lib/setup.c

   1 #include <string.h>
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <stdarg.h>
   5 #include <fcntl.h>
   6 #include <errno.h>
   7
   8 #include "libcryptsetup.h"
   9 #include "luks.h"
  10 #include "internal.h"
  11
  12 struct crypt_device {
  13         /* callbacks definitions */
  14         void (*log)(int class, const char *msg, void *usrptr);
  15         void *log_usrptr;
  16 };
  17
  18 /* Log helper */
  19 static void (*_default_log)(int class, char *msg) = NULL;
  20 static int _debug_level = 0;
  21
  22 void crypt_set_debug_level(int level)
  23 {
  24         _debug_level = level;
  25 }
  26
  27 void set_default_log(void (*log)(int class, char *msg))
  28 {
  29         _default_log = log;
  30 }
  31
  32 void logger(struct crypt_device *cd, int class, const char *file,
  33             int line, const char *format, ...)
  34 {
  35         va_list argp;
  36         char *target = NULL;
  37
  38         va_start(argp, format);
  39
  40         if (vasprintf(&target, format, argp) > 0) {
  41                 if (class >= 0) {
  42                         if (cd && cd->log)
  43                                 cd->log(class, target, cd->log_usrptr);
  44                         else if (_default_log)
  45                                 _default_log(class, target);
  46 #ifdef CRYPT_DEBUG
  47                 } else if (_debug_level)
  48                         printf("# %s:%d %s\n", file ?: "?", line, target);
  49 #else
  50                 } else if (_debug_level)
  51                         printf("# %s\n", target);
  52 #endif
  53         }
  54
  55         va_end(argp);
  56         free(target);
  57 }
  58
  59 static void hexprintICB(struct crypt_device *cd, char *d, int n)
  60 {
  61         int i;
  62         for(i = 0; i < n; i++)
  63                 log_std(cd, "%02hhx ", (char)d[i]);
  64 }
  65
  66 /*
  67  * Password processing behaviour matrix of process_key
  68  *
  69  * from binary file: check if there is sufficently large key material
  70  * interactive & from fd: hash if requested, otherwise crop or pad with '0'
  71  */
  72 static char *process_key(struct crypt_device *cd,
  73                          struct crypt_options *options,
  74                          const char *pass, size_t passLen)
  75 {
  76         char *key = safe_alloc(options->key_size);
  77         memset(key, 0, options->key_size);
  78
  79         /* key is coming from binary file */
  80         if (options->key_file && strcmp(options->key_file, "-")) {
  81                 if(passLen < options->key_size) {
  82                         log_err(cd, _("Cannot not read %d bytes from key file %s.\n"),
  83                                 options->key_size, options->key_file);
  84                         safe_free(key);
  85                         return NULL;
  86                 }
  87                 memcpy(key,pass,options->key_size);
  88                 return key;
  89         }
  90
  91         /* key is coming from tty, fd or binary stdin */
  92         if (options->hash) {
  93                 if (hash(NULL, options->hash,
  94                          key, options->key_size,
  95                          pass, passLen) < 0)
  96                 {
  97                         log_err(cd, _("Key processing error.\n"));
  98                         safe_free(key);
  99                         return NULL;
 100                 }
 101         } else if (passLen > options->key_size) {
 102                 memcpy(key, pass, options->key_size);
 103         } else {
 104                 memcpy(key, pass, passLen);
 105         }
 106
 107         return key;
 108 }
 109
 110 int parse_into_name_and_mode(const char *nameAndMode, char *name, char *mode)
 111 {
 112 /* Token content stringification, see info cpp/stringification */
 113 #define str(s) #s
 114 #define xstr(s) str(s)
 115 #define scanpattern1 "%" xstr(LUKS_CIPHERNAME_L) "[^-]-%" xstr(LUKS_CIPHERMODE_L)  "s"
 116 #define scanpattern2 "%" xstr(LUKS_CIPHERNAME_L) "[^-]"
 117
 118         int r;
 119
 120         if(sscanf(nameAndMode,scanpattern1, name, mode) != 2) {
 121                 if((r = sscanf(nameAndMode,scanpattern2,name)) == 1)
 122                         strncpy(mode,"cbc-plain",10);
 123                 else
 124                         return -EINVAL;
 125         }
 126
 127         return 0;
 128
 129 #undef scanpattern1
 130 #undef scanpattern2
