8 #include "libcryptsetup.h"
16 struct volume_key *volume_key;
18 uint64_t iteration_time;
22 /* used in CRYPT_LUKS1 */
24 uint64_t PBKDF2_per_sec;
26 /* used in CRYPT_PLAIN */
27 struct crypt_params_plain plain_hdr;
29 char *plain_cipher_mode;
32 /* callbacks definitions */
33 void (*log)(int level, const char *msg, void *usrptr);
35 int (*confirm)(const char *msg, void *usrptr);
37 int (*password)(const char *msg, char *buf, size_t length, void *usrptr);
38 void *password_usrptr;
42 static void (*_default_log)(int level, const char *msg, void *usrptr) = NULL;
43 static int _debug_level = 0;
45 void crypt_set_debug_level(int level)
50 int crypt_get_debug_level()
55 void crypt_log(struct crypt_device *cd, int level, const char *msg)
58 cd->log(level, msg, cd->log_usrptr);
59 else if (_default_log)
60 _default_log(level, msg, NULL);
63 void logger(struct crypt_device *cd, int level, const char *file,
64 int line, const char *format, ...)
69 va_start(argp, format);
71 if (vasprintf(&target, format, argp) > 0) {
73 crypt_log(cd, level, target);
75 } else if (_debug_level)
76 printf("# %s:%d %s\n", file ?: "?", line, target);
78 } else if (_debug_level)
79 printf("# %s\n", target);
88 * Password processing behaviour matrix of process_key
90 * from binary file: check if there is sufficently large key material
91 * interactive & from fd: hash if requested, otherwise crop or pad with '0'
93 static char *process_key(struct crypt_device *cd, const char *hash_name,
94 const char *key_file, size_t key_size,
95 const char *pass, size_t passLen)
97 char *key = safe_alloc(key_size);
98 memset(key, 0, key_size);
100 /* key is coming from binary file */
101 if (key_file && strcmp(key_file, "-")) {
102 if(passLen < key_size) {
103 log_err(cd, _("Cannot not read %d bytes from key file %s.\n"),
108 memcpy(key, pass, key_size);
112 /* key is coming from tty, fd or binary stdin */
114 if (hash(NULL, hash_name, key, key_size, pass, passLen) < 0) {
115 log_err(cd, _("Key processing error (using hash algorithm %s).\n"),
120 } else if (passLen > key_size) {
121 memcpy(key, pass, key_size);
123 memcpy(key, pass, passLen);
129 static int isPLAIN(const char *type)
131 return (type && !strcmp(CRYPT_PLAIN, type));
134 static int isLUKS(const char *type)
136 return (type && !strcmp(CRYPT_LUKS1, type));
139 /* keyslot helpers */
140 static int keyslot_verify_or_find_empty(struct crypt_device *cd, int *keyslot)
142 if (*keyslot == CRYPT_ANY_SLOT) {
143 *keyslot = LUKS_keyslot_find_empty(&cd->hdr);
145 log_err(cd, _("All key slots full.\n"));
150 switch (LUKS_keyslot_info(&cd->hdr, *keyslot)) {
151 case CRYPT_SLOT_INVALID:
152 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
153 *keyslot, LUKS_NUMKEYS - 1);
155 case CRYPT_SLOT_INACTIVE:
158 log_err(cd, _("Key slot %d is full, please select another one.\n"),
166 static int verify_other_keyslot(struct crypt_device *cd,
167 const char *key_file,
171 struct volume_key *vk;
172 crypt_keyslot_info ki;
174 char *password = NULL;
175 unsigned int passwordLen;
177 get_key(_("Enter any remaining LUKS passphrase: "), &password,
178 &passwordLen, 0, key_file, cd->timeout, flags, cd);
182 ki = crypt_keyslot_status(cd, keyIndex);
183 if (ki == CRYPT_SLOT_ACTIVE) /* Not last slot */
184 LUKS_keyslot_set(&cd->hdr, keyIndex, 0);
186 openedIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT,
187 password, passwordLen,
190 if (ki == CRYPT_SLOT_ACTIVE)
191 LUKS_keyslot_set(&cd->hdr, keyIndex, 1);
