socsvn commit: r257607 - in soc2013/def/crashdump-head: etc/rc.d sbin/dumpkey sbin/savecore
def at FreeBSD.org
def at FreeBSD.org
Sun Sep 22 14:46:24 UTC 2013
Author: def
Date: Sun Sep 22 14:46:23 2013
New Revision: 257607
URL: http://svnweb.FreeBSD.org/socsvn/?view=rev&rev=257607
Log:
Change savecore(8) to: provide a private key, save an encrypted key in a file, decrypt the key to use it later. Use RSA_size(3) to determine the size of the key.
Modified:
soc2013/def/crashdump-head/etc/rc.d/savecore
soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c
soc2013/def/crashdump-head/sbin/savecore/Makefile
soc2013/def/crashdump-head/sbin/savecore/decryptfile.c
soc2013/def/crashdump-head/sbin/savecore/decryptfile.h
soc2013/def/crashdump-head/sbin/savecore/savecore.c
Modified: soc2013/def/crashdump-head/etc/rc.d/savecore
==============================================================================
--- soc2013/def/crashdump-head/etc/rc.d/savecore Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/etc/rc.d/savecore Sun Sep 22 14:46:23 2013 (r257607)
@@ -13,6 +13,7 @@
start_cmd="savecore_start"
start_precmd="savecore_prestart"
stop_cmd=":"
+savecore_flags="${savecore_flags} -p ${dumpkey_priv}"
savecore_prestart()
{
Modified: soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c
==============================================================================
--- soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/sbin/dumpkey/dumpkey.c Sun Sep 22 14:46:23 2013 (r257607)
@@ -56,7 +56,7 @@
}
static int
-encrypt_key(char *key, char *encrypted_key, RSA *public_key, char *public_key_file)
+encrypt_key(char *plainkey, struct kerneldumpkey *key, RSA *public_key, char *public_key_file)
{
FILE *fp;
@@ -71,9 +71,11 @@
if (public_key == NULL)
return (-1);
- if (RSA_public_encrypt(KERNELDUMP_KEY_SIZE, key, encrypted_key, public_key, RSA_PKCS1_PADDING) == -1)
+ if (RSA_public_encrypt(KERNELDUMP_KEY_SIZE, plainkey, key->encrypted_key, public_key, RSA_PKCS1_PADDING) == -1)
return (-1);
+ key->keysize = RSA_size(public_key);
+
return (0);
}
@@ -139,8 +141,6 @@
goto out;
}
- key.keysize = KERNELDUMP_KEY_SIZE;
-
if (random_data(buf, KERNELDUMP_KEY_SIZE)) {
printf("Error: cannot generate a symmetric key.\n");
error = 1;
@@ -153,7 +153,7 @@
goto out;
}
- if (encrypt_key(buf, key.encrypted_key, public_key, public_key_file)) {
+ if (encrypt_key(buf, &key, public_key, public_key_file)) {
printf("Error: cannot encrypt a symmetric key.\n");
error = 1;
goto out;
Modified: soc2013/def/crashdump-head/sbin/savecore/Makefile
==============================================================================
--- soc2013/def/crashdump-head/sbin/savecore/Makefile Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/sbin/savecore/Makefile Sun Sep 22 14:46:23 2013 (r257607)
@@ -10,8 +10,8 @@
SRCS+= camellia.c
SRCS+= hmac.c sha2.c
SRCS+= xts.c
-DPADD= ${LIBZ}
-LDADD= -lz
+DPADD= ${LIBZ} ${LIBCRYPTO}
+LDADD= -lz -lcrypto
CFLAGS+=-I${SYS}
WARNS?= 2
MAN= savecore.8
Modified: soc2013/def/crashdump-head/sbin/savecore/decryptfile.c
