aboutsummaryrefslogtreecommitdiffstats
path: root/meta-ivi/recipes-support-ivi/ecryptfs-utils/ecryptfs-utils/ecryptfs-fix-disable-nss.patch
blob: 76d502dbbbc190014c7091b2154483cc1e0baa2f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
From 278418aa56573c368abd6dc9b7742df270574842 Mon Sep 17 00:00:00 2001
From: Li xin <lixin.fnst at cn.fujitsu.com>
Date: Tue, 28 Jul 2015 03:06:10 +0900
Subject: [PATCH] ecryptfs fix disable nss

---
 src/libecryptfs/key_management.c | 87 ++++++++++++++++++++++++++++++++++++++++
 src/libecryptfs/main.c           | 31 ++++++++++++++
 2 files changed, 118 insertions(+)

diff --git a/src/libecryptfs/key_management.c b/src/libecryptfs/key_management.c
index 81a9c08..c051a50 100644
--- a/src/libecryptfs/key_management.c
+++ b/src/libecryptfs/key_management.c
@@ -21,8 +21,12 @@
  */
 
 #include <errno.h>
+#ifdef ENABLE_NSS
 #include <nss.h>
 #include <pk11func.h>
+#else
+#include <gcrypt.h>
+#endif /* #ifdef ENABLE_NSS */
 #include <keyutils.h>
 #ifndef S_SPLINT_S
 #include <stdio.h>
@@ -572,6 +576,7 @@ int ecryptfs_wrap_passphrase(char *filename, char *wrapping_passphrase,
 		ECRYPTFS_AES_BLOCK_SIZE + 1];
 	int encrypted_passphrase_pos = 0;
 	int decrypted_passphrase_pos = 0;
+#ifdef ENABLE_NSS
 	int tmp1_outlen = 0;
 	int tmp2_outlen = 0;
 	SECStatus err;
@@ -580,6 +585,11 @@ int ecryptfs_wrap_passphrase(char *filename, char *wrapping_passphrase,
 	PK11SlotInfo *slot = NULL;
 	PK11Context *enc_ctx = NULL;
 	SECItem *sec_param = NULL;
+#else
+#warning Building against gcrypt instead of nss
+       gcry_cipher_hd_t gcry_handle;
+       gcry_error_t gcry_err;
+#endif /* #ifdef ENABLE_NSS */
 	int encrypted_passphrase_bytes;
 	int decrypted_passphrase_bytes;
 	int fd;
@@ -618,6 +628,7 @@ int ecryptfs_wrap_passphrase(char *filename, char *wrapping_passphrase,
 					       - (decrypted_passphrase_bytes
 						  % ECRYPTFS_AES_BLOCK_SIZE));
 	encrypted_passphrase_bytes = decrypted_passphrase_bytes;
+#ifdef ENABLE_NSS
 	NSS_NoDB_Init(NULL);
 	slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
 	key_item.data = (unsigned char *)wrapping_key;
@@ -678,6 +689,41 @@ nss_finish:
 		rc = - EIO;
 		goto out;
 	}
+#else
+       if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
+                                        GCRY_CIPHER_MODE_ECB, 0))) {
+               syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
+                      "gcry_error_t = [%d]\n", gcry_err);
+               rc = -EIO;
+               goto out;
+       }
+       if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
+                                          ECRYPTFS_AES_KEY_BYTES))) {
+               syslog(LOG_ERR, "Error attempting to set AES key; "
+                      "gcry_error_t = [%d]\n", gcry_err);
+               rc = -EIO;
+               gcry_cipher_close(gcry_handle);
+               goto out;
+       }
+       while (decrypted_passphrase_bytes > 0) {
+               if ((gcry_err = gcry_cipher_encrypt(
+                            gcry_handle,
+                            &encrypted_passphrase[encrypted_passphrase_pos],
+                            ECRYPTFS_AES_BLOCK_SIZE,
+                            &decrypted_passphrase[decrypted_passphrase_pos],
+                            ECRYPTFS_AES_BLOCK_SIZE))) {
+                       syslog(LOG_ERR, "Error attempting to encrypt block; "
+                              "gcry_error = [%d]\n", gcry_err);
+                       rc = -EIO;
+                       gcry_cipher_close(gcry_handle);
+                       goto out;
+               }
+               encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
+               decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
+               decrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
+       }
+       gcry_cipher_close(gcry_handle);
+#endif /* #ifdef ENABLE_NSS */
 	rc = write_v2_wrapped_passphrase_file(filename, wrapping_salt,
 					      wrapping_auth_tok_sig,
 					      encrypted_passphrase,
@@ -852,6 +898,7 @@ int ecryptfs_unwrap_passphrase(char *decrypted_passphrase, char *filename,
 	char encrypted_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];
 	int encrypted_passphrase_pos = 0;
 	int decrypted_passphrase_pos = 0;
+#ifdef ENABLE_NSS
 	int tmp1_outlen = 0;
 	int tmp2_outlen = 0;
 	SECStatus err;
@@ -860,6 +907,10 @@ int ecryptfs_unwrap_passphrase(char *decrypted_passphrase, char *filename,
 	PK11SlotInfo *slot = NULL;
 	PK11Context *enc_ctx = NULL;
 	SECItem *sec_param = NULL;
+#else
+       gcry_cipher_hd_t gcry_handle;
+       gcry_error_t gcry_err;
+#endif /* #ifdef ENABLE_NSS */
 	uint8_t version = 0;
 	int encrypted_passphrase_bytes;
 	int rc;
@@ -923,6 +974,7 @@ int ecryptfs_unwrap_passphrase(char *decrypted_passphrase, char *filename,
 		rc = -EIO;
 		goto out;
 	}
+#ifdef ENABLE_NSS
 	NSS_NoDB_Init(NULL);
 	slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
 	key_item.data = (unsigned char *)wrapping_key;
@@ -982,6 +1034,41 @@ nss_finish:
 		rc = - EIO;
 		goto out;
 	}
+#else
+       if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
+                                        GCRY_CIPHER_MODE_ECB, 0))) {
+               syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
+                      "gcry_error_t = [%d]\n", gcry_err);
+               rc = -EIO;
+               goto out;
+       }
+       if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
+                                          ECRYPTFS_AES_KEY_BYTES))) {
+               syslog(LOG_ERR, "Error attempting to set AES key; "
+                      "gcry_error_t = [%d]\n", gcry_err);
+               rc = -EIO;
+               gcry_cipher_close(gcry_handle);
+               goto out;
+       }
+       memset(decrypted_passphrase, 0, ECRYPTFS_MAX_PASSPHRASE_BYTES + 1);
+       while (encrypted_passphrase_bytes > 0) {
+               if ((gcry_err = gcry_cipher_decrypt(
+                            gcry_handle,
+                            &decrypted_passphrase[encrypted_passphrase_pos],
+                            ECRYPTFS_AES_BLOCK_SIZE,
+                            &encrypted_passphrase[decrypted_passphrase_pos],
+                            ECRYPTFS_AES_BLOCK_SIZE))) {
+                       syslog(LOG_ERR, "Error attempting to decrypt block; "
+                              "gcry_error = [%d]\n", gcry_err);
+                       rc = -EIO;
+                       gcry_cipher_close(gcry_handle);
+                       goto out;
+               }
+               encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
+               decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
+               encrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
+       }
+#endif /* #ifdef ENABLE_NSS */
 out:
 	return rc;
 }
diff --git a/src/libecryptfs/main.c b/src/libecryptfs/main.c
index 98bdc54..800c851 100644
--- a/src/libecryptfs/main.c
+++ b/src/libecryptfs/main.c
@@ -20,8 +20,12 @@
  */
 