192 crypt_free_volume_key(vk);
198 log_verbose(cd, _("Key slot %d verified.\n"), openedIndex);
202 static int find_keyslot_by_passphrase(struct crypt_device *cd,
203 const char *key_file,
207 struct volume_key *vk;
208 char *password = NULL;
209 unsigned int passwordLen;
212 get_key(message,&password,&passwordLen, 0, key_file,
213 cd->timeout, flags, cd);
217 keyIndex = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
218 passwordLen, &cd->hdr, &vk, cd);
219 crypt_free_volume_key(vk);
225 static int device_check_and_adjust(struct crypt_device *cd,
227 uint64_t *size, uint64_t *offset,
230 struct device_infos infos;
232 if (!device || get_device_infos(device, &infos, cd) < 0) {
233 log_err(cd, _("Cannot get info about device %s.\n"),
241 log_err(cd, _("Device %s has zero size.\n"), device);
244 if (*size < *offset) {
245 log_err(cd, _("Device %s is too small.\n"), device);
254 log_dbg("Calculated device size is %" PRIu64 " sectors (%s), offset %" PRIu64 ".",
255 *size, *read_only ? "RO" : "RW", *offset);
259 static int luks_remove_helper(struct crypt_device *cd,
261 const char *other_key_file,
262 const char *key_file,
265 crypt_keyslot_info ki;
268 if (key_slot == CRYPT_ANY_SLOT) {
269 key_slot = find_keyslot_by_passphrase(cd, key_file, 0,
270 _("Enter LUKS passphrase to be deleted: "));
276 log_std(cd, _("key slot %d selected for deletion.\n"), key_slot);
279 ki = crypt_keyslot_status(cd, key_slot);
280 if (ki == CRYPT_SLOT_INVALID) {
281 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
282 key_slot, LUKS_NUMKEYS - 1);
286 if (ki <= CRYPT_SLOT_INACTIVE) {
287 log_err(cd, _("Key %d not active. Can't wipe.\n"), key_slot);
292 if (ki == CRYPT_SLOT_ACTIVE_LAST && cd->confirm &&
293 !(cd->confirm(_("This is the last keyslot."
294 " Device will become unusable after purging this key."),
295 cd->confirm_usrptr))) {
301 r = verify_other_keyslot(cd, other_key_file, 0, key_slot);
306 r = crypt_keyslot_destroy(cd, key_slot);
308 return (r < 0) ? r : 0;
311 static int create_device_helper(struct crypt_device *cd,
315 const char *cipher_mode,
316 const char *key_file,
328 crypt_status_info ci;
329 char *dm_cipher = NULL;
330 char *processed_key = NULL;
336 ci = crypt_status(cd, name);
337 if (ci == CRYPT_INVALID)
340 if (reload && ci < CRYPT_ACTIVE)
343 if (!reload && ci >= CRYPT_ACTIVE) {
344 log_err(cd, _("Device %s already exists.\n"), name);
348 if (key_size < 0 || key_size > 1024) {
349 log_err(cd, _("Invalid key size %d.\n"), key_size);
353 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
357 if (cipher_mode && asprintf(&dm_cipher, "%s-%s", cipher, cipher_mode) < 0)
360 processed_key = process_key(cd, hash, key_file, key_size, key, keyLen);
364 r = dm_create_device(name, cd->device, dm_cipher ?: cipher, cd->type, uuid, size, skip, offset,
365 key_size, processed_key, read_only, reload);
368 safe_free(processed_key);
372 static int open_from_hdr_and_vk(struct crypt_device *cd,
373 struct volume_key *vk,
377 uint64_t size, offset;
379 int read_only, no_uuid, r;
382 offset = crypt_get_data_offset(cd);
383 read_only = flags & CRYPT_ACTIVATE_READONLY;
384 no_uuid = flags & CRYPT_ACTIVATE_NO_UUID;
386 r = device_check_and_adjust(cd, cd->device, &size, &offset, &read_only);
390 if (asprintf(&cipher, "%s-%s", crypt_get_cipher(cd),
391 crypt_get_cipher_mode(cd)) < 0)
394 r = dm_create_device(name, cd->device, cipher, cd->type,
395 no_uuid ? NULL : crypt_get_uuid(cd),
