static int
find_unused_slot(struct crypt_device *cd, const lm_t *lm)
{
for (int slot = 0; slot < LUKS_NSLOTS; slot++) {
if (crypt_keyslot_status(cd, slot) == CRYPT_SLOT_INACTIVE &&
uuid_is_zero(lm->slots[slot].uuid))
return slot;
}
return -1;
}
static char * _empty_slots( const char * device,const resolve_path_t * opts )
{
struct crypt_device * cd;
int j ;
int k ;
const char * type ;
string_t p ;
if( opts ){;}
if( crypt_init( &cd,device ) != 0 ){
return zuluExit( NULL,NULL ) ;
}
if( crypt_load( cd,NULL,NULL ) != 0 ){
return zuluExit( NULL,cd ) ;
}
type = crypt_get_type( cd ) ;
if( type == NULL ){
return zuluExit( NULL,cd ) ;
}
k = crypt_keyslot_max( type ) ;
if( k < 0 ){
return zuluExit( NULL,cd ) ;
}
p = StringEmpty() ;
for( j = 0 ; j < k ; j++ ){
switch( crypt_keyslot_status( cd,j ) ){
case CRYPT_SLOT_INACTIVE : StringAppend( p,"0" ) ; break ;
case CRYPT_SLOT_ACTIVE : StringAppend( p,"1" ) ; break ;
case CRYPT_SLOT_INVALID : StringAppend( p,"2" ) ; break ;
case CRYPT_SLOT_ACTIVE_LAST: StringAppend( p,"3" ) ; break ;
default : ;
}
}
return zuluExit( StringDeleteHandle( &p ),cd ) ;
}
static string_t _get_crypto_info_from_cryptsetup( const char * mapper )
{
char buff[ SIZE ] ;
char * buffer = buff ;
const char * z ;
const char * type ;
uint64_t e ;
string_t q ;
string_t p ;
int k ;
int i = 0 ;
int j ;
crypt_status_info info ;
struct crypt_device * cd ;
struct crypt_active_device cad ;
if( crypt_init_by_name( &cd,mapper ) != 0 ){
return StringVoid ;
}
p = String( mapper ) ;
info = crypt_status( cd,mapper ) ;
switch( info ){
case CRYPT_INACTIVE :
StringAppend( p," is inactive.\n" ) ;
break ;
case CRYPT_INVALID :
StringAppend( p," is invalid.\n" ) ;
break ;
case CRYPT_ACTIVE :
StringAppend( p," is active.\n" ) ;
break ;
case CRYPT_BUSY :
StringAppend( p," is active and is in use.\n" ) ;
break ;
default :
StringAppend( p," is invalid.\n" ) ;
}
if( info == CRYPT_ACTIVE || info == CRYPT_BUSY ){
StringAppend( p," type: \t" ) ;
type = crypt_get_type( cd ) ;
if( type != NULL ){
q = String( type ) ;
StringAppend( p,StringToLowerCase( q ) ) ;
StringDelete( &q ) ;
}else{
q = _get_type_from_udev_1( mapper ) ;
StringAppendString( p,q ) ;
StringDelete( &q ) ;
}
z = crypt_get_cipher( cd ) ;
if( z != NULL ){
StringMultipleAppend( p,"\n cipher:\t",z,"-",NULL ) ;
}else{
StringAppend( p,"\n cipher:\tNil-" ) ;
}
z = crypt_get_cipher_mode( cd ) ;
if( z != NULL ){
StringAppend( p,z ) ;
}else{
StringAppend( p,"Nil" ) ;
}
z = StringIntToString_1( buffer,SIZE,8 * crypt_get_volume_key_size( cd ) ) ;
StringMultipleAppend( p,"\n keysize:\t",z," bits",NULL ) ;
e = crypt_get_data_offset( cd ) ;
z = StringIntToString_1( buffer,SIZE,e ) ;
StringMultipleAppend( p,"\n offset:\t",z," sectors",NULL ) ;
zuluCryptFormatSize( e * 512,buffer,SIZE ) ;
StringMultipleAppend( p," / ",buffer,NULL ) ;
_device_info( p,crypt_get_device_name( cd ) ) ;
