rpms/cryptsetup
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport upstream changes to disallow images with invalid CAPI cipher.

Browse Source 
Backport the cipher check also to cryptsetup-reencrypt and add test for
it.

- Resolves: #2212772
This commit is contained in:
Daniel Zatovic 2023-06-28 15:06:06 +02:00
parent 464cf81f41
commit 03c2771916
5 changed files with 114 additions and 68 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1,2 +1,3 @@
SOURCES/cryptsetup-2.3.7.tar.xz
/cryptsetup-2.3.7.tar.xz
/tests.tar.xz

85
cryptsetup-2.7.0-Fix-activation-of-LUKS2-with-capi-format-cipher-and-.patch
View File

@ -22,11 +22,11 @@ Fixes: #820
5 files changed, 25 insertions(+), 2 deletions(-)
create mode 100644 tests/luks2_invalid_cipher.img.xz
diff --git a/lib/luks2/luks2_json_metadata.c b/lib/luks2/luks2_json_metadata.c
index 2fcc8aa6..b1d0c05d 100644
--- a/lib/luks2/luks2_json_metadata.c
+++ b/lib/luks2/luks2_json_metadata.c
@@ -2605,6 +2605,11 @@ int LUKS2_activate(struct crypt_device *cd,
Index: cryptsetup-2.3.7/lib/luks2/luks2_json_metadata.c
===================================================================
--- cryptsetup-2.3.7.orig/lib/luks2/luks2_json_metadata.c
+++ cryptsetup-2.3.7/lib/luks2/luks2_json_metadata.c
@@ -2324,6 +2324,11 @@ int LUKS2_activate(struct crypt_device *
if ((r = LUKS2_unmet_requirements(cd, hdr, 0, 0)))
return r;
@ -38,33 +38,19 @@ index 2fcc8aa6..b1d0c05d 100644
r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd),
vk, crypt_get_cipher_spec(cd), crypt_get_iv_offset(cd),
crypt_get_data_offset(cd), crypt_get_integrity(cd) ?: "none",
diff --git a/tests/Makefile.am b/tests/Makefile.am
index c8a46a85..6feaef3b 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -68,6 +68,7 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
luks2_valid_hdr.img.xz \
luks2_header_requirements.tar.xz \
luks2_mda_images.tar.xz \
+ luks2_invalid_cipher.img.xz \
evil_hdr-payload_overwrite.xz \
evil_hdr-stripes_payload_dmg.xz \
evil_hdr-luks_hdr_damage.xz \
@@ -110,7 +111,8 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
Index: cryptsetup-2.3.7/tests/compat-test2
===================================================================
--- cryptsetup-2.3.7.orig/tests/compat-test2
+++ cryptsetup-2.3.7/tests/compat-test2
@@ -3,6 +3,7 @@
PS4='$LINENO:'
[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
+CRYPTSETUP_REENCRYPT=$CRYPTSETUP_PATH/cryptsetup-reencrypt
CLEANFILES = cryptsetup-tst* valglog* *-fail-*.log test-symbols-list.h fake_token_path.so fake_systemd_tpm_path.so
clean-local:
- -rm -rf tcrypt-images luks1-images luks2-images bitlk-images fvault2-images conversion_imgs luks2_valid_hdr.img blkid-luks2-pv-img blkid-luks2-pv-img.bcp external-tokens
+ -rm -rf tcrypt-images luks1-images luks2-images bitlk-images fvault2-images conversion_imgs \
+ luks2_valid_hdr.img blkid-luks2-pv-img blkid-luks2-pv-img.bcp external-tokens luks2_invalid_cipher.img
differ_SOURCES = differ.c
differ_CFLAGS = $(AM_CFLAGS) -Wall -O2
diff --git a/tests/compat-test2 b/tests/compat-test2
index c54dc7ea..8b6bb073 100755
--- a/tests/compat-test2
+++ b/tests/compat-test2
@@ -16,6 +16,7 @@ IMG10=luks-test-v10
CRYPTSETUP_VALGRIND=../.libs/cryptsetup
CRYPTSETUP_LIB_VALGRIND=../.libs
@@ -16,6 +17,7 @@ IMG10=luks-test-v10
HEADER_IMG=luks-header
HEADER_KEYU=luks2_keyslot_unassigned.img
HEADER_LUKS2_PV=blkid-luks2-pv.img
@ -72,7 +58,7 @@ index c54dc7ea..8b6bb073 100755
KEY1=key1
KEY2=key2
KEY5=key5
@@ -50,7 +51,9 @@ function remove_mapping()
@@ -50,7 +52,9 @@ function remove_mapping()
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
losetup -d $LOOPDEV >/dev/null 2>&1
@ -83,9 +69,9 @@ index c54dc7ea..8b6bb073 100755
# unlink whole test keyring
[ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null
@@ -1200,5 +1203,17 @@ if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
$CRYPTSETUP open -q --test-passphrase --token-only --token-id 0 -q $IMG || fail
fi
@@ -1049,5 +1053,19 @@ for cipher in $CIPHERS ; do
done
echo
+prepare "[44] LUKS2 invalid cipher (kernel cipher driver name)" wipe
+xz -dk $HEADER_LUKS2_INV.xz
@ -94,6 +80,8 @@ index c54dc7ea..8b6bb073 100755
+echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
+echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME 2>&1 | grep -q "No known cipher specification pattern" || fail
+echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV >/dev/null 2>&1 && fail
+echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV 2>&1 | grep -q "No known cipher specification pattern" || fail
+echo $PWD1 | $CRYPTSETUP_REENCRYPT $LOOPDEV 2>&1 | grep -q "No known cipher specification pattern" || fail
+dmsetup create $DEV_NAME --uuid CRYPT-LUKS2-3d20686f551748cb89911ad32379821b-test --table \
+ "0 8 crypt capi:xts(ecb(aes-generic))-plain64 edaa40709797973715e572bf7d86fcbb9cfe2051083c33c28d58fe4e1e7ff642 0 $LOOPDEV 32768"
+$CRYPTSETUP status $DEV_NAME | grep -q "n/a" || fail
@ -101,18 +89,15 @@ index c54dc7ea..8b6bb073 100755
+
remove_mapping
exit 0
diff --git a/tests/meson.build b/tests/meson.build
index 00f629f5..7bb3f406 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -21,6 +21,7 @@ test_files_to_copy = [
'luks2_keyslot_unassigned.img.xz',
'luks2_mda_images.tar.xz',
'luks2_valid_hdr.img.xz',
+ 'luks2_invalid_cipher.img.xz',
'tcrypt-images.tar.xz',
'valid_header_file.xz',
'xfs_512_block_size.img.xz',
--
2.40.1
Index: cryptsetup-2.3.7/src/cryptsetup.h
===================================================================
--- cryptsetup-2.3.7.orig/src/cryptsetup.h
+++ cryptsetup-2.3.7/src/cryptsetup.h
@@ -103,6 +103,7 @@ void tools_clear_line(void);
int tools_wipe_progress(uint64_t size, uint64_t offset, void *usrptr);
int tools_reencrypt_progress(uint64_t size, uint64_t offset, void *usrptr);
int reencrypt_is_header_detached(const char *header_device, const char *data_device);
+bool luks2_reencrypt_eligible(struct crypt_device *cd);
int tools_read_mk(const char *file, char **key, int keysize);
int tools_write_mk(const char *file, const char *key, int keysize);