 131 #undef str
 132 #undef xstr
 133 }
 134
 135 static int keyslot_is_valid(struct crypt_device *cd, int keySlotIndex)
 136 {
 137         if(keySlotIndex >= LUKS_NUMKEYS || keySlotIndex < 0) {
 138                         log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
 139                                 keySlotIndex, LUKS_NUMKEYS - 1);
 140                 return 0;
 141         }
 142
 143         return 1;
 144 }
 145
 146 /* Select free keyslot or verifies that the one specified is empty */
 147 static int keyslot_from_option(struct crypt_device *cd, int keySlotOption, struct luks_phdr *hdr) {
 148         if(keySlotOption >= 0) {
 149                 if(!keyslot_is_valid(cd, keySlotOption))
 150                         return -EINVAL;
 151                 else if(hdr->keyblock[keySlotOption].active != LUKS_KEY_DISABLED) {
 152                         log_err(cd, _("Key slot %d is full, please select another one.\n"),
 153                                 keySlotOption);
 154                         return -EINVAL;
 155                 } else {
 156                         return keySlotOption;
 157                 }
 158         } else {
 159                 int i;
 160                 /* Find empty key slot */
 161                 for(i=0; i<LUKS_NUMKEYS; i++) {
 162                         if(hdr->keyblock[i].active == LUKS_KEY_DISABLED) break;
 163                 }
 164                 if(i==LUKS_NUMKEYS) {
 165                         log_err(cd, _("All key slots full.\n"));
 166                         return -EINVAL;
 167                 }
 168                 return i;
 169         }
 170 }
 171
 172 static int create_device_helper(int reload, struct crypt_options *options)
 173 {
 174         struct crypt_device *cd = NULL;
 175         struct device_infos infos;
 176         char *key = NULL;
 177         unsigned int keyLen;
 178         char *processed_key = NULL;
 179         int r;
 180
 181         r = dm_status_device(options->name);
 182         if (reload) {
 183                 if (r < 0)
 184                         return r;
 185         } else {
 186                 if (r >= 0) {
 187                         log_err(cd, _("Device %s already exists.\n"), options->name);
 188                         return -EEXIST;
 189                 }
 190                 if (r != -ENODEV)
 191                         return r;
 192         }
 193
 194         if (options->key_size < 0 || options->key_size > 1024) {
 195                 log_err(cd, _("Invalid key size %d.\n"), options->key_size);
 196                 return -EINVAL;
 197         }
 198
 199         if (get_device_infos(options->device, &infos, cd) < 0)
 200                 return -ENOTBLK;
 201
 202         if (!options->size) {
 203                 options->size = infos.size;
 204                 if (!options->size) {
 205                         log_err(cd, "Not a block device");
 206                         return -ENOTBLK;
 207                 }
 208                 if (options->size <= options->offset) {
 209                         log_err(cd, "Invalid offset");
 210                         return -EINVAL;
 211                 }
 212                 options->size -= options->offset;
 213         }
 214
 215         if (infos.readonly)
 216                 options->flags |= CRYPT_FLAG_READONLY;
 217
 218         get_key("Enter passphrase: ", &key, &keyLen, options->key_size,
 219                 options->key_file, options->timeout, options->flags, NULL);
 220         if (!key) {
 221                 log_err(cd, "Key reading error");
 222                 return -ENOENT;
 223         }
 224
 225         processed_key = process_key(cd, options, key, keyLen);
 226         safe_free(key);
 227
 228         if (!processed_key)
 229                 return -ENOENT;
 230
 231         r = dm_create_device(options->name, options->device, options->cipher,
 232                              NULL, options->size, options->skip, options->offset,
 233                              options->key_size, processed_key,
 234                              options->flags & CRYPT_FLAG_READONLY, reload);
 235
 236         safe_free(processed_key);
 237
 238         return r;
 239 }
 240
 241 static int luks_remove_helper(struct crypt_device *cd,
 242                               struct crypt_options *options, int supply_it)
 243 {
 244         struct luks_masterkey *mk;
 245         struct luks_phdr hdr;
