aboutsummaryrefslogtreecommitdiff
path: root/lib/geom
diff options
context:
space:
mode:
authorBen Woods <woodsb02@FreeBSD.org>2018-06-26 18:07:16 +0000
committerBen Woods <woodsb02@FreeBSD.org>2018-06-26 18:07:16 +0000
commit217df2da0805f63e8d35787929aeaf92815a4c17 (patch)
tree4378f61f959ddf39cdd9109c9062f73a9b2bbccd /lib/geom
parent96fa53869c833944247fe2d3e95f7bb4931c1d4d (diff)
downloadsrc-217df2da0805f63e8d35787929aeaf92815a4c17.tar.gz
src-217df2da0805f63e8d35787929aeaf92815a4c17.zip
geli attach multiple providers
Allow attaching of multiple geli providers at once if they use same passphrase and keyfiles. This is helpful when the providers being attached are not used for boot, and therefore the existing code to first try the cached password when tasting the providers during boot does not apply. Multiple providers with the same passphrase and keyfiles can be attached at the same time during system start-up by adding the following to rc.conf: geli_groups="storage backup" geli_storage_flags="-k /etc/geli/storage.keys" geli_storage_devices="ada0 ada1" geli_backup_flags="-j /etc/geli/backup.passfile -k /etc/geli/backup.keys" geli_backup_devices="ada2 ada3" Reviewed by: wblock, delphij, jilles Approved by: sobomax (src), bcr (doc) Differential Revision: https://reviews.freebsd.org/D12644
Notes
Notes: svn path=/head/; revision=335673
Diffstat (limited to 'lib/geom')
-rw-r--r--lib/geom/eli/geli.8111
-rw-r--r--lib/geom/eli/geom_eli.c194
2 files changed, 185 insertions, 120 deletions
diff --git a/lib/geom/eli/geli.8 b/lib/geom/eli/geli.8
index e4a48cf625f7..1709e629b5ac 100644
--- a/lib/geom/eli/geli.8
+++ b/lib/geom/eli/geli.8
@@ -24,7 +24,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd May 9, 2018
+.Dd June 27, 2018
.Dt GELI 8
.Os
.Sh NAME
@@ -71,7 +71,7 @@ utility:
.Op Fl n Ar keyno
.Op Fl j Ar passfile
.Op Fl k Ar keyfile
-.Ar prov
+.Ar prov ...
.Nm
.Cm detach
.Op Fl fl
@@ -192,8 +192,7 @@ entered via prompt or read from one or more passfiles; a keyfile read from
one or more files.
.It
Allows encryption of the root partition.
-The user will be asked for the
-passphrase before the root file system is mounted.
+The user is asked for the passphrase before the root filesystem is mounted.
.It
Strengthens the passphrase component of the User Key with:
.Rs
@@ -217,12 +216,12 @@ so that if a user has to quickly destroy key material,
it is possible to get the data back by restoring keys from
backup.
.It
-Providers can be configured to automatically detach on last close
-(so users do not have to remember to detach providers after unmounting
-the file systems).
+Providers can be configured to automatically detach on last close,
+so users do not have to remember to detach providers after unmounting
+the filesystems.
.It
-Allows attaching a provider with a random, one-time Master Key -
-useful for swap partitions and temporary file systems.
+Allows attaching a provider with a random, one-time Master Key,
+which is useful for swap partitions and temporary filesystems.
.It
Allows verification of data integrity (data authentication).
.It
@@ -380,17 +379,23 @@ This option is helpful when creating a provider that may be used by older
versions.
Consult the
.Sx HISTORY
-section to find which metadata version is supported by which FreeBSD version.
+section to find which metadata version is supported by which
+.Fx
+version.
Note that using an older version of metadata may limit the number of
features available.
.El
.It Cm attach
-Attach the given provider.
-The encrypted Master Key will be loaded from the metadata and decrypted
-using the given passphrase/keyfile and a new GEOM provider will be created
-using the given provider's name with an
+Attach the given providers.
+The encrypted Master Keys are loaded from the metadata and decrypted
+using the given passphrase/keyfile and new GEOM providers are created
+using the specified provider names.
+A
.Qq .eli
-suffix.
+suffix is added to the user specified provider names.
+Multiple providers can only be attached with a single
+.Cm attach
+command if they all have the same passphrase and keyfiles.
.Pp
Additional options include:
.Bl -tag -width ".Fl j Ar passfile"
@@ -398,11 +403,11 @@ Additional options include:
Do a dry-run decryption.
