8 #include "libcryptsetup.h"
16 struct luks_masterkey *volume_key;
18 uint64_t iteration_time;
22 /* used in CRYPT_LUKS1 */
24 uint64_t PBKDF2_per_sec;
26 /* used in CRYPT_PLAIN */
27 struct crypt_params_plain plain_hdr;
29 char *plain_cipher_mode;
32 /* callbacks definitions */
33 void (*log)(int class, const char *msg, void *usrptr);
35 int (*confirm)(const char *msg, void *usrptr);
37 int (*password)(const char *msg, char *buf, size_t length, void *usrptr);
38 void *password_usrptr;
42 static void (*_default_log)(int class, char *msg) = NULL;
43 static int _debug_level = 0;
45 void crypt_set_debug_level(int level)
50 void set_default_log(void (*log)(int class, char *msg))
55 void logger(struct crypt_device *cd, int class, const char *file,
56 int line, const char *format, ...)
61 va_start(argp, format);
63 if (vasprintf(&target, format, argp) > 0) {
66 cd->log(class, target, cd->log_usrptr);
67 else if (_default_log)
68 _default_log(class, target);
70 } else if (_debug_level)
71 printf("# %s:%d %s\n", file ?: "?", line, target);
73 } else if (_debug_level)
74 printf("# %s\n", target);
83 * Password processing behaviour matrix of process_key
85 * from binary file: check if there is sufficently large key material
86 * interactive & from fd: hash if requested, otherwise crop or pad with '0'
88 static char *process_key(struct crypt_device *cd, const char *hash_name,
89 const char *key_file, size_t key_size,
90 const char *pass, size_t passLen)
92 char *key = safe_alloc(key_size);
93 memset(key, 0, key_size);
95 /* key is coming from binary file */
96 if (key_file && strcmp(key_file, "-")) {
97 if(passLen < key_size) {
98 log_err(cd, _("Cannot not read %d bytes from key file %s.\n"),
103 memcpy(key, pass, key_size);
107 /* key is coming from tty, fd or binary stdin */
109 if (hash(NULL, hash_name, key, key_size, pass, passLen) < 0) {
110 log_err(cd, _("Key processing error.\n"));
114 } else if (passLen > key_size) {
115 memcpy(key, pass, key_size);
117 memcpy(key, pass, passLen);
123 int parse_into_name_and_mode(const char *nameAndMode, char *name, char *mode)
125 /* Token content stringification, see info cpp/stringification */
127 #define xstr(s) str(s)
128 #define scanpattern1 "%" xstr(LUKS_CIPHERNAME_L) "[^-]-%" xstr(LUKS_CIPHERMODE_L) "s"
129 #define scanpattern2 "%" xstr(LUKS_CIPHERNAME_L) "[^-]"
133 if(sscanf(nameAndMode,scanpattern1, name, mode) != 2) {
134 if((r = sscanf(nameAndMode,scanpattern2,name)) == 1)
135 strncpy(mode,"cbc-plain",10);
148 static int isPLAIN(const char *type)
150 return (type && !strcmp(CRYPT_PLAIN, type));
153 static int isLUKS(const char *type)
155 return (type && !strcmp(CRYPT_LUKS1, type));
158 /* keyslot helpers */
159 static int keyslot_verify_or_find_empty(struct crypt_device *cd, int *keyslot)
161 if (*keyslot == CRYPT_ANY_SLOT) {
162 *keyslot = LUKS_keyslot_find_empty(&cd->hdr);
164 log_err(cd, _("All key slots full.\n"));
169 switch (LUKS_keyslot_info(&cd->hdr, *keyslot)) {
171 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
172 *keyslot, LUKS_NUMKEYS - 1);
177 log_err(cd, _("Key slot %d is full, please select another one.\n"),
185 static int verify_other_keyslot(struct crypt_device *cd,
186 const char *key_file,
190 struct luks_masterkey *mk;
191 crypt_keyslot_info ki;
193 char *password = NULL;
194 unsigned int passwordLen;
196 get_key(_("Enter any remaining LUKS passphrase: "), &password,
197 &passwordLen, 0, key_file, cd->timeout, flags, cd);
201 ki = crypt_keyslot_status(cd, keyIndex);
202 if (ki == SLOT_ACTIVE) /* Not last slot */
203 LUKS_keyslot_set(&cd->hdr, keyIndex, 0);
205 openedIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT,
206 password, passwordLen,
209 if (ki == SLOT_ACTIVE)
210 LUKS_keyslot_set(&cd->hdr, keyIndex, 1);
211 LUKS_dealloc_masterkey(mk);
217 log_std(cd, _("Key slot %d verified.\n"), openedIndex);
221 static int find_keyslot_by_passphrase(struct crypt_device *cd,
222 const char *key_file,
226 struct luks_masterkey *mk;
227 char *password = NULL;
228 unsigned int passwordLen;
231 get_key(message,&password,&passwordLen, 0, key_file,
232 cd->timeout, flags, cd);
236 keyIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
237 passwordLen, &cd->hdr, &mk, cd);
238 LUKS_dealloc_masterkey(mk);
244 static int device_check_and_adjust(struct crypt_device *cd,
246 uint64_t *size, uint64_t *offset,
249 struct device_infos infos;
251 if (get_device_infos(device, &infos, cd) < 0) {
252 log_err(cd, _("Cannot get info about device %s.\n"), device);
259 log_err(cd, _("Device %s has zero size.\n"), device);
262 if (*size <= *offset) {
263 log_err(cd, _("Device %s is too small.\n"), device);
275 static int luks_remove_helper(struct crypt_device *cd,
277 const char *other_key_file,
278 const char *key_file,
281 crypt_keyslot_info ki;
284 if (key_slot == CRYPT_ANY_SLOT) {
285 key_slot = find_keyslot_by_passphrase(cd, key_file, 0,
286 _("Enter LUKS passphrase to be deleted: "));
292 log_std(cd, _("key slot %d selected for deletion.\n"), key_slot);
295 ki = crypt_keyslot_status(cd, key_slot);
296 if (ki == SLOT_INVALID) {
297 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
298 key_slot, LUKS_NUMKEYS - 1);
302 if (ki <= SLOT_INACTIVE) {
303 log_err(cd, _("Key %d not active. Can't wipe.\n"), key_slot);
308 if (ki == SLOT_ACTIVE_LAST && cd->confirm &&
309 !(cd->confirm(_("This is the last keyslot."
