lib/setup.c

   1 #include <string.h>
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <inttypes.h>
   5 #include <sys/types.h>
   6 #include <sys/ioctl.h>
   7 #include <sys/mman.h>
   8 #include <fcntl.h>
   9 #include <unistd.h>
  10 #include <errno.h>
  11 #include <signal.h>
  12 #include <assert.h>
  13
  14 #include "libcryptsetup.h"
  15 #include "internal.h"
  16 #include "blockdev.h"
  17 #include "luks.h"
  18
  19 struct device_infos {
  20         uint64_t        size;
  21         int             readonly;
  22 };
  23
  24 static int memory_unsafe = 0;
  25
  26 #define at_least_one(a) ({ __typeof__(a) __at_least_one=(a); (__at_least_one)?__at_least_one:1; })
  27
  28 static void logger(struct crypt_options *options, int class, char *format, ...) {
  29         va_list argp;
  30         char *target = NULL;
  31
  32         va_start(argp, format);
  33
  34         if (vasprintf(&target, format, argp) > 0)
  35                 options->icb->log(class, target);
  36
  37         va_end(argp);
  38         free(target);
  39 }
  40
  41 static void hexprintICB(struct crypt_options *options, int class, char *d, int n)
  42 {
  43         int i;
  44         for(i = 0; i < n; i++)
  45                 logger(options, class, "%02hhx ", (char)d[i]);
  46 }
  47
  48 static int setup_enter(void (*log)(int, char *))
  49 {
  50         int r;
  51
  52         /*
  53          * from here we could have sensible data in memory
  54          * so protect it from being swapped out
  55          */
  56         r = mlockall(MCL_CURRENT | MCL_FUTURE);
  57         if (r < 0) {
  58                 perror("mlockall failed");
  59                 log(CRYPT_LOG_ERROR, "WARNING!!! Possibly insecure memory. Are you root?\n");
  60                 memory_unsafe = 1;
  61         }
  62
  63         set_error(NULL);
  64
  65         return 0;
  66 }
  67
  68 static int setup_leave(void)
  69 {
  70         /* dangerous, we can't wipe all the memory */
  71         if (!memory_unsafe)
  72                 munlockall();
  73
  74         return 0;
  75 }
  76
  77 /*
  78  * Password processing behaviour matrix of process_key
  79  *
  80  * from binary file: check if there is sufficently large key material
  81  * interactive & from fd: hash if requested, otherwise crop or pad with '0'
  82  */
  83
  84 static char *process_key(struct crypt_options *options, char *pass, int passLen) {
  85         char *key = safe_alloc(options->key_size);
  86         memset(key, 0, options->key_size);
  87
  88         /* key is coming from binary file */
  89         if (options->key_file && strcmp(options->key_file, "-")) {
  90                 if(passLen < options->key_size) {
  91                         set_error("Could not read %d bytes from key file",
  92                                   options->key_size);
  93                         safe_free(key);
  94                         return NULL;
  95                 }
  96                 memcpy(key,pass,options->key_size);
  97                 return key;
  98         }
  99
 100         /* key is coming from tty, fd or binary stdin */
 101         if (options->hash) {
 102                 if (hash(NULL, options->hash,
 103                          key, options->key_size,
 104                          pass, passLen) < 0)
 105                 {
 106                         safe_free(key);
 107                         return NULL;
 108                 }
 109         } else if (passLen > options->key_size) {
 110                 memcpy(key, pass, options->key_size);
 111         } else {
 112                 memcpy(key, pass, passLen);
 113         }
 114
 115         return key;
 116 }
 117
 118 static int get_device_infos(const char *device, struct device_infos *infos)
 119 {
 120         char buf[128];
 121         uint64_t size;
 122         unsigned long size_small;
 123         int readonly = 0;
 124         int ret = -1;
 125         int fd;
 126
 127         /* Try to open read-write to check whether it is a read-only device */
 128         fd = open(device, O_RDWR);
 129         if (fd < 0) {
 130                 if (errno == EROFS) {
 131                         readonly = 1;
 132                         fd = open(device, O_RDONLY);
 133                 }
 134         } else {
 135                 close(fd);
 136                 fd = open(device, O_RDONLY);
 137         }
 138         if (fd < 0) {
 139                 set_error("Error opening device: %s",
 140                           strerror_r(errno, buf, 128));
 141                 return -1;
 142         }
 143
 144 #ifdef BLKROGET
 145         /* If the device can be opened read-write, i.e. readonly is still 0, then
 146          * check whether BKROGET says that it is read-only. E.g. read-only loop
 147          * devices may be openend read-write but are read-only according to BLKROGET
 148          */
 149         if (readonly == 0) {
 150                 if (ioctl(fd, BLKROGET, &readonly) < 0) {
 151                         set_error("BLKROGET failed on device: %s",
 152                                   strerror_r(errno, buf, 128));
 153                         return -1;
 154                 }
 155         }
 156 #else
 157 #error BLKROGET not available
 158 #endif
 159
 160 #ifdef BLKGETSIZE64
 161         if (ioctl(fd, BLKGETSIZE64, &size) >= 0) {
 162                 size >>= SECTOR_SHIFT;
 163                 ret = 0;
 164                 goto out;
 165         }
 166 #endif
 167
 168 #ifdef BLKGETSIZE
 169         if (ioctl(fd, BLKGETSIZE, &size_small) >= 0) {
 170                 size = (uint64_t)size_small;
 171                 ret = 0;
 172                 goto out;
 173         }
 174 #else
 175 #       error Need at least the BLKGETSIZE ioctl!