crypt_get_active_device( NULL,mapper,&cad ) ;
if( cad.flags == 1 ){
StringAppend( p,"\n mode: \tread only" ) ;
}else{
StringAppend( p,"\n mode: \tread and write" ) ;
}
k = crypt_keyslot_max( crypt_get_type( cd ) ) ;
if( k > 0 ){
i = 0 ;
for( j = 0 ; j < k ; j++ ){
switch( crypt_keyslot_status( cd,j ) ){
case CRYPT_SLOT_ACTIVE_LAST : i++ ; break ;
case CRYPT_SLOT_ACTIVE : i++ ; break ;
default : ;
}
}
StringMultipleAppend( p,"\n active slots:\t",StringIntToString_1( buffer,SIZE,i ),NULL ) ;
StringMultipleAppend( p," / ",StringIntToString_1( buffer,SIZE,k ),NULL ) ;
}else{
StringAppend( p,"\n active slots:\tNil" ) ;
}
}
crypt_free( cd ) ;
return p ;
}
int
main(int argc, char *argv[])
{
struct crypt_device *cd = NULL;
struct options opts = {};
const char *type = NULL;
int nerr = 0;
if (argp_parse(&argp, argc, argv, 0, NULL, &opts) != 0)
return EX_OSERR;
if (strlen(opts.params.hostname) == 0) {
for (int slot = 0; slot < LUKS_NUMKEYS; slot++) {
TANG_LUKS *tl = NULL;
sbuf_t *buf = NULL;
buf = meta_read(opts.device, slot);
if (!buf)
continue;
tl = TANG_LUKS_from_sbuf(buf);
sbuf_free(buf);
if (!tl)
continue;
fwrite(tl->hostname->data, tl->hostname->length, 1, stderr);
fwrite(":", 1, 1, stderr);
fwrite(tl->service->data, tl->service->length, 1, stderr);
fwrite("\n", 1, 1, stderr);
TANG_LUKS_free(tl);
}
return 0;
}
nerr = crypt_init(&cd, opts.device);
if (nerr != 0) {
fprintf(stderr, "Unable to open device (%s): %s\n",
opts.device, strerror(-nerr));
goto error;
}
nerr = crypt_load(cd, NULL, NULL);
if (nerr != 0) {
fprintf(stderr, "Unable to load device (%s): %s\n",
opts.device, strerror(-nerr));
goto error;
}
type = crypt_get_type(cd);
if (type == NULL) {
fprintf(stderr, "Unable to determine device type\n");
goto error;
}
if (strcmp(type, CRYPT_LUKS1) != 0) {
fprintf(stderr, "%s (%s) is not a LUKS device\n", opts.device, type);
goto error;
}
for (int slot = 0; slot < crypt_keyslot_max(CRYPT_LUKS1); slot++) {
TANG_LUKS *tl = NULL;
sbuf_t *buf = NULL;
switch (crypt_keyslot_status(cd, slot)) {
case CRYPT_SLOT_ACTIVE:
case CRYPT_SLOT_ACTIVE_LAST:
buf = meta_read(opts.device, slot);
if (!buf)
continue;
tl = TANG_LUKS_from_sbuf(buf);
sbuf_free(buf);
if (!tl)
continue;
if (strncmp((char *) tl->hostname->data, opts.params.hostname,
tl->hostname->length) != 0) {
TANG_LUKS_free(tl);
continue;
}
if (strncmp((char *) tl->service->data, opts.params.service,
tl->service->length) != 0) {
TANG_LUKS_free(tl);
continue;
}
TANG_LUKS_free(tl);
if (crypt_keyslot_destroy(cd, slot) == 0)
meta_erase(opts.device, slot);
break;
default:
break;
}
}
crypt_free(cd);
return 0;
error:
crypt_free(cd);
return EX_IOERR;
}
int main(int argc, char **argv) {
unsigned int version = 0, help = 0;
char challenge_old[CHALLENGELEN + 1],
challenge_new[CHALLENGELEN + 1],
response_old[RESPONSELEN],
response_new[RESPONSELEN],
passphrase_old[PASSPHRASELEN + 1],
passphrase_new[PASSPHRASELEN + 1];