 #include <errno.h>
+#ifdef ENABLE_NSS
 #include <nss.h>
 #include <pk11func.h>
+#else
+#include <gcrypt.h>
+#endif /* #ifdef ENABLE_NSS */
 #include <mntent.h>
 #ifndef S_SPLINT_S
 #include <stdio.h>
@@ -73,7 +77,16 @@ void from_hex(char *dst, char *src, int dst_size)
 
 int do_hash(char *src, int src_size, char *dst, int algo)
 {
+#ifdef ENABLE_NSS
 	SECStatus err;
+#else
+       gcry_md_hd_t hd;
+       gcry_error_t err = 0;
+       unsigned char * hash;
+       unsigned int mdlen;
+#endif /* #ifdef ENABLE_NSS */
+
+#ifdef ENABLE_NSS
 
 	NSS_NoDB_Init(NULL);
 	err = PK11_HashBuf(algo, (unsigned char *)dst, (unsigned char *)src,
@@ -85,6 +98,19 @@ int do_hash(char *src, int src_size, char *dst, int algo)
 		err = -EINVAL;
 		goto out;
 	}
+#else
+       err = gcry_md_open(&hd, algo, 0);
+       mdlen = gcry_md_get_algo_dlen(algo);
+       if (err) {
+               syslog(LOG_ERR, "Failed to open hash algo [%d]: "
+                      "[%d]\n", algo, err);
+               goto out;
+       }
+       gcry_md_write(hd, src, src_size);
+       hash = gcry_md_read(hd, algo);
+       memcpy(dst, hash, mdlen);
+       gcry_md_close(hd);
+#endif /* #ifdef ENABLE_NSS */
 out:
 	return (int)err;
 }
@@ -217,7 +243,12 @@ generate_passphrase_sig(char *passphrase_sig, char *fekek,
 	char salt_and_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES
 				 + ECRYPTFS_SALT_SIZE];
 	int passphrase_size;
+#ifdef ENABLE_NSS
 	int alg = SEC_OID_SHA512;
+#else
+        int alg = GCRY_MD_SHA512;
+#endif /* #ifdef ENABLE_NSS */
+
 	int dig_len = SHA512_DIGEST_LENGTH;
 	char buf[SHA512_DIGEST_LENGTH];
 	int hash_iterations = ECRYPTFS_DEFAULT_NUM_HASH_ITERATIONS;
-- 
1.8.4.2