 176 #endif
 177
 178         set_error("BLKGETSIZE ioctl failed on device: %s",
 179                   strerror_r(errno, buf, 128));
 180
 181 out:
 182         if (ret == 0) {
 183                 infos->size = size;
 184                 infos->readonly = readonly;
 185         }
 186         close(fd);
 187         return ret;
 188 }
 189
 190 static int wipe_device_header(const char *device, int sectors)
 191 {
 192         char *buffer;
 193         int size = sectors * SECTOR_SIZE;
 194         int r = -1;
 195         int devfd;
 196
 197         devfd = open(device, O_RDWR | O_DIRECT | O_SYNC);
 198         if(devfd == -1) {
 199                 set_error("Can't wipe header on device %s", device);
 200                 return -EINVAL;
 201         }
 202
 203         buffer = malloc(size);
 204         if (!buffer) {
 205                 close(devfd);
 206                 return -ENOMEM;
 207         }
 208         memset(buffer, 0, size);
 209
 210         r = write_blockwise(devfd, buffer, size) < size ? -EIO : 0;
 211
 212         free(buffer);
 213         close(devfd);
 214
 215         return r;
 216 }
 217
 218 static int parse_into_name_and_mode(const char *nameAndMode, char *name,
 219                                     char *mode)
 220 {
 221 /* Token content stringification, see info cpp/stringification */
 222 #define str(s) #s
 223 #define xstr(s) str(s)
 224 #define scanpattern1 "%" xstr(LUKS_CIPHERNAME_L) "[^-]-%" xstr(LUKS_CIPHERMODE_L)  "s"
 225 #define scanpattern2 "%" xstr(LUKS_CIPHERNAME_L) "[^-]"
 226
 227         int r;
 228
 229         if(sscanf(nameAndMode,scanpattern1, name, mode) != 2) {
 230                 if((r = sscanf(nameAndMode,scanpattern2,name)) == 1) {
 231                         strncpy(mode,"cbc-plain",10);
 232                 }
 233                 else {
 234                         set_error("no known cipher-spec pattern detected");
 235                         return -EINVAL;
 236                 }
 237         }
 238
 239         return 0;
 240
 241 #undef sp1
 242 #undef sp2
 243 #undef str
 244 #undef xstr
 245 }
 246
 247 static int keyslot_is_valid(int keySlotIndex, struct crypt_options *options)
 248 {
 249         if(keySlotIndex >= LUKS_NUMKEYS || keySlotIndex < 0) {
 250                 logger(options,CRYPT_LOG_ERROR,"Key slot %d is invalid, please pick between 0 and %d.\n", keySlotIndex, LUKS_NUMKEYS - 1);
 251                 return 0;
 252         }
 253
 254         return 1;
 255 }
 256
 257 /* Select free keyslot or verifies that the one specified is empty */
 258 static int keyslot_from_option(int keySlotOption, struct luks_phdr *hdr, struct crypt_options *options) {
 259         if(keySlotOption >= 0) {
 260                 if(!keyslot_is_valid(keySlotOption, options))
 261                         return -EINVAL;
 262                 else if(hdr->keyblock[keySlotOption].active != LUKS_KEY_DISABLED) {
 263                         logger(options,CRYPT_LOG_ERROR,"Key slot %d is full, please pick another one", keySlotOption);
 264                         return -EINVAL;
 265                 } else {
 266                         return keySlotOption;
 267                 }
 268         } else {
 269                 int i;
 270                 /* Find empty key slot */
 271                 for(i=0; i<LUKS_NUMKEYS; i++) {
 272                         if(hdr->keyblock[i].active == LUKS_KEY_DISABLED) break;
 273                 }
 274                 if(i==LUKS_NUMKEYS) {
 275                         logger(options,CRYPT_LOG_ERROR,"All slots full");
 276                         return -EINVAL;
 277                 }
 278                 return i;
 279         }
 280 }
 281
 282 static int __crypt_create_device(int reload, struct crypt_options *options)
 283 {
 284         struct device_infos infos;
 285         char *key = NULL;
 286         unsigned int keyLen;