310 " Device will become unusable after purging this key."),
311 cd->confirm_usrptr))) {
317 r = verify_other_keyslot(cd, other_key_file, 0, key_slot);
322 r = crypt_keyslot_destroy(cd, key_slot);
324 return (r < 0) ? r : 0;
327 static int create_device_helper(struct crypt_device *cd,
331 const char *cipher_mode,
332 const char *key_file,
344 crypt_status_info ci;
345 char *dm_cipher = NULL;
346 char *processed_key = NULL;
349 ci = crypt_status(cd, name);
353 if (reload && ci < ACTIVE)
356 if (!reload && ci >= ACTIVE) {
357 log_err(cd, _("Device %s already exists.\n"), name);
361 if (key_size < 0 || key_size > 1024) {
362 log_err(cd, _("Invalid key size %d.\n"), key_size);
366 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
370 if (cipher_mode && asprintf(&dm_cipher, "%s-%s", cipher, cipher_mode) < 0)
373 processed_key = process_key(cd, hash, key_file, key_size, key, keyLen);
377 r = dm_create_device(name, cd->device, dm_cipher ?: cipher, cd->type, uuid, size, skip, offset,
378 key_size, processed_key, read_only, reload);
381 safe_free(processed_key);
385 static int open_from_hdr_and_mk(struct crypt_device *cd,
386 struct luks_masterkey *mk,
390 uint64_t size, offset;
392 int read_only, no_uuid, r;
395 offset = crypt_get_data_offset(cd);
396 read_only = flags & CRYPT_ACTIVATE_READONLY;
397 no_uuid = flags & CRYPT_ACTIVATE_NO_UUID;
399 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
403 if (asprintf(&cipher, "%s-%s", crypt_get_cipher(cd),
404 crypt_get_cipher_mode(cd)) < 0)
407 r = dm_create_device(name, cd->device, cipher, cd->type,
408 no_uuid ? NULL : crypt_get_uuid(cd),
409 size, 0, offset, mk->keyLength, mk->key,
415 static void log_wrapper(int class, const char *msg, void *usrptr)
417 void (*xlog)(int class, char *msg) = usrptr;
418 xlog(class, (char *)msg);
421 static int yesDialog_wrapper(const char *msg, void *usrptr)
423 int (*xyesDialog)(char *msg) = usrptr;
424 return xyesDialog((char*)msg);
427 static void key_from_terminal(struct crypt_device *cd, char *msg, char **key,
428 unsigned int *key_len, int force_verify)
433 *key = safe_alloc(MAX_TTY_PASSWORD_LEN);
436 r = cd->password(msg, *key, (size_t)key_len, cd->password_usrptr);
443 if (force_verify || cd->password_verify)
444 flags |= CRYPT_FLAG_VERIFY_IF_POSSIBLE;
445 get_key(msg, key, key_len, 0, NULL, cd->timeout, flags, cd);
449 static int volume_key_by_terminal_passphrase(struct crypt_device *cd, int keyslot,
450 struct luks_masterkey **mk)
452 char *prompt = NULL, *passphrase_read = NULL;
453 unsigned int passphrase_size_read;
454 int r = -EINVAL, tries = cd->tries;
456 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
462 LUKS_dealloc_masterkey(*mk);
465 key_from_terminal(cd, prompt, &passphrase_read,
466 &passphrase_size_read, 0);
467 if(!passphrase_read) {
472 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
473 passphrase_size_read, &cd->hdr, mk, cd);
474 safe_free(passphrase_read);
475 passphrase_read = NULL;
476 } while (r == -EPERM && (--tries > 0));
479 LUKS_dealloc_masterkey(*mk);
488 static void key_from_file(struct crypt_device *cd, char *msg,
489 char **key, unsigned int *key_len,
490 const char *key_file, size_t key_size)
492 get_key(msg, key, key_len, key_size, key_file, cd->timeout, 0, cd);
495 static int _crypt_init(struct crypt_device **cd,
497 struct crypt_options *options,
498 int load, int need_dm)
502 /* if it is plain device and mapping table is being reloaded
503 initialize it by name*/
504 init_by_name = (type && !strcmp(type, CRYPT_PLAIN) && load);
506 /* Some of old API calls do not require DM in kernel,
507 fake initialisation by initialise it with kernel_check disabled */
509 (void)dm_init(NULL, 0);
511 r = crypt_init_by_name(cd, options->name);
513 r = crypt_init(cd, options->device);
520 crypt_set_log_callback(*cd, log_wrapper, options->icb->log);
521 crypt_set_confirm_callback(*cd, yesDialog_wrapper, options->icb->yesDialog);
523 crypt_set_timeout(*cd, options->timeout);
524 crypt_set_password_retry(*cd, options->tries);
525 crypt_set_iterarion_time(*cd, options->iteration_time ?: 1000);
526 crypt_set_password_verify(*cd, options->flags & CRYPT_FLAG_VERIFY);
528 if (load && !init_by_name)
529 r = crypt_load(*cd, type, NULL);
531 if (!r && type && !(*cd)->type) {
532 (*cd)->type = strdup(type);
543 void crypt_set_log_callback(struct crypt_device *cd,
544 void (*log)(int class, const char *msg, void *usrptr),
548 cd->log_usrptr = usrptr;
551 void crypt_set_confirm_callback(struct crypt_device *cd,
552 int (*confirm)(const char *msg, void *usrptr),
555 cd->confirm = confirm;
556 cd->confirm_usrptr = usrptr;
