From 3e4c69a01709d35322ffa17c5360608907a207d7 Mon Sep 17 00:00:00 2001

From: Ondrej Kozina <okozina@redhat.com>

Date: Tue, 11 Oct 2022 11:48:13 +0200

Subject: [PATCH 5/5] Fix internal crypt segment compare routine.

The function is supposed to check if manipulated

active dm-crypt device matches the on-disk metadata.

Unfortunately it did not take into account differences

between normal cipher specification (aes-xts-plain64)

and capi format specification (capi:xts(aes)-plain64).

The internal query function always converted capi format

in normal format and therefor failed if capi format was

used in metadata.

Fixes: #759.

---

 lib/setup.c        | 36 ++++++++++++++++++++++++++----------

 tests/api-test-2.c | 14 ++++++++++++--

 2 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/lib/setup.c b/lib/setup.c

index 6d7411b5..809049b9 100644

--- a/lib/setup.c

+++ b/lib/setup.c

@@ -2458,6 +2458,9 @@ static int _compare_crypt_devices(struct crypt_device *cd,

 			       const struct dm_target *src,

 			       const struct dm_target *tgt)

 {

+	char *src_cipher = NULL, *src_integrity = NULL;

+	int r = -EINVAL;

+

 	/* for crypt devices keys are mandatory */

 	if (!src->u.crypt.vk || !tgt->u.crypt.vk)

 		return -EINVAL;

@@ -2465,21 +2468,30 @@ static int _compare_crypt_devices(struct crypt_device *cd,

 	/* CIPHER checks */

 	if (!src->u.crypt.cipher || !tgt->u.crypt.cipher)

 		return -EINVAL;

-	if (strcmp(src->u.crypt.cipher, tgt->u.crypt.cipher)) {

-		log_dbg(cd, "Cipher specs do not match.");

+

+	/*

+	 * dm_query_target converts capi cipher specification to dm-crypt format.

+	 * We need to do same for cipher specification requested in source

+	 * device.

+	 */

+	if (crypt_capi_to_cipher(&src_cipher, &src_integrity, src->u.crypt.cipher, src->u.crypt.integrity))

 		return -EINVAL;

+

+	if (strcmp(src_cipher, tgt->u.crypt.cipher)) {

+		log_dbg(cd, "Cipher specs do not match.");

+		goto out;

 	}

 	if (tgt->u.crypt.vk->keylength == 0 && crypt_is_cipher_null(tgt->u.crypt.cipher))

 		log_dbg(cd, "Existing device uses cipher null. Skipping key comparison.");

 	else if (_compare_volume_keys(src->u.crypt.vk, 0, tgt->u.crypt.vk, tgt->u.crypt.vk->key_description != NULL)) {

 		log_dbg(cd, "Keys in context and target device do not match.");

-		return -EINVAL;

+		goto out;

 	}

-	if (crypt_strcmp(src->u.crypt.integrity, tgt->u.crypt.integrity)) {

+	if (crypt_strcmp(src_integrity, tgt->u.crypt.integrity)) {

 		log_dbg(cd, "Integrity parameters do not match.");

-		return -EINVAL;

+		goto out;

 	}

 	if (src->u.crypt.offset      != tgt->u.crypt.offset ||

@@ -2487,15 +2499,19 @@ static int _compare_crypt_devices(struct crypt_device *cd,

 	    src->u.crypt.iv_offset   != tgt->u.crypt.iv_offset ||

 	    src->u.crypt.tag_size    != tgt->u.crypt.tag_size) {

 		log_dbg(cd, "Integer parameters do not match.");

-		return -EINVAL;

+		goto out;

 	}

-	if (device_is_identical(src->data_device, tgt->data_device) <= 0) {

+	if (device_is_identical(src->data_device, tgt->data_device) <= 0)

 		log_dbg(cd, "Data devices do not match.");

-		return -EINVAL;

-	}

+	else

+		r = 0;

-	return 0;

+out:

+	free(src_cipher);

+	free(src_integrity);

+

+	return r;

 }

 static int _compare_integrity_devices(struct crypt_device *cd,

diff --git a/tests/api-test-2.c b/tests/api-test-2.c

index 0534677a..34002d1a 100644

--- a/tests/api-test-2.c

+++ b/tests/api-test-2.c

@@ -1585,8 +1585,8 @@ static void ResizeDeviceLuks2(void)

 	const char *mk_hex = "bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a";

 	size_t key_size = strlen(mk_hex) / 2;

-	const char *cipher = "aes";

-	const char *cipher_mode = "cbc-essiv:sha256";

+	const char *cipher = "aes", *capi_cipher = "capi:cbc(aes)";

+	const char *cipher_mode = "cbc-essiv:sha256", *capi_cipher_mode = "essiv:sha256";

 	uint64_t r_payload_offset, r_header_size, r_size;

 	/* Cannot use Argon2 in FIPS */

@@ -1728,6 +1728,16 @@ static void ResizeDeviceLuks2(void)

 	OK_(crypt_deactivate(cd, CDEVICE_1));

 	CRYPT_FREE(cd);

+	OK_(crypt_init(&cd, DMDIR L_DEVICE_OK));

+	OK_(crypt_set_pbkdf_type(cd, &pbkdf));

+	OK_(crypt_format(cd, CRYPT_LUKS2, capi_cipher, capi_cipher_mode, NULL, key, key_size, NULL));

+	OK_(crypt_activate_by_volume_key(cd, CDEVICE_1, key, key_size, 0));

+	OK_(crypt_resize(cd, CDEVICE_1, 8));

+	if (!t_device_size(DMDIR CDEVICE_1, &r_size))

+		EQ_(8, r_size >> SECTOR_SHIFT);

+	OK_(crypt_deactivate(cd, CDEVICE_1));

+	CRYPT_FREE(cd);

+

 	_cleanup_dmdevices();

 }

-- 

2.38.1