From 2c153ce62577b105165d7af91789599cb8937691 Mon Sep 17 00:00:00 2001 From: CyberLeo Date: Sun, 23 Jul 2017 03:47:43 -0500 Subject: [PATCH] cdn-patch: adjust geli boot-time unlock behaviour This patch will cause geli's boot-time unlock code to attempt unlocking the container using only the preloaded keyfile(s); and only when that fails will it prompt for a passphrase. If a container has a keyfile in one slot and a passphrase in the other, the boot-time unlock code will get confused and assume they are to be combined, resulting in a container that cannot be unlocked during boot when its keyfile is preloaded. --- sys/geom/eli/g_eli.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/sys/geom/eli/g_eli.c b/sys/geom/eli/g_eli.c index 6d734aece18..88496061f97 100644 --- a/sys/geom/eli/g_eli.c +++ b/sys/geom/eli/g_eli.c @@ -1035,7 +1035,41 @@ g_eli_taste(struct g_class *mp, struct g_provider *pp, int flags __unused) tries = g_eli_tries; } + /* + * CyberLeo: Attempt to decrypt the provider using only the keys, to avoid kern/193624 + */ + g_eli_crypto_hmac_init(&ctx, NULL, 0); + if (0 < g_eli_keyfiles_load(&ctx, pp->name)) { + g_eli_crypto_hmac_final(&ctx, key, 0); + error = g_eli_mkey_decrypt(&md, key, mkey, &nkey); + bzero(key, sizeof(key)); + if (error == -1) { + G_ELI_DEBUG(0, + "Wrong key for %s.", + pp->name); + } else if (error > 0) { + G_ELI_DEBUG(0, + "Cannot decrypt Master Key for %s (error=%d).", + pp->name, error); + g_eli_keyfiles_clear(pp->name); + return (NULL); + } else { + G_ELI_DEBUG(0, + "Decrypted master key for %s without passphrase.", + pp->name); + tries = 0; + } + } else { + /* Cleanup */ + g_eli_crypto_hmac_final(&ctx, key, 0); + bzero(key, sizeof(key)); + } + for (i = 0; i <= tries; i++) { + /* Avoid running loop at all if there are no tries */ + if (tries < 1) + break; + g_eli_crypto_hmac_init(&ctx, NULL, 0); /* -- 2.45.0