const char * tmp;
char challengefilename[sizeof(CHALLENGEDIR) + 11 /* "/challenge-" */ + 10 /* unsigned int in char */ + 1],
challengefiletmpname[sizeof(CHALLENGEDIR) + 11 /* "/challenge-" */ + 10 /* unsigned int in char */ + 7 /* -XXXXXX */ + 1];
int challengefile = 0, challengefiletmp = 0;
struct timeval tv;
int i;
size_t len;
int8_t rc = EXIT_FAILURE;
/* cryptsetup */
const char * device_name;
int8_t luks_slot = -1;
struct crypt_device *cryptdevice;
crypt_status_info cryptstatus;
crypt_keyslot_info cryptkeyslot;
char * passphrase = NULL;
/* keyutils */
key_serial_t key;
void * payload = NULL;
char * second_factor = NULL, * new_2nd_factor = NULL, * new_2nd_factor_verify = NULL;
/* yubikey */
YK_KEY * yk;
uint8_t yk_slot = SLOT_CHAL_HMAC2;
unsigned int serial = 0;
/* iniparser */
dictionary * ini;
char section_ykslot[10 /* unsigned int in char */ + 1 + sizeof(CONFYKSLOT) + 1];
char section_luksslot[10 + 1 + sizeof(CONFLUKSSLOT) + 1];
/* get command line options */
while ((i = getopt_long(argc, argv, optstring, options_long, NULL)) != -1)
switch (i) {
case 'h':
help++;
break;
case 'n':
case 'N':
if (new_2nd_factor != NULL) {
fprintf(stderr, "We already have a new second factor. Did you specify it twice?\n");
goto out10;
}
if (optarg == NULL) { /* N */
if ((new_2nd_factor = ask_secret("new second factor")) == NULL)
goto out10;
if ((new_2nd_factor_verify = ask_secret("new second factor for verification")) == NULL)
goto out10;
if (strcmp(new_2nd_factor, new_2nd_factor_verify) != 0) {
fprintf(stderr, "Verification failed, given strings do not match.\n");
goto out10;
}
} else { /* n */
new_2nd_factor = strdup(optarg);
memset(optarg, '*', strlen(optarg));
}
break;
case 's':
case 'S':
if (second_factor != NULL) {
fprintf(stderr, "We already have a second factor. Did you specify it twice?\n");
goto out10;
}
if (optarg == NULL) { /* S */
second_factor = ask_secret("current second factor");
} else { /* s */
second_factor = strdup(optarg);
memset(optarg, '*', strlen(optarg));
}
break;
case 'V':
version++;
break;
}
if (version > 0)
printf("%s: %s v%s (compiled: " __DATE__ ", " __TIME__ ")\n", argv[0], PROGNAME, VERSION);
if (help > 0)
fprintf(stderr, "usage: %s [-h|--help] [-n|--new-2nd-factor <new-2nd-factor>] [-N|--ask-new-2nd-factor]\n"
" [-s|--2nd-factor <2nd-factor>] [-S|--ask-2nd-factor] [-V|--version]\n", argv[0]);
if (version > 0 || help > 0)
return EXIT_SUCCESS;
/* initialize random seed */
gettimeofday(&tv, NULL);
srand(tv.tv_usec * tv.tv_sec);
/* initialize static buffers */
memset(challenge_old, 0, CHALLENGELEN + 1);
memset(challenge_new, 0, CHALLENGELEN + 1);
memset(response_old, 0, RESPONSELEN);
memset(response_new, 0, RESPONSELEN);
memset(passphrase_old, 0, PASSPHRASELEN + 1);
memset(passphrase_new, 0, PASSPHRASELEN + 1);
if ((ini = iniparser_load(CONFIGFILE)) == NULL) {
fprintf(stderr, "Could not parse configuration file.\n");
