8 #include "libcryptsetup.h"
16 struct luks_masterkey *volume_key;
18 uint64_t iteration_time;
22 /* used in CRYPT_LUKS1 */
24 uint64_t PBKDF2_per_sec;
26 /* used in CRYPT_PLAIN */
27 struct crypt_params_plain plain_hdr;
29 char *plain_cipher_mode;
32 /* callbacks definitions */
33 void (*log)(int class, const char *msg, void *usrptr);
35 int (*confirm)(const char *msg, void *usrptr);
37 int (*password)(const char *msg, char *buf, size_t length, void *usrptr);
38 void *password_usrptr;
42 static void (*_default_log)(int class, char *msg) = NULL;
43 static int _debug_level = 0;
45 void crypt_set_debug_level(int level)
50 void set_default_log(void (*log)(int class, char *msg))
55 void logger(struct crypt_device *cd, int class, const char *file,
56 int line, const char *format, ...)
61 va_start(argp, format);
63 if (vasprintf(&target, format, argp) > 0) {
66 cd->log(class, target, cd->log_usrptr);
67 else if (_default_log)
68 _default_log(class, target);
70 } else if (_debug_level)
71 printf("# %s:%d %s\n", file ?: "?", line, target);
73 } else if (_debug_level)
74 printf("# %s\n", target);
83 * Password processing behaviour matrix of process_key
85 * from binary file: check if there is sufficently large key material
86 * interactive & from fd: hash if requested, otherwise crop or pad with '0'
88 static char *process_key(struct crypt_device *cd, const char *hash_name,
89 const char *key_file, size_t key_size,
90 const char *pass, size_t passLen)
92 char *key = safe_alloc(key_size);
93 memset(key, 0, key_size);
95 /* key is coming from binary file */
96 if (key_file && strcmp(key_file, "-")) {
97 if(passLen < key_size) {
98 log_err(cd, _("Cannot not read %d bytes from key file %s.\n"),
103 memcpy(key, pass, key_size);
107 /* key is coming from tty, fd or binary stdin */
109 if (hash(NULL, hash_name, key, key_size, pass, passLen) < 0) {
110 log_err(cd, _("Key processing error.\n"));
114 } else if (passLen > key_size) {
115 memcpy(key, pass, key_size);
117 memcpy(key, pass, passLen);
123 int parse_into_name_and_mode(const char *nameAndMode, char *name, char *mode)
125 /* Token content stringification, see info cpp/stringification */
127 #define xstr(s) str(s)
128 #define scanpattern1 "%" xstr(LUKS_CIPHERNAME_L) "[^-]-%" xstr(LUKS_CIPHERMODE_L) "s"
129 #define scanpattern2 "%" xstr(LUKS_CIPHERNAME_L) "[^-]"
133 if(sscanf(nameAndMode,scanpattern1, name, mode) != 2) {
134 if((r = sscanf(nameAndMode,scanpattern2,name)) == 1)
135 strncpy(mode,"cbc-plain",10);
148 static int isPLAIN(const char *type)
150 return (type && !strcmp(CRYPT_PLAIN, type));
153 static int isLUKS(const char *type)
155 return (type && !strcmp(CRYPT_LUKS1, type));
158 /* keyslot helpers */
159 static int keyslot_verify_or_find_empty(struct crypt_device *cd, int *keyslot)
161 if (*keyslot == CRYPT_ANY_SLOT) {
162 *keyslot = LUKS_keyslot_find_empty(&cd->hdr);
164 log_err(cd, _("All key slots full.\n"));
169 switch (LUKS_keyslot_info(&cd->hdr, *keyslot)) {
171 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
172 *keyslot, LUKS_NUMKEYS - 1);
177 log_err(cd, _("Key slot %d is full, please select another one.\n"),
185 static int verify_other_keyslot(struct crypt_device *cd,
186 const char *key_file,
190 struct luks_masterkey *mk;
191 crypt_keyslot_info ki;
193 char *password = NULL;
194 unsigned int passwordLen;
196 get_key(_("Enter any remaining LUKS passphrase: "), &password,
197 &passwordLen, 0, key_file, cd->timeout, flags, cd);
201 if (ki == SLOT_ACTIVE_LAST)
202 LUKS_keyslot_set(&cd->hdr, keyIndex, 0);
204 openedIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT,
205 password, passwordLen,
207 if (openedIndex < 0) {
208 LUKS_keyslot_set(&cd->hdr, keyIndex, 1);
212 LUKS_dealloc_masterkey(mk);
215 log_std(cd, _("Key slot %d verified.\n"), openedIndex);
219 static int find_keyslot_by_passphrase(struct crypt_device *cd,
220 const char *key_file,
224 struct luks_masterkey *mk;
225 char *password = NULL;
226 unsigned int passwordLen;
229 get_key(message,&password,&passwordLen, 0, key_file,
230 cd->timeout, flags, cd);
234 keyIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
235 passwordLen, &cd->hdr, &mk, cd);
236 LUKS_dealloc_masterkey(mk);
242 static int device_check_and_adjust(struct crypt_device *cd,
244 uint64_t *size, uint64_t *offset,
247 struct device_infos infos;
249 if (get_device_infos(device, &infos, cd) < 0) {
250 log_err(cd, _("Cannot get info about device %s.\n"), device);
257 log_err(cd, _("Device %s has zero size.\n"), device);
260 if (*size <= *offset) {
261 log_err(cd, _("Device %s is too small.\n"), device);
273 static int luks_remove_helper(struct crypt_device *cd,
275 const char *other_key_file,
276 const char *key_file,
279 crypt_keyslot_info ki;
282 if (key_slot == CRYPT_ANY_SLOT) {
283 key_slot = find_keyslot_by_passphrase(cd, key_file, 0,
284 _("Enter LUKS passphrase to be deleted: "));
290 log_std(cd, _("key slot %d selected for deletion.\n"), key_slot);
293 ki = crypt_keyslot_status(cd, key_slot);
294 if (ki == SLOT_INVALID) {
295 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
296 key_slot, LUKS_NUMKEYS - 1);
300 if (ki <= SLOT_INACTIVE) {
301 log_err(cd, _("Key %d not active. Can't wipe.\n"), key_slot);
306 if (ki == SLOT_ACTIVE_LAST && cd->confirm &&
307 !(cd->confirm(_("This is the last keyslot."