This is useful to verify passphrase and keyfile without decrypting the device.
.It Fl d
-If specified, a decrypted provider will be detached automatically on last close.
-This can help with scarce memory so the user does not have to remember to detach the
-provider after unmounting the file system.
-It only works when the provider was opened for writing, so it will not work if
-the file system on the provider is mounted read-only.
+If specified, the decrypted providers are detached automatically on last close,
+so the user does not have to remember to detach
+providers after unmounting the filesystems.
+This only works when providers were opened for writing, and will not work if
+the filesystems on the providers were mounted read-only.
Probably a better choice is the
.Fl l
option for the
@@ -419,6 +424,7 @@ For more information see the description of the
option for the
.Cm init
subcommand.
+The same passfiles are used for all listed providers.
.It Fl k Ar keyfile
Specifies a file which contains the keyfile component of the User Key
(or part of it).
@@ -427,14 +433,15 @@ For more information see the description of the
option for the
.Cm init
subcommand.
+The same keyfiles are used for all listed providers.
.It Fl p
-Do not use a passphrase as a component of the User Key.
+Do not use a passphrase as a component of the User Keys.
Cannot be combined with the
.Fl j
option.
.It Fl r
-Attach read-only provider.
-It will not be opened for writing.
+Attach read-only providers.
+They are not opened for writing.
.El
.It Cm detach
Detach the given providers, which means remove the devfs entry
@@ -445,14 +452,15 @@ Additional options include:
.It Fl f
Force detach - detach even if the provider is open.
.It Fl l
-Mark provider to detach on last close.
+Mark provider to detach on last close, after the last filesystem has been
+unmounted.
If this option is specified, the provider will not be detached
while it is open, but will be automatically detached when it is closed for the
last time even if it was only opened for reading.
.El
.It Cm onetime
Attach the given providers with a random, one-time (ephemeral) Master Key.
-The command can be used to encrypt swap partitions or temporary file systems.
+The command can be used to encrypt swap partitions or temporary filesystems.
.Pp
Additional options include:
.Bl -tag -width ".Fl a Ar sectorsize"
@@ -467,10 +475,10 @@ For more information, see the description of the
.Cm init
subcommand.
.It Fl d
-Detach on last close.
-Note: this option is not usable for temporary file systems as the provider will
-be detached after creating the file system on it.
-It still can (and should be) used for swap partitions.
+Detach on last close, after the last filesystem has been unmounted.
+Note: this option is not usable for temporary filesystems as the provider is
+detached after the filesystem has been created.
+It still can, and should, be used for swap partitions.
For more information, see the description of the
.Cm attach
subcommand.
@@ -643,17 +651,17 @@ and
.El
.It Cm suspend
Suspend device by waiting for all inflight requests to finish, clearing all
-sensitive information (like the Master Key and Data Keys) from kernel memory,
+sensitive information such as the Master Key and Data Keys from kernel memory,
and blocking all further I/O requests until the
.Cm resume
subcommand is executed.
-This functionality is useful for laptops: when one wants to suspend a
-laptop, one does not want to leave an encrypted device attached.
-Instead of closing all files and directories opened from a file system located
-on an encrypted device, unmounting the file system, and detaching the device,
-the
+This functionality is useful for laptops.
+Suspending a laptop should not leave an encrypted device attached.
+The
.Cm suspend
-subcommand can be used.
+subcommand can be used rather than closing all files and directories from
+filesystems on the encrypted device, unmounting the filesystem, and
+detaching the device.
Any access to the encrypted device will be blocked until the Master Key is
reloaded through the
.Cm resume
@@ -664,8 +672,8 @@ The
subcommand does not work with devices created with the
.Cm onetime
subcommand.
-Please note that sensitive data might still be present in memory after
-suspending an encrypted device due to the file system cache, etc.
+Please note that sensitive data might still be present in memory locations
+such as the filesystem cache after suspending an encrypted device.
.Pp
Additional options include:
.Bl -tag -width ".Fl a"
@@ -678,23 +686,23 @@ devices.
Resume previously suspended device.
The caller must ensure that executing this subcommand does not access the
suspended device, leading to a deadlock.
-For example suspending a device which contains the file system where the
+For example, suspending a device which contains the filesystem where the
.Nm
-utility is stored is bad idea.
+utility is stored is a bad idea.
.Pp
Additional options include:
.Bl -tag -width ".Fl j Ar passfile"
.It Fl j Ar passfile
-Specifies a file which contains the passphrase component of the User Key
-(or part of it).