 246         char *password=NULL;
 247         unsigned int passwordLen;
 248         const char *device = options->device;
 249         int keyIndex;
 250         int openedIndex;
 251         int r, last_slot;
 252
 253         r = LUKS_read_phdr(options->device, &hdr, 1, cd);
 254         if(r < 0)
 255                 return r;
 256
 257         if(supply_it) {
 258                 get_key("Enter LUKS passphrase to be deleted: ",&password,&passwordLen, 0, options->new_key_file,
 259                         options->timeout, options->flags, cd);
 260                 if(!password) {
 261                         r = -EINVAL; goto out;
 262                 }
 263
 264                 keyIndex = LUKS_open_key_with_hdr(device, CRYPT_ANY_SLOT, password, passwordLen, &hdr, &mk, cd);
 265                 if(keyIndex < 0) {
 266                         log_err(cd, "No remaining key available with this passphrase.\n");
 267                         r = -EPERM; goto out;
 268                 } else
 269                         log_std(cd ,"key slot %d selected for deletion.\n", keyIndex);
 270
 271                 safe_free(password);
 272                 password = NULL;
 273         } else {
 274                 keyIndex = options->key_slot;
 275                 if (!keyslot_is_valid(cd, keyIndex)) {
 276                         r = -EINVAL; goto out;
 277                 }
 278         }
 279
 280         if (LUKS_keyslot_info(&hdr, keyIndex) == SLOT_INACTIVE) {
 281                 log_err(cd, _("Key %d not active. Can't wipe.\n"), keyIndex);
 282                 r = -EINVAL;
 283                 goto out;
 284         }
 285
 286         last_slot = (LUKS_keyslot_info(&hdr, keyIndex) == SLOT_ACTIVE_LAST);
 287         if(last_slot && !(options->icb->yesDialog(_("This is the last keyslot. Device will become unusable after purging this key.")))) {
 288                 r = -EINVAL; goto out;
 289         }
 290
 291         if(options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY) {
 292                 options->flags &= ~CRYPT_FLAG_VERIFY_ON_DELKEY;
 293                 get_key("Enter any remaining LUKS passphrase: ",&password,&passwordLen, 0, options->key_file,
 294                         options->timeout, options->flags, cd);
 295                 if(!password) {
 296                         r = -EINVAL; goto out;
 297                 }
 298
 299                 r = LUKS_read_phdr(device, &hdr, 1, cd);
 300                 if(r < 0) {
 301                         options->icb->log(CRYPT_LOG_ERROR,"Failed to access device.\n");
 302                         r = -EIO; goto out;
 303                 }
 304
 305                 if(!last_slot)
 306                         hdr.keyblock[keyIndex].active = LUKS_KEY_DISABLED;
 307
 308                 openedIndex = LUKS_open_key_with_hdr(device, CRYPT_ANY_SLOT, password, passwordLen, &hdr, &mk, cd);
 309                 /* Clean up */
 310                 if (openedIndex >= 0) {
 311                         LUKS_dealloc_masterkey(mk);
 312                         mk = NULL;
 313                 }
 314                 if(openedIndex < 0) {
 315                             log_err(cd, "No remaining key available with this passphrase.\n");
 316                             r = -EPERM; goto out;
 317                 } else
 318                         log_std(cd, "key slot %d verified.\n", openedIndex);
 319         }
 320         r = LUKS_del_key(device, keyIndex, cd);
 321         if(r < 0) goto out;
 322
 323         r = 0;
 324 out:
 325         safe_free(password);
 326         return r;
 327 }
 328
 329 /* OPTIONS: name, cipher, device, hash, key_file, key_size, key_slot,
 330  *          offset, size, skip, timeout, tries, passphrase_fd (ignored),
 331  *          flags, icb */
 332 int crypt_create_device(struct crypt_options *options)
 333 {
 334         return create_device_helper(0, options);
 335 }
 336
 337 /* OPTIONS: same as create above */
 338 int crypt_update_device(struct crypt_options *options)
 339 {
 340         return create_device_helper(1, options);
 341 }
 342
 343 /* OPTIONS: name, size, icb */
 344 int crypt_resize_device(struct crypt_options *options)
 345 {
 346         struct crypt_device *cd = NULL;
 347         char *device, *cipher, *key = NULL;
 348         uint64_t size, skip, offset;
 349         int key_size, read_only, r;
 350         struct device_infos infos;
 351
 352         r = dm_query_device(options->name, &device, &size, &skip, &offset,
