From nobody Wed Feb 08 18:27:52 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PBpQJ50YGz3nlkx; Wed, 8 Feb 2023 18:27:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PBpQJ3txpz3tVQ; Wed, 8 Feb 2023 18:27:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675880872; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xeObQ81r8aJ9nmDU2QigZ0BpwsSNBT4KtLN8PulPOKY=; b=uBdT7sB7gd8TP2aXOcgy5tOnaSt0eU3+WU53h0t2bx3ZktwQoUnJjMmXMfI0SP4jytdZHo j2+j6K+nZt5sH64HelMHOfspPtlnwJgCbk/IjVRMRwhLeD7V73B+PhGh9t87TMsJSHoIbi XUpKJJ2TKNJ7nSQztONQJcwNH/SFPfZ/+eCdoqWQT481ccFjEmz52Wl3khqjaSQ9cZFuWh nDN5kQ7xJ27mko7M+Fx6ANQU14+2L/J9Vn+oSbAebIkZ26CRDx32XhvwPGYb9U57bWxNwB nBWQptEbeIlxL15Ym58dYEXMM9EEzeyuANLKbvog7ADfOXb725qlbXcV8MngJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675880872; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xeObQ81r8aJ9nmDU2QigZ0BpwsSNBT4KtLN8PulPOKY=; b=fH2X6qLPAwPwdgrBKaVOuri2WcmujZmrhwyE/ReovxQzN9nFI/MJWyYuPyTcjXLGKjEf0l yCyZ1QO29y3uZiLYeBP0X0raALolr7XmYs1eBG03nps7JU50ul+BtRRCkkx6bsutAi7KDj VUx197YytiRIkdK1r7JW4XcWI+i6wWZc1BepOUew3ThrqnRzGXVq+06x4OeO4WZN91MdZT 19xmAwrFBWnTcCr9IeK+NdqGMJSmtS+/iK91sZaEmEjs6DvD+oQQ31vC7M1de8prej07wO U3xbhITh4EiIJGqig4iRwmj+aRlzk/N/5DPffbCJ8YwQT5gL79jGtLKztjOG8w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1675880872; a=rsa-sha256; cv=none; b=cRK45VXwiGjWogPS8AKC6omSB1pWfdtom4GwlYoKMMPAVNd9z8kIi50f76hPYNTJloWCuK /IaQv2a7of0Cnndy1vu2dctTNR4Tasqn8KYlyM3T+UdtTlZiWn3kZdFhmN/7nLuSVnCGYq oEUKGH/ri26LpdC1/19guYdPfTQJgKJQSlZ5b2YI+/1xz3Dntd3F0wHPataMHHhXNGyBq1 T7yw5QUlvGtUdamog7htfWWoKCKHLAWoSATEGmlN+tjcfgr6unTaFqOQTqpTKubXj2u9MA 5f+lmlkz7epbigPC60xlWl7zv+IAmczfmgiAJicCjXIrdXgmUv53O/30esKRmA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PBpQJ2J5kz16Ss; Wed, 8 Feb 2023 18:27:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 318IRqbO037071; Wed, 8 Feb 2023 18:27:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 318IRqo3037070; Wed, 8 Feb 2023 18:27:52 GMT (envelope-from git) Date: Wed, 8 Feb 2023 18:27:52 GMT Message-Id: <202302081827.318IRqo3037070@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: 5e1ad8bebd36 - releng/12.3 - geli: split the initalization of HMAC List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/releng/12.3 X-Git-Reftype: branch X-Git-Commit: 5e1ad8bebd36392eeaa898fe2fc5348bd5e5c863 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch releng/12.3 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=5e1ad8bebd36392eeaa898fe2fc5348bd5e5c863 commit 5e1ad8bebd36392eeaa898fe2fc5348bd5e5c863 Author: Mariusz Zaborski AuthorDate: 2023-02-08 16:41:06 +0000 Commit: Gordon Tetlow CommitDate: 2023-02-08 18:09:41 +0000 geli: split the initalization of HMAC GELI allows to read a user key from a standard input. However if user initialize multiple providers at once, the standard input will be empty for the second and next providers. This caused GELI to encrypt a master key with an empty key file. This commits initialize the HMAC with the key file, and then reuse the finalized structure to generate different encryption keys for different providers. Reported by: Nathan Dorfman Tested by: philip Approved by: so Security: FreeBSD-SA-23:01.geli Security: CVE-2023-0751 (cherry picked from commit 5fff09660e06a66bed6482da9c70df328e16bbb6) (cherry picked from commit a5afaf4e9abd8d5e6cce5d6c433d2276bf9b8721) --- lib/geom/eli/geom_eli.c | 72 ++++++++++++++++++++++++++++++++++++------------- 1 file changed, 54 insertions(+), 18 deletions(-) diff --git a/lib/geom/eli/geom_eli.c b/lib/geom/eli/geom_eli.c index a89ac69cf338..147807c46416 100644 --- a/lib/geom/eli/geom_eli.c +++ b/lib/geom/eli/geom_eli.c @@ -565,27 +565,35 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new, return (0); } -static unsigned char * -eli_genkey(struct gctl_req *req, struct g_eli_metadata *md, unsigned char *key, - bool new) +static bool +eli_init_key_hmac_ctx(struct gctl_req *req, struct hmac_ctx *ctx, bool new) { - struct hmac_ctx ctx; - bool nopassphrase; int nfiles; + bool nopassphrase; nopassphrase = gctl_get_int(req, new ? "nonewpassphrase" : "nopassphrase"); - g_eli_crypto_hmac_init(&ctx, NULL, 0); - - nfiles = eli_genkey_files(req, new, "keyfile", &ctx, NULL, 0); - if (nfiles == -1) - return (NULL); - else if (nfiles == 0 && nopassphrase) { + g_eli_crypto_hmac_init(ctx, NULL, 0); + nfiles = eli_genkey_files(req, new, "keyfile", ctx, NULL, 0); + if (nfiles == -1) { + return (false); + } else if (nfiles == 0 && nopassphrase) { gctl_error(req, "No key components given."); - return (NULL); + return (false); } + return (true); +} + +static unsigned char * +eli_genkey(struct gctl_req *req, const struct hmac_ctx *ctxtemplate, + struct g_eli_metadata *md, unsigned char *key, bool new) +{ + struct hmac_ctx ctx; + + memcpy(&ctx, ctxtemplate, sizeof(ctx)); + if (eli_genkey_passphrase(req, md, new, &ctx) == -1) return (NULL); @@ -594,6 +602,22 @@ eli_genkey(struct gctl_req *req, struct g_eli_metadata *md, unsigned char *key, return (key); } +static unsigned char * +eli_genkey_single(struct gctl_req *req, struct g_eli_metadata *md, + unsigned char *key, bool new) +{ + struct hmac_ctx ctx; + unsigned char *rkey; + + if (!eli_init_key_hmac_ctx(req, &ctx, new)) { + return (NULL); + } + rkey = eli_genkey(req, &ctx, md, key, new); + explicit_bzero(&ctx, sizeof(ctx)); + + return (rkey); +} + static int eli_metadata_read(struct gctl_req *req, const char *prov, struct g_eli_metadata *md) @@ -705,6 +729,7 @@ eli_init(struct gctl_req *req) intmax_t val; int error, i, nargs, nparams, param; const int one = 1; + struct hmac_ctx ctxtemplate; nargs = gctl_get_int(req, "nargs"); if (nargs <= 0) { @@ -852,6 +877,10 @@ eli_init(struct gctl_req *req) */ nparams = req->narg - nargs - 1; + /* Generate HMAC context template. */ + if (!eli_init_key_hmac_ctx(req, &ctxtemplate, true)) + return; + /* Create new child request for each provider and issue to kernel */ for (i = 0; i < nargs; i++) { r = gctl_get_handle(); @@ -893,7 +922,7 @@ eli_init(struct gctl_req *req) arc4random_buf(md.md_mkeys, sizeof(md.md_mkeys)); /* Generate user key. */ - if (eli_genkey(r, &md, key, true) == NULL) { + if (eli_genkey(r, &ctxtemplate, &md, key, true) == NULL) { /* * Error generating key - details added to geom request * by eli_genkey(). @@ -1017,6 +1046,7 @@ out: /* Clear the cached metadata, including keys. */ explicit_bzero(&md, sizeof(md)); + explicit_bzero(&ctxtemplate, sizeof(ctxtemplate)); } static void @@ -1028,6 +1058,7 @@ eli_attach(struct gctl_req *req) off_t mediasize; int i, nargs, nparams, param; const int one = 1; + struct hmac_ctx ctxtemplate; nargs = gctl_get_int(req, "nargs"); if (nargs <= 0) { @@ -1043,6 +1074,10 @@ eli_attach(struct gctl_req *req) */ nparams = req->narg - nargs - 1; + /* Generate HMAC context template. */ + if (!eli_init_key_hmac_ctx(req, &ctxtemplate, false)) + return; + /* Create new child request for each provider and issue to kernel */ for (i = 0; i < nargs; i++) { r = gctl_get_handle(); @@ -1072,7 +1107,7 @@ eli_attach(struct gctl_req *req) goto out; } - if (eli_genkey(r, &md, key, false) == NULL) { + if (eli_genkey(r, &ctxtemplate, &md, key, false) == NULL) { /* * Error generating key - details added to geom request * by eli_genkey(). @@ -1106,6 +1141,7 @@ out: /* Clear sensitive data from memory. */ explicit_bzero(cached_passphrase, sizeof(cached_passphrase)); + explicit_bzero(&ctxtemplate, sizeof(ctxtemplate)); } static void @@ -1277,7 +1313,7 @@ eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md) old = md->md_iterations; /* Generate key for Master Key encryption. */ - if (eli_genkey(req, md, key, true) == NULL) { + if (eli_genkey_single(req, md, key, true) == NULL) { explicit_bzero(key, sizeof(key)); return; } @@ -1312,7 +1348,7 @@ eli_setkey_detached(struct gctl_req *req, const char *prov, } /* Generate key for Master Key decryption. */ - if (eli_genkey(req, md, key, false) == NULL) { + if (eli_genkey_single(req, md, key, false) == NULL) { explicit_bzero(key, sizeof(key)); return; } @@ -1370,7 +1406,7 @@ eli_setkey_detached(struct gctl_req *req, const char *prov, explicit_bzero(mkey, sizeof(mkey)); /* Generate key for Master Key encryption. */ - if (eli_genkey(req, md, key, true) == NULL) { + if (eli_genkey_single(req, md, key, true) == NULL) { explicit_bzero(key, sizeof(key)); explicit_bzero(md, sizeof(*md)); return; @@ -1516,7 +1552,7 @@ eli_resume(struct gctl_req *req) return; } - if (eli_genkey(req, &md, key, false) == NULL) { + if (eli_genkey_single(req, &md, key, false) == NULL) { explicit_bzero(key, sizeof(key)); return; }