+Specifies a file which contains the passphrase component of the User Key,
+or part of it.
For more information see the description of the
.Fl J
option for the
.Cm init
subcommand.
.It Fl k Ar keyfile
-Specifies a file which contains the keyfile component of the User Key
-(or part of it).
+Specifies a file which contains the keyfile component of the User Key,
+or part of it.
For more information see the description of the
.Fl K
option for the
@@ -810,18 +818,17 @@ If set to 3, the
maximum amount of debug information is printed.
.It Va kern.geom.eli.tries : No 3
Number of times a user is asked for the passphrase.
-This is only used for providers which are attached on boot
-(before the root file system is mounted).
+This is only used for providers which are attached on boot,
+before the root filesystem is mounted.
If set to 0, attaching providers on boot will be disabled.
This variable should be set in
.Pa /boot/loader.conf .
.It Va kern.geom.eli.overwrites : No 5
-Specifies how many times the Master Key will be overwritten
+Specifies how many times the Master Key is overwritten
with random values when it is destroyed.
After this operation it is filled with zeros.
.It Va kern.geom.eli.visible_passphrase : No 0
-If set to 1, the passphrase entered on boot (before the root
-file system is mounted) will be visible.
+If set to 1, the passphrase entered on boot will be visible.
This alternative should be used with caution as the entered
passphrase can be logged and exposed via
.Xr dmesg 8 .
@@ -860,7 +867,7 @@ Exit status is 0 on success, and 1 if the command fails.
Initialize a provider which is going to be encrypted with a
passphrase and random data from a file on the user's pen drive.
Use 4kB sector size.
-Attach the provider, create a file system, and mount it.
+Attach the provider, create a filesystem, and mount it.
Do the work.
Unmount the provider and detach it:
.Bd -literal -offset indent
@@ -915,7 +922,7 @@ Encrypted swap partition setup:
.Ed
.Pp
The example below shows how to configure two providers which will be attached
-on boot (before the root file system is mounted).
+on boot, before the root filesystem is mounted.
One of them is using passphrase and three keyfile parts and the other is
using only a keyfile in one part:
.Bd -literal -offset indent
@@ -993,7 +1000,7 @@ geli: Cannot read metadata from /dev/da0: Invalid argument.
Enter passphrase:
.Ed
.Pp
-If an encrypted file system is extended, it is necessary to relocate and
+If an encrypted filesystem is extended, it is necessary to relocate and
update the metadata:
.Bd -literal -offset indent
# gpart create -s GPT ada0
diff --git a/lib/geom/eli/geom_eli.c b/lib/geom/eli/geom_eli.c
index f6ed6a88fb4f..15e584049da6 100644
--- a/lib/geom/eli/geom_eli.c
+++ b/lib/geom/eli/geom_eli.c
@@ -62,6 +62,13 @@ uint32_t version = G_ELI_VERSION;
#define GELI_BACKUP_DIR "/var/backups/"
#define GELI_ENC_ALGO "aes"
+#define BUFSIZE 1024
+
+/*
+ * Passphrase cached when attaching multiple providers, in order to be more
+ * user-friendly if they are using the same passphrase.
+ */
+static char cached_passphrase[BUFSIZE] = "";
static void eli_main(struct gctl_req *req, unsigned flags);
static void eli_init(struct gctl_req *req);
@@ -86,7 +93,7 @@ static int eli_backup_create(struct gctl_req *req, const char *prov,
*
* init [-bdgPTv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-J newpassfile] [-K newkeyfile] [-s sectorsize] [-V version] prov
* label - alias for 'init'
- * attach [-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov
+ * attach [-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov ...
* detach [-fl] prov ...
* stop - alias for 'detach'
* onetime [-d] [-a aalgo] [-e ealgo] [-l keylen] prov
@@ -154,7 +161,7 @@ struct g_command class_commands[] = {
{ 'r', "readonly", NULL, G_TYPE_BOOL },
G_OPT_SENTINEL
},
- "[-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov"
+ "[-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov ..."