==============================================================================
--- soc2013/def/crashdump-head/sbin/savecore/decryptfile.c Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/sbin/savecore/decryptfile.c Sun Sep 22 14:46:23 2013 (r257607)
@@ -4,9 +4,78 @@
#include <string.h>
#include <opencrypto/cryptodev.h>
#include <crypto/hmac/hmac.h>
+
+#define OPENSSL_NO_SHA
+#include <openssl/conf.h>
+#include <openssl/err.h>
+#include <openssl/rsa.h>
+#include <openssl/pem.h>
+
#include "decryptfile.h"
int
+save_key_for(decFile *fd, const char *keyname)
+{
+ FILE *fp;
+
+ fp = fopen(keyname, "w");
+
+ if (fp == NULL)
+ return (-1);
+
+ if (fwrite(fd->encrypted_key, 1, fd->keysize, fp) != fd->keysize) {
+ fclose(fp);
+
+ return (-1);
+ }
+
+ fclose(fp);
+
+ return (0);
+}
+
+int
+decrypt_key_for(decFile *fd, const char *private_key_file)
+{
+ RSA *private_key;
+ FILE *fp;
+ int error;
+
+ ERR_load_crypto_strings();
+ OpenSSL_add_all_algorithms();
+ OPENSSL_config(NULL);
+
+ error = 0;
+ private_key = RSA_new();
+ fp = fopen(private_key_file, "r");
+
+ if (fp == NULL) {
+ error = 1;
+ goto out;
+ }
+
+ private_key = PEM_read_RSAPrivateKey(fp, &private_key, NULL, NULL);
+ fclose(fp);
+
+ if (private_key == NULL) {
+ error = 1;
+ goto out;
+ }
+
+ if (RSA_private_decrypt(fd->keysize, fd->encrypted_key, fd->key, private_key, RSA_PKCS1_PADDING) == -1) {
+ error = 1;
+ goto out;
+ }
+
+out:
+ RSA_free(private_key);
+ ERR_free_strings();
+ EVP_cleanup();
+
+ return (error);
+}
+
+int
dwrite(void *cookie, const char *data, int size)
{
decFile *fd = (decFile *)cookie;
@@ -57,7 +126,8 @@
}
FILE *
-dopen(const char *fname, const char *mode, const struct kerneldumpheader *h, off_t offset)
+dopen(const char *fname, const char *mode, const char *keyname,
+ const char *private_key_file, const struct kerneldumpheader *h, off_t offset)
{
uint8_t key[KERNELDUMP_KEY_SIZE];
struct xts_ctx ctx;
@@ -77,17 +147,20 @@
fd->fp = fp;
fd->keysize = h->keysize;
- memcpy(fd->key, h->key, fd->keysize);
+ memcpy(fd->encrypted_key, h->encrypted_key, KERNELDUMP_ENCRYPTED_KEY_SIZE);
memcpy(fd->tweak, h->tweak, KERNELDUMP_TWEAK_SIZE);
bzero(&fd->tweak_ctx, sizeof(fd->tweak_ctx));
bzero(&fd->data_ctx, sizeof(fd->data_ctx));
bzero(key, KERNELDUMP_KEY_SIZE);
+ save_key_for(fd, keyname);
+ decrypt_key_for(fd, private_key_file);
+
hkdf_expand(&ctx, fd->key, key, 1, kerneldump_magic, sizeof(kerneldump_magic));
- xts_alg_aes.pa_keysetup(&fd->data_ctx, key, fd->keysize << 3);
+ xts_alg_aes.pa_keysetup(&fd->data_ctx, key, KERNELDUMP_KEY_SIZE << 3);
hkdf_expand(&ctx, fd->key, key, 2, kerneldump_magic, sizeof(kerneldump_magic));
- xts_alg_aes.pa_keysetup(&fd->tweak_ctx, key, fd->keysize << 3);
+ xts_alg_aes.pa_keysetup(&fd->tweak_ctx, key, KERNELDUMP_KEY_SIZE << 3);
bzero(&ctx, sizeof(ctx));
bzero(key, KERNELDUMP_KEY_SIZE);
Modified: soc2013/def/crashdump-head/sbin/savecore/decryptfile.h
==============================================================================
--- soc2013/def/crashdump-head/sbin/savecore/decryptfile.h Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/sbin/savecore/decryptfile.h Sun Sep 22 14:46:23 2013 (r257607)
