lib/libtcplay/tcplay.h

   1 /*
   2  * Copyright (c) 2011 Alex Hornung <alex@alexhornung.com>.
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in
  13  *    the documentation and/or other materials provided with the
  14  *    distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  18  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  19  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  20  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  21  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  22  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  24  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  25  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  26  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  */
  29
  30 /* Version of tcplay specified during build (CMakeLists.txt, Makefile.classic) */
  31
  32 #ifndef _TCPLAY_H
  33 #define _TCPLAY_H
  34
  35 #define MAX_BLKSZ               4096
  36 #define MAX_KEYSZ               192
  37 #define HDRSZ                   512
  38 #define HDR_OFFSET_SYS          31744   /* 512 * (63 -1) */
  39 #define TC_SIG                  "TRUE"
  40 #define MAX_PASSSZ              64
  41 #define PASS_BUFSZ              256
  42 #define KPOOL_SZ                64
  43 #define MAX_KFILE_SZ            1048576 /* 1 MB */
  44 #define MAX_KEYFILES            256
  45 #define HDR_OFFSET_HIDDEN       65536
  46 #define BACKUP_HDR_HIDDEN_OFFSET_END    65536
  47 #define BACKUP_HDR_OFFSET_END   131072
  48 #define SALT_LEN                64
  49 #define VOL_RSVD_BYTES_START    (256*512) /* Reserved bytes at vol. start */
  50 #define VOL_RSVD_BYTES_END      (256*512) /* Reserved bytes at vol. end */
  51 #define MIN_VOL_BYTES           (VOL_RSVD_BYTES_START + VOL_RSVD_BYTES_END)
  52
  53 #define MAX_CIPHER_CHAINS       64
  54 #define DEFAULT_RETRIES         3
  55 #define ERASE_BUFFER_SIZE       4*1024*1024 /* 4 MB */
  56
  57 /* TrueCrypt Volume flags */
  58 #define TC_VOLFLAG_SYSTEM       0x01    /* system encryption */
  59 #define TC_VOLFLAG_INPLACE      0x02    /* non-system in-place-encrypted volume */
  60
  61 #define TC_VOLFLAG_SET(f, x)    ((f & TC_VOLFLAG_##x) == TC_VOLFLAG_##x)
  62
  63 #define LOG_BUFFER_SZ           1024
  64 #if 0
  65 #define DEBUG 1
  66 #endif
  67
  68 #define TC_FLAG_SYS             0x0001
  69 #define TC_FLAG_FDE             0x0002
  70 #define TC_FLAG_BACKUP          0x0004
  71 #define TC_FLAG_ONLY_RESTORE    0x0008
  72 #define TC_FLAG_ALLOW_TRIM      0x0010
  73 #define TC_FLAG_SAVE_TO_FILE    0x0020
  74 #define TC_FLAG_HDR_FROM_FILE   0x0040
  75 #define TC_FLAG_H_HDR_FROM_FILE 0x0080
  76
  77 #define TC_FLAG_SET(f, x)       ((f & TC_FLAG_##x) == TC_FLAG_##x)
  78
  79 #include <limits.h>
  80 #include <inttypes.h>
  81
  82 #if defined(__DragonFly__)
  83 #include <uuid.h>
  84 #elif defined(__linux__)
  85 #include <uuid/uuid.h>
  86 #endif
  87
  88
  89 typedef uint64_t disksz_t;
  90 #define DISKSZ_FMT PRIu64
  91
  92
  93 struct pbkdf_prf_algo {
  94         const char *name;
  95         int iteration_count;
  96 };
  97
  98 struct tc_crypto_algo {
  99         const char *name;
 100         const char *dm_crypt_str;
 101         int klen;
 102         int ivlen;
 103 };
 104
 105 struct tc_cipher_chain {
 106         struct tc_crypto_algo *cipher;
 107         unsigned char *key;
 108         char dm_key[MAX_KEYSZ*2 + 1];
 109
 110         struct tc_cipher_chain *prev;
