Subversion Repositories zfs_utils

#! /usr/bin/env perl

use strict;

use warnings;

use Data::Dumper;

use File::Path qw(make_path);

# script will create the key files used for GELI encryption

# if only the combined key file is provided, it will be created as a single key.

# if both local key files are provided, the combined key will be split into

# the two local keys using XOR, so that both local keys are required to

# reconstruct the combined key.

# these are the names of the key files used to create the GELI encryption

# if both local key files are provided, the combined key will be split into

# the two local keys using XOR, so that both local keys are required to

# reconstruct the combined key.

# if only the combined key file is provided, it will be created as a single key.

my $rootKeyLocation = '/tmp/keys/'; # '/media/passkey/'; # should be a tmpfs or ramdisk so no record is left on disk

my $localKeyFile1 = $rootKeyLocation . 'local_geli_1.key';

my $localKeyFile2 = $rootKeyLocation . 'local_geli_2.key';

my $combinedKeyFile = $rootKeyLocation . 'combined_geli.key';

# sub will take three file names:

# 1: combined key file to create

# 2: local key file 1 to create (optional)

# 3: local key file 2 to create (optional)

# If both local key files are provided, the combined key will be split into

# the two local keys using XOR, so that both local keys are required to

# reconstruct the combined key.

# returns the actual contents of the combined key, local key 1, and local key 2 as array

sub makeKeys {

   $combinedKeyFile = shift;

   $localKeyFile1 = shift;

   $localKeyFile2 = shift;

   # the actual contents of each key file, returned as raw binary strings for further processing

   my $combinedKey;

   my $localKey1;

   my $localKey2;

   # create a new combined key file if it does not exist

   $combinedKey = make256bitKeyFile( $combinedKeyFile );

   # if both local key file names are provided, create them.

   if ( $localKeyFile1 && $localKeyFile2 ) {

      $localKey1 = make256bitKeyFile ( $localKeyFile1 );

      $localKey2 = xorKeys( $combinedKey, $localKey1 );

      writeKeyfile( $localKeyFile2, $localKey2 );

   }

   return ( $combinedKey, $localKey1, $localKey2 );

}

# unpack and display a binary key as hex with a label

sub displayKey {

   my ( $key, $label ) = @_;

   die "No key provided to displayKey\n" unless defined $key;

   die "No label provided to displayKey\n" unless defined $label;

   my $hex = unpack( 'H*', $key );

   print "$label: $hex\n";

}

sub runCommand {

   my $command = shift;

   print "$command\n";

   `$command`;

}

sub readKeyfile {

   my $keyfile = shift;

   die "No keyfile provided to readKeyfile\n" unless defined $keyfile;

   open( my $fh, '<:raw', $keyfile ) or die "Cannot open keyfile $keyfile: $!";

   my $key;

   my $read = read($fh, $key, 32);

   close $fh;

   die "Failed to read 32 bytes from $keyfile (got " . (defined $read ? $read : 0) . ")\n" unless defined $read && $read == 32;

   return $key; # raw 32-byte binary key

}

sub writeKeyfile {

   my ( $keyfile, $key ) = @_;

   die "No keyfile provided to writeKeyfile\n" unless defined $keyfile;

   die "No key provided to writeKeyfile\n" unless defined $key;

   open( my $fh, '>:raw', $keyfile ) or die "Cannot open keyfile $keyfile for writing: $!";

   my $written = syswrite( $fh, $key );

   close $fh;

   die "Failed to write 32 bytes to $keyfile (wrote " . (defined $written ? $written : 0) . ")\n" unless defined $written && $written == 32;

}

sub xorKeys {

   my ( $key1, $key2 ) = @_;

   die "No key1 provided to xorKeys\n" unless defined $key1;

   die "No key2 provided to xorKeys\n" unless defined $key2;

   die "Keys must be 32 bytes each\n" unless length($key1) == 32 && length($key2) == 32;

   my $result = $key1 ^ $key2;

   return $result;

}

# create a new 256-bit (32 byte) random key file unless it already exixts

# returns the raw binary contents of the key

sub make256bitKeyFile {

   my $keyfile = shift;

   die "No keyfile name provided to make256bitKeyFile\n" unless defined $keyfile;

   if ( -f $keyfile ) {

      print "Key file $keyfile already exists, not overwriting\n";

   } else {

      print "Creating new key file $keyfile\n";

      if ( -x '/usr/bin/openssl' ) {

         # openssl prefers /dev/urandom automatically

         runCommand( "openssl rand -out $keyfile 32" );

      } else {

         # dd displays too much output, so redirect to /dev/null (stdout and stderr)

         runCommand( "dd if=/dev/random of=$keyfile bs=32 count=1 >/dev/null 2>&1" );

      }

   }

   return readKeyfile( $keyfile );

}

# ensure the root key location directory exists

make_path( $rootKeyLocation ) unless -d $rootKeyLocation;

# create the key(s) used for GELI encryption

my ( $combinedKey, $localKey1, $localKey2 ) = makeKeys( $combinedKeyFile, $localKeyFile1, $localKeyFile2 );

# show the results as ASCII hex for recording

print "Keys created, please record this sensitive information for your records:\n";

displayKey( $combinedKey, 'Combined Key' );

displayKey( $localKey1, 'Local Key 1' ) if defined $localKey1;

displayKey( $localKey2, 'Local Key 2' ) if defined $localKey2;