559 void crypt_set_password_callback(struct crypt_device *cd,
560 int (*password)(const char *msg, char *buf, size_t length, void *usrptr),
563 cd->password = password;
564 cd->password_usrptr = usrptr;
567 /* OPTIONS: name, cipher, device, hash, key_file, key_size, key_slot,
568 * offset, size, skip, timeout, tries, passphrase_fd (ignored),
570 int crypt_create_device(struct crypt_options *options)
572 struct crypt_device *cd = NULL;
577 r = _crypt_init(&cd, CRYPT_PLAIN, options, 0, 1);
581 get_key(_("Enter passphrase: "), &key, &keyLen, options->key_size,
582 options->key_file, cd->timeout, options->flags, cd);
586 r = create_device_helper(cd, options->name, options->hash,
587 options->cipher, NULL, options->key_file, key, keyLen,
588 options->key_size, options->size, options->skip,
589 options->offset, NULL, options->flags & CRYPT_FLAG_READONLY,
597 /* OPTIONS: same as create above */
598 int crypt_update_device(struct crypt_options *options)
600 struct crypt_device *cd = NULL;
605 r = _crypt_init(&cd, CRYPT_PLAIN, options, 1, 1);
609 get_key(_("Enter passphrase: "), &key, &keyLen, options->key_size,
610 options->key_file, cd->timeout, options->flags, cd);
614 r = create_device_helper(cd, options->name, options->hash,
615 options->cipher, NULL, options->key_file, key, keyLen,
616 options->key_size, options->size, options->skip,
617 options->offset, NULL, options->flags & CRYPT_FLAG_READONLY,
625 /* OPTIONS: name, size, icb */
626 int crypt_resize_device(struct crypt_options *options)
628 struct crypt_device *cd = NULL;
629 char *device = NULL, *cipher = NULL, *uuid = NULL, *key = NULL;
631 uint64_t size, skip, offset;
632 int key_size, read_only, r;
634 r = dm_query_device(options->name, &device, &size, &skip, &offset,
635 &cipher, &key_size, &key, &read_only, NULL, &uuid);
639 /* Try to determine type of device from UUID */
641 if (!strncmp(uuid, CRYPT_PLAIN, strlen(CRYPT_PLAIN))) {
645 } else if (!strncmp(uuid, CRYPT_LUKS1, strlen(CRYPT_LUKS1)))
649 r = _crypt_init(&cd, type, options, 1, 1);
653 size = options->size;
654 r = device_check_and_adjust(cd, device, &size, &offset, &read_only);
658 r = dm_create_device(options->name, device, cipher, type,
659 crypt_get_uuid(cd), size, skip, offset,
660 key_size, key, read_only, 1);
670 /* OPTIONS: name, icb */
671 int crypt_query_device(struct crypt_options *options)
675 r = dm_status_device(options->name);
679 r = dm_query_device(options->name, (char **)&options->device, &options->size,
680 &options->skip, &options->offset, (char **)&options->cipher,
681 &options->key_size, NULL, &read_only, NULL, NULL);
687 options->flags |= CRYPT_FLAG_READONLY;
689 options->flags |= CRYPT_FLAG_FREE_DEVICE;
690 options->flags |= CRYPT_FLAG_FREE_CIPHER;
695 /* OPTIONS: name, icb */
696 int crypt_remove_device(struct crypt_options *options)
698 return crypt_deactivate(NULL, options->name);
701 /* OPTIONS: device, cipher, hash, align_payload, key_size (master key), key_slot
702 * new_key_file, iteration_time, timeout, flags, icb */
703 int crypt_luksFormat(struct crypt_options *options)
705 char cipherName[LUKS_CIPHERNAME_L];
706 char cipherMode[LUKS_CIPHERMODE_L];
708 unsigned int passwordLen;
709 struct crypt_device *cd;
710 struct crypt_params_luks1 cp = {
711 .hash = options->hash,
712 .data_alignment = options->align_payload
716 r = parse_into_name_and_mode(options->cipher, cipherName, cipherMode);
718 log_err(cd, _("No known cipher specification pattern detected.\n"));
722 if ((r = _crypt_init(&cd, CRYPT_LUKS1, options, 0, 1)))
725 if (options->key_slot >= LUKS_NUMKEYS && options->key_slot != CRYPT_ANY_SLOT) {
726 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
727 options->key_slot, LUKS_NUMKEYS - 1);
732 get_key(_("Enter LUKS passphrase: "), &password, &passwordLen, 0,
733 options->new_key_file, options->timeout, options->flags, cd);
740 r = crypt_format(cd, CRYPT_LUKS1, cipherName, cipherMode,
741 NULL, NULL, options->key_size, &cp);
745 /* Add keyslot using internally stored volume key generated during format */
746 r = crypt_keyslot_add_by_volume_key(cd, options->key_slot, NULL, 0,
747 password, passwordLen);
751 return (r < 0) ? r : 0;
754 /* OPTIONS: name, device, key_size, key_file, timeout, tries, flags, icb */
755 int crypt_luksOpen(struct crypt_options *options)
757 struct crypt_device *cd = NULL;
764 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
768 if (options->flags & CRYPT_FLAG_READONLY)
769 flags |= CRYPT_ACTIVATE_READONLY;
771 if (options->flags & CRYPT_FLAG_NON_EXCLUSIVE_ACCESS)
772 flags |= CRYPT_ACTIVATE_NO_UUID;
774 if (options->key_file)
775 r = crypt_activate_by_keyfile(cd, options->name,
