Date: Sun, 22 Sep 2013 14:46:23 GMT From: def@FreeBSD.org To: svn-soc-all@FreeBSD.org Subject: socsvn commit: r257607 - in soc2013/def/crashdump-head: etc/rc.d sbin/dumpkey sbin/savecore Message-ID: <201309221446.r8MEkNQe088221@socsvn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: def Date: Sun Sep 22 14:46:23 2013 New Revision: 257607 URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=257607 Log: Change savecore(8) to: provide a private key, save an encrypted key in a file, decrypt the key to use it later. Use RSA_size(3) to determine the size of the key. Modified: soc2013/def/crashdump-head/etc/rc.d/savecore soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c soc2013/def/crashdump-head/sbin/savecore/Makefile soc2013/def/crashdump-head/sbin/savecore/decryptfile.c soc2013/def/crashdump-head/sbin/savecore/decryptfile.h soc2013/def/crashdump-head/sbin/savecore/savecore.c Modified: soc2013/def/crashdump-head/etc/rc.d/savecore ============================================================================== --- soc2013/def/crashdump-head/etc/rc.d/savecore Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/etc/rc.d/savecore Sun Sep 22 14:46:23 2013 (r257607) @@ -13,6 +13,7 @@ start_cmd="savecore_start" start_precmd="savecore_prestart" stop_cmd=":" +savecore_flags="${savecore_flags} -p ${dumpkey_priv}" savecore_prestart() { Modified: soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c ============================================================================== --- soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c Sun Sep 22 14:46:23 2013 (r257607) @@ -56,7 +56,7 @@ } static int -encrypt_key(char *key, char *encrypted_key, RSA *public_key, char *public_key_file) +encrypt_key(char *plainkey, struct kerneldumpkey *key, RSA *public_key, char *public_key_file) { FILE *fp; @@ -71,9 +71,11 @@ if (public_key == NULL) return (-1); - if (RSA_public_encrypt(KERNELDUMP_KEY_SIZE, key, encrypted_key, public_key, RSA_PKCS1_PADDING) == -1) + if (RSA_public_encrypt(KERNELDUMP_KEY_SIZE, plainkey, key->encrypted_key, public_key, RSA_PKCS1_PADDING) == -1) return (-1); + key->keysize = RSA_size(public_key); + return (0); } @@ -139,8 +141,6 @@ goto out; } - key.keysize = KERNELDUMP_KEY_SIZE; - if (random_data(buf, KERNELDUMP_KEY_SIZE)) { printf("Error: cannot generate a symmetric key.\n"); error = 1; @@ -153,7 +153,7 @@ goto out; } - if (encrypt_key(buf, key.encrypted_key, public_key, public_key_file)) { + if (encrypt_key(buf, &key, public_key, public_key_file)) { printf("Error: cannot encrypt a symmetric key.\n"); error = 1; goto out; Modified: soc2013/def/crashdump-head/sbin/savecore/Makefile ============================================================================== --- soc2013/def/crashdump-head/sbin/savecore/Makefile Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/sbin/savecore/Makefile Sun Sep 22 14:46:23 2013 (r257607) @@ -10,8 +10,8 @@ SRCS+= camellia.c SRCS+= hmac.c sha2.c SRCS+= xts.c -DPADD= ${LIBZ} -LDADD= -lz +DPADD= ${LIBZ} ${LIBCRYPTO} +LDADD= -lz -lcrypto CFLAGS+=-I${SYS} WARNS?= 2 MAN= savecore.8 Modified: soc2013/def/crashdump-head/sbin/savecore/decryptfile.c ============================================================================== --- soc2013/def/crashdump-head/sbin/savecore/decryptfile.c Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/sbin/savecore/decryptfile.c Sun Sep 22 14:46:23 2013 (r257607) @@ -4,9 +4,78 @@ #include <string.h> #include <opencrypto/cryptodev.h> #include <crypto/hmac/hmac.h> + +#define OPENSSL_NO_SHA +#include <openssl/conf.h> +#include <openssl/err.h> +#include <openssl/rsa.h> +#include <openssl/pem.h> + #include "decryptfile.h" int +save_key_for(decFile *fd, const char *keyname) +{ + FILE *fp; + + fp = fopen(keyname, "w"); + + if (fp == NULL) + return (-1); + + if (fwrite(fd->encrypted_key, 1, fd->keysize, fp) != fd->keysize) { + fclose(fp); + + return (-1); + } + + fclose(fp); + + return (0); +} + +int +decrypt_key_for(decFile *fd, const char *private_key_file) +{ + RSA *private_key; + FILE *fp; + int error; + + ERR_load_crypto_strings(); + OpenSSL_add_all_algorithms(); + OPENSSL_config(NULL); + + error = 0; + private_key = RSA_new(); + fp = fopen(private_key_file, "r"); + + if (fp == NULL) { + error = 1; + goto out; + } + + private_key = PEM_read_RSAPrivateKey(fp, &private_key, NULL, NULL); + fclose(fp); + + if (private_key == NULL) { + error = 1; + goto out; + } + + if (RSA_private_decrypt(fd->keysize, fd->encrypted_key, fd->key, private_key, RSA_PKCS1_PADDING) == -1) { + error = 1; + goto out; + } + +out: + RSA_free(private_key); + ERR_free_strings(); + EVP_cleanup(); + + return (error); +} + +int dwrite(void *cookie, const