308 " Device will become unusable after purging this key."),
309 cd->confirm_usrptr))) {
315 r = verify_other_keyslot(cd, other_key_file, 0, key_slot);
320 r = crypt_keyslot_destroy(cd, key_slot);
322 return (r < 0) ? r : 0;
325 static int create_device_helper(struct crypt_device *cd,
329 const char *cipher_mode,
330 const char *key_file,
342 crypt_status_info ci;
343 char *dm_cipher = NULL;
344 char *processed_key = NULL;
347 ci = crypt_status(cd, name);
351 if (reload && ci < ACTIVE)
354 if (!reload && ci >= ACTIVE) {
355 log_err(cd, _("Device %s already exists.\n"), name);
359 if (key_size < 0 || key_size > 1024) {
360 log_err(cd, _("Invalid key size %d.\n"), key_size);
364 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
368 if (cipher_mode && asprintf(&dm_cipher, "%s-%s", cipher, cipher_mode) < 0)
371 processed_key = process_key(cd, hash, key_file, key_size, key, keyLen);
375 r = dm_create_device(name, cd->device, dm_cipher ?: cipher, cd->type, uuid, size, skip, offset,
376 key_size, processed_key, read_only, reload);
379 safe_free(processed_key);
383 static int open_from_hdr_and_mk(struct crypt_device *cd,
384 struct luks_masterkey *mk,
388 uint64_t size, offset;
390 int read_only, no_uuid, r;
393 offset = crypt_get_data_offset(cd);
394 read_only = flags & CRYPT_ACTIVATE_READONLY;
395 no_uuid = flags & CRYPT_ACTIVATE_NO_UUID;
397 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
401 if (asprintf(&cipher, "%s-%s", crypt_get_cipher(cd),
402 crypt_get_cipher_mode(cd)) < 0)
405 r = dm_create_device(name, cd->device, cipher, cd->type,
406 no_uuid ? NULL : crypt_get_uuid(cd),
407 size, 0, offset, mk->keyLength, mk->key,
413 static void log_wrapper(int class, const char *msg, void *usrptr)
415 void (*xlog)(int class, char *msg) = usrptr;
416 xlog(class, (char *)msg);
419 static int yesDialog_wrapper(const char *msg, void *usrptr)
421 int (*xyesDialog)(char *msg) = usrptr;
422 return xyesDialog((char*)msg);
425 static void key_from_terminal(struct crypt_device *cd, char *msg, char **key,
426 unsigned int *key_len, int force_verify)
431 *key = safe_alloc(MAX_TTY_PASSWORD_LEN);
434 r = cd->password(msg, *key, (size_t)key_len, cd->password_usrptr);
441 if (force_verify || cd->password_verify)
442 flags |= CRYPT_FLAG_VERIFY_IF_POSSIBLE;
443 get_key(msg, key, key_len, 0, NULL, cd->timeout, flags, cd);
447 static int volume_key_by_terminal_passphrase(struct crypt_device *cd, int keyslot,
448 struct luks_masterkey **mk)
450 char *prompt = NULL, *passphrase_read = NULL;
451 unsigned int passphrase_size_read;
452 int r = -EINVAL, tries = cd->tries;
454 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
460 LUKS_dealloc_masterkey(*mk);
463 key_from_terminal(cd, prompt, &passphrase_read,
464 &passphrase_size_read, 0);
465 if(!passphrase_read) {
470 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
471 passphrase_size_read, &cd->hdr, mk, cd);
472 safe_free(passphrase_read);
473 passphrase_read = NULL;
474 } while (r == -EPERM && (--tries > 0));
477 LUKS_dealloc_masterkey(*mk);
486 static void key_from_file(struct crypt_device *cd, char *msg,
487 char **key, unsigned int *key_len,
488 const char *key_file, size_t key_size)
490 get_key(msg, key, key_len, key_size, key_file, cd->timeout, 0, cd);
493 static int _crypt_init(struct crypt_device **cd,
495 struct crypt_options *options,
496 int load, int need_dm)
500 /* if it is plain device and mapping table is being reloaded
501 initialize it by name*/
502 init_by_name = (type && !strcmp(type, CRYPT_PLAIN) && load);
504 /* Some of old API calls do not require DM in kernel,
505 fake initialisation by initialise it with kernel_check disabled */
507 (void)dm_init(NULL, 0);
509 r = crypt_init_by_name(cd, options->name);
511 r = crypt_init(cd, options->device);
518 crypt_set_log_callback(*cd, log_wrapper, options->icb->log);
519 crypt_set_confirm_callback(*cd, yesDialog_wrapper, options->icb->yesDialog);
521 crypt_set_timeout(*cd, options->timeout);
522 crypt_set_password_retry(*cd, options->tries);
523 crypt_set_iterarion_time(*cd, options->iteration_time ?: 1000);
524 crypt_set_password_verify(*cd, options->flags & CRYPT_FLAG_VERIFY);
526 if (load && !init_by_name)
527 r = crypt_load(*cd, type, NULL);
529 if (type && !(*cd)->type) {
530 (*cd)->type = strdup(type);
541 void crypt_set_log_callback(struct crypt_device *cd,
542 void (*log)(int class, const char *msg, void *usrptr),
546 cd->log_usrptr = usrptr;
549 void crypt_set_confirm_callback(struct crypt_device *cd,
550 int (*confirm)(const char *msg, void *usrptr),
553 cd->confirm = confirm;
554 cd->confirm_usrptr = usrptr;