 353                             &cipher, &key_size, &key, &read_only);
 354         if (r < 0)
 355                 return r;
 356
 357         if (get_device_infos(device, &infos, cd) < 0)
 358                 return -EINVAL;
 359
 360         if (!options->size) {
 361                 options->size = infos.size;
 362                 if (!options->size) {
 363                         log_err(cd, "Not a block device");
 364                         return -ENOTBLK;
 365                 }
 366                 if (options->size <= offset) {
 367                         log_err(cd, "Invalid offset");
 368                         return -EINVAL;
 369                 }
 370                 options->size -= offset;
 371         }
 372         size = options->size;
 373
 374         if (infos.readonly)
 375                 options->flags |= CRYPT_FLAG_READONLY;
 376
 377         r = dm_create_device(options->name, device, cipher, NULL, size, skip, offset,
 378                              key_size, key, read_only, 1);
 379
 380         safe_free(key);
 381         free(cipher);
 382         free(device);
 383
 384         return r;
 385 }
 386
 387 /* OPTIONS: name, icb */
 388 int crypt_query_device(struct crypt_options *options)
 389 {
 390         int read_only, r;
 391
 392         r = dm_status_device(options->name);
 393         if (r == -ENODEV)
 394                 return 0;
 395
 396         r = dm_query_device(options->name, (char **)&options->device, &options->size,
 397                             &options->skip, &options->offset, (char **)&options->cipher,
 398                             &options->key_size, NULL, &read_only);
 399
 400         if (r < 0)
 401                 return r;
 402
 403         if (read_only)
 404                 options->flags |= CRYPT_FLAG_READONLY;
 405
 406         options->flags |= CRYPT_FLAG_FREE_DEVICE;
 407         options->flags |= CRYPT_FLAG_FREE_CIPHER;
 408
 409         return 1;
 410 }
 411
 412 /* OPTIONS: name, icb */
 413 int crypt_remove_device(struct crypt_options *options)
 414 {
 415         int r;
 416
 417         r = dm_status_device(options->name);
 418         if (r < 0)
 419                 return r;
 420         if (r > 0) {
 421                 log_err(NULL, "Device busy");
 422                 return -EBUSY;
 423         }
 424
 425         return dm_remove_device(options->name, 0, 0);
 426 }
 427
 428 /* OPTIONS: device, cipher, hash, align_payload, key_size (master key), key_slot
 429  *          new_key_file, iteration_time, timeout, flags, icb */
 430 int crypt_luksFormat(struct crypt_options *options)
 431 {
 432         struct crypt_device *cd = NULL;
 433         struct luks_phdr header;
 434         struct luks_masterkey *mk=NULL;
 435         char *password=NULL;
 436         char cipherName[LUKS_CIPHERNAME_L];
 437         char cipherMode[LUKS_CIPHERMODE_L];
 438         unsigned int passwordLen;
 439         uint64_t PBKDF2perSecond = 0;
 440         int r, keyIndex;
 441
 442         if (!device_ready(cd, options->device, O_RDWR | O_EXCL))
 443                 return -ENOTBLK;
 444
 445         mk = LUKS_generate_masterkey(options->key_size);
 446         if(NULL == mk) return -ENOMEM; // FIXME This may be misleading, since we don't know what went wrong
 447
 448 #ifdef LUKS_DEBUG
 449 #define printoffset(entry) \
 450         logger(options, CRYPT_LOG_ERROR, \
 451                 "offset of " #entry " = %d\n", (char *)(&header.entry)-(char *)(&header))
 452
 453         log_err("sizeof phdr %d, sizeof key slot %d\n",
 454                 sizeof(struct luks_phdr),
 455                 sizeof(header.keyblock[0]));
 456
 457         printoffset(magic);
 458         printoffset(version);
 459         printoffset(cipherName);
 460         printoffset(cipherMode);
 461         printoffset(hashSpec);
 462         printoffset(payloadOffset);
 463         printoffset(keyBytes);
 464         printoffset(mkDigest);
 465         printoffset(mkDigestSalt);
 466         printoffset(mkDigestIterations);
 467         printoffset(uuid);
 468 #endif
 469
 470         r = parse_into_name_and_mode(options->cipher, cipherName, cipherMode);
 471         if(r < 0) {
 472                 log_err(cd, _("No known cipher specification pattern detected.\n"));
 473                 return r;
 474         }
 475
 476         r = LUKS_generate_phdr(&header, mk, cipherName, cipherMode, options->hash, NULL, LUKS_STRIPES, options->align_payload, NULL);