goto out10;
}
if ((device_name = iniparser_getstring(ini, "general:" CONFDEVNAME, NULL)) == NULL) {
/* read from crypttab? */
/* get device from currently open devices? */
fprintf(stderr, "Could not read LUKS device from configuration file.\n");
goto out20;
}
/* init and open first Yubikey */
if (yk_init() == 0) {
perror("yk_init() failed");
goto out20;
}
if ((yk = yk_open_first_key()) == NULL) {
fprintf(stderr, "No Yubikey available.\n");
goto out30;
}
/* read the serial number from key */
if (yk_get_serial(yk, 0, 0, &serial) == 0) {
perror("yk_get_serial() failed");
goto out40;
}
/* get the yk slot */
sprintf(section_ykslot, "%d:" CONFYKSLOT, serial);
yk_slot = iniparser_getint(ini, "general:" CONFYKSLOT, yk_slot);
yk_slot = iniparser_getint(ini, section_ykslot, yk_slot);
switch (yk_slot) {
case 1:
case SLOT_CHAL_HMAC1:
yk_slot = SLOT_CHAL_HMAC1;
break;
case 2:
case SLOT_CHAL_HMAC2:
default:
yk_slot = SLOT_CHAL_HMAC2;
break;
}
/* get the luks slot */
sprintf(section_luksslot, "%d:" CONFLUKSSLOT, serial);
luks_slot = iniparser_getint(ini, section_luksslot, luks_slot);
if (luks_slot < 0) {
fprintf(stderr, "Please set LUKS key slot for Yubikey with serial %d!\n"
"Add something like this to " CONFIGFILE ":\n\n"
"[%d]\nluks slot = 1\n", serial, serial);
goto out40;
}
if (second_factor == NULL) {
/* get second factor from key store */
if ((key = request_key("user", "ykfde-2f", NULL, 0)) < 0)
fprintf(stderr, "Failed requesting key. That's ok if you do not use\n"
"second factor. Give it manually if required.\n");
if (key > -1) {
/* if we have a key id we have a key - so this should succeed */
if (keyctl_read_alloc(key, &payload) < 0) {
perror("Failed reading payload from key");
goto out40;
}
second_factor = payload;
} else
second_factor = strdup("");
}
/* warn when second factor is not enabled in config */
if ((*second_factor != 0 || new_2nd_factor != NULL) &&
iniparser_getboolean(ini, "general:" CONF2NDFACTOR, 0) == 0)
fprintf(stderr, "Warning: Processing second factor, but not enabled in config!\n");
/* get random number and limit to printable ASCII character (32 to 126) */
for(i = 0; i < CHALLENGELEN; i++)
challenge_new[i] = (rand() % (126 - 32)) + 32;
/* these are the filenames for challenge
* we need this for reading and writing */
sprintf(challengefilename, CHALLENGEDIR "/challenge-%d", serial);
sprintf(challengefiletmpname, CHALLENGEDIR "/challenge-%d-XXXXXX", serial);
/* write new challenge to file */
if ((challengefiletmp = mkstemp(challengefiletmpname)) < 0) {
fprintf(stderr, "Could not open file %s for writing.\n", challengefiletmpname);
goto out40;
}
if (write(challengefiletmp, challenge_new, CHALLENGELEN) < 0) {
fprintf(stderr, "Failed to write challenge to file.\n");
goto out50;
}
challengefiletmp = close(challengefiletmp);
/* now that the new challenge has been written to file...