396 size, 0, offset, vk->keylength, vk->key,
402 static void log_wrapper(int level, const char *msg, void *usrptr)
404 void (*xlog)(int level, char *msg) = usrptr;
405 xlog(level, (char *)msg);
408 static int yesDialog_wrapper(const char *msg, void *usrptr)
410 int (*xyesDialog)(char *msg) = usrptr;
411 return xyesDialog((char*)msg);
414 int crypt_confirm(struct crypt_device *cd, const char *msg)
416 if (!cd || !cd->confirm)
419 return cd->confirm(msg, cd->confirm_usrptr);
422 static void key_from_terminal(struct crypt_device *cd, char *msg, char **key,
423 unsigned int *key_len, int force_verify)
428 *key = safe_alloc(MAX_TTY_PASSWORD_LEN);
431 r = cd->password(msg, *key, (size_t)key_len, cd->password_usrptr);
438 if (force_verify || cd->password_verify)
439 flags |= CRYPT_FLAG_VERIFY_IF_POSSIBLE;
440 get_key(msg, key, key_len, 0, NULL, cd->timeout, flags, cd);
444 static int volume_key_by_terminal_passphrase(struct crypt_device *cd, int keyslot,
445 struct volume_key **vk)
447 char *prompt = NULL, *passphrase_read = NULL;
448 unsigned int passphrase_size_read;
449 int r = -EINVAL, tries = cd->tries;
451 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
457 crypt_free_volume_key(*vk);
460 key_from_terminal(cd, prompt, &passphrase_read,
461 &passphrase_size_read, 0);
462 if(!passphrase_read) {
467 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
468 passphrase_size_read, &cd->hdr, vk, cd);
469 safe_free(passphrase_read);
470 passphrase_read = NULL;
471 } while (r == -EPERM && (--tries > 0));
474 crypt_free_volume_key(*vk);
483 static void key_from_file(struct crypt_device *cd, char *msg,
484 char **key, unsigned int *key_len,
485 const char *key_file, size_t key_size)
487 get_key(msg, key, key_len, key_size, key_file, cd->timeout, 0, cd);
490 static int _crypt_init(struct crypt_device **cd,
492 struct crypt_options *options,
493 int load, int need_dm)
497 /* if it is plain device and mapping table is being reloaded
498 initialize it by name*/
499 init_by_name = (type && !strcmp(type, CRYPT_PLAIN) && load);
501 /* Some of old API calls do not require DM in kernel,
502 fake initialisation by initialise it with kernel_check disabled */
504 (void)dm_init(NULL, 0);
506 r = crypt_init_by_name(cd, options->name);
508 r = crypt_init(cd, options->device);
515 crypt_set_log_callback(*cd, log_wrapper, options->icb->log);
516 crypt_set_confirm_callback(*cd, yesDialog_wrapper, options->icb->yesDialog);
518 crypt_set_timeout(*cd, options->timeout);
519 crypt_set_password_retry(*cd, options->tries);
520 crypt_set_iterarion_time(*cd, options->iteration_time ?: 1000);
521 crypt_set_password_verify(*cd, options->flags & CRYPT_FLAG_VERIFY);
523 if (load && !init_by_name)
524 r = crypt_load(*cd, type, NULL);
526 if (!r && type && !(*cd)->type) {
527 (*cd)->type = strdup(type);
538 void crypt_set_log_callback(struct crypt_device *cd,
539 void (*log)(int level, const char *msg, void *usrptr),
546 cd->log_usrptr = usrptr;
550 void crypt_set_confirm_callback(struct crypt_device *cd,
551 int (*confirm)(const char *msg, void *usrptr),
554 cd->confirm = confirm;
555 cd->confirm_usrptr = usrptr;
558 void crypt_set_password_callback(struct crypt_device *cd,
559 int (*password)(const char *msg, char *buf, size_t length, void *usrptr),
562 cd->password = password;
563 cd->password_usrptr = usrptr;
566 /* OPTIONS: name, cipher, device, hash, key_file, key_size, key_slot,
567 * offset, size, skip, timeout, tries, passphrase_fd (ignored),