 287         char *processed_key = NULL;
 288         int r;
 289
 290         r = dm_status_device(options->name);
 291         if (reload) {
 292                 if (r < 0)
 293                         return r;
 294         } else {
 295                 if (r >= 0) {
 296                         set_error("Device %s already exists.", options->name);
 297                         return -EEXIST;
 298                 }
 299                 if (r != -ENODEV)
 300                         return r;
 301         }
 302
 303         if (options->key_size < 0 || options->key_size > 1024) {
 304                 set_error("Invalid key size");
 305                 return -EINVAL;
 306         }
 307
 308         if (get_device_infos(options->device, &infos) < 0)
 309                 return -ENOTBLK;
 310
 311         if (!options->size) {
 312                 options->size = infos.size;
 313                 if (!options->size) {
 314                         set_error("Not a block device");
 315                         return -ENOTBLK;
 316                 }
 317                 if (options->size <= options->offset) {
 318                         set_error("Invalid offset");
 319                         return -EINVAL;
 320                 }
 321                 options->size -= options->offset;
 322         }
 323
 324         if (infos.readonly)
 325                 options->flags |= CRYPT_FLAG_READONLY;
 326
 327         get_key("Enter passphrase: ", &key, &keyLen, options->key_size, options->key_file, options->passphrase_fd, options->timeout, options->flags);
 328         if (!key) {
 329                 set_error("Key reading error");
 330                 return -ENOENT;
 331         }
 332
 333         processed_key = process_key(options,key,keyLen);
 334         safe_free(key);
 335
 336         if (!processed_key) {
 337                 const char *error=get_error();
 338                 if(error) {
 339                         char *c_error_handling_sucks = NULL;
 340                         if (asprintf(&c_error_handling_sucks,"Key processing error: %s",error) > 0)
 341                                 set_error(c_error_handling_sucks);
 342                         free(c_error_handling_sucks);
 343                 } else
 344                         set_error("Key processing error");
 345                 return -ENOENT;
 346         }
 347
 348         r = dm_create_device(options->name, options->device, options->cipher,
 349                              NULL, options->size, options->skip, options->offset,
 350                              options->key_size, processed_key,
 351                              options->flags & CRYPT_FLAG_READONLY, reload);
 352
 353         safe_free(processed_key);
 354
 355         return r;
 356 }
 357
 358 static int __crypt_query_device(int details, struct crypt_options *options)
 359 {
 360         int read_only, r;
 361
 362         r = dm_status_device(options->name);
 363         if (r == -ENODEV)
 364                 return 0;
 365
 366         r = dm_query_device(options->name, (char **)&options->device, &options->size,
 367                             &options->skip, &options->offset, (char **)&options->cipher,
 368                             &options->key_size, NULL, &read_only);
 369
 370         if (r < 0)
 371                 return r;
 372
 373         if (read_only)
 374                 options->flags |= CRYPT_FLAG_READONLY;
 375
 376         options->flags |= CRYPT_FLAG_FREE_DEVICE;
 377         options->flags |= CRYPT_FLAG_FREE_CIPHER;
 378
 379         return 1;
 380 }
 381
 382 static int __crypt_resize_device(int details, struct crypt_options *options)
 383 {
 384         char *device, *cipher, *key = NULL;
 385         uint64_t size, skip, offset;
 386         int key_size, read_only, r;
 387         struct device_infos infos;
 388
 389         r = dm_query_device(options->name, &device, &size, &skip, &offset,