80
cryptsetup-2.7.0-Fix-reencryption-to-fail-properly-for-unknown-cipher.patch
View File

@ -9,23 +9,73 @@ check it in advance.
src/utils_reencrypt.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/utils_reencrypt.c b/src/utils_reencrypt.c
index a78557cb..8ffceb36 100644
--- a/src/utils_reencrypt.c
+++ b/src/utils_reencrypt.c
@@ -419,6 +419,12 @@ static bool luks2_reencrypt_eligible(struct crypt_device *cd)
return false;
}
Index: cryptsetup-2.3.7/src/cryptsetup.c
===================================================================
--- cryptsetup-2.3.7.orig/src/cryptsetup.c
+++ cryptsetup-2.3.7/src/cryptsetup.c
@@ -2999,6 +2999,12 @@ static int action_encrypt_luks2(struct c
if (r < 0)
goto err;
+ /* Check that cipher is in compatible format */
+ if (!crypt_get_cipher(cd)) {
+ if (!crypt_get_cipher(*cd)) {
+ log_err(_("No known cipher specification pattern detected in LUKS2 header."));
+ return false;
+ r = -EINVAL;
+ goto err;
+ }
+
return true;
}
if (opt_data_shift) {
params.data_shift = imaxabs(opt_data_shift) / SECTOR_SIZE,
params.resilience = "datashift";
@@ -3068,6 +3074,11 @@ static int action_decrypt_luks2(struct c
};
size_t passwordLen;
--
2.40.1
+ if (!crypt_get_cipher(cd)) {
+ log_err(_("No known cipher specification pattern detected in LUKS2 header."));
+ return -EINVAL;
+ }
+
if (!crypt_get_metadata_device_name(cd) || !crypt_get_device_name(cd) ||
!strcmp(crypt_get_metadata_device_name(cd), crypt_get_device_name(cd))) {
log_err(_("LUKS2 decryption is supported with detached header device only."));
@@ -3289,6 +3300,11 @@ static int action_reencrypt_luks2(struct
.luks2 = &luks2_params,
};
+ if (!crypt_get_cipher(cd)) {
+ log_err(_("No known cipher specification pattern detected in LUKS2 header."));
+ return -EINVAL;
+ }
+
_set_reencryption_flags(&params.flags);
if (!opt_cipher && crypt_is_cipher_null(crypt_get_cipher(cd))) {
Index: cryptsetup-2.3.7/src/cryptsetup_reencrypt.c
===================================================================
--- cryptsetup-2.3.7.orig/src/cryptsetup_reencrypt.c
+++ cryptsetup-2.3.7/src/cryptsetup_reencrypt.c
@@ -185,6 +185,11 @@ static int set_reencrypt_requirement(con
crypt_persistent_flags_get(cd, CRYPT_FLAGS_REQUIREMENTS, &reqs))
goto out;
+ if (!crypt_get_cipher(cd)) {
+ log_err(_("No known cipher specification pattern detected in LUKS2 header."));
+ goto out;
+ }
+
/* reencrypt already in-progress */
if (reqs & CRYPT_REQUIREMENT_OFFLINE_REENCRYPT) {
log_err(_("Reencryption already in-progress."));
@@ -709,6 +714,12 @@ static int backup_luks_headers(struct re
(r = crypt_load(cd, CRYPT_LUKS, NULL)))
goto out;
+ if (!crypt_get_cipher(cd)) {
+ log_err(_("No known cipher specification pattern detected in LUKS2 header."));
+ r = -EINVAL;
+ goto out;
+ }
+
if ((r = crypt_header_backup(cd, CRYPT_LUKS, rc->header_file_org)))
goto out;
if (isLUKS2(rc->type)) {

