arch/all-pc/boot/grub2-aros/grub-core/disk/luks.c

   1 /*
   2  *  GRUB  --  GRand Unified Bootloader
   3  *  Copyright (C) 2003,2007,2010,2011  Free Software Foundation, Inc.
   4  *
   5  *  GRUB is free software: you can redistribute it and/or modify
   6  *  it under the terms of the GNU General Public License as published by
   7  *  the Free Software Foundation, either version 3 of the License, or
   8  *  (at your option) any later version.
   9  *
  10  *  GRUB is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include <grub/cryptodisk.h>
  20 #include <grub/types.h>
  21 #include <grub/misc.h>
  22 #include <grub/mm.h>
  23 #include <grub/dl.h>
  24 #include <grub/err.h>
  25 #include <grub/disk.h>
  26 #include <grub/crypto.h>
  27 #include <grub/partition.h>
  28 #include <grub/i18n.h>
  29
  30 GRUB_MOD_LICENSE ("GPLv3+");
  31
  32 #define MAX_PASSPHRASE 256
  33
  34 #define LUKS_KEY_ENABLED  0x00AC71F3
  35
  36 /* On disk LUKS header */
  37 struct grub_luks_phdr
  38 {
  39   grub_uint8_t magic[6];
  40 #define LUKS_MAGIC        "LUKS\xBA\xBE"
  41   grub_uint16_t version;
  42   char cipherName[32];
  43   char cipherMode[32];
  44   char hashSpec[32];
  45   grub_uint32_t payloadOffset;
  46   grub_uint32_t keyBytes;
  47   grub_uint8_t mkDigest[20];
  48   grub_uint8_t mkDigestSalt[32];
  49   grub_uint32_t mkDigestIterations;
  50   char uuid[40];
  51   struct
  52   {
  53     grub_uint32_t active;
  54     grub_uint32_t passwordIterations;
  55     grub_uint8_t passwordSalt[32];
  56     grub_uint32_t keyMaterialOffset;
  57     grub_uint32_t stripes;
  58   } keyblock[8];
  59 } __attribute__ ((packed));
  60
  61 typedef struct grub_luks_phdr *grub_luks_phdr_t;
  62
  63 gcry_err_code_t AF_merge (const gcry_md_spec_t * hash, grub_uint8_t * src,
  64                           grub_uint8_t * dst, grub_size_t blocksize,
  65                           grub_size_t blocknumbers);
  66
  67 static grub_cryptodisk_t
  68 configure_ciphers (grub_disk_t disk, const char *check_uuid,
  69                    int check_boot)
  70 {
  71   grub_cryptodisk_t newdev;
  72   const char *iptr;
  73   struct grub_luks_phdr header;
  74   char *optr;
  75   char uuid[sizeof (header.uuid) + 1];
  76   char ciphername[sizeof (header.cipherName) + 1];
  77   char ciphermode[sizeof (header.cipherMode) + 1];
  78   char *cipheriv = NULL;
  79   char hashspec[sizeof (header.hashSpec) + 1];
  80   grub_crypto_cipher_handle_t cipher = NULL, secondary_cipher = NULL;
  81   grub_crypto_cipher_handle_t essiv_cipher = NULL;
  82   const gcry_md_spec_t *hash = NULL, *essiv_hash = NULL;
  83   const struct gcry_cipher_spec *ciph;
  84   grub_cryptodisk_mode_t mode;
  85   grub_cryptodisk_mode_iv_t mode_iv;
  86   int benbi_log = 0;
  87   grub_err_t err;
  88
  89   if (check_boot)
  90     return NULL;
  91
  92   /* Read the LUKS header.  */
  93   err = grub_disk_read (disk, 0, 0, sizeof (header), &header);
  94   if (err)
  95     {
  96       if (err == GRUB_ERR_OUT_OF_RANGE)
  97         grub_errno = GRUB_ERR_NONE;
  98       return NULL;
  99     }
 100
 101   /* Look for LUKS magic sequence.  */
 102   if (grub_memcmp (header.magic, LUKS_MAGIC, sizeof (header.magic))
 103       || grub_be_to_cpu16 (header.version) != 1)
 104     return NULL;
 105
 106   optr = uuid;