 390                             &cipher, &key_size, &key, &read_only);
 391         if (r < 0)
 392                 return r;
 393
 394         if (get_device_infos(device, &infos) < 0)
 395                 return -EINVAL;
 396
 397         if (!options->size) {
 398                 options->size = infos.size;
 399                 if (!options->size) {
 400                         set_error("Not a block device");
 401                         return -ENOTBLK;
 402                 }
 403                 if (options->size <= offset) {
 404                         set_error("Invalid offset");
 405                         return -EINVAL;
 406                 }
 407                 options->size -= offset;
 408         }
 409         size = options->size;
 410
 411         if (infos.readonly)
 412                 options->flags |= CRYPT_FLAG_READONLY;
 413
 414         r = dm_create_device(options->name, device, cipher, NULL, size, skip, offset,
 415                              key_size, key, read_only, 1);
 416
 417         safe_free(key);
 418         free(cipher);
 419         free(device);
 420
 421         return r;
 422 }
 423
 424 static int __crypt_remove_device(int arg, struct crypt_options *options)
 425 {
 426         int r;
 427
 428         r = dm_status_device(options->name);
 429         if (r < 0)
 430                 return r;
 431         if (r > 0) {
 432                 set_error("Device busy");
 433                 return -EBUSY;
 434         }
 435
 436         return dm_remove_device(options->name, 0, 0);
 437 }
 438
 439 static int __crypt_luks_format(int arg, struct crypt_options *options)
 440 {
 441         int r;
 442
 443         struct luks_phdr header;
 444         struct luks_masterkey *mk=NULL;
 445         char *password=NULL;
 446         char cipherName[LUKS_CIPHERNAME_L];
 447         char cipherMode[LUKS_CIPHERMODE_L];
 448         unsigned int passwordLen;
 449         unsigned int PBKDF2perSecond = 0;
 450         int keyIndex;
 451
 452         if (!LUKS_device_ready(options->device, O_RDWR | O_EXCL))
 453                 return -ENOTBLK;
 454
 455         mk = LUKS_generate_masterkey(options->key_size);
 456         if(NULL == mk) return -ENOMEM; // FIXME This may be misleading, since we don't know what went wrong
 457
 458 #ifdef LUKS_DEBUG
 459 #define printoffset(entry) \
 460         logger(options, CRYPT_LOG_ERROR, \
 461                 "offset of " #entry " = %d\n", (char *)(&header.entry)-(char *)(&header))
 462
 463         logger(options, CRYPT_LOG_ERROR,
 464                 "sizeof phdr %d, sizeof key slot %d\n",
 465                 sizeof(struct luks_phdr),
 466                 sizeof(header.keyblock[0]));
 467
 468         printoffset(magic);
 469         printoffset(version);
 470         printoffset(cipherName);
 471         printoffset(cipherMode);
 472         printoffset(hashSpec);
 473         printoffset(payloadOffset);
 474         printoffset(keyBytes);
 475         printoffset(mkDigest);
 476         printoffset(mkDigestSalt);
 477         printoffset(mkDigestIterations);
 478         printoffset(uuid);
 479 #endif
 480
 481         r = parse_into_name_and_mode(options->cipher, cipherName, cipherMode);
 482         if(r < 0) return r;
 483
 484         r = LUKS_generate_phdr(&header, mk, cipherName, cipherMode, options->hash, LUKS_STRIPES, options->align_payload);
 485         if(r < 0) return r;
 486
 487         keyIndex = keyslot_from_option(options->key_slot, &header, options);
 488         if(keyIndex == -EINVAL) {
 489                 r = -EINVAL; goto out;
 490         }
 491
 492         r = LUKS_benchmarkt_iterations(options->hash, &PBKDF2perSecond);
 493         if (r < 0) goto out;
 494
 495         header.keyblock[keyIndex].passwordIterations = at_least_one(PBKDF2perSecond * ((float)options->iteration_time / 1000.0));
