genode/repos/dde_rump/src/server/rump_cgd/cgd.h

60 lines
1.2 KiB
C
Raw Normal View History

dde_rump: block encryption server using cgd(4) The 'rump_cgd' server provides block level encryption for a block session by employing the 'cgd(4)' device provided by the rumpkernel. 'rump_cgd' uses a Block_session to get access to an existing block device and provides another Block_session to its clients. Each block written or read by the client is transperently encrypted or decrypted by the server. For now 'rump_cgd' may only _configure_ a 'cgd' device but is unable to generate a configuration. The used cipher is hardcoded to _aes-cbc_ with a keysize of 256 bit. Furthermore the server is able to serve one client only. To ease the usage, its interface is modelled after the interface of 'cgdconfig(8)'. As implications thereof the key must have the same format as used by 'cgdconfig'. That means the key is a base 64 encoded string in which the first 4 bytes denote the actual length of the key in bits (these 4 bytes are stored in big endian order). Preparing a raw (e.g. without partition table) encrypted Ext2 disk image is done by executing 'tool/rump': ! dd if=/dev/urandom of=/path/to/disk_image ! rump -c /path/to/disk_image # key is printed to stdout ! rump -c -k <key> -F ext2fs /path/to/disk_image To use this disk image the following config snippet can be used: ! <start name="rump_cgd"> ! <resource name="RAM" quantum="8M" /> ! <provides><service name="Block"/></provides> ! <config action="configure"> ! <params> ! <method>key</method>} ! <key>AAABAJhpB2Y2UvVjkFdlP4m44449Pi3A/uW211mkanSulJo8</key> ! </params> ! </config> ! <route> ! <service name="Block"> <child name="ahci"/> </service> ! <any-service> <parent/> <any-child/> </any-service> ! </route> ! </start> the Block service provided by rump_cgd may be used by a file system server in return: ! <start name="rump_fs"> ! <resource name="RAM" quantum="16M"/> ! <provides><service name="File_system"/></provides> ! <config fs="ext2fs"> ! <policy label="" root="/" writeable="yes"/> ! </config> ! <route> ! <service name="Block"> <child name="rump_cgd"/> </service> ! <any-service> <parent/> <any-child/> </any-service> ! </route> ! </start> Since 'tool/rump' just utilizes the rumpkernel running on the host system to do its duty there is a script called 'tool/cgdconf' that extracts the key from a 'cgdconfig(8)' generated configuration file and also is able to generade such a file from a given key. Thereby the interoperabilty between 'rump_cgd' and the general rumpkernel based tools is secured.
2014-04-16 15:06:27 +02:00
/**
* \brief Rump cgd header
* \author Josef Soentgen
* \date 2014-04-11
*/
/*
* Copyright (C) 2014 Genode Labs GmbH
*
* This file is part of the Genode OS framework, which is distributed
* under the terms of the GNU General Public License version 2.
*/
#ifndef _CGD_H_
#define _CGD_H_
#include <base/signal.h>
#include <os/server.h>
namespace Cgd {
typedef Genode::uint64_t seek_off_t;
class Params;
class Device
{
private:
int _fd; /* fd for cgd (raw) device */
Genode::size_t _blk_sz; /* block size of cgd device */
Genode::uint64_t _blk_cnt; /* block count of cgd device */
public:
Device(int fd);
~Device();
char const *name() const;
Genode::size_t block_size() const { return _blk_sz; }
Genode::uint64_t block_count() const { return _blk_cnt; }
Genode::size_t read(char *dst, Genode::size_t len, seek_off_t seek_offset);
Genode::size_t write(char const *src, Genode::size_t len, seek_off_t seek_offset);
static Device *configure(Genode::Allocator *alloc, Params const *p, char const *dev);
};
Device *init(Genode::Allocator *alloc, Server::Entrypoint &ep);
void deinit(Genode::Allocator *alloc, Device *dev);
}
#endif /* _CGD_H_ */