* add second factor to new challenge */
tmp = new_2nd_factor ? new_2nd_factor : second_factor;
len = strlen(tmp);
memcpy(challenge_new, tmp, len < MAX2FLEN ? len : MAX2FLEN);
/* do challenge/response and encode to hex */
if (yk_challenge_response(yk, yk_slot, true,
CHALLENGELEN, (unsigned char *) challenge_new,
RESPONSELEN, (unsigned char *) response_new) == 0) {
perror("yk_challenge_response() failed");
goto out50;
}
yubikey_hex_encode((char *) passphrase_new, (char *) response_new, SHA1_DIGEST_SIZE);
/* get status of crypt device
* We expect this to be active (or busy). It is the actual root device, no? */
cryptstatus = crypt_status(cryptdevice, device_name);
if (cryptstatus != CRYPT_ACTIVE && cryptstatus != CRYPT_BUSY) {
fprintf(stderr, "Device %s is invalid or inactive.\n", device_name);
goto out50;
}
/* initialize crypt device */
if (crypt_init_by_name(&cryptdevice, device_name) < 0) {
fprintf(stderr, "Device %s failed to initialize.\n", device_name);
goto out60;
}
cryptkeyslot = crypt_keyslot_status(cryptdevice, luks_slot);
if (cryptkeyslot == CRYPT_SLOT_INVALID) {
fprintf(stderr, "Key slot %d is invalid.\n", luks_slot);
goto out60;
} else if (cryptkeyslot == CRYPT_SLOT_ACTIVE || cryptkeyslot == CRYPT_SLOT_ACTIVE_LAST) {
/* read challenge from file */
if ((challengefile = open(challengefilename, O_RDONLY)) < 0) {
perror("Failed opening challenge file for reading");
goto out60;
}
if (read(challengefile, challenge_old, CHALLENGELEN) < 0) {
perror("Failed reading challenge from file");
goto out60;
}
challengefile = close(challengefile);
/* finished reading challenge */
/* copy the second factor */
len = strlen(second_factor);
memcpy(challenge_old, second_factor, len < MAX2FLEN ? len : MAX2FLEN);
/* do challenge/response and encode to hex */
if (yk_challenge_response(yk, yk_slot, true,
CHALLENGELEN, (unsigned char *) challenge_old,
RESPONSELEN, (unsigned char *) response_old) == 0) {
perror("yk_challenge_response() failed");
goto out60;
}
yubikey_hex_encode((char *) passphrase_old, (char *) response_old, SHA1_DIGEST_SIZE);
if (crypt_keyslot_change_by_passphrase(cryptdevice, luks_slot, luks_slot,
passphrase_old, PASSPHRASELEN,
passphrase_new, PASSPHRASELEN) < 0) {
fprintf(stderr, "Could not update passphrase for key slot %d.\n", luks_slot);
goto out60;
}
if (unlink(challengefilename) < 0) {
fprintf(stderr, "Failed to delete old challenge file.\n");
goto out60;
}
} else { /* ck == CRYPT_SLOT_INACTIVE */
if ((passphrase = ask_secret("existing LUKS passphrase")) == NULL)
goto out60;
if (crypt_keyslot_add_by_passphrase(cryptdevice, luks_slot,
passphrase, strlen(passphrase),
passphrase_new, PASSPHRASELEN) < 0) {
fprintf(stderr, "Could not add passphrase for key slot %d.\n", luks_slot);
goto out60;
}
}
if (rename(challengefiletmpname, challengefilename) < 0) {
fprintf(stderr, "Failed to rename new challenge file.\n");
goto out60;
}
rc = EXIT_SUCCESS;
out60:
/* free crypt context */
crypt_free(cryptdevice);
out50:
/* close the challenge file */
if (challengefile)
close(challengefile);
if (challengefiletmp)
close(challengefiletmp);