569 static int crypt_create_and_update_device(struct crypt_options *options, int update)
571 struct crypt_device *cd = NULL;
576 r = _crypt_init(&cd, CRYPT_PLAIN, options, 0, 1);
580 get_key(_("Enter passphrase: "), &key, &keyLen, options->key_size,
581 options->key_file, cd->timeout, options->flags, cd);
585 r = create_device_helper(cd, options->name, options->hash,
586 options->cipher, NULL, options->key_file, key, keyLen,
587 options->key_size, options->size, options->skip,
588 options->offset, NULL, options->flags & CRYPT_FLAG_READONLY,
589 options->flags, update);
596 int crypt_create_device(struct crypt_options *options)
598 return crypt_create_and_update_device(options, 0);
601 int crypt_update_device(struct crypt_options *options)
603 return crypt_create_and_update_device(options, 1);
606 /* OPTIONS: name, size, icb */
607 int crypt_resize_device(struct crypt_options *options)
609 struct crypt_device *cd = NULL;
610 char *device = NULL, *cipher = NULL, *uuid = NULL, *key = NULL;
612 uint64_t size, skip, offset;
613 int key_size, read_only, r;
615 log_dbg("Resizing device %s to %" PRIu64 " sectors.", options->name, options->size);
617 if (dm_init(NULL, 1) < 0)
620 r = dm_query_device(options->name, &device, &size, &skip, &offset,
621 &cipher, &key_size, &key, &read_only, NULL, &uuid);
623 log_err(NULL, _("Device %s is not active.\n"), options->name);
627 /* Try to determine type of device from UUID */
630 if (!strncmp(uuid, CRYPT_PLAIN, strlen(CRYPT_PLAIN))) {
634 } else if (!strncmp(uuid, CRYPT_LUKS1, strlen(CRYPT_LUKS1)))
638 if (!options->device)
639 options->device = device;
641 r = _crypt_init(&cd, type, options, 1, 1);
645 size = options->size;
646 r = device_check_and_adjust(cd, device, &size, &offset, &read_only);
650 r = dm_create_device(options->name, device, cipher, type,
651 crypt_get_uuid(cd), size, skip, offset,
652 key_size, key, read_only, 1);
656 if (options->device == device)
657 options->device = NULL;
665 /* OPTIONS: name, icb */
666 int crypt_query_device(struct crypt_options *options)
670 log_dbg("Query device %s.", options->name);
672 if (dm_init(NULL, 1) < 0)
675 r = dm_status_device(options->name);
679 r = dm_query_device(options->name, (char **)&options->device, &options->size,
680 &options->skip, &options->offset, (char **)&options->cipher,
681 &options->key_size, NULL, &read_only, NULL, NULL);
684 options->flags |= CRYPT_FLAG_READONLY;
686 options->flags |= CRYPT_FLAG_FREE_DEVICE;
687 options->flags |= CRYPT_FLAG_FREE_CIPHER;
699 /* OPTIONS: name, icb */
700 int crypt_remove_device(struct crypt_options *options)
702 struct crypt_device *cd = NULL;
705 r = crypt_init_by_name(&cd, options->name);
707 r = crypt_deactivate(cd, options->name);
714 /* OPTIONS: device, cipher, hash, align_payload, key_size (master key), key_slot
715 * new_key_file, iteration_time, timeout, flags, icb */
716 int crypt_luksFormat(struct crypt_options *options)
718 char cipherName[LUKS_CIPHERNAME_L];
719 char cipherMode[LUKS_CIPHERMODE_L];
721 unsigned int passwordLen;
722 struct crypt_device *cd = NULL;
723 struct crypt_params_luks1 cp = {
724 .hash = options->hash,
725 .data_alignment = options->align_payload
729 r = crypt_parse_name_and_mode(options->cipher, cipherName, cipherMode);
731 log_err(cd, _("No known cipher specification pattern detected.\n"));
735 if ((r = _crypt_init(&cd, CRYPT_LUKS1, options, 0, 1)))
738 if (options->key_slot >= LUKS_NUMKEYS && options->key_slot != CRYPT_ANY_SLOT) {
