From f1b264f17c7087d9794dd3ae34e804d1f2cbf8b2 Mon Sep 17 00:00:00 2001 From: Paul Crowley Date: Tue, 28 Jan 2020 10:38:19 -0800 Subject: [PATCH 1/2] Add support for v2 of dm-default-key Version 2 of dm-default-key has an extra parameter and always sets the DUN. Bug: 147814592 Test: Cuttlefish boots with keydirectory flag Test: Crosshatch formatted before this change boots after it Change-Id: I309bcc3f907a6df745f5c073b0017a7dd5b5354b --- fs_mgr/libdm/dm_target.cpp | 32 ++++++++++++++++++++++++-- fs_mgr/libdm/dm_test.cpp | 19 +++++++++++++-- fs_mgr/libdm/include/libdm/dm_target.h | 10 +++++--- 3 files changed, 54 insertions(+), 7 deletions(-) diff --git a/fs_mgr/libdm/dm_target.cpp b/fs_mgr/libdm/dm_target.cpp index ea54029f3..d7b689ed7 100644 --- a/fs_mgr/libdm/dm_target.cpp +++ b/fs_mgr/libdm/dm_target.cpp @@ -243,15 +243,43 @@ std::string DmTargetCrypt::GetParameterString() const { return android::base::Join(argv, " "); } +const std::string DmTargetDefaultKey::name_ = "default-key"; + +bool DmTargetDefaultKey::IsLegacy(bool* result) { + DeviceMapper& dm = DeviceMapper::Instance(); + DmTargetTypeInfo info; + if (!dm.GetTargetByName(name_, &info)) return false; + // dm-default-key was modified to be like dm-crypt with version 2 + *result = !info.IsAtLeast(2, 0, 0); + return true; +} + +bool DmTargetDefaultKey::Valid() const { + bool real_is_legacy; + if (!DmTargetDefaultKey::IsLegacy(&real_is_legacy)) return false; + if (real_is_legacy != is_legacy_) return false; + if (!is_legacy_ && !set_dun_) return false; + return true; +} + std::string DmTargetDefaultKey::GetParameterString() const { std::vector argv; argv.emplace_back(cipher_); argv.emplace_back(key_); + if (!is_legacy_) { + argv.emplace_back("0"); // iv_offset + } argv.emplace_back(blockdev_); argv.push_back(std::to_string(start_sector_)); std::vector extra_argv; - if (set_dun_) { - extra_argv.emplace_back("set_dun"); + if (is_legacy_) { + if (set_dun_) { // v2 always sets the DUN. + extra_argv.emplace_back("set_dun"); + } + } else { + extra_argv.emplace_back("allow_discards"); + extra_argv.emplace_back("sector_size:4096"); + extra_argv.emplace_back("iv_large_sectors"); } if (!extra_argv.empty()) { argv.emplace_back(std::to_string(extra_argv.size())); diff --git a/fs_mgr/libdm/dm_test.cpp b/fs_mgr/libdm/dm_test.cpp index b7f31bc44..b29680161 100644 --- a/fs_mgr/libdm/dm_test.cpp +++ b/fs_mgr/libdm/dm_test.cpp @@ -516,10 +516,25 @@ TEST(libdm, CryptArgs) { } TEST(libdm, DefaultKeyArgs) { - DmTargetDefaultKey target(0, 4096, "AES-256-XTS", "abcdef0123456789", "/dev/loop0", 0); + DmTargetTypeInfo info; + + DeviceMapper& dm = DeviceMapper::Instance(); + if (!dm.GetTargetByName("default-key", &info)) { + cout << "default-key module not enabled; skipping test" << std::endl; + return; + } + bool is_legacy; + ASSERT_TRUE(DmTargetDefaultKey::IsLegacy(&is_legacy)); + // set_dun only in the non-is_legacy case + DmTargetDefaultKey target(0, 4096, "AES-256-XTS", "abcdef0123456789", "/dev/loop0", 0, + is_legacy, !is_legacy); ASSERT_EQ(target.name(), "default-key"); ASSERT_TRUE(target.Valid()); - ASSERT_EQ(target.GetParameterString(), "AES-256-XTS abcdef0123456789 /dev/loop0 0"); + if (is_legacy) { + ASSERT_EQ(target.GetParameterString(), "AES-256-XTS abcdef0123456789 /dev/loop0 0"); + } else { + ASSERT_EQ(target.GetParameterString(), "AES-256-XTS abcdef0123456789 0 /dev/loop0 0"); + } } TEST(libdm, DeleteDeviceWithTimeout) { diff --git a/fs_mgr/libdm/include/libdm/dm_target.h