 @@ -1,14 +1,14 @@
-.\" $NetBSD: cgdconfig.8,v 1.27 2008/05/13 09:31:06 wiz Exp $
+.\" $NetBSD: cgdconfig.8,v 1.28 2008/09/12 16:51:55 christos Exp $
 .\"
 .\" Copyright (c) 2002, The NetBSD Foundation, Inc.
 .\" All rights reserved.
 .\"
 .\" This code is derived from software contributed to The NetBSD Foundation
 .\" by Roland C. Dowdeswell.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 @@ -17,27 +17,27 @@
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 .\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 .\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 .\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd May 10, 2008
+.Dd September 12, 2008
 .Dt CGDCONFIG 8
 .Os
 .Sh NAME
 .Nm cgdconfig
 .Nd configuration utility for the cryptographic disk driver
 .Sh SYNOPSIS
 .Nm
 .Op Fl npv
 .Op Fl V Ar vmeth
 .Ar cgd dev
 .Op Ar paramsfile
 .Nm
 .Fl C
 @@ -87,27 +87,27 @@ The options are as follows:
 Configure all the devices listed in the cgd configuration file.
 .It Fl f Ar configfile
 Specify the configuration file explicitly, rather than using the default
 configuration file
 .Pa /etc/cgd/cgd.conf .
 .It Fl G
 Generate a new paramsfile (to stdout) using the values from
 .Ar paramsfile
 which will generate the same key.
 This may need to prompt for multiple passphrases.
 .It Fl g
 Generate a paramsfile (to stdout).
 .It Fl i Ar ivmeth
-Specify the IV method (default: encblkno).
+Specify the IV method (default: encblkno1).
 .It Fl k Ar kgmeth
 Specify the key generation method (default: pkcs5_pbkdf2/sha1).
 .It Fl o Ar outfile
 When generating a
 .Ar paramsfile ,
 store it in
 .Ar outfile .
 .It Fl p
 Read all passphrases from stdin rather than
 .Pa /dev/tty .
 Passphrases are separated by newlines.
 Users of this flag must be able to predict the order in which passphrases
 are prompted.
 @@ -306,27 +306,27 @@ Only used for pkcs5_pbkdf2/sha1 and pkcs
 The salt.
 Only used for pkcs5_pbkdf2/sha1 and pkcs5_pbkdf2.
 .El
 .Sh FILES
 .Bl -tag -width indentxxxxxxxxxxxxxxxxxx -compact
 .It Pa /etc/cgd/
 configuration directory, used to store paramsfiles.
 .It Pa /etc/cgd/cgd.conf
 cgd configuration file.
 .El
 .Sh EXAMPLES
 To set up and configure a cgd that uses AES with a 192 bit key
 in CBC mode with the IV Method
-.Sq encblkno
+.Sq encblkno1
 (encrypted block number):
 .Bd -literal
 	# cgdconfig -g -o /etc/cgd/wd0e aes-cbc 192
 	# cgdconfig cgd0 /dev/wd0e
 	/dev/wd0e's passphrase:
 .Ed
 .Pp
 When using verification methods, the first time that we configure the
 disk the verification method will fail.
 We overcome this by supplying
 .Fl V Ar re-enter
 when we configure the first time to set up the disk.
 Here is the
 @@ -349,40 +349,40 @@ parameters file:
              old file's passphrase:
              new file's passphrase:
 .Ed
 .Pp
 To configure a cgd that uses Blowfish with a 200 bit key that it
 reads from stdin:
 .Bd -literal
 	# cgdconfig -s cgd0 /dev/sd0h blowfish-cbc 200
 .Ed
 .Pp
 An example parameters file which uses PKCS#5 PBKDF2:
 .Bd -literal
 	algorithm aes-cbc;
-	iv-method encblkno;
+	iv-method encblkno1;
 	keylength 128;
 	verify_method none;
 	keygen pkcs5_pbkdf2/sha1 {
 		iterations 39361;
 		salt AAAAgMoHiYonye6Kog \\
 		     dYJAobCHE=;
 	};
 .Ed
 .Pp
 An example parameters file which stores its key locally:
 .Bd -literal
 	algorithm       aes-cbc;
-	iv-method       encblkno;
+	iv-method       encblkno1;
 	keylength       256;
 	verify_method   none;
 	keygen storedkey key AAABAK3QO6d7xzLfrXTdsgg4 \\
 			     ly2TdxkFqOkYYcbyUKu/f60L;
 .Ed
 .Pp
 An example
 .Pa /etc/cgd/cgd.conf :
 .Bd -literal
+	#
 	# /etc/cgd/cgd.conf
 	# Configuration file for cryptographic disk devices
+	#

 @@ -1,14 +1,14 @@
-/* $NetBSD: params.c,v 1.23 2008/05/11 03:15:21 elric Exp $ */
+/* $NetBSD: params.c,v 1.24 2008/09/12 16:51:55 christos Exp $ */