557 void crypt_set_password_callback(struct crypt_device *cd,
558 int (*password)(const char *msg, char *buf, size_t length, void *usrptr),
561 cd->password = password;
562 cd->password_usrptr = usrptr;
565 /* OPTIONS: name, cipher, device, hash, key_file, key_size, key_slot,
566 * offset, size, skip, timeout, tries, passphrase_fd (ignored),
568 int crypt_create_device(struct crypt_options *options)
570 struct crypt_device *cd = NULL;
575 r = _crypt_init(&cd, CRYPT_PLAIN, options, 0, 1);
579 get_key(_("Enter passphrase: "), &key, &keyLen, options->key_size,
580 options->key_file, cd->timeout, options->flags, cd);
584 r = create_device_helper(cd, options->name, options->hash,
585 options->cipher, NULL, options->key_file, key, keyLen,
586 options->key_size, options->size, options->skip,
587 options->offset, NULL, options->flags & CRYPT_FLAG_READONLY,
595 /* OPTIONS: same as create above */
596 int crypt_update_device(struct crypt_options *options)
598 struct crypt_device *cd = NULL;
603 r = _crypt_init(&cd, CRYPT_PLAIN, options, 1, 1);
607 get_key(_("Enter passphrase: "), &key, &keyLen, options->key_size,
608 options->key_file, cd->timeout, options->flags, cd);
612 r = create_device_helper(cd, options->name, options->hash,
613 options->cipher, NULL, options->key_file, key, keyLen,
614 options->key_size, options->size, options->skip,
615 options->offset, NULL, options->flags & CRYPT_FLAG_READONLY,
623 /* OPTIONS: name, size, icb */
624 int crypt_resize_device(struct crypt_options *options)
626 struct crypt_device *cd = NULL;
627 char *device = NULL, *cipher = NULL, *uuid = NULL, *key = NULL;
629 uint64_t size, skip, offset;
630 int key_size, read_only, r;
632 r = dm_query_device(options->name, &device, &size, &skip, &offset,
633 &cipher, &key_size, &key, &read_only, NULL, &uuid);
637 /* Try to determine type of device from UUID */
639 if (!strncmp(uuid, CRYPT_PLAIN, strlen(CRYPT_PLAIN))) {
643 } else if (!strncmp(uuid, CRYPT_LUKS1, strlen(CRYPT_LUKS1)))
647 r = _crypt_init(&cd, type, options, 1, 1);
651 size = options->size;
652 r = device_check_and_adjust(cd, device, &size, &offset, &read_only);
656 r = dm_create_device(options->name, device, cipher, type,
657 crypt_get_uuid(cd), size, skip, offset,
658 key_size, key, read_only, 1);
668 /* OPTIONS: name, icb */
669 int crypt_query_device(struct crypt_options *options)
673 r = dm_status_device(options->name);
677 r = dm_query_device(options->name, (char **)&options->device, &options->size,
678 &options->skip, &options->offset, (char **)&options->cipher,
679 &options->key_size, NULL, &read_only, NULL, NULL);
685 options->flags |= CRYPT_FLAG_READONLY;
687 options->flags |= CRYPT_FLAG_FREE_DEVICE;
688 options->flags |= CRYPT_FLAG_FREE_CIPHER;
693 /* OPTIONS: name, icb */
694 int crypt_remove_device(struct crypt_options *options)
696 return crypt_deactivate(NULL, options->name);
699 /* OPTIONS: device, cipher, hash, align_payload, key_size (master key), key_slot
700 * new_key_file, iteration_time, timeout, flags, icb */
701 int crypt_luksFormat(struct crypt_options *options)
703 char cipherName[LUKS_CIPHERNAME_L];
704 char cipherMode[LUKS_CIPHERMODE_L];
706 unsigned int passwordLen;
707 struct crypt_device *cd;
708 struct crypt_params_luks1 cp = {
709 .hash = options->hash,
710 .data_alignment = options->align_payload
714 r = parse_into_name_and_mode(options->cipher, cipherName, cipherMode);
716 log_err(cd, _("No known cipher specification pattern detected.\n"));
720 if ((r = _crypt_init(&cd, CRYPT_LUKS1, options, 0, 1)))
723 if (options->key_slot >= LUKS_NUMKEYS && options->key_slot != CRYPT_ANY_SLOT) {
724 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
725 options->key_slot, LUKS_NUMKEYS - 1);
730 get_key(_("Enter LUKS passphrase: "), &password, &passwordLen, 0,
731 options->new_key_file, options->timeout, options->flags, cd);
738 r = crypt_format(cd, CRYPT_LUKS1, cipherName, cipherMode,
739 NULL, NULL, options->key_size, &cp);
743 /* Add keyslot using internally stored volume key generated during format */
744 r = crypt_keyslot_add_by_volume_key(cd, options->key_slot, NULL, 0,
745 password, passwordLen);
749 return (r < 0) ? r : 0;
752 /* OPTIONS: name, device, key_size, key_file, timeout, tries, flags, icb */
753 int crypt_luksOpen(struct crypt_options *options)
755 struct crypt_device *cd = NULL;
762 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
766 if (options->flags & CRYPT_FLAG_READONLY)
767 flags |= CRYPT_ACTIVATE_READONLY;
769 if (options->flags & CRYPT_FLAG_NON_EXCLUSIVE_ACCESS)
770 flags |= CRYPT_ACTIVATE_NO_UUID;
772 if (options->key_file)
