Core: Add support for LUKS re-encryption.

.packit.yaml

@@ -24,7 +24,7 @@ jobs:
     - fedora-latest-stable-ppc64le
     - fedora-latest-stable-x86_64
   additional_repos:
-  - "copr://@storage/udisks-daily"
+  - "copr://@storage/temp-reencryption"
 
 - job: tests
   trigger: pull_request
@@ -34,7 +34,7 @@ jobs:
     environments:
       - artifacts:
         - type: repository-file
-          id: https://copr.fedorainfracloud.org/coprs/g/storage/udisks-daily/repo/fedora-$releasever/group_storage-udisks-daily-fedora-$releasever.repo
+          id: https://copr.fedorainfracloud.org/coprs/g/storage/reencryption/repo/fedora-$releasever/group_storage-reencryption-fedora-$releasever.repo
 
 # run tests for udisks consumers, see plans/ with `revdeps == yes`
 - job: tests
@@ -53,7 +53,7 @@ jobs:
         - type: repository-file
           id: https://copr.fedorainfracloud.org/coprs/g/cockpit/main-builds/repo/fedora-$releasever/group_cockpit-main-builds-fedora-$releasever.repo
         - type: repository-file
-          id: https://copr.fedorainfracloud.org/coprs/g/storage/udisks-daily/repo/fedora-$releasever/group_storage-udisks-daily-fedora-$releasever.repo
+          id: https://copr.fedorainfracloud.org/coprs/g/storage/reencryption/repo/fedora-$releasever/group_storage-reencryption-fedora-$releasever.repo
         tmt:
           context:
             revdeps: "yes"

data/org.freedesktop.UDisks2.xml

@@ -2360,6 +2360,19 @@
       <arg name="options" direction="in" type="a{sv}"/>
     </method>
 
+    <!--
+      Encrypt:
+      @passphrase: Future passphrase of the LUKS2 device.
+      @options: Options. TODO
+      @since: 2.11.0
+
+      Encrypts a block device to the LUKS2 format.
+    -->
+    <method name="Encrypt">
+      <arg name="passphrase" direction="in" type="s"/>
+      <arg name="options" direction="in" type="a{sv}"/>
+    </method>
+
   </interface>
 
   <!-- ********************************************************************** -->
@@ -3039,6 +3052,19 @@
       <arg name="options" direction="in" type="a{sv}"/>
     </method>
 
+    <!--
+        Reencrypt:
+        @passphrase: Passphrase to unlock the device.
+        @options: Options. TODO
+        @since: 2.11.0
+
+        Reencrypts a LUKS2 device, i.e. changes one or more of: cipher, cipher mode, volume key.
+    -->
+    <method name="Reencrypt">
+      <arg name="passphrase" direction="in" type="s"/>
+      <arg name="options" direction="in" type="a{sv}"/>
+    </method>
+
   </interface>
 
   <!-- ********************************************************************** -->

src/tests/dbus-tests/test_50_block.py

@@ -357,6 +357,35 @@ def test_rescan(self):
 
         disk.Rescan(self.no_options, dbus_interface=self.iface_prefix + '.Block')
 
+    def test_encrypt(self):
+        disk = self.vdevs[0]
+        device = self.get_device(disk)
+        self.assertIsNotNone(device)
+
+        d = dbus.Dictionary(signature='sv')
+        d['passphrase'] = "shouldnotseeme"
+        d['key-size'] = dbus.UInt32(256)
+        d['cipher'] = "aes"
+        d['cipher-mode'] = "cbc-essiv:sha256"
+        d['resilience'] = "datashift" # required, otherwise won't work
+        d['hash'] = "sha256"
+        d['max-hotzone-size'] = dbus.UInt64(0)
+        d['sector-size'] = dbus.UInt32(512)
+        d['new-volume_key'] = True
+
+        device.Encrypt(self.LUKS_PASSPHRASE, d, dbus_interface=self.iface_prefix + '.Block')
+
+        # verify that device now has the .Encrypted interface
+        device = self.get_device(disk)
+        self.assertHasIface(device, "org.freedesktop.UDisks2.Encrypted")
+
+        # verify that the newly encrypted device can be unlocked
+        luks_obj = device.Unlock("shouldnotseeme", self.no_options,
+                                  dbus_interface=self.iface_prefix + '.Encrypted')
+        self.assertIsNotNone(luks_obj)
+        ret, _ = self.run_command("ls /dev/mapper/luks*")
+        self.assertEqual(ret, 0)
+
 
