From d28b0d273c91064b34ec4d232234b8c466c772f3 Mon Sep 17 00:00:00 2001
From: Arie Peterson <arie@greenhost.nl>
Date: Thu, 20 Jul 2017 14:12:59 +0200
Subject: [PATCH] Add endpoint for adding encryption password
---
src/api/encryption_keys_post.c | 69 ++++++++++++++++++++++++++++++++++
src/api/encryption_keys_put.c | 2 +-
src/cryptops-api.c | 4 ++
3 files changed, 74 insertions(+), 1 deletion(-)
create mode 100644 src/api/encryption_keys_post.c
diff --git a/src/api/encryption_keys_post.c b/src/api/encryption_keys_post.c
new file mode 100644
index 0000000..878f90b
--- /dev/null
+++ b/src/api/encryption_keys_post.c
@@ -0,0 +1,69 @@
+/**
+ * Callback function to add a luks encryption password.
+ * @param[in] request incoming HTTP request
+ * @param[out] response HTTP response to the request
+ * @param[in] user_data extra data to pass between main thread and callbacks
+ * @return internal status code
+ */
+int callback_encryption_keys_post(const struct _u_request * request,
+ struct _u_response * response, void * user_data)
+{
+ int r;
+
+ // Read in json request body.
+ json_t * json_input = ulfius_get_json_body_request(request, NULL);
+
+ // Read (current) password from request.
+ const char * password;
+ password = json_string_value(json_object_get(json_input, "password"));
+ if (password == NULL)
+ {
+ return send_simple_response(response, 400, "error", "missing password");
+ }
+
+ // Read new password from request.
+ const char * new_password;
+ new_password = json_string_value(json_object_get(json_input,
+ "new-password"));
+ if (new_password == NULL)
+ {
+ return send_simple_response(response, 400, "error",
+ "missing new password");
+ }
+
+ // Initialise encrypted container.
+ struct crypt_device * cd = NULL;
+ r = container_initialise(&cd, DATA_PARTITION_DEVICE, true);
+ if (r < 0)
+ {
+ crypt_free(cd);
+ }
+ if (r != 0)
+ {
+ printf("container_initialise failed with status %d\n", r);
+ return send_simple_response(response, 500, "error",
+ "initialising encrypted container failed");
+ }
+
+ // Add encryption password.
+ r = crypt_keyslot_add_by_passphrase(cd, CRYPT_ANY_SLOT,
+ password, strlen(password), new_password, strlen(new_password));
+
+ if (r == -1)
+ {
+ // Experience learns that -1 is returned when the password is wrong.
+ return send_simple_response(response, 403, "error",
+ "incorrect password");
+ }
+
+ if (r < 0)
+ {
+ // Something else went wrong.
+ printf("crypt_keyslot_add_by_passphrase failed with status %d\n", r);
+ return send_simple_response(response, 500, "error",
+ "error changing password");
+ }
+
+ // If we reach this point, apparently everything went well.
+ return send_simple_response(response, 200, "status", "ok");
+}
diff --git a/src/api/encryption_keys_put.c b/src/api/encryption_keys_put.c
index fc6782f..4555225 100644
--- a/src/api/encryption_keys_put.c
+++ b/src/api/encryption_keys_put.c
@@ -75,7 +75,7 @@ int callback_encryption_keys_put(const struct _u_request * request,
if (r < 0)
{
// Something else went wrong.
- printf("crypt_keyslot_add_by_passphrase failed with status %d\n", r);
+ printf("crypt_keyslot_change_by_passphrase failed with status %d\n", r);
return send_simple_response(response, 500, "error",
"error changing password");
}
diff --git a/src/cryptops-api.c b/src/cryptops-api.c
index 58ac3dd..9944624 100644
--- a/src/cryptops-api.c
+++ b/src/cryptops-api.c
@@ -11,6 +11,7 @@
#include <api/encryption_remove_post.c>
#include <api/encryption_unlock_post.c>
#include <api/encryption_keys_get.c>
+#include <api/encryption_keys_post.c>
#include <api/encryption_keys_put.c>
#include <api/ssh_keys_get.c>
#include <api/ssh_keys_put.c>
@@ -58,6 +59,9 @@ int main(int argc, char ** argv)
ulfius_add_endpoint_by_val(&instance, "GET" , PREFIX,
"/encryption/keys",
0, &callback_encryption_keys_get, NULL);
+ ulfius_add_endpoint_by_val(&instance, "POST" , PREFIX,
+ "/encryption/keys",
+ 0, &callback_encryption_keys_post, NULL);
ulfius_add_endpoint_by_val(&instance, "PUT" , PREFIX,
"/encryption/keys/:slot",
0, &callback_encryption_keys_put, NULL);
--
GitLab