},
{ "detach", 0, NULL,
{
@@ -275,8 +282,6 @@ struct g_command class_commands[] = {
static int verbose = 0;
-#define BUFSIZE 1024
-
static int
eli_protect(struct gctl_req *req)
{
@@ -411,7 +416,7 @@ eli_genkey_files(struct gctl_req *req, bool new, const char *type,
passbufsize) {
gctl_error(req,
"Passphrase in %s too long.", file);
- bzero(buf, sizeof(buf));
+ explicit_bzero(buf, sizeof(buf));
return (-1);
}
if (p != NULL)
@@ -421,7 +426,7 @@ eli_genkey_files(struct gctl_req *req, bool new, const char *type,
error = errno;
if (strcmp(file, "-") != 0)
close(fd);
- bzero(buf, sizeof(buf));
+ explicit_bzero(buf, sizeof(buf));
if (done == -1) {
gctl_error(req, "Cannot read %s %s: %s.",
type, file, strerror(error));
@@ -442,7 +447,7 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
new ? "Enter new passphrase: " : "Enter passphrase: ",
passbuf, passbufsize, RPP_ECHO_OFF | RPP_REQUIRE_TTY);
if (p == NULL) {
- bzero(passbuf, passbufsize);
+ explicit_bzero(passbuf, passbufsize);
gctl_error(req, "Cannot read passphrase: %s.",
strerror(errno));
return (-1);
@@ -455,7 +460,7 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
tmpbuf, sizeof(tmpbuf),
RPP_ECHO_OFF | RPP_REQUIRE_TTY);
if (p == NULL) {
- bzero(passbuf, passbufsize);
+ explicit_bzero(passbuf, passbufsize);
gctl_error(req,
"Cannot read passphrase: %s.",
strerror(errno));
@@ -463,11 +468,11 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
}
if (strcmp(passbuf, tmpbuf) != 0) {
- bzero(passbuf, passbufsize);
+ explicit_bzero(passbuf, passbufsize);
fprintf(stderr, "They didn't match.\n");
continue;
}
- bzero(tmpbuf, sizeof(tmpbuf));
+ explicit_bzero(tmpbuf, sizeof(tmpbuf));
}
return (0);
}
@@ -482,6 +487,10 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
bool nopassphrase;
int nfiles;
+ /*
+ * Return error if the 'do not use passphrase' flag was given but a
+ * passfile was provided.
+ */
nopassphrase =
gctl_get_int(req, new ? "nonewpassphrase" : "nopassphrase");
if (nopassphrase) {
@@ -494,20 +503,32 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
return (0);
}
+ /*
+ * Return error if using a provider which does not require a passphrase
+ * but the 'do not use passphrase' flag was not given.
+ */
if (!new && md->md_iterations == -1) {
gctl_error(req, "Missing -p flag.");
return (-1);
}
passbuf[0] = '\0';
- nfiles = eli_genkey_files(req, new, "passfile", NULL, passbuf,
- sizeof(passbuf));
- if (nfiles == -1)
- return (-1);
- else if (nfiles == 0) {
- if (eli_genkey_passphrase_prompt(req, new, passbuf,
- sizeof(passbuf)) == -1) {
+
+ /* Use cached passphrase if defined. */
+ if (strlen(cached_passphrase) > 0) {
+ strlcpy(passbuf, cached_passphrase, sizeof(passbuf));
+ } else {
+ nfiles = eli_genkey_files(req, new, "passfile", NULL, passbuf,
+ sizeof(passbuf));
+ if (nfiles == -1) {
return (-1);
+ } else if (nfiles == 0) {
+ if (eli_genkey_passphrase_prompt(req, new, passbuf,
+ sizeof(passbuf)) == -1) {
+ return (-1);
+ }
}
+ /* Cache the passphrase for other providers. */
+ strlcpy(cached_passphrase, passbuf, sizeof(cached_passphrase));
}
/*
* Field md_iterations equal to -1 means "choose some sane
@@ -537,9 +558,9 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