 107   for (iptr = header.uuid; iptr < &header.uuid[ARRAY_SIZE (header.uuid)];
 108        iptr++)
 109     {
 110       if (*iptr != '-')
 111         *optr++ = *iptr;
 112     }
 113   *optr = 0;
 114
 115   if (check_uuid && grub_strcasecmp (check_uuid, uuid) != 0)
 116     {
 117       grub_dprintf ("luks", "%s != %s\n", uuid, check_uuid);
 118       return NULL;
 119     }
 120
 121   /* Make sure that strings are null terminated.  */
 122   grub_memcpy (ciphername, header.cipherName, sizeof (header.cipherName));
 123   ciphername[sizeof (header.cipherName)] = 0;
 124   grub_memcpy (ciphermode, header.cipherMode, sizeof (header.cipherMode));
 125   ciphermode[sizeof (header.cipherMode)] = 0;
 126   grub_memcpy (hashspec, header.hashSpec, sizeof (header.hashSpec));
 127   hashspec[sizeof (header.hashSpec)] = 0;
 128
 129   ciph = grub_crypto_lookup_cipher_by_name (ciphername);
 130   if (!ciph)
 131     {
 132       grub_error (GRUB_ERR_FILE_NOT_FOUND, "Cipher %s isn't available",
 133                   ciphername);
 134       return NULL;
 135     }
 136
 137   /* Configure the cipher used for the bulk data.  */
 138   cipher = grub_crypto_cipher_open (ciph);
 139   if (!cipher)
 140     return NULL;
 141
 142   if (grub_be_to_cpu32 (header.keyBytes) > 1024)
 143     {
 144       grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid keysize %d",
 145                   grub_be_to_cpu32 (header.keyBytes));
 146       return NULL;
 147     }
 148
 149   /* Configure the cipher mode.  */
 150   if (grub_strcmp (ciphermode, "ecb") == 0)
 151     {
 152       mode = GRUB_CRYPTODISK_MODE_ECB;
 153       mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
 154       cipheriv = NULL;
 155     }
 156   else if (grub_strcmp (ciphermode, "plain") == 0)
 157     {
 158       mode = GRUB_CRYPTODISK_MODE_CBC;
 159       mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
 160       cipheriv = NULL;
 161     }
 162   else if (grub_memcmp (ciphermode, "cbc-", sizeof ("cbc-") - 1) == 0)
 163     {
 164       mode = GRUB_CRYPTODISK_MODE_CBC;
 165       cipheriv = ciphermode + sizeof ("cbc-") - 1;
 166     }
 167   else if (grub_memcmp (ciphermode, "pcbc-", sizeof ("pcbc-") - 1) == 0)
 168     {
 169       mode = GRUB_CRYPTODISK_MODE_PCBC;
 170       cipheriv = ciphermode + sizeof ("pcbc-") - 1;
 171     }
 172   else if (grub_memcmp (ciphermode, "xts-", sizeof ("xts-") - 1) == 0)
 173     {
 174       mode = GRUB_CRYPTODISK_MODE_XTS;
 175       cipheriv = ciphermode + sizeof ("xts-") - 1;
 176       secondary_cipher = grub_crypto_cipher_open (ciph);
 177       if (!secondary_cipher)
 178         {
 179           grub_crypto_cipher_close (cipher);
 180           return NULL;
 181         }
 182       if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 183         {
 184           grub_crypto_cipher_close (cipher);
 185           grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
 186                       cipher->cipher->blocksize);
 187           return NULL;
 188         }
 189       if (secondary_cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 190         {
 191           grub_crypto_cipher_close (cipher);
 192           grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported XTS block size: %d",
 193                       secondary_cipher->cipher->blocksize);