 111         struct tc_cipher_chain *next;
 112 };
 113
 114 struct tchdr_enc {
 115         unsigned char salt[SALT_LEN];   /* Salt for PBKDF */
 116         unsigned char enc[448];         /* Encrypted part of the header */
 117 } __attribute__((__packed__));
 118
 119 struct tchdr_dec {
 120         char            tc_str[4];      /* ASCII string "TRUE" */
 121         uint16_t        tc_ver;         /* Volume header format version */
 122         uint16_t        tc_min_ver;
 123         uint32_t        crc_keys;       /* CRC32 of the key section */
 124         uint64_t        vol_ctime;      /* Volume creation time */
 125         uint64_t        hdr_ctime;      /* Header creation time */
 126         uint64_t        sz_hidvol;      /* Size of hidden volume (set to zero
 127                                            in non-hidden volumes) */
 128         uint64_t        sz_vol;         /* Size of volume */
 129         uint64_t        off_mk_scope;   /* Byte offset of the start of the
 130                                            master key scope */
 131         uint64_t        sz_mk_scope;    /* Size of the encrypted area within
 132                                            the master key scope */
 133         uint32_t        flags;          /* Flag bits
 134                                            (bit 0: system encryption;
 135                                            bit 1: non-system in-place-encrypted volume;
 136                                            bits 2–31 are reserved) */
 137         uint32_t        sec_sz;         /* Sector size (in bytes) */
 138         unsigned char   unused3[120];
 139         uint32_t        crc_dhdr;       /* CRC32 of dec. header (except keys) */
 140         unsigned char   keys[256];
 141 } __attribute__((__packed__));
 142
 143 struct tcplay_info {
 144         char dev[PATH_MAX];
 145         struct tchdr_dec *hdr;
 146         struct tc_cipher_chain *cipher_chain;
 147         struct pbkdf_prf_algo *pbkdf_prf;
 148         char key[MAX_KEYSZ*2 + 1];
 149
 150         int flags;
 151         int volflags;
 152
 153         uint32_t blk_sz;
 154
 155         off_t start;    /* Logical volume offset in table (in blk_sz blocks) */
 156         disksz_t size;  /* Volume size (in blk_sz blocks) */
 157
 158         off_t skip;     /* IV offset (in blk_sz blocks) */
 159         off_t offset;   /* Block offset (in blk_sz blocks) */
 160
 161         /* Populated by dm_setup */
 162         uuid_t uuid;
 163
 164         int hidden;
 165 };
 166
 167 #define INFO_TO_DM_BLOCKS(info, memb) \
 168     (((info)->memb * (uint64_t)((info)->blk_sz))/512)
 169
 170 struct tcplay_dm_table {
 171         char device[PATH_MAX];  /* Underlying device */
 172         char target[256];       /* DM Target type */
 173         off_t start;            /* Logical volume offset in table */
 174         disksz_t size;          /* Volume size */
 175
 176         char cipher[256];       /* Cipher */
 177         off_t skip;             /* IV offset */
 178         off_t offset;           /* Block offset */
 179 };
 180
 181
 182 typedef int (*tc_state_change_fn)(void *, const char *, int);
 183
 184 struct tcplay_opts {
 185         /* (Mostly) common options */
 186         const char      *dev;
 187         const char      *keyfiles[MAX_KEYFILES];
 188         int             nkeyfiles;
 189         const char      *h_keyfiles[MAX_KEYFILES];
 190         int             n_hkeyfiles;