 477         if(r < 0) return r;
 478
 479         keyIndex = keyslot_from_option(NULL, options->key_slot, &header);
 480         if(keyIndex == -EINVAL) {
 481                 r = -EINVAL; goto out;
 482         }
 483
 484         get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->new_key_file,
 485                 options->timeout, options->flags, NULL);
 486         if(!password) {
 487                 r = -EINVAL; goto out;
 488         }
 489
 490         /* Wipe first 8 sectors - fs magic numbers etc. */
 491         r = wipe_device_header(options->device, 8);
 492         if(r < 0) goto out;
 493
 494         /* Set key, also writes phdr */
 495         r = LUKS_set_key(options->device, keyIndex, password, passwordLen, &header, mk,
 496                          options->iteration_time, &PBKDF2perSecond, NULL);
 497         if(r < 0) goto out;
 498
 499         r = 0;
 500 out:
 501         LUKS_dealloc_masterkey(mk);
 502         safe_free(password);
 503         return r;
 504 }
 505
 506 /* OPTIONS: name, device, key_size, key_file, timeout, tries, flags, icb */
 507 int crypt_luksOpen(struct crypt_options *options)
 508 {
 509         struct crypt_device *cd = NULL;
 510         struct luks_masterkey *mk=NULL;
 511         struct luks_phdr hdr;
 512         char *prompt = NULL;
 513         char *password;
 514         unsigned int passwordLen;
 515         struct device_infos infos;
 516         char *dmCipherSpec = NULL;
 517         int r, tries = options->tries;
 518         int excl = (options->flags & CRYPT_FLAG_NON_EXCLUSIVE_ACCESS) ? 0 : O_EXCL ;
 519
 520         r = dm_status_device(options->name);
 521         if (r >= 0) {
 522                 log_err(cd, "Device %s already exists.", options->name);
 523                 return -EEXIST;
 524         }
 525
 526         if (!device_ready(cd, options->device, O_RDONLY | excl))
 527                 return -ENOTBLK;
 528
 529         if (get_device_infos(options->device, &infos, cd) < 0) {
 530                 log_err(cd, "Can't get device information.\n");
 531                 return -ENOTBLK;
 532         }
 533
 534         if (infos.readonly)
 535                 options->flags |= CRYPT_FLAG_READONLY;
 536
 537         if(asprintf(&prompt, "Enter LUKS passphrase for %s: ", options->device) < 0)
 538                 return -ENOMEM;
 539
 540 start:
 541         mk=NULL;
 542
 543         if(options->passphrase) {
 544                 passwordLen = strlen(options->passphrase);
 545                 password = safe_alloc(passwordLen + 1);
 546                 strncpy(password, options->passphrase, passwordLen + 1);
 547                 tries = 0;
 548         } else {
 549                 get_key(prompt, &password, &passwordLen, options->key_size, options->key_file,
 550                         options->timeout, options->flags, cd);
 551                 if (password)
 552                         tries--;
 553                 else
 554                         tries = 0;
 555         }
 556
 557         if(!password) {
 558                 r = -EINVAL; goto out;
 559         }
 560
 561         r = LUKS_read_phdr(options->device, &hdr, 1, cd);
 562         if(r < 0)
 563                 return r;
 564
 565         r = LUKS_open_key_with_hdr(options->device, CRYPT_ANY_SLOT, password, passwordLen, &hdr, &mk, cd);
 566         if (r == -EPERM)
 567                 log_err(cd, "No key available with this passphrase.\n");
 568         if (r < 0)
 569                 goto out1;
 570
 571         log_err(NULL, "key slot %d unlocked.\n", r);
 572
 573
 574         options->offset = hdr.payloadOffset;
 575         if (asprintf(&dmCipherSpec, "%s-%s", hdr.cipherName, hdr.cipherMode) < 0) {
 576                 r = -ENOMEM;
 577                 goto out2;
 578         }
 579         options->cipher = dmCipherSpec;
 580         options->key_size = mk->keyLength;
 581         options->skip = 0;
 582
 583         options->size = infos.size;
 584         if (!options->size) {
 585                 log_err(cd, "Not a block device.\n");
 586                 r = -ENOTBLK; goto out2;
 587         }
 588         if (options->size <= options->offset) {
 589                 log_err(cd, "Invalid offset");
 590                 r = -EINVAL; goto out2;
 591         }
 592         options->size -= options->offset;
 593         /* FIXME: code allows multiple crypt mapping, cannot use uuid then.