776 CRYPT_ANY_SLOT, options->key_file, options->key_size,
779 r = crypt_activate_by_passphrase(cd, options->name,
780 CRYPT_ANY_SLOT, options->passphrase,
781 options->passphrase ? strlen(options->passphrase) : 0,
785 return (r < 0) ? r : 0;
788 /* OPTIONS: device, keys_slot, key_file, timeout, flags, icb */
789 int crypt_luksKillSlot(struct crypt_options *options)
791 struct crypt_device *cd = NULL;
794 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
798 r = luks_remove_helper(cd, options->key_slot, options->key_file, NULL,
799 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
802 return (r < 0) ? r : 0;
805 /* OPTIONS: device, new_key_file, key_file, timeout, flags, icb */
806 int crypt_luksRemoveKey(struct crypt_options *options)
808 struct crypt_device *cd = NULL;
811 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
815 r = luks_remove_helper(cd, CRYPT_ANY_SLOT, options->key_file, options->new_key_file,
816 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
819 return (r < 0) ? r : 0;
823 /* OPTIONS: device, new_key_file, key_file, key_slot, flags,
824 iteration_time, timeout, icb */
825 int crypt_luksAddKey(struct crypt_options *options)
827 struct crypt_device *cd = NULL;
830 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
834 if (options->key_file || options->new_key_file)
835 r = crypt_keyslot_add_by_keyfile(cd, options->key_slot,
836 options->key_file, 0,
837 options->new_key_file, 0);
839 r = crypt_keyslot_add_by_passphrase(cd, options->key_slot,
843 return (r < 0) ? r : 0;
846 /* OPTIONS: device, icb */
847 int crypt_luksUUID(struct crypt_options *options)
849 struct crypt_device *cd = NULL;
853 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
857 uuid = (char *)crypt_get_uuid(cd);
858 log_std(cd, uuid ?: "");
864 /* OPTIONS: device, icb */
865 int crypt_isLuks(struct crypt_options *options)
867 struct crypt_device *cd = NULL;
870 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
876 /* OPTIONS: device, icb */
877 int crypt_luksDump(struct crypt_options *options)
879 struct crypt_device *cd = NULL;
882 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
892 void crypt_get_error(char *buf, size_t size)
894 const char *error = get_error();
896 if (!buf || size < 1)
899 strncpy(buf, error, size - 1);
900 buf[size - 1] = '\0';
906 void crypt_put_options(struct crypt_options *options)
908 if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
909 free((char *)options->device);
910 options->device = NULL;
911 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
913 if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
914 free((char *)options->cipher);
915 options->cipher = NULL;
916 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
920 const char *crypt_get_dir(void)
925 /////////////////////////////////
930 int crypt_init(struct crypt_device **cd, const char *device)
932 struct crypt_device *h = NULL;
937 log_dbg("Allocating crypt device %s context.", device);
939 if (!device_ready(NULL, device, O_RDONLY))
942 if (!(h = malloc(sizeof(struct crypt_device))))
945 memset(h, 0, sizeof(*h));
947 h->device = strdup(device);
953 if (!dm_init(h, 1) < 0) {
958 h->iteration_time = 1000;
959 h->password_verify = 0;
965 int crypt_init_by_name(struct crypt_device **cd, const char *name)
967 crypt_status_info ci;
971 log_dbg("Allocating crypt device context by device %s.", name);
973 ci = crypt_status(NULL, name);
975 log_err(NULL, _("Device %s is not active.\n"), name);
979 r = dm_query_device(name, &device, NULL, NULL, NULL,
980 NULL, NULL, NULL, NULL, NULL, NULL);
982 r = crypt_init(cd, device);
988 static int _crypt_format_plain(struct crypt_device *cd,
990 const char *cipher_mode,
992 struct crypt_params_plain *params)
994 if (!cipher || !cipher_mode || !params || !params->hash) {
995 log_err(cd, _("Invalid plain crypt parameters.\n"));
999 if (cd->volume_key->keyLength > 1024) {
1000 log_err(cd, _("Invalid key size.\n"));
1004 cd->plain_cipher = strdup(cipher);
1005 cd->plain_cipher_mode = strdup(cipher_mode);
1008 cd->plain_uuid = strdup(uuid);
1011 cd->plain_hdr.hash = strdup(params->hash);
1013 cd->plain_hdr.offset = params->offset;
1014 cd->plain_hdr.skip = params->skip;
1016 if ((params->hash && !cd->plain_hdr.hash) ||
1017 !cd->plain_cipher || !cd->plain_cipher_mode)
1023 static int _crypt_format_luks1(struct crypt_device *cd,
1025 const char *cipher_mode,
1027 struct crypt_params_luks1 *params)
1031 r = LUKS_generate_phdr(&cd->hdr, cd->volume_key, cipher, cipher_mode,
1032 (params && params->hash) ? params->hash : "sha1",
1034 params ? params->data_alignment: DEFAULT_ALIGNMENT, cd);