 191         struct pbkdf_prf_algo   *prf_algo;
 192         struct tc_cipher_chain  *cipher_chain;
 193         struct pbkdf_prf_algo   *h_prf_algo;
 194         struct tc_cipher_chain  *h_cipher_chain;
 195         const char      *passphrase;
 196         const char      *h_passphrase;
 197         int             interactive;
 198         int             weak_keys_and_salt;
 199
 200         /* Options for create */
 201         int             hidden;
 202         disksz_t        hidden_size_bytes;
 203         int             secure_erase; /* XXX: default to 1! */
 204
 205         /* Options for map, info_mapped */
 206         const char      *map_name;
 207
 208         /* Options for info, map, modify */
 209         int             flags;
 210         const char      *sys_dev;
 211         int             protect_hidden;
 212         int             retries;        /* XXX: default to DEFAULT_RETRIES */
 213         time_t          timeout;
 214
 215         const char      *hdr_file_in;
 216         const char      *h_hdr_file_in;
 217
 218         /* Options for modify only */
 219         struct pbkdf_prf_algo   *new_prf_algo;
 220         const char      *new_passphrase;
 221         const char      *hdr_file_out;
 222         const char      *new_keyfiles[MAX_KEYFILES];
 223         int             n_newkeyfiles;
 224
 225         void            *api_ctx;
 226         tc_state_change_fn      state_change_fn;
 227 };
 228
 229
 230 struct tcplay_opts *opts_init(void);
 231 int opts_add_keyfile(struct tcplay_opts *opts, const char *keyfile);
 232 int opts_add_keyfile_hidden(struct tcplay_opts *opts, const char *keyfile);
 233 int opts_add_keyfile_new(struct tcplay_opts *opts, const char *keyfile);
 234 void opts_free(struct tcplay_opts *opts);
 235 void opts_clear_keyfile(struct tcplay_opts *opts);
 236 void opts_clear_keyfile_hidden(struct tcplay_opts *opts);
 237 void opts_clear_keyfile_new(struct tcplay_opts *opts);
 238
 239 void *read_to_safe_mem(const char *file, off_t offset, size_t *sz);
 240 int get_random(unsigned char *buf, size_t len, int weak);
 241 int secure_erase(const char *dev, disksz_t bytes, size_t blksz);
 242 int get_disk_info(const char *dev, disksz_t *blocks, size_t *bsize);
 243 int write_to_disk(const char *dev, off_t offset, size_t blksz, void *mem,
 244     size_t bytes);
 245 int write_to_file(const char *file, void *mem, size_t bytes);
 246 int read_passphrase(const char *prompt, char *pass, size_t passlen,
 247     size_t bufsz, time_t timeout);
 248 float get_random_read_progress(void);
 249 float get_secure_erase_progress(void);
 250
 251
 252 int tc_crypto_init(void);
 253 int tc_cipher_chain_populate_keys(struct tc_cipher_chain *cipher_chain,
 254     unsigned char *key);
 255 int tc_cipher_chain_free_keys(struct tc_cipher_chain *cipher_chain);
 256 int tc_encrypt(struct tc_cipher_chain *cipher_chain, unsigned char *key,
 257     unsigned char *iv,
 258     unsigned char *in, int in_len, unsigned char *out);
 259 int tc_decrypt(struct tc_cipher_chain *cipher_chain, unsigned char *key,
 260     unsigned char *iv,
 261     unsigned char *in, int in_len, unsigned char *out);
 262
 263 /* The following two are platform dependent */
 264 int syscrypt(struct tc_crypto_algo *cipher, unsigned char *key, size_t klen,
 265     unsigned char *iv, unsigned char *in, unsigned char *out, size_t len,
 266     int do_encrypt);
 267 int pbkdf2(struct pbkdf_prf_algo *hash, const char *pass, int passlen,