 594          * anyway, it is dangerous and can corrupt data. Remove it in next version! */
 595         r = dm_create_device(options->name, options->device, options->cipher,
 596                              excl ? hdr.uuid : NULL, options->size,
 597                              0, options->offset, mk->keyLength, mk->key,
 598                              options->flags & CRYPT_FLAG_READONLY, 0);
 599
 600  out2:
 601         free(dmCipherSpec);
 602         dmCipherSpec = NULL;
 603  out1:
 604         safe_free(password);
 605  out:
 606         LUKS_dealloc_masterkey(mk);
 607         if (r == -EPERM && tries > 0)
 608                 goto start;
 609
 610         free(prompt);
 611
 612         return r;
 613 }
 614
 615 /* OPTIONS: device, keys_slot, key_file, timeout, flags, icb */
 616 int crypt_luksKillSlot(struct crypt_options *options)
 617 {
 618         return luks_remove_helper(NULL, options, 0);
 619 }
 620
 621 /* OPTIONS: device, new_key_file, key_file, timeout, flags, icb */
 622 int crypt_luksRemoveKey(struct crypt_options *options)
 623 {
 624         return luks_remove_helper(NULL, options, 1);
 625 }
 626
 627 /* OPTIONS: device, new_key_file, key_file, key_slot, flags,
 628             iteration_time, timeout, icb */
 629 int crypt_luksAddKey(struct crypt_options *options)
 630 {
 631         struct crypt_device *cd = NULL;
 632         struct luks_masterkey *mk=NULL;
 633         struct luks_phdr hdr;
 634         char *password=NULL; unsigned int passwordLen;
 635         unsigned int keyIndex;
 636         uint64_t PBKDF2perSecond = 0;
 637         const char *device = options->device;
 638         int r;
 639
 640         if (!device_ready(cd, options->device, O_RDWR))
 641                 return -ENOTBLK;
 642
 643         r = LUKS_read_phdr(device, &hdr, 1, cd);
 644         if(r < 0) return r;
 645
 646
 647         keyIndex = keyslot_from_option(cd, options->key_slot, &hdr);
 648         if(keyIndex == -EINVAL) {
 649                 r = -EINVAL; goto out;
 650         }
 651
 652         get_key("Enter any LUKS passphrase: ",
 653                 &password,
 654                 &passwordLen,
 655                 0,
 656                 options->key_file,
 657                 options->timeout,
 658                 options->flags & ~(CRYPT_FLAG_VERIFY | CRYPT_FLAG_VERIFY_IF_POSSIBLE), cd);
 659
 660         if(!password) {
 661                 r = -EINVAL; goto out;
 662         }
 663         r = LUKS_open_key_with_hdr(device, CRYPT_ANY_SLOT, password, passwordLen, &hdr, &mk, cd);
 664         if(r < 0) {
 665                 options->icb->log(CRYPT_LOG_ERROR,"No key available with this passphrase.\n");
 666                 r = -EPERM; goto out;
 667         }
 668         safe_free(password);
 669
 670         get_key("Enter new passphrase for key slot: ",
 671                 &password,
 672                 &passwordLen,
 673                 0,
 674                 options->new_key_file,
 675                 options->timeout,
 676                 options->flags, cd);
 677         if(!password) {
 678                 r = -EINVAL; goto out;
 679         }
 680
 681         r = LUKS_set_key(device, keyIndex, password, passwordLen, &hdr, mk, options->iteration_time, &PBKDF2perSecond, cd);
 682         if(r < 0) goto out;
 683
 684         r = 0;
 685 out:
 686         safe_free(password);
 687         LUKS_dealloc_masterkey(mk);
 688         return r;
 689 }
 690
 691 /* OPTIONS: device, icb */
 692 int crypt_luksUUID(struct crypt_options *options)
 693 {
 694         struct crypt_device *cd = NULL;
 695         struct luks_phdr hdr;
 696         int r;
 697
 698         r = LUKS_read_phdr(options->device, &hdr, 1, cd);
 699         if(r < 0) return r;
 700
 701         options->icb->log(CRYPT_LOG_NORMAL,hdr.uuid);
 702         options->icb->log(CRYPT_LOG_NORMAL,"\n");
 703         return 0;
 704 }
 705
 706 /* OPTIONS: device, icb */