1038 /* Wipe first 8 sectors - fs magic numbers etc. */
1039 r = wipe_device_header(cd->device, 8);
1041 log_err(cd, _("Can't wipe header on device %s.\n"), cd->device);
1045 r = LUKS_write_phdr(cd->device, &cd->hdr, cd);
1050 int crypt_format(struct crypt_device *cd,
1053 const char *cipher_mode,
1055 const char *volume_key,
1056 size_t volume_key_size,
1061 log_dbg("Formatting device %s as type %s.", cd->device, cd->type ?: "(none)");
1067 cd->volume_key = LUKS_alloc_masterkey(volume_key_size,
1070 cd->volume_key = LUKS_generate_masterkey(volume_key_size);
1076 r = _crypt_format_plain(cd, cipher, cipher_mode,
1078 else if (isLUKS(type))
1079 r = _crypt_format_luks1(cd, cipher, cipher_mode,
1082 /* FIXME: allow plugins here? */
1083 log_err(cd, _("Unkown crypt device type %s requesed.\n"), type);
1087 if (!r && !(cd->type = strdup(type)))
1091 LUKS_dealloc_masterkey(cd->volume_key);
1092 cd->volume_key = NULL;
1098 int crypt_load(struct crypt_device *cd,
1099 const char *requested_type,
1102 struct luks_phdr hdr;
1105 log_dbg("Trying to load %s crypt type from device %s.",
1106 requested_type ?: "any", cd->device);
1108 if (requested_type && !isPLAIN(requested_type) && !isLUKS(requested_type))
1111 /* Some hash functions need initialized gcrypt library */
1112 if (init_crypto()) {
1113 log_err(cd, _("Cannot initialize crypto backend.\n"));
1117 r = LUKS_read_phdr(cd->device, &hdr, 0, cd);
1120 memcpy(&cd->hdr, &hdr, sizeof(hdr));
1121 cd->type = strdup(requested_type);
1129 void crypt_free(struct crypt_device *cd)
1132 log_dbg("Releasing crypt device %s context.", cd->device);
1136 LUKS_dealloc_masterkey(cd->volume_key);
1141 /* used in plain device only */
1142 free((char*)cd->plain_hdr.hash);
1143 free(cd->plain_cipher);
1144 free(cd->plain_cipher_mode);
1145 free(cd->plain_uuid);
1151 int crypt_suspend(struct crypt_device *cd,
1154 crypt_status_info ci;
1155 int r, suspended = 0;
1157 log_dbg("Suspending volume %s.", name);
1159 ci = crypt_status(NULL, name);
1161 log_err(cd, _("Volume %s is not active.\n"), name);
1165 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1166 NULL, NULL, NULL, NULL, &suspended, NULL);
1171 log_err(cd, _("Volume %s is already suspended.\n"), name);
1175 r = dm_suspend_and_wipe_key(name);
1177 log_err(cd, "Error during suspending device %s.\n", name);
1182 int crypt_resume_by_passphrase(struct crypt_device *cd,
1185 const char *passphrase,
1186 size_t passphrase_size)
1188 struct luks_masterkey *mk = NULL;
1189 int r, suspended = 0;
1191 log_dbg("Resuming volume %s.", name);
1193 if (!isLUKS(cd->type)) {
1194 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1199 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1200 NULL, NULL, NULL, NULL, &suspended, NULL);
1205 log_err(cd, _("Volume %s is not suspended.\n"), name);
1210 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1211 passphrase_size, &cd->hdr, &mk, cd);
1213 r = volume_key_by_terminal_passphrase(cd, keyslot, &mk);
1217 r = dm_resume_and_reinstate_key(name, mk->keyLength, mk->key);
1219 log_err(cd, "Error during resuming device %s.\n", name);
1223 LUKS_dealloc_masterkey(mk);
1224 return r < 0 ? r : keyslot;
1227 int crypt_resume_by_keyfile(struct crypt_device *cd,
1230 const char *keyfile,
1231 size_t keyfile_size)
1233 struct luks_masterkey *mk = NULL;
1234 char *passphrase_read = NULL;
1235 unsigned int passphrase_size_read;
1236 int r, suspended = 0;
1238 log_dbg("Resuming volume %s.", name);
1240 if (!isLUKS(cd->type)) {
1241 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1246 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1247 NULL, NULL, NULL, NULL, &suspended, NULL);
1252 log_err(cd, _("Volume %s is not suspended.\n"), name);
1259 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1260 &passphrase_size_read, keyfile, keyfile_size);
1262 if(!passphrase_read)
1265 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1266 passphrase_size_read, &cd->hdr, &mk, cd);
1267 safe_free(passphrase_read);
1272 r = dm_resume_and_reinstate_key(name, mk->keyLength, mk->key);
1274 log_err(cd, "Error during resuming device %s.\n", name);
1278 LUKS_dealloc_masterkey(mk);
1279 return r < 0 ? r : keyslot;
1282 // slot manipulation
1283 int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
1284 int keyslot, // -1 any
1285 const char *passphrase, // NULL -> terminal
1286 size_t passphrase_size,
1287 const char *new_passphrase, // NULL -> terminal
1288 size_t new_passphrase_size)
1290 struct luks_masterkey *mk = NULL;
1291 char *password = NULL, *new_password = NULL;
1292 unsigned int passwordLen, new_passwordLen;
1295 log_dbg("Adding new keyslot, existing passphrase %sprovided,"
