Page MenuHomeFreeBSD
Files F105755854

D24343.diff
No OneTemporary
Actions

D24343.diff
View Options

Index: head/lib/geom/eli/geli.8
===================================================================
--- head/lib/geom/eli/geli.8
+++ head/lib/geom/eli/geli.8
@@ -24,7 +24,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd March 19, 2020
+.Dd April 14, 2020
.Dt GELI 8
.Os
.Sh NAME
@@ -172,14 +172,11 @@
Supports many cryptographic algorithms (currently
.Nm AES-XTS ,
.Nm AES-CBC ,
-.Nm Blowfish-CBC ,
-.Nm Camellia-CBC
and
-.Nm 3DES-CBC ) .
+.Nm Camellia-CBC ) .
.It
Can optionally perform data authentication (integrity verification) utilizing
one of the following algorithms:
-.Nm HMAC/MD5 ,
.Nm HMAC/SHA1 ,
.Nm HMAC/RIPEMD160 ,
.Nm HMAC/SHA256 ,
@@ -259,7 +256,6 @@
.Nm HMAC/SHA256
algorithm, 89% of the original provider storage will be available for use.
Currently supported algorithms are:
-.Nm HMAC/MD5 ,
.Nm HMAC/SHA1 ,
.Nm HMAC/RIPEMD160 ,
.Nm HMAC/SHA256 ,
@@ -303,9 +299,7 @@
Currently supported algorithms are:
.Nm AES-XTS ,
.Nm AES-CBC ,
-.Nm Blowfish-CBC ,
.Nm Camellia-CBC ,
-.Nm 3DES-CBC ,
and
.Nm NULL .
The default and recommended algorithm is
@@ -359,11 +353,6 @@
.Em 128 ,
192,
256
-.It Nm Blowfish-CBC
-.Em 128
-+ n * 32, for n=[0..10]
-.It Nm 3DES-CBC
-.Em 192
.El
.It Fl P
Do not use a passphrase as a component of the User Key.
@@ -901,18 +890,6 @@
.El
.Sh EXIT STATUS
Exit status is 0 on success, and 1 if the command fails.
-.Sh DEPRECATION NOTICE
-Support for the
-.Nm Blowfish-CBC
-and
-.Nm 3DES-CBC
-cryptographic algorithms and
-.Nm HMAC/MD5
-authentication algorithm will be removed in
-.Fx 13.0 .
-New volumes cannot be created using these algorithms.
-Existing volumes should be migrated to a new volume that uses
-non-deprecated algorithms.
.Sh EXAMPLES
Initialize a provider which is going to be encrypted with a
passphrase and random data from a file on the user's pen drive.
@@ -967,7 +944,7 @@
Encrypted swap partition setup:
.Bd -literal -offset indent
# dd if=/dev/random of=/dev/ada0s1b bs=1m
-# geli onetime -d -e 3des ada0s1b
+# geli onetime -d ada0s1b
# swapon /dev/ada0s1b.eli
.Ed
.Pp
Index: head/lib/geom/eli/geom_eli.c
===================================================================
--- head/lib/geom/eli/geom_eli.c
+++ head/lib/geom/eli/geom_eli.c
@@ -805,22 +805,6 @@
return;
}
}
- if (md.md_flags & G_ELI_FLAG_AUTH) {
- switch (md.md_aalgo) {
- case CRYPTO_MD5_HMAC:
- gctl_error(req,
- "The %s authentication algorithm is deprecated.",
- g_eli_algo2str(md.md_aalgo));
- return;
- }
- }
- switch (md.md_ealgo) {
- case CRYPTO_3DES_CBC:
- case CRYPTO_BLF_CBC:
- gctl_error(req, "The %s encryption algorithm is deprecated.",
- g_eli_algo2str(md.md_ealgo));
- return;
- }
val = gctl_get_intmax(req, "keylen");
md.md_keylen = val;