 496 #ifdef LUKS_DEBUG
 497         logger(options, CRYPT_LOG_ERROR, "pitr %d\n", header.keyblock[0].passwordIterations);
 498 #endif
 499         get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->new_key_file, options->passphrase_fd, options->timeout, options->flags);
 500         if(!password) {
 501                 r = -EINVAL; goto out;
 502         }
 503
 504         /* Wipe first 8 sectors - fs magic numbers etc. */
 505         r = wipe_device_header(options->device, 8);
 506         if(r < 0) goto out;
 507
 508         /* Set key, also writes phdr */
 509         r = LUKS_set_key(options->device, keyIndex, password, passwordLen, &header, mk);
 510         if(r < 0) goto out;
 511
 512         r = 0;
 513 out:
 514         LUKS_dealloc_masterkey(mk);
 515         safe_free(password);
 516         return r;
 517 }
 518
 519 static int __crypt_luks_open(int arg, struct crypt_options *options)
 520 {
 521         struct luks_masterkey *mk=NULL;
 522         struct luks_phdr hdr;
 523         char *prompt = NULL;
 524         char *password;
 525         unsigned int passwordLen;
 526         struct device_infos infos;
 527         char *dmCipherSpec = NULL;
 528         int r, tries = options->tries;
 529         int excl = (options->flags & CRYPT_FLAG_NON_EXCLUSIVE_ACCESS) ? 0 : O_EXCL ;
 530
 531         r = dm_status_device(options->name);
 532         if (r >= 0) {
 533                 set_error("Device %s already exists.", options->name);
 534                 return -EEXIST;
 535         }
 536
 537         if (!LUKS_device_ready(options->device, O_RDONLY | excl))
 538                 return -ENOTBLK;
 539
 540         if (get_device_infos(options->device, &infos) < 0) {
 541                 set_error("Can't get device information.\n");
 542                 return -ENOTBLK;
 543         }
 544
 545         if (infos.readonly)
 546                 options->flags |= CRYPT_FLAG_READONLY;
 547
 548         if(asprintf(&prompt, "Enter LUKS passphrase for %s: ", options->device) < 0)
 549                 return -ENOMEM;
 550
 551 start:
 552         mk=NULL;
 553
 554         if(options->passphrase) {
 555                 passwordLen = strlen(options->passphrase);
 556                 password = safe_alloc(passwordLen + 1);
 557                 strncpy(password, options->passphrase, passwordLen + 1);
 558                 tries = 0;
 559         } else if(get_key(prompt, &password, &passwordLen, options->key_size, options->key_file, options->passphrase_fd, options->timeout, options->flags))
 560                 tries--;
 561         else
 562                 tries = 0;
 563
 564         if(!password) {
 565                 r = -EINVAL; goto out;
 566         }
 567
 568         r = LUKS_open_any_key(options->device, password, passwordLen, &hdr, &mk);
 569         if (r == -EPERM)
 570                 set_error("No key available with this passphrase.\n");
 571         if (r < 0)
 572                 goto out1;
 573
 574         logger(options, CRYPT_LOG_NORMAL,"key slot %d unlocked.\n", r);
 575
 576
 577         options->offset = hdr.payloadOffset;
 578         if (asprintf(&dmCipherSpec, "%s-%s", hdr.cipherName, hdr.cipherMode) < 0) {
 579                 r = -ENOMEM;
 580                 goto out2;
 581         }
 582         options->cipher = dmCipherSpec;
 583         options->key_size = mk->keyLength;
 584         options->skip = 0;
 585
 586         options->size = infos.size;
 587         if (!options->size) {
 588                 set_error("Not a block device.\n");
 589                 r = -ENOTBLK; goto out2;
 590         }
 591         if (options->size <= options->offset) {
 592                 set_error("Invalid offset");
 593                 r = -EINVAL; goto out2;
 594         }
 595         options->size -= options->offset;
 596         /* FIXME: code allows multiple crypt mapping, cannot use uuid then.