if (access(challengefiletmpname, F_OK) == 0)
unlink(challengefiletmpname);
out40:
/* close Yubikey */
if (yk_close_key(yk) == 0)
perror("yk_close_key() failed");
out30:
/* release Yubikey */
if (yk_release() == 0)
perror("yk_release() failed");
out20:
/* free iniparser dictionary */
iniparser_freedict(ini);
out10:
/* wipe response (cleartext password!) from memory */
/* This is statically allocated and always save to wipe! */
memset(challenge_old, 0, CHALLENGELEN + 1);
memset(challenge_new, 0, CHALLENGELEN + 1);
memset(response_old, 0, RESPONSELEN);
memset(response_new, 0, RESPONSELEN);
memset(passphrase_old, 0, PASSPHRASELEN + 1);
memset(passphrase_new, 0, PASSPHRASELEN + 1);
free(passphrase);
free(new_2nd_factor_verify);
free(new_2nd_factor);
free(second_factor);
return rc;
}
static int check_keyslots(FILE *out, struct crypt_device *cd, int f_luks)
{
int i;
double ent;
off_t ofs;
uint64_t start, length, end;
crypt_keyslot_info ki;
unsigned char buffer[sector_size];
for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1) ; i++) {
fprintf(out, "- processing keyslot %d:", i);
ki = crypt_keyslot_status(cd, i);
if (ki == CRYPT_SLOT_INACTIVE) {
fprintf(out, " keyslot not in use\n");
continue;
}
if (ki == CRYPT_SLOT_INVALID) {
fprintf(out, "\nError: keyslot invalid.\n");
return EXIT_FAILURE;
}
if (crypt_keyslot_area(cd, i, &start, &length) < 0) {
fprintf(stderr,"\nError: querying keyslot area failed for slot %d\n", i);
perror(NULL);
return EXIT_FAILURE;
}
end = start + length;
fprintf(out, " start: ");
print_address(out, start);
fprintf(out, " end: ");
print_address(out, end);
fprintf(out, "\n");
/* check whether sector-size divides size */
if (length % sector_size != 0) {
fprintf(stderr,"\nError: Argument to -s does not divide keyslot size\n");
return EXIT_FAILURE;
}
for (ofs = start; (uint64_t)ofs < end; ofs += sector_size) {
if (lseek(f_luks, ofs, SEEK_SET) != ofs) {
fprintf(stderr,"\nCannot seek to keyslot area.\n");
return EXIT_FAILURE;
}
if (read(f_luks, buffer, sector_size) != sector_size) {
fprintf(stderr,"\nCannot read keyslot area.\n");
return EXIT_FAILURE;
}
ent = ent_samp(buffer, sector_size);
if (ent < threshold) {
fprintf(out, " low entropy at: ");
print_address(out, ofs);
fprintf(out, " entropy: %f\n", ent);
if (verbose) {
fprintf(out, " Binary dump:\n");
hexdump_sector(out, buffer, (uint64_t)ofs, sector_size);
fprintf(out,"\n");
}
}
}
}
return EXIT_SUCCESS;
}
int main(int argc, char **argv) {
char challenge_old[CHALLENGELEN + 1],
challenge_new[CHALLENGELEN + 1],
repose_old[RESPONSELEN],
repose_new[RESPONSELEN],
passphrase_old[PASSPHRASELEN + 1],
passphrase_new[PASSPHRASELEN + 1];
char challengefilename[sizeof(CHALLENGEDIR) + 11 /* "/challenge-" */ + 10 /* unsigned int in char */ + 1],
challengefiletmpname[sizeof(CHALLENGEDIR) + 11 /* "/challenge-" */ + 10 /* unsigned int in char */ + 7 /* -XXXXXX */ + 1];
int challengefile = 0, challengefiletmp = 0;
struct timeval tv;
int i;
int8_t rc = EXIT_FAILURE;
/* cryptsetup */
char * device_name;
int8_t luks_slot = -1;
struct crypt_device *cd;
crypt_status_info cs;
crypt_keyslot_info ck;