773 r = crypt_activate_by_keyfile(cd, options->name,
774 CRYPT_ANY_SLOT, options->key_file, options->key_size,
777 r = crypt_activate_by_passphrase(cd, options->name,
778 CRYPT_ANY_SLOT, options->passphrase,
779 options->passphrase ? strlen(options->passphrase) : 0,
783 return (r < 0) ? r : 0;
786 /* OPTIONS: device, keys_slot, key_file, timeout, flags, icb */
787 int crypt_luksKillSlot(struct crypt_options *options)
789 struct crypt_device *cd = NULL;
792 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
796 r = luks_remove_helper(cd, options->key_slot, options->key_file, NULL,
797 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
800 return (r < 0) ? r : 0;
803 /* OPTIONS: device, new_key_file, key_file, timeout, flags, icb */
804 int crypt_luksRemoveKey(struct crypt_options *options)
806 struct crypt_device *cd = NULL;
809 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
813 r = luks_remove_helper(cd, CRYPT_ANY_SLOT, options->key_file, options->new_key_file,
814 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
817 return (r < 0) ? r : 0;
821 /* OPTIONS: device, new_key_file, key_file, key_slot, flags,
822 iteration_time, timeout, icb */
823 int crypt_luksAddKey(struct crypt_options *options)
825 struct crypt_device *cd = NULL;
828 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
832 if (options->key_file || options->new_key_file)
833 r = crypt_keyslot_add_by_keyfile(cd, options->key_slot,
834 options->key_file, 0,
835 options->new_key_file, 0);
837 r = crypt_keyslot_add_by_passphrase(cd, options->key_slot,
841 return (r < 0) ? r : 0;
844 /* OPTIONS: device, icb */
845 int crypt_luksUUID(struct crypt_options *options)
847 struct crypt_device *cd = NULL;
851 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
855 uuid = (char *)crypt_get_uuid(cd);
856 log_std(cd, uuid ?: "");
862 /* OPTIONS: device, icb */
863 int crypt_isLuks(struct crypt_options *options)
865 struct crypt_device *cd = NULL;
868 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
874 /* OPTIONS: device, icb */
875 int crypt_luksDump(struct crypt_options *options)
877 struct crypt_device *cd = NULL;
880 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
890 void crypt_get_error(char *buf, size_t size)
892 const char *error = get_error();
894 if (!buf || size < 1)
897 strncpy(buf, error, size - 1);
898 buf[size - 1] = '\0';
904 void crypt_put_options(struct crypt_options *options)
906 if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
907 free((char *)options->device);
908 options->device = NULL;
909 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
911 if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
912 free((char *)options->cipher);
913 options->cipher = NULL;
914 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
918 const char *crypt_get_dir(void)
923 /////////////////////////////////
928 int crypt_init(struct crypt_device **cd, const char *device)
930 struct crypt_device *h = NULL;
935 log_dbg("Allocating crypt device %s context.", device);
937 if (!device_ready(NULL, device, 0))
940 if (!(h = malloc(sizeof(struct crypt_device))))
943 memset(h, 0, sizeof(*h));
945 h->device = strdup(device);
951 if (!dm_init(h, 1) < 0) {
956 h->iteration_time = 1000;
957 h->password_verify = 0;
963 int crypt_init_by_name(struct crypt_device **cd, const char *name)
965 crypt_status_info ci;
969 log_dbg("Allocating crypt device context by device %s.", name);
971 ci = crypt_status(NULL, name);
973 log_err(NULL, _("Device %s is not active.\n"), name);
977 r = dm_query_device(name, &device, NULL, NULL, NULL,
978 NULL, NULL, NULL, NULL, NULL, NULL);
980 r = crypt_init(cd, device);
986 static int _crypt_format_plain(struct crypt_device *cd,
988 const char *cipher_mode,
990 struct crypt_params_plain *params)
992 if (!cipher || !cipher_mode || !params || !params->hash) {
993 log_err(cd, _("Invalid plain crypt parameters.\n"));
997 if (cd->volume_key->keyLength > 1024) {
998 log_err(cd, _("Invalid key size.\n"));
1002 cd->plain_cipher = strdup(cipher);
1003 cd->plain_cipher_mode = strdup(cipher_mode);
1006 cd->plain_uuid = strdup(uuid);
1009 cd->plain_hdr.hash = strdup(params->hash);
1011 cd->plain_hdr.offset = params->offset;
1012 cd->plain_hdr.skip = params->skip;
1014 if ((params->hash && !cd->plain_hdr.hash) ||
1015 !cd->plain_cipher || !cd->plain_cipher_mode)
1021 static int _crypt_format_luks1(struct crypt_device *cd,
1023 const char *cipher_mode,
1025 struct crypt_params_luks1 *params)
1029 r = LUKS_generate_phdr(&cd->hdr, cd->volume_key, cipher, cipher_mode,
1030 (params && params->hash) ? params->hash : "sha1",
1032 params ? params->data_alignment: DEFAULT_ALIGNMENT, cd);