char *data, int size) { decFile *fd = (decFile *)cookie; @@ -57,7 +126,8 @@ } FILE * -dopen(const char *fname, const char *mode, const struct kerneldumpheader *h, off_t offset) +dopen(const char *fname, const char *mode, const char *keyname, + const char *private_key_file, const struct kerneldumpheader *h, off_t offset) { uint8_t key[KERNELDUMP_KEY_SIZE]; struct xts_ctx ctx; @@ -77,17 +147,20 @@ fd->fp = fp; fd->keysize = h->keysize; - memcpy(fd->key, h->key, fd->keysize); + memcpy(fd->encrypted_key, h->encrypted_key, KERNELDUMP_ENCRYPTED_KEY_SIZE); memcpy(fd->tweak, h->tweak, KERNELDUMP_TWEAK_SIZE); bzero(&fd->tweak_ctx, sizeof(fd->tweak_ctx)); bzero(&fd->data_ctx, sizeof(fd->data_ctx)); bzero(key, KERNELDUMP_KEY_SIZE); + save_key_for(fd, keyname); + decrypt_key_for(fd, private_key_file); + hkdf_expand(&ctx, fd->key, key, 1, kerneldump_magic, sizeof(kerneldump_magic)); - xts_alg_aes.pa_keysetup(&fd->data_ctx, key, fd->keysize << 3); + xts_alg_aes.pa_keysetup(&fd->data_ctx, key, KERNELDUMP_KEY_SIZE << 3); hkdf_expand(&ctx, fd->key, key, 2, kerneldump_magic, sizeof(kerneldump_magic)); - xts_alg_aes.pa_keysetup(&fd->tweak_ctx, key, fd->keysize << 3); + xts_alg_aes.pa_keysetup(&fd->tweak_ctx, key, KERNELDUMP_KEY_SIZE << 3); bzero(&ctx, sizeof(ctx)); bzero(key, KERNELDUMP_KEY_SIZE); Modified: soc2013/def/crashdump-head/sbin/savecore/decryptfile.h ============================================================================== --- soc2013/def/crashdump-head/sbin/savecore/decryptfile.h Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/sbin/savecore/decryptfile.h Sun Sep 22 14:46:23 2013 (r257607) @@ -8,6 +8,7 @@ FILE *fp; int keysize; char key[KERNELDUMP_KEY_SIZE]; + char encrypted_key[KERNELDUMP_ENCRYPTED_KEY_SIZE]; char tweak[KERNELDUMP_TWEAK_SIZE]; struct xts_ctx tweak_ctx; struct xts_ctx data_ctx; @@ -18,7 +19,10 @@ } decFile; int dwrite(void *cookie, const char *data, int size); -FILE *dopen(const char *fname, const char *mode, const struct kerneldumpheader *h, off_t offset); +FILE *dopen(const char *fname, const char *mode, const char *keyname, + const char *private_key_file, const struct kerneldumpheader *h, off_t offset); int dclose(void *cookie); +int save_key_for(decFile *fd, const char *keyname); +int decrypt_key_for(decFile *fd, const char *public_key_file); #endif /* _FILEDECRYPT_H */ Modified: soc2013/def/crashdump-head/sbin/savecore/savecore.c ============================================================================== --- soc2013/def/crashdump-head/sbin/savecore/savecore.c Sun Sep 22 14:36:27 2013 (r257606) +++ soc2013/def/crashdump-head/sbin/savecore/savecore.c Sun Sep 22 14:46:23 2013 (r257607) @@ -92,6 +92,7 @@ static int checkfor, compress, clear, decrypt, force, keep, verbose; /* flags */ static int nfound, nsaved, nerr; /* statistics */ static int maxdumps; +static char *private_key_file; extern FILE *zopen(const char *, const char *); @@ -435,6 +436,7 @@ DoFile(const char *savedir, const char *device) { static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX]; + static char keyname[PATH_MAX]; static char *buf = NULL; struct kerneldumpheader kdhf, kdhl; off_t mediasize, dumpsize, firsthd, lasthd; @@ -634,7 +636,9 @@ } else if (decrypt) { snprintf(corename, sizeof(corename), "%s.%d", istextdump ? "textdump.tar" : "vmcore", bounds); - fp = dopen(corename, "w", &kdhl, firsthd + sizeof(kdhf)); + snprintf(keyname, sizeof(keyname), "key.%d", bounds); + fp = dopen(corename, "w", keyname, private_key_file, + &kdhl, firsthd + sizeof(kdhf)); } else { snprintf(corename, sizeof(corename), "%s.%d", istextdump ? "textdump.tar" : "vmcore", bounds); @@ -735,7 +739,7 @@ fprintf(stderr, "%s\n%s\n%s\n", "usage: savecore -c [-v] [device ...]", " savecore -C [-v] [device ...]", - " savecore [-dfkvz] [-m maxdumps] [directory [device ...]]"); + " savecore [-dfkvz] [-m maxdumps] [-p private_key] [directory [device ...]]"); exit(1); } @@ -748,11 +752,12 @@ checkfor = compress = clear = decrypt = force = keep = verbose = 0; nfound = nsaved = nerr = 0; + private_key_file = NULL; openlog("savecore", LOG_PERROR, LOG_DAEMON); signal(SIGINFO, infohandler); - while ((ch = getopt(argc, argv, "Ccdfkm:vz")) != -1) + while ((ch = getopt(argc, argv, "Ccdfkm:p:vz")) != -1) switch(ch) { case 'C': checkfor = 1; @@ -776,6 +781,9 @@ exit(1); } break; + case 'p': + private_key_file = optarg; + break; case 'v': verbose++; break; @@ -792,6 +800,8 @@ usage(); if (maxdumps > 0 && (checkfor || clear)) usage(); + if (decrypt && private_key_file == NULL) + usage(); argc -= optind; argv += optind; if (argc >= 1 && !checkfor && !clear) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201309221446.r8MEkNQe088221>