/* yubikey */
YK_KEY * yk;
uint8_t yk_slot = SLOT_CHAL_HMAC2;
unsigned int serial = 0;
/* iniparser */
dictionary * ini;
char section_ykslot[10 /* unsigned int in char */ + 1 + sizeof(CONFYKSLOT) + 1];
char section_luksslot[10 /* unsigned int in char */ + 1 + sizeof(CONFLUKSSLOT) + 1];
/* initialize random seed */
gettimeofday(&tv, NULL);
srand(tv.tv_usec * tv.tv_sec);
memset(challenge_old, 0, CHALLENGELEN + 1);
memset(challenge_new, 0, CHALLENGELEN + 1);
memset(repose_old, 0, RESPONSELEN);
memset(repose_new, 0, RESPONSELEN);
memset(passphrase_old, 0, PASSPHRASELEN + 1);
memset(passphrase_new, 0, PASSPHRASELEN + 1);
if ((ini = iniparser_load(CONFIGFILE)) == NULL) {
rc = EXIT_FAILURE;
fprintf(stderr, "Could not parse configuration file.\n");
goto out10;
}
if ((device_name = iniparser_getstring(ini, "general:" CONFDEVNAME, NULL)) == NULL) {
rc = EXIT_FAILURE;
/* read from crypttab? */
/* get device from currently open devices? */
fprintf(stderr, "Could not read LUKS device from configuration file.\n");
goto out20;
}
/* init and open first Yubikey */
if ((rc = yk_init()) < 0) {
perror("yk_init() failed");
goto out20;
}
if ((yk = yk_open_first_key()) == NULL) {
rc = EXIT_FAILURE;
perror("yk_open_first_key() failed");
goto out30;
}
/* read the serial number from key */
if ((rc = yk_get_serial(yk, 0, 0, &serial)) < 0) {
perror("yk_get_serial() failed");
goto out40;
}
/* get the yk slot */
sprintf(section_ykslot, "%d:" CONFYKSLOT, serial);
yk_slot = iniparser_getint(ini, "general:" CONFYKSLOT, yk_slot);
yk_slot = iniparser_getint(ini, section_ykslot, yk_slot);
switch (yk_slot) {
case 1:
case SLOT_CHAL_HMAC1:
yk_slot = SLOT_CHAL_HMAC1;
break;
case 2:
case SLOT_CHAL_HMAC2:
default:
yk_slot = SLOT_CHAL_HMAC2;
break;
}
/* get the luks slot */
sprintf(section_luksslot, "%d:" CONFLUKSSLOT, serial);
luks_slot = iniparser_getint(ini, section_luksslot, luks_slot);
if (luks_slot < 0) {
rc = EXIT_FAILURE;
fprintf(stderr, "Please set LUKS key slot for Yubikey with serial %d!\n", serial);
printf("Add something like this to " CONFIGFILE ":\n\n[%d]\nluks slot = 1\n", serial);
goto out40;
}
/* get random number and limit to printable ASCII character (32 to 126) */
for(i = 0; i < CHALLENGELEN; i++)
challenge_new[i] = (rand() % (126 - 32)) + 32;
/* do challenge/response and encode to hex */
if ((rc = yk_challenge_response(yk, yk_slot, true,
CHALLENGELEN, (unsigned char *)challenge_new,
RESPONSELEN, (unsigned char *)repose_new)) < 0) {
perror("yk_challenge_response() failed");
goto out40;
}
yubikey_hex_encode((char *)passphrase_new, (char *)repose_new, 20);
/* initialize crypt device */
if ((rc = crypt_init_by_name(&cd, device_name)) < 0) {
fprintf(stderr, "Device %s failed to initialize.\n", device_name);
goto out40;
}
/* these are the filenames for challenge
* we need this for reading and writing */
sprintf(challengefilename, CHALLENGEDIR "/challenge-%d", serial);
sprintf(challengefiletmpname, CHALLENGEDIR "/challenge-%d-XXXXXX", serial);
/* write new challenge to file */
if ((rc = challengefiletmp = mkstemp(challengefiletmpname)) < 0) {