1296 "new passphrase %sprovided.",
1297 passphrase ? "" : "not ", new_passphrase ? "" : "not ");
1299 if (!isLUKS(cd->type)) {
1300 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1304 r = keyslot_verify_or_find_empty(cd, &keyslot);
1308 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1309 /* No slots used, try to use pre-generated key in header */
1310 if (cd->volume_key) {
1311 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1312 r = mk ? 0 : -ENOMEM;
1314 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1317 } else if (passphrase) {
1318 /* Passphrase provided, use it to unlock existing keyslot */
1319 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, passphrase,
1320 passphrase_size, &cd->hdr, &mk, cd);
1322 /* Passphrase not provided, ask first and use it to unlock existing keyslot */
1323 key_from_terminal(cd, _("Enter any passphrase: "),
1324 &password, &passwordLen, 0);
1330 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
1331 passwordLen, &cd->hdr, &mk, cd);
1332 safe_free(password);
1338 if (new_passphrase) {
1339 new_password = (char *)new_passphrase;
1340 new_passwordLen = new_passphrase_size;
1342 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1343 &new_password, &new_passwordLen, 1);
1350 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1351 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1356 if (!new_passphrase)
1357 safe_free(new_password);
1358 LUKS_dealloc_masterkey(mk);
1359 return r ?: keyslot;
1362 int crypt_keyslot_add_by_keyfile(struct crypt_device *cd,
1364 const char *keyfile,
1365 size_t keyfile_size,
1366 const char *new_keyfile,
1367 size_t new_keyfile_size)
1369 struct luks_masterkey *mk=NULL;
1370 char *password=NULL; unsigned int passwordLen;
1371 char *new_password = NULL; unsigned int new_passwordLen;
1374 log_dbg("Adding new keyslot, existing keyfile %s, new keyfile %s.",
1375 keyfile ?: "[none]", new_keyfile ?: "[none]");
1377 if (!isLUKS(cd->type)) {
1378 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1382 r = keyslot_verify_or_find_empty(cd, &keyslot);
1386 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1387 /* No slots used, try to use pre-generated key in header */
1388 if (cd->volume_key) {
1389 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1390 r = mk ? 0 : -ENOMEM;
1392 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1396 /* Read password from file of (if NULL) from terminal */
1398 key_from_file(cd, _("Enter any passphrase: "), &password, &passwordLen,
1399 keyfile, keyfile_size);
1401 key_from_terminal(cd, _("Enter any passphrase: "),
1402 &password, &passwordLen, 1);
1407 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password, passwordLen,
1409 safe_free(password);
1416 key_from_file(cd, _("Enter new passphrase for key slot: "),
1417 &new_password, &new_passwordLen, new_keyfile,
1420 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1421 &new_password, &new_passwordLen, 1);
1428 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1429 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1431 safe_free(new_password);
1432 LUKS_dealloc_masterkey(mk);
1433 return r < 0 ? r : keyslot;
1436 int crypt_keyslot_add_by_volume_key(struct crypt_device *cd,
1438 const char *volume_key,
1439 size_t volume_key_size,
1440 const char *passphrase,
1441 size_t passphrase_size)
1443 struct luks_masterkey *mk = NULL;
1445 char *new_password = NULL; unsigned int new_passwordLen;
1447 log_dbg("Adding new keyslot %d using volume key.", keyslot);
1449 if (!isLUKS(cd->type)) {
1450 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1455 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1456 else if (cd->volume_key)
1457 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1462 r = LUKS_verify_master_key(&cd->hdr, mk);
1464 log_err(cd, _("Volume key does not match the volume.\n"));
1468 r = keyslot_verify_or_find_empty(cd, &keyslot);
1473 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1474 &new_password, &new_passwordLen, 1);
1475 passphrase = new_password;
1476 passphrase_size = new_passwordLen;
1479 r = LUKS_set_key(cd->device, keyslot, passphrase, passphrase_size,
1480 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1483 safe_free(new_password);
1484 LUKS_dealloc_masterkey(mk);
1485 return r ?: keyslot;
1488 int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot)
1490 crypt_keyslot_info ki;
1492 log_dbg("Destroying keyslot %d.", keyslot);
1494 if (!isLUKS(cd->type)) {
1495 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1499 ki = crypt_keyslot_status(cd, keyslot);
1500 if (ki == SLOT_INVALID) {