md.md_keylen = g_eli_keylen(md.md_ealgo, md.md_keylen);
Index: head/sys/geom/eli/g_eli.h
===================================================================
--- head/sys/geom/eli/g_eli.h
+++ head/sys/geom/eli/g_eli.h
@@ -417,18 +417,10 @@
return (CRYPTO_AES_CBC);
else if (strcasecmp("aes-xts", name) == 0)
return (CRYPTO_AES_XTS);
- else if (strcasecmp("blowfish", name) == 0)
- return (CRYPTO_BLF_CBC);
- else if (strcasecmp("blowfish-cbc", name) == 0)
- return (CRYPTO_BLF_CBC);
else if (strcasecmp("camellia", name) == 0)
return (CRYPTO_CAMELLIA_CBC);
else if (strcasecmp("camellia-cbc", name) == 0)
return (CRYPTO_CAMELLIA_CBC);
- else if (strcasecmp("3des", name) == 0)
- return (CRYPTO_3DES_CBC);
- else if (strcasecmp("3des-cbc", name) == 0)
- return (CRYPTO_3DES_CBC);
return (CRYPTO_ALGORITHM_MIN - 1);
}
@@ -436,9 +428,7 @@
g_eli_str2aalgo(const char *name)
{
- if (strcasecmp("hmac/md5", name) == 0)
- return (CRYPTO_MD5_HMAC);
- else if (strcasecmp("hmac/sha1", name) == 0)
+ if (strcasecmp("hmac/sha1", name) == 0)
return (CRYPTO_SHA1_HMAC);
else if (strcasecmp("hmac/ripemd160", name) == 0)
return (CRYPTO_RIPEMD160_HMAC);
@@ -462,14 +452,8 @@
return ("AES-CBC");
case CRYPTO_AES_XTS:
return ("AES-XTS");
- case CRYPTO_BLF_CBC:
- return ("Blowfish-CBC");
case CRYPTO_CAMELLIA_CBC:
return ("CAMELLIA-CBC");
- case CRYPTO_3DES_CBC:
- return ("3DES-CBC");
- case CRYPTO_MD5_HMAC:
- return ("HMAC/MD5");
case CRYPTO_SHA1_HMAC:
return ("HMAC/SHA1");
case CRYPTO_RIPEMD160_HMAC:
@@ -522,6 +506,36 @@
printf(" MD5 hash: %s\n", str);
}
+#ifdef _KERNEL
+static bool
+eli_metadata_crypto_supported(const struct g_eli_metadata *md)
+{
+
+ switch (md->md_ealgo) {
+ case CRYPTO_NULL_CBC:
+ case CRYPTO_AES_CBC:
+ case CRYPTO_CAMELLIA_CBC:
+ case CRYPTO_AES_XTS:
+ break;
+ default:
+ return (false);
+ }
+ if (md->md_flags & G_ELI_FLAG_AUTH) {
+ switch (md->md_aalgo) {
+ case CRYPTO_SHA1_HMAC:
+ case CRYPTO_RIPEMD160_HMAC:
+ case CRYPTO_SHA2_256_HMAC:
+ case CRYPTO_SHA2_384_HMAC:
+ case CRYPTO_SHA2_512_HMAC:
+ break;
+ default:
+ return (false);
+ }
+ }
+ return (true);
+}
+#endif
+
static __inline u_int
g_eli_keylen(u_int algo, u_int keylen)
{
@@ -557,18 +571,6 @@
default:
return (0);
}
- case CRYPTO_BLF_CBC:
- if (keylen == 0)
- return (128);
- if (keylen < 128 || keylen > 448)
- return (0);
- if ((keylen % 32) != 0)
- return (0);
- return (keylen);
- case CRYPTO_3DES_CBC:
- if (keylen == 0 || keylen == 192)
- return (192);
- return (0);
default:
return (0);
}
@@ -583,12 +585,8 @@
return (AES_XTS_IV_LEN);
case CRYPTO_AES_CBC:
return (AES_BLOCK_LEN);
- case CRYPTO_BLF_CBC:
- return (BLOWFISH_BLOCK_LEN);
case CRYPTO_CAMELLIA_CBC:
return (CAMELLIA_BLOCK_LEN);
- case CRYPTO_3DES_CBC:
- return (DES3_BLOCK_LEN);
}
return (0);
}
@@ -598,8 +596,6 @@
{
switch (algo) {
- case CRYPTO_MD5_HMAC:
- return (16);
case CRYPTO_SHA1_HMAC:
return (20);
case CRYPTO_RIPEMD160_HMAC:
Index: head/sys/geom/eli/g_eli.c
===================================================================
--- head/sys/geom/eli/g_eli.c
+++ head/sys/geom/eli/g_eli.c
@@ -847,6 +847,8 @@
int dcw, error;
G_ELI_DEBUG(1, "Creating device %s%s.", bpp->name, G_ELI_SUFFIX);
+ KASSERT(eli_metadata_crypto_supported(md),
+ ("%s: unsupported crypto for %s", __func__, bpp->name));
gp = g_new_geomf(mp, "%s%s", bpp->name, G_ELI_SUFFIX);
sc = malloc(sizeof(*sc), M_ELI, M_WAITOK | M_ZERO);
@@ -975,25 +977,8 @@
G_ELI_DEBUG(0, "Device %s created.", pp->name);
G_ELI_DEBUG(0, "Encryption: %s %u", g_eli_algo2str(sc->sc_ealgo),
sc->sc_ekeylen);
- switch (sc->sc_ealgo) {
- case CRYPTO_3DES_CBC:
- gone_in(13,
- "support for GEOM_ELI volumes encrypted with 3des");
- break;
- case CRYPTO_BLF_CBC:
- gone_in(13,
- "support for GEOM_ELI volumes encrypted with blowfish");
- break;
- }
- if (sc->sc_flags & G_ELI_FLAG_AUTH) {
+ if (sc->sc_flags & G_ELI_FLAG_AUTH)
G_ELI_DEBUG(0, " Integrity: %s", g_eli_algo2str(sc->sc_aalgo));
- switch (sc->sc_aalgo) {
- case CRYPTO_MD5_HMAC:
- gone_in(13,
- "support for GEOM_ELI volumes authenticated with hmac/md5");
- break;
- }
- }
G_ELI_DEBUG(0, " Crypto: %s",
sc->sc_crypto == G_ELI_CRYPTO_SW ? "software" : "hardware");
return (gp);
@@ -1188,6 +1173,11 @@
return (NULL);
if (md.md_keys == 0x00) {
G_ELI_DEBUG(0, "No valid keys on %s.", pp->name);
+ return (NULL);
+ }
+ if (!eli_metadata_crypto_supported(&md)) {
+ G_ELI_DEBUG(0, "%s uses invalid or unsupported algorithms\n",
+ pp->name);
return (NULL);
}
if (md.md_iterations == -1) {
Index: head/sys/geom/eli/g_eli_crypto.c
===================================================================
--- head/sys/geom/eli/g_eli_crypto.c
+++ head/sys/geom/eli/g_eli_crypto.c
@@ -138,9 +138,6 @@
return (EINVAL);
}
break;
- case CRYPTO_BLF_CBC:
- type = EVP_bf_cbc();
- break;
#ifndef OPENSSL_NO_CAMELLIA
case CRYPTO_CAMELLIA_CBC:
switch (keysize) {
@@ -158,9 +155,6 @@
}
break;
#endif
- case CRYPTO_3DES_CBC:
- type = EVP_des_ede3_cbc();
- break;
default:
return (EINVAL);
}
Index: head/sys/geom/eli/g_eli_ctl.c
===================================================================
--- head/sys/geom/eli/g_eli_ctl.c
+++ head/sys/geom/eli/g_eli_ctl.c
@@ -138,6 +138,11 @@
gctl_error(req, "No valid keys on %s.", pp->name);
return;
}
+ if (!eli_metadata_crypto_supported(&md)) {
+ explicit_bzero(&md, sizeof(md));
+ gctl_error(req, "Invalid or unsupported algorithms.");
+ return;
+ }
key = gctl_get_param(req, "key", &keysize);
if (key == NULL || keysize != G_ELI_USERKEYLEN) {

File Metadata

Mime Type
text/plain
Expires
Sat, Dec 21, 5:29 AM (18 h, 26 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
15538436
Default Alt Text
D24343.diff (8 KB)

Event Timeline