 /*-
  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Roland C. Dowdeswell.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -21,27 +21,27 @@
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: params.c,v 1.23 2008/05/11 03:15:21 elric Exp $");
+__RCSID("$NetBSD: params.c,v 1.24 2008/09/12 16:51:55 christos Exp $");
 #endif
 #include <sys/types.h>
 #include <err.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <util.h>
 #include "params.h"
 #include "pkcs5_pbkdf2.h"
 @@ -142,73 +142,84 @@ params_combine(struct params *p1, struct
 	 */
 	free(p2);
 	return p;
+}
 int
 params_filldefaults(struct params *p)
+{
 	size_t	i;
 	if (p->verify_method == VERIFY_UNKNOWN)
 		p->verify_method = VERIFY_NONE;
 	if (!p->ivmeth)
-		p->ivmeth = string_fromcharstar("encblkno");
+		p->ivmeth = string_fromcharstar("encblkno1");
 	if (p->keylen == (size_t)-1) {
 		i = crypt_defaults_lookup(string_tocharstar(p->algorithm));
 		if (i != (size_t)-1) {
 			p->keylen = crypto_defaults[i].keylen;
 		} else {
 			warnx("could not determine key length for unknown "
 			    "algorithm \"%s\"",
 			    string_tocharstar(p->algorithm));
 			return -1;
+		}
+	}
 	return 0;
+}
 /*
  * params_verify traverses the parameters and all of the keygen methods
  * looking for inconsistencies.  It outputs warnings on non-fatal errors
  * such as unknown encryption methods, but returns failure on fatal
  * conditions such as a PKCS5_PBKDF2 keygen without a salt.  It is intended
  * to run before key generation.
  */
 int
 params_verify(const struct params *p)
+{
 	static const char *encblkno[] = {
 	    "encblkno", "encblkno1", "encblkno8"
 	};
 	static size_t i;
 	const char *meth;
 	if (!p->algorithm) {
 		warnx("unspecified algorithm");
 		return 0;
+	}
 	/*
 	 * we only warn for the encryption method so that it is possible
 	 * to use an older cgdconfig(8) with a new kernel that supports
 	 * additional crypto algorithms.
 	 */
 	if (crypt_defaults_lookup(string_tocharstar(p->algorithm)) == -1)
 		warnx("unknown algorithm \"%s\"(warning)",
 		    string_tocharstar(p->algorithm));
 	/* same rationale with IV methods. */
 	if (!p->ivmeth) {
 		warnx("unspecified IV method");
 		return 0;
+	}
 	if (strcmp("encblkno", string_tocharstar(p->ivmeth)))
-		warnx("unknown IV method \"%s\" (warning)",
+	meth = string_tocharstar(p->ivmeth);
-		    string_tocharstar(p->ivmeth));
+	for (i = 0; i < __arraycount(encblkno); i++)
 		if (strcmp(encblkno[i], meth) == 0)
 			break;
 	if (i == __arraycount(encblkno))
 		warnx("unknown IV method \"%s\" (warning)", meth);
 	if (p->keylen == (size_t)-1) {
 		warnx("unspecified key length");
 		return 0;
+	}
 	return keygen_verify(p->keygen);
+}
 struct params *
 params_algorithm(string_t *in)
+{
 	struct params *p = params_new();

 @@ -1,14 +1,14 @@
-/* $NetBSD: cgd.c,v 1.52 2008/04/28 20:23:46 martin Exp $ */
+/* $NetBSD: cgd.c,v 1.53 2008/09/12 16:51:55 christos Exp $ */
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Roland C. Dowdeswell.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -20,27 +20,27 @@
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cgd.c,v 1.52 2008/04/28 20:23:46 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cgd.c,v 1.53 2008/09/12 16:51:55 christos Exp $");
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
 #include <sys/errno.h>
 #include <sys/buf.h>
 #include <sys/bufq.h>
 #include <sys/malloc.h>
 #include <sys/pool.h>
 #include <sys/ioctl.h>
 #include <sys/device.h>
 #include <sys/disk.h>
 @@ -476,80 +476,102 @@ cgddump(dev_t dev, daddr_t blkno, void *
 	DPRINTF_FOLLOW(("cgddump(%d, %" PRId64 ", %p, %lu)\n", dev, blkno, va,
 	    (unsigned long)size));
 	GETCGD_SOFTC(cs, dev);
 	return dk_dump(di, &cs->sc_dksc, dev, blkno, va, size);
+}
 /*
  * XXXrcd:
  *  for now we hardcode the maximum key length.