b/fs_mgr/libdm/include/libdm/dm_target.h index a78bc716a..e3dd92b17 100644 --- a/fs_mgr/libdm/include/libdm/dm_target.h +++ b/fs_mgr/libdm/include/libdm/dm_target.h @@ -281,23 +281,27 @@ class DmTargetDefaultKey final : public DmTarget { public: DmTargetDefaultKey(uint64_t start, uint64_t length, const std::string& cipher, const std::string& key, const std::string& blockdev, uint64_t start_sector, - bool set_dun = false) + bool is_legacy, bool set_dun) : DmTarget(start, length), cipher_(cipher), key_(key), blockdev_(blockdev), start_sector_(start_sector), + is_legacy_(is_legacy), set_dun_(set_dun) {} - std::string name() const override { return "default-key"; } - bool Valid() const override { return true; } + std::string name() const override { return name_; } + bool Valid() const override; std::string GetParameterString() const override; + static bool IsLegacy(bool* result); private: + static const std::string name_; std::string cipher_; std::string key_; std::string blockdev_; uint64_t start_sector_; + bool is_legacy_; bool set_dun_; }; From 3d8e105510dcbb7fc775bd846f3ebefb1278be41 Mon Sep 17 00:00:00 2001 From: Paul Crowley Date: Wed, 29 Jan 2020 16:16:32 -0800 Subject: [PATCH 2/2] Set metadata cipher in fstab Bug: 147814592 Test: Cuttlefish can use adiantum Change-Id: I9207ffcdb74dcd36c8b2534b51233a3f8e80dc0b --- fs_mgr/fs_mgr_fstab.cpp | 3 +++ fs_mgr/include_fstab/fstab/fstab.h | 1 + fs_mgr/tests/fs_mgr_test.cpp | 17 +++++++++++++++++ 3 files changed, 21 insertions(+) diff --git a/fs_mgr/fs_mgr_fstab.cpp b/fs_mgr/fs_mgr_fstab.cpp index ad878f2ad..561d99482 100644 --- a/fs_mgr/fs_mgr_fstab.cpp +++ b/fs_mgr/fs_mgr_fstab.cpp @@ -277,6 +277,9 @@ void ParseFsMgrFlags(const std::string& flags, FstabEntry* entry) { } else if (StartsWith(flag, "keydirectory=")) { // The metadata flag is followed by an = and the directory for the keys. entry->metadata_key_dir = arg; + } else if (StartsWith(flag, "metadata_cipher=")) { + // Specify the cipher to use for metadata encryption + entry->metadata_cipher = arg; } else if (StartsWith(flag, "sysfs_path=")) { // The path to trigger device gc by idle-maint of vold. entry->sysfs_path = arg; diff --git a/fs_mgr/include_fstab/fstab/fstab.h b/fs_mgr/include_fstab/fstab/fstab.h index a6e6e09ab..4dc09c1df 100644 --- a/fs_mgr/include_fstab/fstab/fstab.h +++ b/fs_mgr/include_fstab/fstab/fstab.h @@ -38,6 +38,7 @@ struct FstabEntry { std::string fs_options; std::string key_loc; std::string metadata_key_dir; + std::string metadata_cipher; off64_t length = 0; std::string label; int partnum = -1; diff --git a/fs_mgr/tests/fs_mgr_test.cpp b/fs_mgr/tests/fs_mgr_test.cpp index 709be59b6..800ad7e56 100644 --- a/fs_mgr/tests/fs_mgr_test.cpp +++ b/fs_mgr/tests/fs_mgr_test.cpp @@ -895,6 +895,23 @@ source none0 swap defaults keydirectory=/dir/key EXPECT_EQ("/dir/key", entry->metadata_key_dir); } +TEST(fs_mgr, ReadFstabFromFile_FsMgrOptions_MetadataCipher) { + TemporaryFile tf; + ASSERT_TRUE(tf.fd != -1); + std::string fstab_contents = R"fs( +source none0 swap defaults keydirectory=/dir/key,metadata_cipher=adiantum +)fs"; + + ASSERT_TRUE(android::base::WriteStringToFile(fstab_contents, tf.path)); + + Fstab fstab; + EXPECT_TRUE(ReadFstabFromFile(tf.path, &fstab)); + ASSERT_EQ(1U, fstab.size()); + + auto entry = fstab.begin(); + EXPECT_EQ("adiantum", entry->metadata_cipher); +} + TEST(fs_mgr, ReadFstabFromFile_FsMgrOptions_SysfsPath) { TemporaryFile tf; ASSERT_TRUE(tf.fd != -1);