739 log_err(cd, _("Key slot %d is invalid, please select between 0 and %d.\n"),
740 options->key_slot, LUKS_NUMKEYS - 1);
745 get_key(_("Enter LUKS passphrase: "), &password, &passwordLen, 0,
746 options->new_key_file, options->timeout, options->flags, cd);
753 r = crypt_format(cd, CRYPT_LUKS1, cipherName, cipherMode,
754 NULL, NULL, options->key_size, &cp);
758 /* Add keyslot using internally stored volume key generated during format */
759 r = crypt_keyslot_add_by_volume_key(cd, options->key_slot, NULL, 0,
760 password, passwordLen);
764 return (r < 0) ? r : 0;
767 /* OPTIONS: name, device, key_size, key_file, timeout, tries, flags, icb */
768 int crypt_luksOpen(struct crypt_options *options)
770 struct crypt_device *cd = NULL;
777 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
781 if (options->flags & CRYPT_FLAG_READONLY)
782 flags |= CRYPT_ACTIVATE_READONLY;
784 if (options->flags & CRYPT_FLAG_NON_EXCLUSIVE_ACCESS)
785 flags |= CRYPT_ACTIVATE_NO_UUID;
787 if (options->key_file)
788 r = crypt_activate_by_keyfile(cd, options->name,
789 CRYPT_ANY_SLOT, options->key_file, options->key_size,
792 r = crypt_activate_by_passphrase(cd, options->name,
793 CRYPT_ANY_SLOT, options->passphrase,
794 options->passphrase ? strlen(options->passphrase) : 0,
798 return (r < 0) ? r : 0;
801 /* OPTIONS: device, keys_slot, key_file, timeout, flags, icb */
802 int crypt_luksKillSlot(struct crypt_options *options)
804 struct crypt_device *cd = NULL;
807 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
811 r = luks_remove_helper(cd, options->key_slot, options->key_file, NULL,
812 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
815 return (r < 0) ? r : 0;
818 /* OPTIONS: device, new_key_file, key_file, timeout, flags, icb */
819 int crypt_luksRemoveKey(struct crypt_options *options)
821 struct crypt_device *cd = NULL;
824 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
828 r = luks_remove_helper(cd, CRYPT_ANY_SLOT, options->key_file, options->new_key_file,
829 options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY);
832 return (r < 0) ? r : 0;
836 /* OPTIONS: device, new_key_file, key_file, key_slot, flags,
837 iteration_time, timeout, icb */
838 int crypt_luksAddKey(struct crypt_options *options)
840 struct crypt_device *cd = NULL;
843 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 1);
847 if (options->key_file || options->new_key_file)
848 r = crypt_keyslot_add_by_keyfile(cd, options->key_slot,
849 options->key_file, 0,
850 options->new_key_file, 0);
852 r = crypt_keyslot_add_by_passphrase(cd, options->key_slot,
856 return (r < 0) ? r : 0;
859 /* OPTIONS: device, icb */
860 int crypt_luksUUID(struct crypt_options *options)
862 struct crypt_device *cd = NULL;
866 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
870 uuid = (char *)crypt_get_uuid(cd);
871 log_std(cd, uuid ?: "");
877 /* OPTIONS: device, icb */
878 int crypt_isLuks(struct crypt_options *options)
880 struct crypt_device *cd = NULL;
883 log_dbg("Check device %s for LUKS header.", options->device);
889 r = crypt_init(&cd, options->device);
893 /* Do print fail here, no need to crypt_load() */
894 r = LUKS_read_phdr(cd->device, &cd->hdr, 0, cd) ? -EINVAL : 0;
900 /* OPTIONS: device, icb */
901 int crypt_luksDump(struct crypt_options *options)
903 struct crypt_device *cd = NULL;
906 r = _crypt_init(&cd, CRYPT_LUKS1, options, 1, 0);
916 void crypt_get_error(char *buf, size_t size)