1501 log_err(cd, _("Key slot %d is invalid.\n"), keyslot);
1505 if (ki == SLOT_INACTIVE) {
1506 log_err(cd, _("Key slot %d is not used.\n"), keyslot);
1510 return LUKS_del_key(cd->device, keyslot, &cd->hdr, cd);
1513 // activation/deactivation of device mapping
1514 int crypt_activate_by_passphrase(struct crypt_device *cd,
1517 const char *passphrase,
1518 size_t passphrase_size,
1521 crypt_status_info ci;
1522 struct luks_masterkey *mk = NULL;
1523 char *prompt = NULL;
1526 log_dbg("%s volume %s [keyslot %d] using %spassphrase.",
1527 name ? "Activating" : "Checking", name ?: "",
1528 keyslot, passphrase ? "" : "[none] ");
1533 /* plain, use hashed passphrase */
1534 if (isPLAIN(cd->type))
1535 return create_device_helper(cd, name, cd->plain_hdr.hash,
1536 cd->plain_cipher, cd->plain_cipher_mode, NULL, passphrase, passphrase_size,
1537 cd->volume_key->keyLength, 0, cd->plain_hdr.skip,
1538 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1541 ci = crypt_status(NULL, name);
1544 else if (ci >= ACTIVE) {
1545 log_err(cd, _("Device %s already exists.\n"), name);
1550 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
1553 /* provided passphrase, do not retry */
1555 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1556 passphrase_size, &cd->hdr, &mk, cd);
1558 r = volume_key_by_terminal_passphrase(cd, keyslot, &mk);
1563 r = open_from_hdr_and_mk(cd, mk, name, flags);
1566 LUKS_dealloc_masterkey(mk);
1569 return r < 0 ? r : keyslot;
1572 int crypt_activate_by_keyfile(struct crypt_device *cd,
1575 const char *keyfile,
1576 size_t keyfile_size,
1579 crypt_status_info ci;
1580 struct luks_masterkey *mk = NULL;
1581 char *passphrase_read = NULL;
1582 unsigned int passphrase_size_read;
1585 log_dbg("Activating volume %s [keyslot %d] using keyfile %s.",
1586 name, keyslot, keyfile ?: "[none]");
1588 if (!isLUKS(cd->type)) {
1589 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1594 ci = crypt_status(NULL, name);
1597 else if (ci >= ACTIVE) {
1598 log_err(cd, _("Device %s already exists.\n"), name);
1606 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1607 &passphrase_size_read, keyfile, keyfile_size);
1608 if(!passphrase_read)
1611 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1612 passphrase_size_read, &cd->hdr, &mk, cd);
1613 safe_free(passphrase_read);
1618 r = open_from_hdr_and_mk(cd, mk, name, flags);
1621 LUKS_dealloc_masterkey(mk);
1623 return r < 0 ? r : keyslot;
1626 int crypt_activate_by_volume_key(struct crypt_device *cd,
1628 const char *volume_key,
1629 size_t volume_key_size,
1632 crypt_status_info ci;
1633 struct luks_masterkey *mk;
1636 log_dbg("Activating volume %s by volume key.", name);
1638 /* use key directly, no hash */
1639 if (isPLAIN(cd->type))
1640 return create_device_helper(cd, name, NULL,
1641 cd->plain_cipher, cd->plain_cipher_mode, NULL, volume_key, volume_key_size,
1642 cd->volume_key->keyLength, 0, cd->plain_hdr.skip,
1643 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1645 if (!isLUKS(cd->type)) {
1646 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1651 ci = crypt_status(NULL, name);
1654 else if (ci >= ACTIVE) {
1655 log_err(cd, _("Device %s already exists.\n"), name);
1660 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1663 r = LUKS_verify_master_key(&cd->hdr, mk);
1666 log_err(cd, _("Volume key does not match the volume.\n"));
1669 r = open_from_hdr_and_mk(cd, mk, name, flags);
1671 LUKS_dealloc_masterkey(mk);
1676 int crypt_deactivate(struct crypt_device *cd, const char *name)
1681 log_dbg("Deactivating volume %s.", name);
1683 switch (crypt_status(cd, name)) {
1684 case ACTIVE: return dm_remove_device(name, 0, 0);
1685 case BUSY: log_err(cd, _("Device %s is busy."), name);
1687 case INACTIVE: log_err(cd, _("Device %s is not active."), name);
1689 default: log_err(cd, _("Invalid device %s."), name);
1694 // misc helper functions
1695 int crypt_volume_key_get(struct crypt_device *cd,
1698 size_t *volume_key_size,
1699 const char *passphrase,
1700 size_t passphrase_size)
1702 struct luks_masterkey *mk;
1703 char *processed_key = NULL;
1706 key_len = crypt_get_volume_key_size(cd);
1707 if (key_len > *volume_key_size) {
1708 log_err(cd, _("Volume key buffer too small.\n"));
1712 if (isPLAIN(cd->type)) {
1713 processed_key = process_key(cd, cd->plain_hdr.hash, NULL, key_len,
1714 passphrase, passphrase_size);
1715 if (!processed_key) {
1716 log_err(cd, _("Cannot retrieve volume key for plain device.\n"));
1719 memcpy(volume_key, processed_key, key_len);
1720 *volume_key_size = key_len;
1721 safe_free(processed_key);
1725 if (isLUKS(cd->type)) {
