host, const uint8_t uuid[static 16]);
int keydb_get_host_index(const struct keydb_t *keydb, const struct host_entry_t *host);
int keydb_get_volume_index(const struct host_entry_t *host, const struct volume_entry_t *volume);
const struct host_entry_t* keydb_get_host_by_uuid(const struct keydb_t *keydb, const uint8_t uuid[static 16]);
bool keydb_add_host(struct keydb_t **keydb, const char *host_name);
bool keydb_del_host_by_name(struct keydb_t **keydb, const char *host_name);
bool keydb_rekey_host(struct host_entry_t *host);
struct volume_entry_t* keydb_add_volume(struct host_entry_t *host, const char *devmapper_name, const uint8_t volume_uuid[static 16]);
bool keydb_del_volume(struct host_entry_t *host, const char *devmapper_name);
bool keydb_rekey_volume(struct volume_entry_t *volume);
bool keydb_get_volume_luks_passphrase(const struct volume_entry_t *volume, char *dest, unsigned int dest_buffer_size);
bool keydb_write(const struct keydb_t *keydb, const char *filename, const char *passphrase);
struct keydb_t* keydb_read(const char *filename);
/*************** AUTO GENERATED SECTION ENDS ***************/
#endif

14
luks.c
View File

@ -50,35 +50,25 @@ bool is_luks_device_opened(const char *mapping_name) {
return runresult.success && (runresult.returncode == 0);
}
bool open_luks_device(const uint8_t *encrypted_device_uuid, const char *mapping_name, const char *passphrase, unsigned int passphrase_length, bool allow_discards) {
bool open_luks_device(const uint8_t *encrypted_device_uuid, const char *mapping_name, const char *passphrase, unsigned int passphrase_length) {
char encrypted_device[64];
strcpy(encrypted_device, "UUID=");
sprintf_uuid(encrypted_device + 5, encrypted_device_uuid);
log_msg(LLVL_INFO, "Trying to unlock LUKS mapping %s based on %s", mapping_name, encrypted_device);
struct exec_cmd_t cmd = {
.argv = !allow_discards ? (const char *[]) {
.argv = (const char *[]){
"cryptsetup",
"luksOpen",
"-T", "1",
encrypted_device,
mapping_name,
NULL,
} :
(const char *[]) {
"cryptsetup",
"--allow-discards",
"luksOpen",
"-T", "1",
encrypted_device,
mapping_name,
NULL,
},
.stdin_data = passphrase,
.stdin_length = passphrase_length,
.show_output = should_log(LLVL_DEBUG),
};
struct exec_result_t runresult = exec_command(&cmd);
return runresult.success && (runresult.returncode == 0);
}

2
luks.h
View File

@ -29,7 +29,7 @@
/*************** AUTO GENERATED SECTION FOLLOWS ***************/
bool is_luks_device_opened(const char *mapping_name);
bool open_luks_device(const uint8_t *encrypted_device_uuid, const char *mapping_name, const char *passphrase, unsigned int passphrase_length, bool allow_discards);
bool open_luks_device(const uint8_t *encrypted_device_uuid, const char *mapping_name, const char *passphrase, unsigned int passphrase_length);
/*************** AUTO GENERATED SECTION ENDS ***************/
#endif

2
parsers/parser_client.py
View File

@ -1,6 +1,6 @@
import argparse
parser = argparse.ArgumentParser(prog = "luksrku client", description = "Connects to a luksrku key server and unlocks local LUKS volumes.", add_help = False)
parser.add_argument("-t", "--timeout", metavar = "secs", default = 0, help = "When searching for a keyserver and not all volumes can be unlocked, abort after this period of time, given in seconds. Defaults to infinity. This argument can be specified as a host-based configuration parameter as well; the command-line argument always takes precedence.")
parser.add_argument("-t", "--timeout", metavar = "secs", default = 60, help = "When searching for a keyserver and not all volumes can be unlocked, abort after this period of time, given in seconds. Defaults to %(default)d seconds.")
parser.add_argument("-p", "--port", metavar = "port", default = 23170, help = "Port that is used for both UDP and TCP communication. Defaults to %(default)d.")
parser.add_argument("--no-luks", action = "store_true", help = "Do not call LUKS/cryptsetup. Useful for testing unlocking procedure.")
parser.add_argument("-v", "--verbose", action = "count", default = 0, help = "Increase verbosity. Can be specified multiple times.")