 194           return NULL;
 195         }
 196     }
 197   else if (grub_memcmp (ciphermode, "lrw-", sizeof ("lrw-") - 1) == 0)
 198     {
 199       mode = GRUB_CRYPTODISK_MODE_LRW;
 200       cipheriv = ciphermode + sizeof ("lrw-") - 1;
 201       if (cipher->cipher->blocksize != GRUB_CRYPTODISK_GF_BYTES)
 202         {
 203           grub_crypto_cipher_close (cipher);
 204           grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported LRW block size: %d",
 205                       cipher->cipher->blocksize);
 206           return NULL;
 207         }
 208     }
 209   else
 210     {
 211       grub_crypto_cipher_close (cipher);
 212       grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown cipher mode: %s",
 213                   ciphermode);
 214       return NULL;
 215     }
 216
 217   if (cipheriv == NULL);
 218   else if (grub_memcmp (cipheriv, "plain", sizeof ("plain") - 1) == 0)
 219       mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN;
 220   else if (grub_memcmp (cipheriv, "plain64", sizeof ("plain64") - 1) == 0)
 221       mode_iv = GRUB_CRYPTODISK_MODE_IV_PLAIN64;
 222   else if (grub_memcmp (cipheriv, "benbi", sizeof ("benbi") - 1) == 0)
 223     {
 224       if (cipher->cipher->blocksize & (cipher->cipher->blocksize - 1)
 225           || cipher->cipher->blocksize == 0)
 226         grub_error (GRUB_ERR_BAD_ARGUMENT, "Unsupported benbi blocksize: %d",
 227                     cipher->cipher->blocksize);
 228       for (benbi_log = 0;
 229            (cipher->cipher->blocksize << benbi_log) < GRUB_DISK_SECTOR_SIZE;
 230            benbi_log++);
 231       mode_iv = GRUB_CRYPTODISK_MODE_IV_BENBI;
 232     }
 233   else if (grub_memcmp (cipheriv, "null", sizeof ("null") - 1) == 0)
 234       mode_iv = GRUB_CRYPTODISK_MODE_IV_NULL;
 235   else if (grub_memcmp (cipheriv, "essiv:", sizeof ("essiv:") - 1) == 0)
 236     {
 237       char *hash_str = cipheriv + 6;
 238
 239       mode_iv = GRUB_CRYPTODISK_MODE_IV_ESSIV;
 240
 241       /* Configure the hash and cipher used for ESSIV.  */
 242       essiv_hash = grub_crypto_lookup_md_by_name (hash_str);
 243       if (!essiv_hash)
 244         {
 245           grub_crypto_cipher_close (cipher);
 246           grub_error (GRUB_ERR_FILE_NOT_FOUND,
 247                       "Couldn't load %s hash", hash_str);
 248           return NULL;
 249         }
 250       essiv_cipher = grub_crypto_cipher_open (ciph);
 251       if (!essiv_cipher)
 252         {
 253           grub_crypto_cipher_close (cipher);
 254           return NULL;
 255         }
 256     }
 257   else
 258     {
 259       grub_crypto_cipher_close (cipher);
 260       grub_error (GRUB_ERR_BAD_ARGUMENT, "Unknown IV mode: %s",
 261                   cipheriv);
 262       return NULL;
 263     }
 264
 265   /* Configure the hash used for the AF splitter and HMAC.  */
 266   hash = grub_crypto_lookup_md_by_name (hashspec);
 267   if (!hash)
 268     {
 269       grub_crypto_cipher_close (cipher);
 270       grub_crypto_cipher_close (essiv_cipher);
 271       grub_crypto_cipher_close (secondary_cipher);
 272       grub_error (GRUB_ERR_FILE_NOT_FOUND, "Couldn't load %s hash",
 273                   hashspec);
 274       return NULL;
 275     }
 276
 277   newdev = grub_zalloc (sizeof (struct grub_cryptodisk));
 278   if (!newdev)