 268     const unsigned char *salt, int saltlen,
 269     int keylen, unsigned char *out);
 270
 271 int apply_keyfiles(unsigned char *pass, size_t pass_memsz, const char *keyfiles[],
 272     int nkeyfiles);
 273
 274 struct tchdr_enc *create_hdr(unsigned char *pass, int passlen,
 275     struct pbkdf_prf_algo *prf_algo, struct tc_cipher_chain *cipher_chain,
 276     size_t sec_sz, disksz_t total_blocks,
 277     off_t offset, disksz_t blocks, int hidden, int weak,
 278     struct tchdr_enc **backup_hdr);
 279 struct tchdr_dec *decrypt_hdr(struct tchdr_enc *ehdr,
 280     struct tc_cipher_chain *cipher_chain, unsigned char *key);
 281 int verify_hdr(struct tchdr_dec *hdr);
 282 struct tchdr_enc *copy_reencrypt_hdr(unsigned char *pass, int passlen,
 283     struct pbkdf_prf_algo *prf_algo, int weak, struct tcplay_info *info,
 284     struct tchdr_enc **backup_hdr);
 285
 286 void *_alloc_safe_mem(size_t req_sz, const char *file, int line);
 287 void *_strdup_safe_mem(const char *in, const char *file, int line);
 288 void _free_safe_mem(void *mem, const char *file, int line);
 289 void check_and_purge_safe_mem(void);
 290
 291 struct tc_crypto_algo *check_cipher(const char *cipher, int quiet);
 292 struct tc_cipher_chain *check_cipher_chain(const char *cipher_chain, int quiet);
 293 struct pbkdf_prf_algo *check_prf_algo(const char *algo, int quiet);
 294
 295 int tc_play_init(void);
 296 void tc_log(int err, const char *fmt, ...);
 297 int tc_cipher_chain_klen(struct tc_cipher_chain *chain);
 298 int tc_cipher_chain_length(struct tc_cipher_chain *chain);
 299 char *tc_cipher_chain_sprint(char *buf, size_t bufsz,
 300     struct tc_cipher_chain *chain);
 301 int free_info(struct tcplay_info *info);
 302 void print_info(struct tcplay_info *info);
 303 int adjust_info(struct tcplay_info *info, struct tcplay_info *hinfo);
 304 int process_hdr(const char *dev, int flags, unsigned char *pass, int passlen,
 305     struct tchdr_enc *ehdr, struct tcplay_info **pinfo);
 306 int create_volume(struct tcplay_opts *opts);
 307 struct tcplay_info *info_map_common(struct tcplay_opts *opts,
 308     char *passphrase_out);
 309 int info_mapped_volume(struct tcplay_opts *opts);
 310 int info_volume(struct tcplay_opts *opts);
 311 int map_volume(struct tcplay_opts *opts);
 312 int modify_volume(struct tcplay_opts *opts);
 313 int dm_setup(const char *mapname, struct tcplay_info *info);
 314 int dm_teardown(const char *mapname, const char *device);
 315 struct tcplay_info *dm_info_map(const char *map_name);
 316
 317 typedef void(*summary_fn_t)(void);
 318
 319 extern int tc_internal_verbose;
 320 extern char tc_internal_log_buffer[];
 321 extern summary_fn_t summary_fn;
 322 extern struct pbkdf_prf_algo pbkdf_prf_algos[];
 323 extern struct tc_cipher_chain *tc_cipher_chains[MAX_CIPHER_CHAINS];
 324
 325 #define STATE_UNKNOWN           0
 326 #define STATE_GET_RANDOM        1
 327 #define STATE_ERASE             2
 328
 329 extern int tc_internal_state;
 330 #ifndef __DECONST
 331 #define __DECONST(type, var)    ((type)(uintptr_t)(const void *)(var))
 332 #endif
 333
 334 #define alloc_safe_mem(x) \
 335         _alloc_safe_mem(x, __FILE__, __LINE__)
 336
 337 #define strdup_safe_mem(x) \
 338         _strdup_safe_mem(x, __FILE__, __LINE__)
 339
 340 #define free_safe_mem(x) \
 341         _free_safe_mem(__DECONST(void *, x), __FILE__, __LINE__)
 342
 343 #define __unused       __attribute__((__unused__))
 344
 345 #endif