1726 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1727 passphrase_size, &cd->hdr, &mk, cd);
1730 memcpy(volume_key, mk->key, mk->keyLength);
1731 *volume_key_size = mk->keyLength;
1734 LUKS_dealloc_masterkey(mk);
1738 log_err(cd, _("This operation is not supported for %s crypt device.\n"), cd->type ?: "(none)");
1742 int crypt_volume_key_verify(struct crypt_device *cd,
1743 const char *volume_key,
1744 size_t volume_key_size)
1746 struct luks_masterkey *mk;
1749 if (!isLUKS(cd->type)) {
1750 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1754 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1758 r = LUKS_verify_master_key(&cd->hdr, mk);
1761 log_err(cd, _("Volume key does not match the volume.\n"));
1763 LUKS_dealloc_masterkey(mk);
1768 void crypt_set_timeout(struct crypt_device *cd, uint64_t timeout_sec)
1770 log_dbg("Timeout set to %" PRIu64 " miliseconds.", timeout_sec);
1771 cd->timeout = timeout_sec;
1774 void crypt_set_password_retry(struct crypt_device *cd, int tries)
1776 log_dbg("Password retry count set to %d.", tries);
1780 void crypt_set_iterarion_time(struct crypt_device *cd, uint64_t iteration_time_ms)
1782 log_dbg("Iteration time set to %" PRIu64 " miliseconds.", iteration_time_ms);
1783 cd->iteration_time = iteration_time_ms;
1786 void crypt_set_password_verify(struct crypt_device *cd, int password_verify)
1788 log_dbg("Password verification %s.", password_verify ? "enabled" : "disabled");
1789 cd->password_verify = password_verify ? 1 : 0;
1792 int crypt_memory_lock(struct crypt_device *cd, int lock)
1794 return lock ? memlock_inc(cd) : memlock_dec(cd);
1798 crypt_status_info crypt_status(struct crypt_device *cd, const char *name)
1802 r = dm_status_device(name);
1804 if (r < 0 && r != -ENODEV)
1816 static void hexprintICB(struct crypt_device *cd, char *d, int n)
1819 for(i = 0; i < n; i++)
1820 log_std(cd, "%02hhx ", (char)d[i]);
1823 int crypt_dump(struct crypt_device *cd)
1826 if (!isLUKS(cd->type)) { //FIXME
1827 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1831 log_std(cd, "LUKS header information for %s\n\n", cd->device);
1832 log_std(cd, "Version: \t%d\n", cd->hdr.version);
1833 log_std(cd, "Cipher name: \t%s\n", cd->hdr.cipherName);
1834 log_std(cd, "Cipher mode: \t%s\n", cd->hdr.cipherMode);
1835 log_std(cd, "Hash spec: \t%s\n", cd->hdr.hashSpec);
1836 log_std(cd, "Payload offset:\t%d\n", cd->hdr.payloadOffset);
1837 log_std(cd, "MK bits: \t%d\n", cd->hdr.keyBytes * 8);
1838 log_std(cd, "MK digest: \t");
1839 hexprintICB(cd, cd->hdr.mkDigest, LUKS_DIGESTSIZE);
1841 log_std(cd, "MK salt: \t");
1842 hexprintICB(cd, cd->hdr.mkDigestSalt, LUKS_SALTSIZE/2);
1843 log_std(cd, "\n \t");
1844 hexprintICB(cd, cd->hdr.mkDigestSalt+LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1846 log_std(cd, "MK iterations: \t%d\n", cd->hdr.mkDigestIterations);
1847 log_std(cd, "UUID: \t%s\n\n", cd->hdr.uuid);
1848 for(i = 0; i < LUKS_NUMKEYS; i++) {
1849 if(cd->hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
1850 log_std(cd, "Key Slot %d: ENABLED\n",i);
1851 log_std(cd, "\tIterations: \t%d\n",
1852 cd->hdr.keyblock[i].passwordIterations);
1853 log_std(cd, "\tSalt: \t");
1854 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt,
1856 log_std(cd, "\n\t \t");
1857 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt +
1858 LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1861 log_std(cd, "\tKey material offset:\t%d\n",
1862 cd->hdr.keyblock[i].keyMaterialOffset);
1863 log_std(cd, "\tAF stripes: \t%d\n",
1864 cd->hdr.keyblock[i].stripes);
1867 log_std(cd, "Key Slot %d: DISABLED\n", i);
1872 const char *crypt_get_cipher(struct crypt_device *cd)
1874 if (isPLAIN(cd->type))
1875 return cd->plain_cipher;
1877 if (isLUKS(cd->type))
1878 return cd->hdr.cipherName;
1883 const char *crypt_get_cipher_mode(struct crypt_device *cd)
1885 if (isPLAIN(cd->type))
1886 return cd->plain_cipher_mode;
1888 if (isLUKS(cd->type))
1889 return cd->hdr.cipherMode;
1894 const char *crypt_get_uuid(struct crypt_device *cd)
1896 if (isLUKS(cd->type))
1897 return cd->hdr.uuid;
1902 int crypt_get_volume_key_size(struct crypt_device *cd)
1904 if (isPLAIN(cd->type))
1905 return cd->volume_key->keyLength;
1907 if (isLUKS(cd->type))
1908 return cd->hdr.keyBytes;
1913 uint64_t crypt_get_data_offset(struct crypt_device *cd)
1915 if (isPLAIN(cd->type))
1916 return cd->plain_hdr.offset;
1918 if (isLUKS(cd->type))
1919 return cd->hdr.payloadOffset;
1924 crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot)
1926 if (!isLUKS(cd->type)) {
1927 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1928 return SLOT_INVALID;
1931 return LUKS_keyslot_info(&cd->hdr, keyslot);