 707 int crypt_isLuks(struct crypt_options *options)
 708 {
 709         struct crypt_device *cd = NULL;
 710         struct luks_phdr hdr;
 711         return LUKS_read_phdr(options->device, &hdr, 0, cd);
 712 }
 713
 714 /* OPTIONS: device, icb */
 715 int crypt_luksDump(struct crypt_options *options)
 716 {
 717         struct crypt_device *cd = NULL;
 718         struct luks_phdr hdr;
 719         int r,i;
 720
 721         r = LUKS_read_phdr(options->device, &hdr, 1, cd);
 722         if(r < 0) return r;
 723
 724         log_std(cd, "LUKS header information for %s\n\n", options->device);
 725         log_std(cd, "Version:       \t%d\n", hdr.version);
 726         log_std(cd, "Cipher name:   \t%s\n", hdr.cipherName);
 727         log_std(cd, "Cipher mode:   \t%s\n", hdr.cipherMode);
 728         log_std(cd, "Hash spec:     \t%s\n", hdr.hashSpec);
 729         log_std(cd, "Payload offset:\t%d\n", hdr.payloadOffset);
 730         log_std(cd, "MK bits:       \t%d\n", hdr.keyBytes * 8);
 731         log_std(cd, "MK digest:     \t");
 732         hexprintICB(cd, hdr.mkDigest, LUKS_DIGESTSIZE);
 733         log_std(cd, "\n");
 734         log_std(cd, "MK salt:       \t");
 735         hexprintICB(cd, hdr.mkDigestSalt, LUKS_SALTSIZE/2);
 736         log_std(cd, "\n               \t");
 737         hexprintICB(cd, hdr.mkDigestSalt+LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
 738         log_std(cd, "\n");
 739         log_std(cd, "MK iterations: \t%d\n", hdr.mkDigestIterations);
 740         log_std(cd, "UUID:          \t%s\n\n", hdr.uuid);
 741         for(i = 0; i < LUKS_NUMKEYS; i++) {
 742                 if(hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
 743                         log_std(cd, "Key Slot %d: ENABLED\n",i);
 744                         log_std(cd, "\tIterations:         \t%d\n",
 745                                 hdr.keyblock[i].passwordIterations);
 746                         log_std(cd, "\tSalt:               \t");
 747                         hexprintICB(cd, hdr.keyblock[i].passwordSalt,
 748                                     LUKS_SALTSIZE/2);
 749                         log_std(cd, "\n\t                      \t");
 750                         hexprintICB(cd, hdr.keyblock[i].passwordSalt +
 751                                     LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
 752                         log_std(cd, "\n");
 753
 754                         log_std(cd, "\tKey material offset:\t%d\n",
 755                                 hdr.keyblock[i].keyMaterialOffset);
 756                         log_std(cd, "\tAF stripes:            \t%d\n",
 757                                 hdr.keyblock[i].stripes);
 758                 }
 759                 else
 760                         log_std(cd, "Key Slot %d: DISABLED\n", i);
 761         }
 762         return 0;
 763 }
 764
 765 void crypt_get_error(char *buf, size_t size)
 766 {
 767         const char *error = get_error();
 768
 769         if (!buf || size < 1)
 770                 set_error(NULL);
 771         else if (error) {
 772                 strncpy(buf, error, size - 1);
 773                 buf[size - 1] = '\0';
 774                 set_error(NULL);
 775         } else
 776                 buf[0] = '\0';
 777 }
 778
 779 void crypt_put_options(struct crypt_options *options)
 780 {
 781         if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
 782                 free((char *)options->device);
 783                 options->device = NULL;
 784                 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
 785         }
 786         if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
 787                 free((char *)options->cipher);
 788                 options->cipher = NULL;
 789                 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
 790         }
 791 }
 792
 793 const char *crypt_get_dir(void)
 794 {
 795         return dm_get_dir();
 796 }