1036 /* Wipe first 8 sectors - fs magic numbers etc. */
1037 r = wipe_device_header(cd->device, 8);
1039 log_err(cd, _("Can't wipe header on device %s.\n"), cd->device);
1043 r = LUKS_write_phdr(cd->device, &cd->hdr, cd);
1048 int crypt_format(struct crypt_device *cd,
1051 const char *cipher_mode,
1053 const char *volume_key,
1054 size_t volume_key_size,
1059 log_dbg("Formatting device %s as type %s.", cd->device, cd->type ?: "(none)");
1065 cd->volume_key = LUKS_alloc_masterkey(volume_key_size,
1068 cd->volume_key = LUKS_generate_masterkey(volume_key_size);
1074 r = _crypt_format_plain(cd, cipher, cipher_mode,
1076 else if (isLUKS(type))
1077 r = _crypt_format_luks1(cd, cipher, cipher_mode,
1080 /* FIXME: allow plugins here? */
1081 log_err(cd, _("Unkown crypt device type %s requesed.\n"), type);
1085 if (!r && !(cd->type = strdup(type)))
1089 LUKS_dealloc_masterkey(cd->volume_key);
1090 cd->volume_key = NULL;
1096 int crypt_load(struct crypt_device *cd,
1097 const char *requested_type,
1100 struct luks_phdr hdr;
1103 log_dbg("Trying to load %s crypt type from device %s.",
1104 requested_type ?: "any", cd->device);
1106 if (requested_type && !isPLAIN(requested_type) && !isLUKS(requested_type))
1109 r = LUKS_read_phdr(cd->device, &hdr, 0, cd);
1112 memcpy(&cd->hdr, &hdr, sizeof(hdr));
1113 cd->type = strdup(requested_type);
1121 void crypt_free(struct crypt_device *cd)
1124 log_dbg("Releasing crypt device %s context.", cd->device);
1128 LUKS_dealloc_masterkey(cd->volume_key);
1133 /* used in plain device only */
1134 free((char*)cd->plain_hdr.hash);
1135 free(cd->plain_cipher);
1136 free(cd->plain_cipher_mode);
1137 free(cd->plain_uuid);
1143 int crypt_suspend(struct crypt_device *cd,
1146 crypt_status_info ci;
1147 int r, suspended = 0;
1149 log_dbg("Suspending volume %s.", name);
1151 ci = crypt_status(NULL, name);
1153 log_err(cd, _("Volume %s is not active.\n"), name);
1157 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1158 NULL, NULL, NULL, NULL, &suspended, NULL);
1163 log_err(cd, _("Volume %s is already suspended.\n"), name);
1167 r = dm_suspend_and_wipe_key(name);
1169 log_err(cd, "Error during suspending device %s.\n", name);
1174 int crypt_resume_by_passphrase(struct crypt_device *cd,
1177 const char *passphrase,
1178 size_t passphrase_size)
1180 struct luks_masterkey *mk = NULL;
1181 int r, suspended = 0;
1183 log_dbg("Resuming volume %s.", name);
1185 if (!isLUKS(cd->type)) {
1186 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1191 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1192 NULL, NULL, NULL, NULL, &suspended, NULL);
1197 log_err(cd, _("Volume %s is not suspended.\n"), name);
1202 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1203 passphrase_size, &cd->hdr, &mk, cd);
1205 r = volume_key_by_terminal_passphrase(cd, keyslot, &mk);
1209 r = dm_resume_and_reinstate_key(name, mk->keyLength, mk->key);
1211 log_err(cd, "Error during resuming device %s.\n", name);
1215 LUKS_dealloc_masterkey(mk);
1216 return r < 0 ? r : keyslot;
1219 int crypt_resume_by_keyfile(struct crypt_device *cd,
1222 const char *keyfile,
1223 size_t keyfile_size)
1225 struct luks_masterkey *mk = NULL;
1226 char *passphrase_read = NULL;
1227 unsigned int passphrase_size_read;
1228 int r, suspended = 0;
1230 log_dbg("Resuming volume %s.", name);
1232 if (!isLUKS(cd->type)) {
1233 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1238 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1239 NULL, NULL, NULL, NULL, &suspended, NULL);
1244 log_err(cd, _("Volume %s is not suspended.\n"), name);
1251 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1252 &passphrase_size_read, keyfile, keyfile_size);
1254 if(!passphrase_read)
1257 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1258 passphrase_size_read, &cd->hdr, &mk, cd);
1259 safe_free(passphrase_read);
1264 r = dm_resume_and_reinstate_key(name, mk->keyLength, mk->key);
1266 log_err(cd, "Error during resuming device %s.\n", name);
1270 LUKS_dealloc_masterkey(mk);
1271 return r < 0 ? r : keyslot;
1274 // slot manipulation
1275 int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
1276 int keyslot, // -1 any
1277 const char *passphrase, // NULL -> terminal
1278 size_t passphrase_size,
1279 const char *new_passphrase, // NULL -> terminal
1280 size_t new_passphrase_size)
1282 struct luks_masterkey *mk = NULL;
1283 char *password = NULL, *new_password = NULL;
1284 unsigned int passwordLen, new_passwordLen;
1287 log_dbg("Adding new keyslot, existing passphrase %sprovided,"
1288 "new passphrase %sprovided.",