 597          * anyway, it is dangerous and can corrupt data. Remove it in next version! */
 598         r = dm_create_device(options->name, options->device, options->cipher,
 599                              excl ? hdr.uuid : NULL, options->size,
 600                              0, options->offset, mk->keyLength, mk->key,
 601                              options->flags & CRYPT_FLAG_READONLY, 0);
 602
 603  out2:
 604         free(dmCipherSpec);
 605         dmCipherSpec = NULL;
 606  out1:
 607         safe_free(password);
 608  out:
 609         LUKS_dealloc_masterkey(mk);
 610         if (r == -EPERM && tries > 0)
 611                 goto start;
 612
 613         free(prompt);
 614
 615         return r;
 616 }
 617
 618 static int __crypt_luks_add_key(int arg, struct crypt_options *options)
 619 {
 620         struct luks_masterkey *mk=NULL;
 621         struct luks_phdr hdr;
 622         char *password=NULL; unsigned int passwordLen;
 623         unsigned int keyIndex;
 624         unsigned int PBKDF2perSecond = 0;
 625         const char *device = options->device;
 626         int r;
 627
 628         if (!LUKS_device_ready(options->device, O_RDWR))
 629                 return -ENOTBLK;
 630
 631         r = LUKS_read_phdr(device, &hdr);
 632         if(r < 0) return r;
 633
 634
 635         keyIndex = keyslot_from_option(options->key_slot, &hdr, options);
 636         if(keyIndex == -EINVAL) {
 637                 r = -EINVAL; goto out;
 638         }
 639
 640         get_key("Enter any LUKS passphrase: ",
 641                 &password,
 642                 &passwordLen,
 643                 0,
 644                 options->key_file,
 645                 options->passphrase_fd,
 646                 options->timeout,
 647                 options->flags & ~(CRYPT_FLAG_VERIFY | CRYPT_FLAG_VERIFY_IF_POSSIBLE));
 648
 649         if(!password) {
 650                 r = -EINVAL; goto out;
 651         }
 652         r = LUKS_open_any_key(device, password, passwordLen, &hdr, &mk);
 653         if(r < 0) {
 654                 options->icb->log(CRYPT_LOG_ERROR,"No key available with this passphrase.\n");
 655                 r = -EPERM; goto out;
 656         } else
 657                 logger(options, CRYPT_LOG_NORMAL,"key slot %d unlocked.\n", r);
 658
 659         safe_free(password);
 660
 661         get_key("Enter new passphrase for key slot: ",
 662                 &password,
 663                 &passwordLen,
 664                 0,
 665                 options->new_key_file,
 666                 options->passphrase_fd,
 667                 options->timeout,
 668                 options->flags);
 669         if(!password) {
 670                 r = -EINVAL; goto out;
 671         }
 672
 673         r = LUKS_benchmarkt_iterations(hdr.hashSpec, &PBKDF2perSecond);
 674         if (r < 0) goto out;
 675         hdr.keyblock[keyIndex].passwordIterations = at_least_one(PBKDF2perSecond * ((float)options->iteration_time / 1000));
 676
 677         r = LUKS_set_key(device, keyIndex, password, passwordLen, &hdr, mk);
 678         if(r < 0) goto out;
 679
 680         r = 0;
 681 out:
 682         safe_free(password);
 683         LUKS_dealloc_masterkey(mk);
 684         return r;
 685 }
 686
 687 static int luks_remove_helper(int arg, struct crypt_options *options, int supply_it)
 688 {
 689         struct luks_masterkey *mk;
 690         struct luks_phdr hdr;
 691         char *password=NULL;
 692         unsigned int passwordLen;
 693         const char *device = options->device;
 694         int keyIndex;
 695         int openedIndex;
 696         int r, last_slot;
 697
 698         if (!LUKS_device_ready(options->device, O_RDWR))
 699             return -ENOTBLK;
 700
 701         if(supply_it) {
 702                 get_key("Enter LUKS passphrase to be deleted: ",&password,&passwordLen, 0, options->new_key_file,
 703                         options->passphrase_fd, options->timeout, options->flags);
 704                 if(!password) {
 705                         r = -EINVAL; goto out;
 706                 }
 707
 708                 keyIndex = LUKS_open_any_key(device, password, passwordLen, &hdr, &mk);
 709                 if(keyIndex < 0) {
 710                         options->icb->log(CRYPT_LOG_ERROR,"No remaining key available with this passphrase.\n");
 711                         r = -EPERM; goto out;
 712                 } else
 713                         logger(options, CRYPT_LOG_NORMAL,"key slot %d selected for deletion.\n", keyIndex);
 714