 279     return NULL;
 280   newdev->cipher = cipher;
 281   newdev->offset = grub_be_to_cpu32 (header.payloadOffset);
 282   newdev->source_disk = NULL;
 283   newdev->benbi_log = benbi_log;
 284   newdev->mode = mode;
 285   newdev->mode_iv = mode_iv;
 286   newdev->secondary_cipher = secondary_cipher;
 287   newdev->essiv_cipher = essiv_cipher;
 288   newdev->essiv_hash = essiv_hash;
 289   newdev->hash = hash;
 290   newdev->log_sector_size = 9;
 291   newdev->total_length = grub_disk_get_size (disk) - newdev->offset;
 292   grub_memcpy (newdev->uuid, uuid, sizeof (newdev->uuid));
 293 #ifdef GRUB_UTIL
 294   newdev->modname = "luks";
 295 #endif
 296   COMPILE_TIME_ASSERT (sizeof (newdev->uuid) >= sizeof (uuid));
 297   return newdev;
 298 }
 299
 300 static grub_err_t
 301 luks_recover_key (grub_disk_t source,
 302                   grub_cryptodisk_t dev)
 303 {
 304   struct grub_luks_phdr header;
 305   grub_size_t keysize;
 306   grub_uint8_t *split_key = NULL;
 307   char passphrase[MAX_PASSPHRASE] = "";
 308   grub_uint8_t candidate_digest[sizeof (header.mkDigest)];
 309   unsigned i;
 310   grub_size_t length;
 311   grub_err_t err;
 312   grub_size_t max_stripes = 1;
 313   char *tmp;
 314
 315   err = grub_disk_read (source, 0, 0, sizeof (header), &header);
 316   if (err)
 317     return err;
 318
 319   grub_puts_ (N_("Attempting to decrypt master key..."));
 320   keysize = grub_be_to_cpu32 (header.keyBytes);
 321
 322   for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
 323     if (grub_be_to_cpu32 (header.keyblock[i].active) == LUKS_KEY_ENABLED
 324         && grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
 325       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);
 326
 327   split_key = grub_malloc (keysize * max_stripes);
 328   if (!split_key)
 329     return grub_errno;
 330
 331   /* Get the passphrase from the user.  */
 332   tmp = NULL;
 333   if (source->partition)
 334     tmp = grub_partition_get_name (source->partition);
 335   grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name,
 336                source->partition ? "," : "", tmp ? : "",
 337                dev->uuid);
 338   grub_free (tmp);
 339   if (!grub_password_get (passphrase, MAX_PASSPHRASE))
 340     {
 341       grub_free (split_key);
 342       return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied");
 343     }
 344
 345   /* Try to recover master key from each active keyslot.  */
 346   for (i = 0; i < ARRAY_SIZE (header.keyblock); i++)
 347     {
 348       gcry_err_code_t gcry_err;
 349       grub_uint8_t candidate_key[keysize];
 350       grub_uint8_t digest[keysize];
 351
 352       /* Check if keyslot is enabled.  */
 353       if (grub_be_to_cpu32 (header.keyblock[i].active) != LUKS_KEY_ENABLED)
 354         continue;
 355
 356       grub_dprintf ("luks", "Trying keyslot %d\n", i);
 357
 358       /* Calculate the PBKDF2 of the user supplied passphrase.  */
 359       gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase,
 360                                      grub_strlen (passphrase),
 361                                      header.keyblock[i].passwordSalt,
 362                                      sizeof (header.keyblock[i].passwordSalt),
 363                                      grub_be_to_cpu32 (header.keyblock[i].