@@ -8,6 +8,7 @@
FILE *fp;
int keysize;
char key[KERNELDUMP_KEY_SIZE];
+ char encrypted_key[KERNELDUMP_ENCRYPTED_KEY_SIZE];
char tweak[KERNELDUMP_TWEAK_SIZE];
struct xts_ctx tweak_ctx;
struct xts_ctx data_ctx;
@@ -18,7 +19,10 @@
} decFile;
int dwrite(void *cookie, const char *data, int size);
-FILE *dopen(const char *fname, const char *mode, const struct kerneldumpheader *h, off_t offset);
+FILE *dopen(const char *fname, const char *mode, const char *keyname,
+ const char *private_key_file, const struct kerneldumpheader *h, off_t offset);
int dclose(void *cookie);
+int save_key_for(decFile *fd, const char *keyname);
+int decrypt_key_for(decFile *fd, const char *public_key_file);
#endif /* _FILEDECRYPT_H */
Modified: soc2013/def/crashdump-head/sbin/savecore/savecore.c
==============================================================================
--- soc2013/def/crashdump-head/sbin/savecore/savecore.c Sun Sep 22 14:36:27 2013 (r257606)
+++ soc2013/def/crashdump-head/sbin/savecore/savecore.c Sun Sep 22 14:46:23 2013 (r257607)
@@ -92,6 +92,7 @@
static int checkfor, compress, clear, decrypt, force, keep, verbose; /* flags */
static int nfound, nsaved, nerr; /* statistics */
static int maxdumps;
+static char *private_key_file;
extern FILE *zopen(const char *, const char *);
@@ -435,6 +436,7 @@
DoFile(const char *savedir, const char *device)
{
static char infoname[PATH_MAX], corename[PATH_MAX], linkname[PATH_MAX];
+ static char keyname[PATH_MAX];
static char *buf = NULL;
struct kerneldumpheader kdhf, kdhl;
off_t mediasize, dumpsize, firsthd, lasthd;
@@ -634,7 +636,9 @@
} else if (decrypt) {
snprintf(corename, sizeof(corename), "%s.%d",
istextdump ? "textdump.tar" : "vmcore", bounds);
- fp = dopen(corename, "w", &kdhl, firsthd + sizeof(kdhf));
+ snprintf(keyname, sizeof(keyname), "key.%d", bounds);
+ fp = dopen(corename, "w", keyname, private_key_file,
+ &kdhl, firsthd + sizeof(kdhf));
} else {
snprintf(corename, sizeof(corename), "%s.%d",
istextdump ? "textdump.tar" : "vmcore", bounds);
@@ -735,7 +739,7 @@
fprintf(stderr, "%s\n%s\n%s\n",
"usage: savecore -c [-v] [device ...]",
" savecore -C [-v] [device ...]",
- " savecore [-dfkvz] [-m maxdumps] [directory [device ...]]");
+ " savecore [-dfkvz] [-m maxdumps] [-p private_key] [directory [device ...]]");
exit(1);
}
@@ -748,11 +752,12 @@
checkfor = compress = clear = decrypt = force = keep = verbose = 0;
nfound = nsaved = nerr = 0;
+ private_key_file = NULL;
openlog("savecore", LOG_PERROR, LOG_DAEMON);
signal(SIGINFO, infohandler);
- while ((ch = getopt(argc, argv, "Ccdfkm:vz")) != -1)
+ while ((ch = getopt(argc, argv, "Ccdfkm:p:vz")) != -1)
switch(ch) {
case 'C':
checkfor = 1;
@@ -776,6 +781,9 @@
exit(1);
}
break;
+ case 'p':
+ private_key_file = optarg;
+ break;
case 'v':
verbose++;
break;
@@ -792,6 +800,8 @@
usage();
if (maxdumps > 0 && (checkfor || clear))
usage();
+ if (decrypt && private_key_file == NULL)
+ usage();
argc -= optind;
argv += optind;
if (argc >= 1 && !checkfor && !clear) {
More information about the svn-soc-all
mailing list