1289 passphrase ? "" : "not ", new_passphrase ? "" : "not ");
1291 if (!isLUKS(cd->type)) {
1292 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1296 r = keyslot_verify_or_find_empty(cd, &keyslot);
1300 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1301 /* No slots used, try to use pre-generated key in header */
1302 if (cd->volume_key) {
1303 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1304 r = mk ? 0 : -ENOMEM;
1306 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1309 } else if (passphrase) {
1310 /* Passphrase provided, use it to unlock existing keyslot */
1311 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, passphrase,
1312 passphrase_size, &cd->hdr, &mk, cd);
1314 /* Passphrase not provided, ask first and use it to unlock existing keyslot */
1315 key_from_terminal(cd, _("Enter any passphrase: "),
1316 &password, &passwordLen, 0);
1322 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
1323 passwordLen, &cd->hdr, &mk, cd);
1324 safe_free(password);
1330 if (new_passphrase) {
1331 new_password = (char *)new_passphrase;
1332 new_passwordLen = new_passphrase_size;
1334 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1335 &new_password, &new_passwordLen, 1);
1342 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1343 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1348 if (!new_passphrase)
1349 safe_free(new_password);
1350 LUKS_dealloc_masterkey(mk);
1351 return r ?: keyslot;
1354 int crypt_keyslot_add_by_keyfile(struct crypt_device *cd,
1356 const char *keyfile,
1357 size_t keyfile_size,
1358 const char *new_keyfile,
1359 size_t new_keyfile_size)
1361 struct luks_masterkey *mk=NULL;
1362 char *password=NULL; unsigned int passwordLen;
1363 char *new_password = NULL; unsigned int new_passwordLen;
1366 log_dbg("Adding new keyslot, existing keyfile %s, new keyfile %s.",
1367 keyfile ?: "[none]", new_keyfile ?: "[none]");
1369 if (!isLUKS(cd->type)) {
1370 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1374 r = keyslot_verify_or_find_empty(cd, &keyslot);
1378 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1379 /* No slots used, try to use pre-generated key in header */
1380 if (cd->volume_key) {
1381 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1382 r = mk ? 0 : -ENOMEM;
1384 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1388 /* Read password from file of (if NULL) from terminal */
1390 key_from_file(cd, _("Enter any passphrase: "), &password, &passwordLen,
1391 keyfile, keyfile_size);
1393 key_from_terminal(cd, _("Enter any passphrase: "),
1394 &password, &passwordLen, 1);
1399 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password, passwordLen,
1401 safe_free(password);
1408 key_from_file(cd, _("Enter new passphrase for key slot: "),
1409 &new_password, &new_passwordLen, new_keyfile,
1412 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1413 &new_password, &new_passwordLen, 1);
1420 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1421 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1423 safe_free(new_password);
1424 LUKS_dealloc_masterkey(mk);
1425 return r < 0 ? r : keyslot;
1428 int crypt_keyslot_add_by_volume_key(struct crypt_device *cd,
1430 const char *volume_key,
1431 size_t volume_key_size,
1432 const char *passphrase,
1433 size_t passphrase_size
1436 struct luks_masterkey *mk;
1438 char *new_password = NULL; unsigned int new_passwordLen;
1440 log_dbg("Adding new keyslot %d using volume key.", keyslot);
1442 if (!isLUKS(cd->type)) {
1443 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1448 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1449 else if (cd->volume_key)
1450 mk = LUKS_alloc_masterkey(cd->volume_key->keyLength, cd->volume_key->key);
1455 r = LUKS_verify_master_key(&cd->hdr, mk);
1457 log_err(cd, _("Volume key does not match the volume.\n"));
1461 r = keyslot_verify_or_find_empty(cd, &keyslot);
1466 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1467 &new_password, &new_passwordLen, 1);
1468 passphrase = new_password;
1469 passphrase_size = new_passwordLen;
1472 r = LUKS_set_key(cd->device, keyslot, passphrase, passphrase_size,
1473 &cd->hdr, mk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1476 safe_free(new_password);
1477 LUKS_dealloc_masterkey(mk);
1478 return r ?: keyslot;
1481 int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot)
1483 crypt_keyslot_info ki;
1485 log_dbg("Destroying keyslot %d.", keyslot);
1487 if (!isLUKS(cd->type)) {
1488 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1492 ki = crypt_keyslot_status(cd, keyslot);
1493 if (ki == SLOT_INVALID) {
1494 log_err(cd, _("Key slot %d is invalid.\n"), keyslot);