fprintf(stderr, "Could not open file %s for writing.\n", challengefiletmpname);
goto out50;
}
if ((rc = write(challengefiletmp, challenge_new, CHALLENGELEN)) < 0) {
fprintf(stderr, "Failed to write challenge to file.\n");
goto out60;
}
challengefiletmp = close(challengefiletmp);
/* get status of crypt device
* We expect this to be active (or busy). It is the actual root device, no? */
cs = crypt_status(cd, device_name);
if (cs != CRYPT_ACTIVE && cs != CRYPT_BUSY) {
rc = EXIT_FAILURE;
fprintf(stderr, "Device %s is invalid or inactive.\n", device_name);
goto out60;
}
ck = crypt_keyslot_status(cd, luks_slot);
if (ck == CRYPT_SLOT_INVALID) {
rc = EXIT_FAILURE;
fprintf(stderr, "Key slot %d is invalid.\n", luks_slot);
goto out60;
} else if (ck == CRYPT_SLOT_ACTIVE || ck == CRYPT_SLOT_ACTIVE_LAST) {
/* read challenge from file */
if ((rc = challengefile = open(challengefilename, O_RDONLY)) < 0) {
perror("Failed opening challenge file for reading");
goto out60;
}
if ((rc = read(challengefile, challenge_old, CHALLENGELEN)) < 0) {
perror("Failed reading challenge from file");
goto out60;
}
challengefile = close(challengefile);
/* finished reading challenge */
/* do challenge/response and encode to hex */
if ((rc = yk_challenge_response(yk, yk_slot, true,
CHALLENGELEN, (unsigned char *)challenge_old,
RESPONSELEN, (unsigned char *)repose_old)) < 0) {
perror("yk_challenge_response() failed");
goto out60;
}
yubikey_hex_encode((char *)passphrase_old, (char *)repose_old, 20);
if ((rc = crypt_keyslot_change_by_passphrase(cd, luks_slot, luks_slot,
passphrase_old, PASSPHRASELEN,
passphrase_new, PASSPHRASELEN)) < 0) {
fprintf(stderr, "Could not update passphrase for key slot %d.\n", luks_slot);
goto out60;
}
if ((rc = unlink(challengefilename)) < 0) {
fprintf(stderr, "Failed to delete old challenge file.\n");
goto out60;
}
} else { /* ck == CRYPT_SLOT_INACTIVE */
if ((rc = crypt_keyslot_add_by_passphrase(cd, luks_slot, NULL, 0,
passphrase_new, PASSPHRASELEN)) < 0) {
fprintf(stderr, "Could add passphrase for key slot %d.\n", luks_slot);
goto out60;
}
}
if ((rc = rename(challengefiletmpname, challengefilename)) < 0) {
fprintf(stderr, "Failed to rename new challenge file.\n");
goto out60;
}
rc = EXIT_SUCCESS;
out60:
/* close the challenge file */
if (challengefile)
close(challengefile);
if (challengefiletmp)
close(challengefiletmp);
if (access(challengefiletmpname, F_OK) == 0 )
unlink(challengefiletmpname);
out50:
/* free crypt context */
crypt_free(cd);
out40:
/* close Yubikey */
if (!yk_close_key(yk))
perror("yk_close_key() failed");
out30:
/* release Yubikey */
if (!yk_release())
perror("yk_release() failed");
out20:
/* free iniparser dictionary */
iniparser_freedict(ini);
out10:
/* wipe response (cleartext password!) from memory */
/* This is statically allocated and always save to wipe! */
memset(challenge_old, 0, CHALLENGELEN + 1);
memset(challenge_new, 0, CHALLENGELEN + 1);
memset(repose_old, 0, RESPONSELEN);
memset(repose_new, 0, RESPONSELEN);
memset(passphrase_old, 0, PASSPHRASELEN + 1);
memset(passphrase_new, 0, PASSPHRASELEN + 1);
return rc;
}