pkcs5v2_genkey(dkey, sizeof(dkey), md->md_salt,
sizeof(md->md_salt), passbuf, md->md_iterations);
g_eli_crypto_hmac_update(ctxp, dkey, sizeof(dkey));
- bzero(dkey, sizeof(dkey));
+ explicit_bzero(dkey, sizeof(dkey));
}
- bzero(passbuf, sizeof(passbuf));
+ explicit_bzero(passbuf, sizeof(passbuf));
return (0);
}
@@ -645,13 +666,13 @@ eli_metadata_store(struct gctl_req *req, const char *prov,
if (fd == -1) {
gctl_error(req, "Cannot open %s: %s.", prov,
strerror(errno));
- bzero(sector, sizeof(sector));
+ explicit_bzero(sector, sizeof(sector));
return (-1);
}
if (write(fd, sector, sizeof(sector)) != sizeof(sector)) {
gctl_error(req, "Cannot write metadata to %s: %s.",
prov, strerror(errno));
- bzero(sector, sizeof(sector));
+ explicit_bzero(sector, sizeof(sector));
close(fd);
return (-1);
}
@@ -662,11 +683,11 @@ eli_metadata_store(struct gctl_req *req, const char *prov,
if (error != 0) {
gctl_error(req, "Cannot write metadata to %s: %s.",
prov, strerror(errno));
- bzero(sector, sizeof(sector));
+ explicit_bzero(sector, sizeof(sector));
return (-1);
}
}
- bzero(sector, sizeof(sector));
+ explicit_bzero(sector, sizeof(sector));
return (0);
}
@@ -697,7 +718,7 @@ eli_init(struct gctl_req *req)
return;
}
- bzero(&md, sizeof(md));
+ explicit_bzero(&md, sizeof(md));
strlcpy(md.md_magic, G_ELI_MAGIC, sizeof(md.md_magic));
val = gctl_get_intmax(req, "mdversion");
if (val == -1) {
@@ -828,25 +849,25 @@ eli_init(struct gctl_req *req)
/* Generate user key. */
if (eli_genkey(req, &md, key, true) == NULL) {
- bzero(key, sizeof(key));
- bzero(&md, sizeof(md));
+ explicit_bzero(key, sizeof(key));
+ explicit_bzero(&md, sizeof(md));
return;
}
/* Encrypt the first and the only Master Key. */
error = g_eli_mkey_encrypt(md.md_ealgo, key, md.md_keylen, md.md_mkeys);
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
if (error != 0) {
- bzero(&md, sizeof(md));
+ explicit_bzero(&md, sizeof(md));
gctl_error(req, "Cannot encrypt Master Key: %s.",
strerror(error));
return;
}
eli_metadata_encode(&md, sector);
- bzero(&md, sizeof(md));
+ explicit_bzero(&md, sizeof(md));
error = g_metadata_store(prov, sector, sizeof(sector));
- bzero(sector, sizeof(sector));
+ explicit_bzero(sector, sizeof(sector));
if (error != 0) {
gctl_error(req, "Cannot store metadata on %s: %s.", prov,
strerror(error));
@@ -886,38 +907,75 @@ static void
eli_attach(struct gctl_req *req)
{
struct g_eli_metadata md;
- unsigned char key[G_ELI_USERKEYLEN];
+ struct gctl_req *r;
const char *prov;
off_t mediasize;
- int nargs;
+ int i, nargs, nparams, param;
+ const int one = 1;
nargs = gctl_get_int(req, "nargs");
- if (nargs != 1) {
- gctl_error(req, "Invalid number of arguments.");
+ if (nargs == 0) {
+ gctl_error(req, "Too few arguments.");
return;
}
- prov = gctl_get_ascii(req, "arg0");
- if (eli_metadata_read(req, prov, &md) == -1)
- return;
+ unsigned char key[G_ELI_USERKEYLEN];
- mediasize = g_get_mediasize(prov);
- if (md.md_provsize != (uint64_t)mediasize) {
- gctl_error(req, "Provider size mismatch.");
- return;
- }
+ /*
+ * Determine number of parameters in the parent geom request before the
+ * nargs parameter and list of providers.