 class UdisksBlockRemovableTest(udiskstestcase.UdisksTestCase):
     '''Extra block device tests over a scsi_debug removable device'''

src/tests/dbus-tests/test_70_encrypted.py

@@ -657,6 +657,35 @@ def test_header_backup_restore(self):
         device = self.get_device(disk)
         self.assertHasIface(device, "org.freedesktop.UDisks2.Encrypted")
 
+    def test_reencrypt(self):
+        disk = self.vdevs[0]
+        device = self.get_device(disk)
+        self._create_luks(device, self.PASSPHRASE)
+
+        self.addCleanup(self._remove_luks, device)
+        self.udev_settle()
+
+        d = dbus.Dictionary(signature='sv')
+        d['key-size'] = dbus.UInt32(256)
+        d['cipher'] = "aes"
+        d['cipher-mode'] = "cbc-essiv:sha256"
+        d['resilience'] = "checksum"
+        d['hash'] = "sha256"
+        d['max-hotzone-size'] = dbus.UInt64(0)
+        d['sector-size'] = dbus.UInt32(512)
+        d['new-volume_key'] = True
+        d['pbkdf-type'] = ""
+
+        # Online
+        device.Reencrypt(self.PASSPHRASE, d,
+                         dbus_interface=self.iface_prefix + '.Encrypted')
+
+        device.Lock(self.no_options, dbus_interface=self.iface_prefix + '.Encrypted')
+        # Offline
+        device.Reencrypt(self.PASSPHRASE, d,
+                         dbus_interface=self.iface_prefix + '.Encrypted')
+
+
     def _get_default_luks_version(self):
         manager = self.get_object('/Manager')
         default_encryption_type = self.get_property(manager, '.Manager', 'DefaultEncryptionType')

src/udiskslinuxblock.c

@@ -4308,6 +4308,129 @@ handle_restore_encrypted_header (UDisksBlock           *encrypted,
 
 /* ---------------------------------------------------------------------------------------------------- */
 