1498 if (ki == SLOT_INACTIVE) {
1499 log_err(cd, _("Key slot %d is not used.\n"), keyslot);
1503 return LUKS_del_key(cd->device, keyslot, &cd->hdr, cd);
1506 // activation/deactivation of device mapping
1507 int crypt_activate_by_passphrase(struct crypt_device *cd,
1510 const char *passphrase,
1511 size_t passphrase_size,
1514 crypt_status_info ci;
1515 struct luks_masterkey *mk = NULL;
1516 char *prompt = NULL;
1519 log_dbg("%s volume %s [keyslot %d] using %spassphrase.",
1520 name ? "Activating" : "Checking", name ?: "",
1521 keyslot, passphrase ? "" : "[none] ");
1526 /* plain, use hashed passphrase */
1527 if (isPLAIN(cd->type))
1528 return create_device_helper(cd, name, cd->plain_hdr.hash,
1529 cd->plain_cipher, cd->plain_cipher_mode, NULL, passphrase, passphrase_size,
1530 cd->volume_key->keyLength, 0, cd->plain_hdr.skip,
1531 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1534 ci = crypt_status(NULL, name);
1537 else if (ci >= ACTIVE) {
1538 log_err(cd, _("Device %s already exists.\n"), name);
1543 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
1546 /* provided passphrase, do not retry */
1548 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1549 passphrase_size, &cd->hdr, &mk, cd);
1551 r = volume_key_by_terminal_passphrase(cd, keyslot, &mk);
1556 r = open_from_hdr_and_mk(cd, mk, name, flags);
1559 LUKS_dealloc_masterkey(mk);
1562 return r < 0 ? r : keyslot;
1565 int crypt_activate_by_keyfile(struct crypt_device *cd,
1568 const char *keyfile,
1569 size_t keyfile_size,
1572 crypt_status_info ci;
1573 struct luks_masterkey *mk = NULL;
1574 char *passphrase_read = NULL;
1575 unsigned int passphrase_size_read;
1578 log_dbg("Activating volume %s [keyslot %d] using keyfile %s.",
1579 name, keyslot, keyfile ?: "[none]");
1581 if (!isLUKS(cd->type)) {
1582 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1587 ci = crypt_status(NULL, name);
1590 else if (ci >= ACTIVE) {
1591 log_err(cd, _("Device %s already exists.\n"), name);
1599 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1600 &passphrase_size_read, keyfile, keyfile_size);
1601 if(!passphrase_read)
1604 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1605 passphrase_size_read, &cd->hdr, &mk, cd);
1606 safe_free(passphrase_read);
1611 r = open_from_hdr_and_mk(cd, mk, name, flags);
1614 LUKS_dealloc_masterkey(mk);
1616 return r < 0 ? r : keyslot;
1619 int crypt_activate_by_volume_key(struct crypt_device *cd,
1621 const char *volume_key,
1622 size_t volume_key_size,
1625 crypt_status_info ci;
1626 struct luks_masterkey *mk;
1629 log_dbg("Activating volume %s by volume key.", name);
1631 /* use key directly, no hash */
1632 if (isPLAIN(cd->type))
1633 return create_device_helper(cd, name, NULL,
1634 cd->plain_cipher, cd->plain_cipher_mode, NULL, volume_key, volume_key_size,
1635 cd->volume_key->keyLength, 0, cd->plain_hdr.skip,
1636 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1638 if (!isLUKS(cd->type)) {
1639 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1644 ci = crypt_status(NULL, name);
1647 else if (ci >= ACTIVE) {
1648 log_err(cd, _("Device %s already exists.\n"), name);
1653 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1656 r = LUKS_verify_master_key(&cd->hdr, mk);
1659 log_err(cd, _("Volume key does not match the volume.\n"));
1662 r = open_from_hdr_and_mk(cd, mk, name, flags);
1664 LUKS_dealloc_masterkey(mk);
1669 int crypt_deactivate(struct crypt_device *cd, const char *name)
1674 log_dbg("Deactivating volume %s.", name);
1676 switch (crypt_status(cd, name)) {
1677 case ACTIVE: return dm_remove_device(name, 0, 0);
1678 case BUSY: log_err(cd, _("Device %s is busy."), name);
1680 case INACTIVE: log_err(cd, _("Device %s is not active."), name);
1682 default: log_err(cd, _("Invalid device %s."), name);
1687 // misc helper functions
1688 int crypt_volume_key_get(struct crypt_device *cd,
1691 size_t *volume_key_size,
1692 const char *passphrase,
1693 size_t passphrase_size)
1695 struct luks_masterkey *mk;
1696 char *processed_key = NULL;
1699 key_len = crypt_get_volume_key_size(cd);
1700 if (key_len > *volume_key_size) {
1701 log_err(cd, _("Volume key buffer too small.\n"));
1705 if (isPLAIN(cd->type)) {
1706 processed_key = process_key(cd, cd->plain_hdr.hash, NULL, key_len,
1707 passphrase, passphrase_size);
1708 if (!processed_key) {
1709 log_err(cd, _("Cannot retrieve volume key for plain device.\n"));
1712 memcpy(volume_key, processed_key, key_len);
1713 *volume_key_size = key_len;
1714 safe_free(processed_key);
1718 if (isLUKS(cd->type)) {
1719 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1720 passphrase_size, &cd->hdr, &mk, cd);