 364                                                        passwordIterations),
 365                                      digest, keysize);
 366
 367       if (gcry_err)
 368         {
 369           grub_free (split_key);
 370           return grub_crypto_gcry_error (gcry_err);
 371         }
 372
 373       grub_dprintf ("luks", "PBKDF2 done\n");
 374
 375       gcry_err = grub_cryptodisk_setkey (dev, digest, keysize);
 376       if (gcry_err)
 377         {
 378           grub_free (split_key);
 379           return grub_crypto_gcry_error (gcry_err);
 380         }
 381
 382       length = (keysize * grub_be_to_cpu32 (header.keyblock[i].stripes));
 383
 384       /* Read and decrypt the key material from the disk.  */
 385       err = grub_disk_read (source,
 386                             grub_be_to_cpu32 (header.keyblock
 387                                               [i].keyMaterialOffset), 0,
 388                             length, split_key);
 389       if (err)
 390         {
 391           grub_free (split_key);
 392           return err;
 393         }
 394
 395       gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0);
 396       if (gcry_err)
 397         {
 398           grub_free (split_key);
 399           return grub_crypto_gcry_error (gcry_err);
 400         }
 401
 402       /* Merge the decrypted key material to get the candidate master key.  */
 403       gcry_err = AF_merge (dev->hash, split_key, candidate_key, keysize,
 404                            grub_be_to_cpu32 (header.keyblock[i].stripes));
 405       if (gcry_err)
 406         {
 407           grub_free (split_key);
 408           return grub_crypto_gcry_error (gcry_err);
 409         }
 410
 411       grub_dprintf ("luks", "candidate key recovered\n");
 412
 413       /* Calculate the PBKDF2 of the candidate master key.  */
 414       gcry_err = grub_crypto_pbkdf2 (dev->hash, candidate_key,
 415                                      grub_be_to_cpu32 (header.keyBytes),
 416                                      header.mkDigestSalt,
 417                                      sizeof (header.mkDigestSalt),
 418                                      grub_be_to_cpu32
 419                                      (header.mkDigestIterations),
 420                                      candidate_digest,
 421                                      sizeof (candidate_digest));
 422       if (gcry_err)
 423         {
 424           grub_free (split_key);
 425           return grub_crypto_gcry_error (gcry_err);
 426         }
 427
 428       /* Compare the calculated PBKDF2 to the digest stored
 429          in the header to see if it's correct.  */
 430       if (grub_memcmp (candidate_digest, header.mkDigest,
 431                        sizeof (header.mkDigest)) != 0)
 432         {
 433           grub_dprintf ("luks", "bad digest\n");
 434           continue;
 435         }
 436
 437       /* TRANSLATORS: It's a cryptographic key slot: one element of an array
 438          where each element is either empty or holds a key.  */
 439       grub_printf_ (N_("Slot %d opened\n"), i);
 440
 441       /* Set the master key.  */
 442       gcry_err = grub_cryptodisk_setkey (dev, candidate_key, keysize);
 443       if (gcry_err)
 444         {
 445           grub_free (split_key);
 446           return grub_crypto_gcry_error (gcry_err);
 447         }
 448
 449       grub_free (split_key);
 450
 451       return GRUB_ERR_NONE;
 452     }
 453
 454   return GRUB_ACCESS_DENIED;
 455 }
 456
 457 struct grub_cryptodisk_dev luks_crypto = {
 458   .scan = configure_ciphers,
 459   .recover_key = luks_recover_key
 460 };
 461
 462 GRUB_MOD_INIT (luks)
 463 {
 464   COMPILE_TIME_ASSERT (sizeof (((struct grub_luks_phdr *) 0)->uuid)
 465                        < GRUB_CRYPTODISK_MAX_UUID_LENGTH);
 466   grub_cryptodisk_dev_register (&luks_crypto);
 467 }
 468
 469 GRUB_MOD_FINI (luks)
 470 {
 471   grub_cryptodisk_dev_unregister (&luks_crypto);
 472 }