15
cryptsetup.spec
View File

@ -5,7 +5,7 @@ Obsoletes: cryptsetup-python3
Summary: A utility for setting up encrypted disks
Name: cryptsetup
Version: 2.3.7
Release: 5%{?dist}
Release: 6%{?dist}
License: GPLv2+ and LGPLv2+
Group: Applications/System
URL: https://gitlab.com/cryptsetup/cryptsetup
@ -19,6 +19,9 @@ Requires: libpwquality >= 1.2.0
%global upstream_version %{version}
Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{upstream_version}.tar.xz
# binary archive with updated tests/conversion_imgs.tar.xz and tests/luks2_header_requirements.tar.xz
# for testing (can not be patched via rpmbuild)
Source1: tests.tar.xz
# Following patch has to applied last
Patch0: %{name}-add-system-library-paths.patch
# Remove the patch when (if ever) osci infrastructure gets stable enough
@ -39,6 +42,8 @@ Patch14: %{name}-2.6.1-Abort-encryption-when-header-and-data-devices-are-sa.patc
Patch15: %{name}-2.7.0-Disallow-use-of-internal-kenrel-crypto-driver-names-.patch
Patch16: %{name}-2.7.0-Also-disallow-active-devices-with-internal-kernel-na.patch
Patch17: %{name}-2.7.0-Fix-init_by_name-to-allow-unknown-cipher-format-in-d.patch
Patch18: %{name}-2.7.0-Fix-reencryption-to-fail-properly-for-unknown-cipher.patch
Patch19: %{name}-2.7.0-Fix-activation-of-LUKS2-with-capi-format-cipher-and-.patch
%description
The cryptsetup package contains a utility for setting up
@ -93,7 +98,7 @@ This package contains cryptsetup-reencrypt utility which
can be used for offline reencryption of disk in situ.
%prep
%setup -q -n cryptsetup-%{upstream_version}
%setup -q -n cryptsetup-%{upstream_version} -a 1
%patch1 -p1
%patch2 -p1
%patch3 -p1
@ -111,6 +116,8 @@ can be used for offline reencryption of disk in situ.
%patch15 -p1
%patch16 -p1
%patch17 -p1
%patch18 -p1
%patch19 -p1
%patch0 -p1
chmod -x misc/dracut_90reencrypt/*
@ -170,11 +177,13 @@ rm -rf %{buildroot}/%{_libdir}/*.la
%clean
%changelog
* Thu Jun 22 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
* Thu Jun 28 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
- patch: Delegate FIPS mode detection to configured crypto backend
- patch: Disallow use of internal kenrel crypto driver names in "capi"
- patch: Also disallow active devices with internal kernel names
- patch: Fix init_by_name to allow unknown cipher format in dm-crypt
- patch: Fix reencryption to fail properly for unknown cipher
- patch: Fix activation of LUKS2 with capi format cipher and kernel
- Resolves: #2212772 #2193342
* Tue Jan 10 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-5

1
sources
View File

@ -1 +1,2 @@
SHA512 (cryptsetup-2.3.7.tar.xz) = d209225c6f195f54c513904b71637bdadd47f3efc6227c61c15434a1467ddb76fe14123683a3d5e943ffa203ef33611f51b7c67bc1aed67d019a6aa552ea15ab
SHA512 (tests.tar.xz) = 3154668ad4e481bf4e98afade202fc302fb72c595eea1bd374de7570ab15a2a9888743db491b812c4ba6006371adaaa0452315027e4ce2a6e6922cc640f47cf0