1723 memcpy(volume_key, mk->key, mk->keyLength);
1724 *volume_key_size = mk->keyLength;
1727 LUKS_dealloc_masterkey(mk);
1731 log_err(cd, _("This operation is not supported for %s crypt device.\n"), cd->type ?: "(none)");
1735 int crypt_volume_key_verify(struct crypt_device *cd,
1736 const char *volume_key,
1737 size_t volume_key_size)
1739 struct luks_masterkey *mk;
1742 if (!isLUKS(cd->type)) {
1743 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1747 mk = LUKS_alloc_masterkey(volume_key_size, volume_key);
1751 r = LUKS_verify_master_key(&cd->hdr, mk);
1754 log_err(cd, _("Volume key does not match the volume.\n"));
1756 LUKS_dealloc_masterkey(mk);
1761 void crypt_set_timeout(struct crypt_device *cd, uint64_t timeout_sec)
1763 log_dbg("Timeout set to %" PRIu64 " miliseconds.", timeout_sec);
1764 cd->timeout = timeout_sec;
1767 void crypt_set_password_retry(struct crypt_device *cd, int tries)
1769 log_dbg("Password retry count set to %d.", tries);
1773 void crypt_set_iterarion_time(struct crypt_device *cd, uint64_t iteration_time_ms)
1775 log_dbg("Iteration time set to %" PRIu64 " miliseconds.", iteration_time_ms);
1776 cd->iteration_time = iteration_time_ms;
1779 void crypt_set_password_verify(struct crypt_device *cd, int password_verify)
1781 log_dbg("Password verification %s.", password_verify ? "enabled" : "disabled");
1782 cd->password_verify = password_verify ? 1 : 0;
1785 int crypt_memory_lock(struct crypt_device *cd, int lock)
1787 return lock ? memlock_inc(cd) : memlock_dec(cd);
1791 crypt_status_info crypt_status(struct crypt_device *cd, const char *name)
1795 r = dm_status_device(name);
1797 if (r < 0 && r != -ENODEV)
1809 static void hexprintICB(struct crypt_device *cd, char *d, int n)
1812 for(i = 0; i < n; i++)
1813 log_std(cd, "%02hhx ", (char)d[i]);
1816 int crypt_dump(struct crypt_device *cd)
1819 if (!isLUKS(cd->type)) { //FIXME
1820 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1824 log_std(cd, "LUKS header information for %s\n\n", cd->device);
1825 log_std(cd, "Version: \t%d\n", cd->hdr.version);
1826 log_std(cd, "Cipher name: \t%s\n", cd->hdr.cipherName);
1827 log_std(cd, "Cipher mode: \t%s\n", cd->hdr.cipherMode);
1828 log_std(cd, "Hash spec: \t%s\n", cd->hdr.hashSpec);
1829 log_std(cd, "Payload offset:\t%d\n", cd->hdr.payloadOffset);
1830 log_std(cd, "MK bits: \t%d\n", cd->hdr.keyBytes * 8);
1831 log_std(cd, "MK digest: \t");
1832 hexprintICB(cd, cd->hdr.mkDigest, LUKS_DIGESTSIZE);
1834 log_std(cd, "MK salt: \t");
1835 hexprintICB(cd, cd->hdr.mkDigestSalt, LUKS_SALTSIZE/2);
1836 log_std(cd, "\n \t");
1837 hexprintICB(cd, cd->hdr.mkDigestSalt+LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1839 log_std(cd, "MK iterations: \t%d\n", cd->hdr.mkDigestIterations);
1840 log_std(cd, "UUID: \t%s\n\n", cd->hdr.uuid);
1841 for(i = 0; i < LUKS_NUMKEYS; i++) {
1842 if(cd->hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
1843 log_std(cd, "Key Slot %d: ENABLED\n",i);
1844 log_std(cd, "\tIterations: \t%d\n",
1845 cd->hdr.keyblock[i].passwordIterations);
1846 log_std(cd, "\tSalt: \t");
1847 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt,
1849 log_std(cd, "\n\t \t");
1850 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt +
1851 LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1854 log_std(cd, "\tKey material offset:\t%d\n",
1855 cd->hdr.keyblock[i].keyMaterialOffset);
1856 log_std(cd, "\tAF stripes: \t%d\n",
1857 cd->hdr.keyblock[i].stripes);
1860 log_std(cd, "Key Slot %d: DISABLED\n", i);
1865 const char *crypt_get_cipher(struct crypt_device *cd)
1867 if (isPLAIN(cd->type))
1868 return cd->plain_cipher;
1870 if (isLUKS(cd->type))
1871 return cd->hdr.cipherName;
1876 const char *crypt_get_cipher_mode(struct crypt_device *cd)
1878 if (isPLAIN(cd->type))
1879 return cd->plain_cipher_mode;
1881 if (isLUKS(cd->type))
1882 return cd->hdr.cipherMode;
1887 const char *crypt_get_uuid(struct crypt_device *cd)
1889 if (isLUKS(cd->type))
1890 return cd->hdr.uuid;
1895 int crypt_get_volume_key_size(struct crypt_device *cd)
1897 if (isPLAIN(cd->type))
1898 return cd->volume_key->keyLength;
1900 if (isLUKS(cd->type))
1901 return cd->hdr.keyBytes;
1906 uint64_t crypt_get_data_offset(struct crypt_device *cd)
1908 if (isPLAIN(cd->type))
1909 return cd->plain_hdr.offset;
1911 if (isLUKS(cd->type))
1912 return cd->hdr.payloadOffset;
1917 crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot)
1919 if (!isLUKS(cd->type)) {
1920 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1921 return SLOT_INVALID;
1924 return LUKS_keyslot_info(&cd->hdr, keyslot);