  */
 #define MAX_KEYSIZE	1024
 static const struct {
 	const char *n;
 	int v;
 	int d;
 } encblkno[] = {
 	{ "encblkno",  CGD_CIPHER_CBC_ENCBLKNO8, 1 },
 	{ "encblkno8", CGD_CIPHER_CBC_ENCBLKNO8, 1 },
 	{ "encblkno1", CGD_CIPHER_CBC_ENCBLKNO1, 8 },
 };
 /* ARGSUSED */
 static int
 cgd_ioctl_set(struct cgd_softc *cs, void *data, struct lwp *l)
+{
 	struct	 cgd_ioctl *ci = data;
 	struct	 vnode *vp;
 	int	 ret;
 	size_t	 i;
 	size_t	 keybytes;			/* key length in bytes */
 	const char *cp;
 	char	 *inbuf;
 	cp = ci->ci_disk;
 	if ((ret = dk_lookup(cp, l, &vp, UIO_USERSPACE)) != 0)
 		return ret;
 	inbuf = malloc(MAX_KEYSIZE, M_TEMP, M_WAITOK);
 	if ((ret = cgdinit(cs, cp, vp, l)) != 0)
 		goto bail;
 	(void)memset(inbuf, 0, MAX_KEYSIZE);
 	ret = copyinstr(ci->ci_alg, inbuf, 256, NULL);
 	if (ret)
 		goto bail;
 	cs->sc_cfuncs = cryptfuncs_find(inbuf);
 	if (!cs->sc_cfuncs) {
 		ret = EINVAL;
 		goto bail;
+	}
 	/* right now we only support encblkno, so hard-code it */
 	(void)memset(inbuf, 0, MAX_KEYSIZE);
 	ret = copyinstr(ci->ci_ivmethod, inbuf, MAX_KEYSIZE, NULL);
 	if (ret)
 		goto bail;
 	if (strcmp("encblkno", inbuf)) {
 	for (i = 0; i < __arraycount(encblkno); i++)
 		if (strcmp(encblkno[i].n, inbuf) == 0)
 			break;
 	if (i == __arraycount(encblkno)) {
 		ret = EINVAL;
 		goto bail;
+	}
 	keybytes = ci->ci_keylen / 8 + 1;
 	if (keybytes > MAX_KEYSIZE) {
 		ret = EINVAL;
 		goto bail;
+	}
 	(void)memset(inbuf, 0, MAX_KEYSIZE);
 	ret = copyin(ci->ci_key, inbuf, keybytes);
 	if (ret)
 		goto bail;
 	cs->sc_cdata.cf_blocksize = ci->ci_blocksize;
-	cs->sc_cdata.cf_mode = CGD_CIPHER_CBC_ENCBLKNO;
+	cs->sc_cdata.cf_mode = encblkno[i].v;
 	cs->sc_cdata.cf_priv = cs->sc_cfuncs->cf_init(ci->ci_keylen, inbuf,
 	    &cs->sc_cdata.cf_blocksize);
 	/*
 	 * The blocksize is supposed to be in bytes. Unfortunately originally
 	 * it was expressed in bits. For compatibility we maintain encblkno
 	 * and encblkno8.
 	 */
 	cs->sc_cdata.cf_blocksize /= encblkno[i].d;
 	(void)memset(inbuf, 0, MAX_KEYSIZE);
 	if (!cs->sc_cdata.cf_priv) {
 		printf("cgd: unable to initialize cipher\n");
 		ret = EINVAL;		/* XXX is this the right error? */
 		goto bail;
+	}
 	free(inbuf, M_TEMP);
 	bufq_alloc(&cs->sc_dksc.sc_bufq, "fcfs", 0);
 	cs->sc_data = malloc(MAXPHYS, M_DEVBUF, M_WAITOK);
 	cs->sc_data_used = 0;

 @@ -1,14 +1,14 @@
-/* $NetBSD: cgdvar.h,v 1.11 2008/04/28 20:23:46 martin Exp $ */
+/* $NetBSD: cgdvar.h,v 1.12 2008/09/12 16:51:55 christos Exp $ */
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Roland C. Dowdeswell.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -49,27 +49,32 @@ struct cgd_ioctl {
 #ifdef _KERNEL
 #include <dev/cgd_crypto.h>
 /* This cryptdata structure is here rather than cgd_crypto.h, since
  * it stores local state which will not be generalised beyond the
  * cgd driver.
  */
 struct cryptdata {
 	size_t		 cf_blocksize;	/* block size (in bytes) */
 	int		 cf_mode;	/* Cipher Mode and IV Gen method */
-#define CGD_CIPHER_CBC_ENCBLKNO 1	/* CBC Mode w/ Enc Block Number */
+#define CGD_CIPHER_CBC_ENCBLKNO8 1	/* CBC Mode w/ Enc Block Number
 					 * 8 passes (compat only)
 					 */
 #define CGD_CIPHER_CBC_ENCBLKNO1 2	/* CBC Mode w/ Enc Block Number
 					 * 1 pass (default)
 					 */
 	void		*cf_priv;	/* enc alg private data */
 };
 struct cgd_softc {
 	struct dk_softc		 sc_dksc;	/* generic disk interface */
 	struct cryptinfo	*sc_crypt;	/* the alg/key/etc */
 	struct vnode		*sc_tvn;	/* target device's vnode */
 	dev_t			 sc_tdev;	/* target device */
 	char			*sc_tpath;	/* target device's path */
 	void *			 sc_data;	/* emergency buffer */
 	int			 sc_data_used;	/* Really lame, we'll change */
 	size_t			 sc_tpathlen;	/* length of prior string */
 	struct cryptdata	 sc_cdata;	/* crypto data */