+ */
+ nparams = req->narg - nargs - 1;
- if (eli_genkey(req, &md, key, false) == NULL) {
- bzero(key, sizeof(key));
- return;
- }
+ /* Create new child geom request for each provider and issue to kernel */
+ for (i = 0; i < nargs; i++) {
+ r = gctl_get_handle();
- gctl_ro_param(req, "key", sizeof(key), key);
- if (gctl_issue(req) == NULL) {
- if (verbose)
- printf("Attached to %s.\n", prov);
+ /* Copy each parameter from the parent request to the child request */
+ for (param = 0; param < nparams; param++) {
+ gctl_ro_param(r, req->arg[param].name, req->arg[param].len, req->arg[param].value);
+ }
+
+ /* Add a single provider to the parameter list of the child */
+ gctl_ro_param(r, "nargs", sizeof(one), &one);
+ prov = gctl_get_ascii(req, "arg%d", i);
+ gctl_ro_param(r, "arg0", -1, prov);
+
+ if (eli_metadata_read(r, prov, &md) == -1)
+ return;
+
+ mediasize = g_get_mediasize(prov);
+ if (md.md_provsize != (uint64_t)mediasize) {
+ gctl_error(r, "Provider size mismatch.");
+ return;
+ }
+
+ if (eli_genkey(r, &md, key, false) == NULL) {
+ explicit_bzero(key, sizeof(key));
+ return;
+ }
+
+ gctl_ro_param(r, "key", sizeof(key), key);
+
+ if (gctl_issue(r) == NULL) {
+ if (verbose)
+ printf("Attached to %s.\n", prov);
+ }
+
+ /* Print error for this request, and set parent request error message */
+ if (r->error != NULL && r->error[0] != '\0') {
+ warnx("%s", r->error);
+ gctl_error(req, "At least one provider failed to attach.");
+ }
+
+ gctl_free(r);
+
+ /* Clear the derived key */
+ explicit_bzero(key, sizeof(key));
}
- bzero(key, sizeof(key));
+
+ /* Clear the cached passphrase */
+ explicit_bzero(cached_passphrase, sizeof(cached_passphrase));
}
static void
@@ -989,7 +1047,7 @@ eli_configure_detached(struct gctl_req *req, const char *prov, int boot,
if (changed)
eli_metadata_store(req, prov, &md);
- bzero(&md, sizeof(md));
+ explicit_bzero(&md, sizeof(md));
}
static void
@@ -1090,7 +1148,7 @@ eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md)
/* Generate key for Master Key encryption. */
if (eli_genkey(req, md, key, true) == NULL) {
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
return;
}
/*
@@ -1105,7 +1163,7 @@ eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md)
gctl_ro_param(req, "key", sizeof(key), key);
gctl_issue(req);
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
}
static void
@@ -1125,15 +1183,15 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
/* Generate key for Master Key decryption. */
if (eli_genkey(req, md, key, false) == NULL) {
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
return;
}
/* Decrypt Master Key. */
error = g_eli_mkey_decrypt_any(md, key, mkey, &nkey);
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
if (error != 0) {
- bzero(md, sizeof(*md));
+ explicit_bzero(md, sizeof(*md));
if (error == -1)
gctl_error(req, "Wrong key for %s.", prov);
else /* if (error > 0) */ {
@@ -1179,20 +1237,20 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
md->md_keys |= (1 << nkey);
bcopy(mkey, mkeydst, sizeof(mkey));
- bzero(mkey, sizeof(mkey));
+ explicit_bzero(mkey, sizeof(mkey));
/* Generate key for Master Key encryption. */
if (eli_genkey(req, md, key, true) == NULL) {
- bzero(key, sizeof(key));
- bzero(md, sizeof(*md));
+ explicit_bzero(key, sizeof(key));
+ explicit_bzero(md, sizeof(*md));
return;
}
/* Encrypt the Master-Key with the new key. */
error = g_eli_mkey_encrypt(md->md_ealgo, key, md->md_keylen, mkeydst);
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
if (error != 0) {
- bzero(md, sizeof(*md));
+ explicit_bzero(md, sizeof(*md));
gctl_error(req, "Cannot encrypt Master Key: %s.",
strerror(error));
return;
@@ -1200,7 +1258,7 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
/* Store metadata with fresh key. */
eli_metadata_store(req, prov, md);
- bzero(md, sizeof(*md));
+ explicit_bzero(md, sizeof(*md));
}
static void
@@ -1281,7 +1339,7 @@ eli_delkey_detached(struct gctl_req *req, const char *prov)
}
eli_metadata_store(req, prov, &md);
- bzero(&md, sizeof(md));
+ explicit_bzero(&md, sizeof(md));
}
static void
@@ -1329,7 +1387,7 @@ eli_resume(struct gctl_req *req)
}
if (eli_genkey(req, &md, key, false) == NULL) {
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
return;
}
@@ -1338,7 +1396,7 @@ eli_resume(struct gctl_req *req)
if (verbose)
printf("Resumed %s.\n", prov);
}
- bzero(key, sizeof(key));
+ explicit_bzero(key, sizeof(key));
}
static int
@@ -1508,7 +1566,7 @@ eli_backup_create(struct gctl_req *req, const char *prov, const char *file)
ret = 0;
out:
if (sector != NULL) {
- bzero(sector, secsize);
+ explicit_bzero(sector, secsize);
free(sector);
}
return (ret);
@@ -1672,7 +1730,7 @@ out:
if (provfd != -1)
(void)g_close(provfd);
if (sector != NULL) {
- bzero(sector, secsize);
+ explicit_bzero(sector, secsize);
free(sector);
}
}