 715                 safe_free(password);
 716                 password = NULL;
 717         } else {
 718                 keyIndex = options->key_slot;
 719                 if (!keyslot_is_valid(keyIndex, options)) {
 720                         r = -EINVAL; goto out;
 721                 }
 722         }
 723
 724         last_slot = LUKS_is_last_keyslot(options->device, keyIndex);
 725         if(last_slot && !(options->icb->yesDialog(_("This is the last keyslot. Device will become unusable after purging this key.")))) {
 726                 r = -EINVAL; goto out;
 727         }
 728
 729         if(options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY) {
 730                 options->flags &= ~CRYPT_FLAG_VERIFY_ON_DELKEY;
 731                 get_key("Enter any remaining LUKS passphrase: ",&password,&passwordLen, 0, options->key_file, options->passphrase_fd, options->timeout, options->flags);
 732                 if(!password) {
 733                         r = -EINVAL; goto out;
 734                 }
 735
 736                 r = LUKS_read_phdr(device, &hdr);
 737                 if(r < 0) {
 738                         options->icb->log(CRYPT_LOG_ERROR,"Failed to access device.\n");
 739                         r = -EIO; goto out;
 740                 }
 741
 742                 if(!last_slot)
 743                         hdr.keyblock[keyIndex].active = LUKS_KEY_DISABLED;
 744
 745                 openedIndex = LUKS_open_any_key_with_hdr(device, password, passwordLen, &hdr, &mk);
 746                 /* Clean up */
 747                 if (openedIndex >= 0) {
 748                         LUKS_dealloc_masterkey(mk);
 749                         mk = NULL;
 750                 }
 751                 if(openedIndex < 0) {
 752                             options->icb->log(CRYPT_LOG_ERROR,"No remaining key available with this passphrase.\n");
 753                             r = -EPERM; goto out;
 754                 } else
 755                         logger(options, CRYPT_LOG_NORMAL,"key slot %d verified.\n", openedIndex);
 756         }
 757         r = LUKS_del_key(device, keyIndex);
 758         if(r < 0) goto out;
 759
 760         r = 0;
 761 out:
 762         safe_free(password);
 763         return r;
 764 }
 765
 766 static int __crypt_luks_kill_slot(int arg, struct crypt_options *options) {
 767         return luks_remove_helper(arg, options, 0);
 768 }
 769
 770 static int __crypt_luks_remove_key(int arg, struct crypt_options *options) {
 771         return luks_remove_helper(arg, options, 1);
 772 }
 773
 774
 775 static int crypt_job(int (*job)(int arg, struct crypt_options *options),
 776                      int arg, struct crypt_options *options)
 777 {
 778         int r;
 779
 780         if (setup_enter(options->icb->log) < 0) {
 781                 r = -ENOSYS;
 782                 goto out;
 783         }
 784
 785         r = job(arg, options);
 786 out:
 787         setup_leave();
 788
 789         if (r >= 0)
 790                 set_error(NULL);
 791
 792         return r;
 793 }
 794
 795 int crypt_create_device(struct crypt_options *options)
 796 {
 797         return crypt_job(__crypt_create_device, 0, options);
 798 }
 799
 800 int crypt_update_device(struct crypt_options *options)
 801 {
 802         return crypt_job(__crypt_create_device, 1, options);
 803 }
 804
 805 int crypt_resize_device(struct crypt_options *options)
 806 {
 807         return crypt_job(__crypt_resize_device, 0, options);
 808 }
 809
 810 int crypt_query_device(struct crypt_options *options)
 811 {
 812         return crypt_job(__crypt_query_device, 1, options);
 813 }
 814
 815 int crypt_remove_device(struct crypt_options *options)
 816 {
 817         return crypt_job(__crypt_remove_device, 0, options);
 818
 819 }
 820
 821 int crypt_luksFormat(struct crypt_options *options)
 822 {
 823         return crypt_job(__crypt_luks_format, 0, options);
 824 }
 825
 826 int crypt_luksOpen(struct crypt_options *options)
 827 {
 828         return crypt_job(__crypt_luks_open, 0, options);
 829 }
 830
 831 int crypt_luksKillSlot(struct crypt_options *options)
 832 {
 833         return crypt_job(__crypt_luks_kill_slot, 0, options);
 834 }
 835
 836 int crypt_luksRemoveKey(struct crypt_options *options)
 837 {
 838         return crypt_job(__crypt_luks_remove_key, 0, options);
 839 }
 840
 841 int crypt_luksAddKey(struct crypt_options *options)
 842 {
 843         return crypt_job(__crypt_luks_add_key, 0, options);
 844 }
 845
 846 int crypt_luksUUID(struct crypt_options *options)