+/* runs in thread dedicated to handling method call */
+static gboolean
+handle_encrypt (UDisksBlock           *block,
+                GDBusMethodInvocation *invocation,
+                const gchar           *passphrase,
+                GVariant              *options)
+{
+  UDisksObject *object = NULL;
+  UDisksDaemon *daemon;
+  UDisksState *state = NULL;
+  uid_t caller_uid;
+  GError *error = NULL;
+  UDisksBaseJob *job = NULL;
+
+  const gchar *device;
+  BDCryptoKeyslotContext *context = NULL;
+  guint32 key_size;
+  gchar *cipher;
+  gchar *cipher_mode;
+  gchar *resilience;
+  gchar *hash;
+  guint64 max_hotzone_size;
+  guint32 sector_size;
+  gboolean new_volume_key;
+  gboolean offline = TRUE;
+//  gchar *pbkdf_type;
+//  BDCryptoLUKSPBKDF *pbkdf = NULL;
+  BDCryptoLUKSReencryptParams *params = NULL;
+
+  object = udisks_daemon_util_dup_object (block, &error);
+  if (object == NULL)
+  {
+    g_dbus_method_invocation_return_gerror (invocation, error);
+    goto out;
+  }
+
+  daemon = udisks_linux_block_object_get_daemon (UDISKS_LINUX_BLOCK_OBJECT (object));
+  state = udisks_daemon_get_state (daemon);
+
+  udisks_linux_block_object_lock_for_cleanup (UDISKS_LINUX_BLOCK_OBJECT (object));
+  udisks_state_check_block (state, udisks_linux_block_object_get_device_number (UDISKS_LINUX_BLOCK_OBJECT (object)));
+
+  if (!udisks_daemon_util_get_caller_uid_sync (daemon, invocation, NULL /* GCancellable */, &caller_uid, &error))
+  {
+    g_dbus_method_invocation_return_gerror (invocation, error);
+    goto out;
+  }
+
+  job = udisks_daemon_launch_simple_job (daemon,
+                                         UDISKS_OBJECT (object),
+                                         "block-encrypt",
+                                         caller_uid,
+                                         NULL);
+  if (job == NULL)
+  {
+    g_dbus_method_invocation_return_error (invocation, UDISKS_ERROR, UDISKS_ERROR_FAILED,
+                                           "Failed to create a job object");
+    goto out;
+  }
+
+  udisks_linux_block_encrypted_lock (block);
+  // do stuff here
+  device = udisks_block_get_device (block);
+
+  context = bd_crypto_keyslot_context_new_passphrase ((const guint8 *) passphrase,
+                                                      strlen(passphrase),
+                                                      &error);
+  if (!context)
+  {
+    g_dbus_method_invocation_return_error (invocation,
+                                           UDISKS_ERROR,
+                                           UDISKS_ERROR_FAILED,
+                                           "Error encrypting block device %s (ctx): %s",
+                                           device,
+                                           error->message);
+    udisks_simple_job_complete (UDISKS_SIMPLE_JOB (job), FALSE, error->message);
+    udisks_linux_block_encrypted_unlock (block);
+    goto out;
+  }
+
+  g_variant_lookup (options, "key-size", "u", &key_size);
+  g_variant_lookup (options, "cipher", "&s", &cipher);
+  g_variant_lookup (options, "cipher-mode", "&s", &cipher_mode);
+  g_variant_lookup (options, "resilience", "&s", &resilience);
+  g_variant_lookup (options, "hash", "&s", &hash);
+  g_variant_lookup (options, "max-hotzone-size", "u", &max_hotzone_size);
+  g_variant_lookup (options, "sector-size", "u", &sector_size);
+  g_variant_lookup (options, "new-volume_key", "b", &new_volume_key);
+  // `offline` is already determined
+
+  params = bd_crypto_luks_reencrypt_params_new (key_size, cipher, cipher_mode, resilience, hash, max_hotzone_size, sector_size, new_volume_key, offline, NULL);
+
+  if (! bd_crypto_luks_encrypt (device, params, context, NULL /* prog_func -- TODO */, &error))
+  {
+    g_dbus_method_invocation_return_error (invocation,
+                                           UDISKS_ERROR,
+                                           UDISKS_ERROR_FAILED,
+                                           "Error encrypting block device %s (enc): %s",
+                                           device,
+                                           error->message);
+    udisks_simple_job_complete (UDISKS_SIMPLE_JOB (job), FALSE, error->message);
+    udisks_linux_block_encrypted_unlock (block);
+    goto out;
+  }
+
+  //
+  udisks_linux_block_encrypted_unlock (block);
+
+  udisks_block_complete_encrypt (block, invocation);
+  udisks_simple_job_complete (UDISKS_SIMPLE_JOB (job), TRUE, NULL);
+
+  out:
+  if (object != NULL)
+    udisks_linux_block_object_release_cleanup_lock (UDISKS_LINUX_BLOCK_OBJECT (object));
+  if (state != NULL)
+    udisks_state_check (state);
+  g_clear_object (&object);
+  g_clear_error (&error);
+  return TRUE; /* returning TRUE means that we handled the method invocation */
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
 static void
 block_iface_init (UDisksBlockIface *iface)
 {
@@ -4322,4 +4445,5 @@ block_iface_init (UDisksBlockIface *iface)
   iface->handle_open_device               = handle_open_device;
   iface->handle_rescan                    = handle_rescan;
   iface->handle_restore_encrypted_header  = handle_restore_encrypted_header;
+  iface->handle_encrypt                   = handle_encrypt;
 }