10
server.c
View File

@ -52,7 +52,7 @@
#include "vaulted_keydb.h"
struct keyserver_t {
keydb_t* keydb;
struct keydb_t* keydb;
struct vaulted_keydb_t *vaulted_keydb;
struct generic_tls_ctx_t gctx;
const struct pgmopts_server_t *opts;
@ -61,14 +61,14 @@ struct keyserver_t {
struct client_thread_ctx_t {
struct generic_tls_ctx_t *gctx;
const keydb_t *keydb;
const struct keydb_t *keydb;
struct vaulted_keydb_t *vaulted_keydb;
const host_entry_t *host;
const struct host_entry_t *host;
int fd;
};
struct udp_listen_thread_ctx_t {
const keydb_t *keydb;
const struct keydb_t *keydb;
int udp_sd;
unsigned int port;
};
@ -165,7 +165,7 @@ static void client_handler_thread(void *vctx) {
* client by filling the UUID fields */
struct msg_t msgs[client->host->volume_count];
for (unsigned int i = 0; i < client->host->volume_count; i++) {
const volume_entry_t *volume = &client->host->volumes[i];
const struct volume_entry_t *volume = &client->host->volumes[i];
memcpy(msgs[i].volume_uuid, volume->volume_uuid, 16);
}

12
vaulted_keydb.c
View File

@ -35,9 +35,9 @@ static struct luks_passphrase_vault_entry_t *vaulted_keydb_get_luks_passphrase_f
return ((struct luks_passphrase_vault_entry_t*)vkeydb->luks_passphrase_vault->data) + host_index;
}
static void move_data_into_vault(struct vaulted_keydb_t *dest, keydb_t *src) {
static void move_data_into_vault(struct vaulted_keydb_t *dest, struct keydb_t *src) {
for (unsigned int i = 0; i < src->host_count; i++) {
host_entry_t *host = &src->hosts[i];
struct host_entry_t *host = &src->hosts[i];
/* Copy over TLS-PSK and remove original */
struct tls_psk_vault_entry_t *dest_tls_psk = vaulted_keydb_get_tls_psk_for_hostindex(dest, i);
@ -47,14 +47,14 @@ static void move_data_into_vault(struct vaulted_keydb_t *dest, keydb_t *src) {
/* Copy over all LUKS keys and remove originals */
struct luks_passphrase_vault_entry_t *dest_luks_passphrase = vaulted_keydb_get_luks_passphrase_for_hostindex(dest, i);
for (unsigned int j = 0; j < host->volume_count; j++) {
volume_entry_t *volume = &host->volumes[j];
struct volume_entry_t *volume = &host->volumes[j];
memcpy(&dest_luks_passphrase->volumes[j].luks_passphrase_raw, volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES);
OPENSSL_cleanse(volume->luks_passphrase_raw, LUKS_PASSPHRASE_RAW_SIZE_BYTES);
}
}
}
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const host_entry_t *host) {
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host) {
int host_index = keydb_get_host_index(vaulted_keydb->keydb, host);
if (host_index < 0) {
log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry.");
@ -83,7 +83,7 @@ bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t de
return true;
}
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *vctx, unsigned int volume_index, const void *source), void *copy_ctx, const host_entry_t *host) {
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *vctx, unsigned int volume_index, const void *source), void *copy_ctx, const struct host_entry_t *host) {
int host_index = keydb_get_host_index(vaulted_keydb->keydb, host);
if (host_index < 0) {
log_msg(LLVL_FATAL, "Unable to retrieve host index for vaulted key db entry.");
@ -112,7 +112,7 @@ bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulte
return true;
}
struct vaulted_keydb_t *vaulted_keydb_new(keydb_t *keydb) {
struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb) {
struct vaulted_keydb_t *vaulted_keydb = calloc(1, sizeof(struct vaulted_keydb_t));
if (!vaulted_keydb) {
log_msg(LLVL_FATAL, "Unable to calloc(3) vaulted keydb");

8
vaulted_keydb.h
View File

@ -38,15 +38,15 @@ struct luks_passphrase_vault_entry_t {
};
struct vaulted_keydb_t {
keydb_t *keydb;
struct keydb_t *keydb;
struct vault_t *tls_psk_vault;
struct vault_t *luks_passphrase_vault;
};
/*************** AUTO GENERATED SECTION FOLLOWS ***************/
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const host_entry_t *host);
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *ctx, unsigned int volume_index, const void *source), void *copy_ctx, const host_entry_t *host);
struct vaulted_keydb_t *vaulted_keydb_new(keydb_t *keydb);
bool vaulted_keydb_get_tls_psk(struct vaulted_keydb_t *vaulted_keydb, uint8_t dest[PSK_SIZE_BYTES], const struct host_entry_t *host);
bool vaulted_keydb_get_volume_luks_passphases_raw(struct vaulted_keydb_t *vaulted_keydb, void (*copy_callback)(void *ctx, unsigned int volume_index, const void *source), void *copy_ctx, const struct host_entry_t *host);
struct vaulted_keydb_t *vaulted_keydb_new(struct keydb_t *keydb);
void vaulted_keydb_free(struct vaulted_keydb_t *vaulted_keydb);
/*************** AUTO GENERATED SECTION ENDS ***************/