 847 {
 848         struct luks_phdr hdr;
 849         int r;
 850
 851         r = LUKS_read_phdr(options->device,&hdr);
 852         if(r < 0) return r;
 853
 854         options->icb->log(CRYPT_LOG_NORMAL,hdr.uuid);
 855         options->icb->log(CRYPT_LOG_NORMAL,"\n");
 856         return 0;
 857 }
 858
 859 int crypt_isLuks(struct crypt_options *options)
 860 {
 861         struct luks_phdr hdr;
 862         return LUKS_read_phdr(options->device,&hdr);
 863 }
 864
 865 int crypt_luksDump(struct crypt_options *options)
 866 {
 867         struct luks_phdr hdr;
 868         int r,i;
 869
 870         r = LUKS_read_phdr(options->device,&hdr);
 871         if(r < 0) return r;
 872
 873         logger(options, CRYPT_LOG_NORMAL, "LUKS header information for %s\n\n",options->device);
 874         logger(options, CRYPT_LOG_NORMAL, "Version:       \t%d\n",hdr.version);
 875         logger(options, CRYPT_LOG_NORMAL, "Cipher name:   \t%s\n",hdr.cipherName);
 876         logger(options, CRYPT_LOG_NORMAL, "Cipher mode:   \t%s\n",hdr.cipherMode);
 877         logger(options, CRYPT_LOG_NORMAL, "Hash spec:     \t%s\n",hdr.hashSpec);
 878         logger(options, CRYPT_LOG_NORMAL, "Payload offset:\t%d\n",hdr.payloadOffset);
 879         logger(options, CRYPT_LOG_NORMAL, "MK bits:       \t%d\n",hdr.keyBytes*8);
 880         logger(options, CRYPT_LOG_NORMAL, "MK digest:     \t");
 881         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigest,LUKS_DIGESTSIZE);
 882         logger(options, CRYPT_LOG_NORMAL, "\n");
 883         logger(options, CRYPT_LOG_NORMAL, "MK salt:       \t");
 884         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigestSalt,LUKS_SALTSIZE/2);
 885         logger(options, CRYPT_LOG_NORMAL, "\n               \t");
 886         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigestSalt+LUKS_SALTSIZE/2,LUKS_SALTSIZE/2);
 887         logger(options, CRYPT_LOG_NORMAL, "\n");
 888         logger(options, CRYPT_LOG_NORMAL, "MK iterations: \t%d\n",hdr.mkDigestIterations);
 889         logger(options, CRYPT_LOG_NORMAL, "UUID:          \t%s\n\n",hdr.uuid);
 890         for(i=0;i<LUKS_NUMKEYS;i++) {
 891                 if(hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
 892                         logger(options, CRYPT_LOG_NORMAL, "Key Slot %d: ENABLED\n",i);
 893                         logger(options, CRYPT_LOG_NORMAL, "\tIterations:         \t%d\n",hdr.keyblock[i].passwordIterations);
 894                         logger(options, CRYPT_LOG_NORMAL, "\tSalt:               \t");
 895                         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.keyblock[i].passwordSalt,LUKS_SALTSIZE/2);
 896                         logger(options, CRYPT_LOG_NORMAL, "\n\t                      \t");
 897                         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.keyblock[i].passwordSalt+LUKS_SALTSIZE/2,LUKS_SALTSIZE/2);
 898                         logger(options, CRYPT_LOG_NORMAL, "\n");
 899
 900                         logger(options, CRYPT_LOG_NORMAL, "\tKey material offset:\t%d\n",hdr.keyblock[i].keyMaterialOffset);
 901                         logger(options, CRYPT_LOG_NORMAL, "\tAF stripes:            \t%d\n",hdr.keyblock[i].stripes);
 902                 }
 903                 else
 904                         logger(options, CRYPT_LOG_NORMAL, "Key Slot %d: DISABLED\n",i);
 905         }
 906         return 0;
 907 }
 908
 909
 910 void crypt_get_error(char *buf, size_t size)
 911 {
 912         const char *error = get_error();
 913
 914         if (!buf || size < 1)
 915                 set_error(NULL);
 916         else if (error) {
 917                 strncpy(buf, error, size - 1);
 918                 buf[size - 1] = '\0';
 919                 set_error(NULL);
 920         } else
 921                 buf[0] = '\0';
 922 }
 923
 924 void crypt_put_options(struct crypt_options *options)
 925 {
 926         if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
 927                 free((char *)options->device);
 928                 options->device = NULL;
 929                 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
 930         }
 931         if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
 932                 free((char *)options->cipher);
 933                 options->cipher = NULL;
 934                 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
 935         }
 936 }
 937
 938 const char *crypt_get_dir(void)
 939 {
 940         return dm_get_dir();
 941 }