918 const char *error = get_error();
920 if (!buf || size < 1)
923 strncpy(buf, error, size - 1);
924 buf[size - 1] = '\0';
930 void crypt_put_options(struct crypt_options *options)
932 if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
933 free((char *)options->device);
934 options->device = NULL;
935 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
937 if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
938 free((char *)options->cipher);
939 options->cipher = NULL;
940 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
944 const char *crypt_get_dir(void)
949 /////////////////////////////////
954 int crypt_init(struct crypt_device **cd, const char *device)
956 struct crypt_device *h = NULL;
961 log_dbg("Allocating crypt device %s context.", device);
963 if (device && !device_ready(NULL, device, O_RDONLY))
966 if (!(h = malloc(sizeof(struct crypt_device))))
969 memset(h, 0, sizeof(*h));
972 h->device = strdup(device);
980 if (dm_init(h, 1) < 0) {
985 h->iteration_time = 1000;
986 h->password_verify = 0;
992 int crypt_init_by_name(struct crypt_device **cd, const char *name)
994 crypt_status_info ci;
998 log_dbg("Allocating crypt device context by device %s.", name);
1000 ci = crypt_status(NULL, name);
1001 if (ci == CRYPT_INVALID)
1004 if (ci < CRYPT_ACTIVE) {
1005 log_err(NULL, _("Device %s is not active.\n"), name);
1009 r = dm_query_device(name, &device, NULL, NULL, NULL,
1010 NULL, NULL, NULL, NULL, NULL, NULL);
1012 /* Underlying device disappeared but mapping still active */
1013 if (r >= 0 && !device)
1014 log_verbose(NULL, _("Underlying device for crypt device %s disappeared.\n"),
1018 r = crypt_init(cd, device);
1024 static int _crypt_format_plain(struct crypt_device *cd,
1026 const char *cipher_mode,
1028 size_t volume_key_size,
1029 struct crypt_params_plain *params)
1031 if (!cipher || !cipher_mode) {
1032 log_err(cd, _("Invalid plain crypt parameters.\n"));
1036 if (volume_key_size > 1024) {
1037 log_err(cd, _("Invalid key size.\n"));
1041 cd->volume_key = crypt_alloc_volume_key(volume_key_size, NULL);
1042 if (!cd->volume_key)
1045 cd->plain_cipher = strdup(cipher);
1046 cd->plain_cipher_mode = strdup(cipher_mode);
1049 cd->plain_uuid = strdup(uuid);
1051 if (params && params->hash)
1052 cd->plain_hdr.hash = strdup(params->hash);
1054 cd->plain_hdr.offset = params ? params->offset : 0;
1055 cd->plain_hdr.skip = params ? params->skip : 0;
1057 if (!cd->plain_cipher || !cd->plain_cipher_mode)
1063 static int _crypt_format_luks1(struct crypt_device *cd,
1065 const char *cipher_mode,
1067 const char *volume_key,
1068 size_t volume_key_size,
1069 struct crypt_params_luks1 *params)
1072 unsigned long required_alignment = DEFAULT_DISK_ALIGNMENT;
1073 unsigned long alignment_offset = 0;
1076 log_err(cd, _("Can't format LUKS without device.\n"));
1081 cd->volume_key = crypt_alloc_volume_key(volume_key_size,
1084 cd->volume_key = crypt_generate_volume_key(volume_key_size);
1089 if (params && params->data_alignment)
1090 required_alignment = params->data_alignment * SECTOR_SIZE;
1092 get_topology_alignment(cd->device, &required_alignment,
1093 &alignment_offset, DEFAULT_DISK_ALIGNMENT);
1095 r = LUKS_generate_phdr(&cd->hdr, cd->volume_key, cipher, cipher_mode,
1096 (params && params->hash) ? params->hash : "sha1",
1098 required_alignment / SECTOR_SIZE,
1099 alignment_offset / SECTOR_SIZE,
1100 cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1104 /* Wipe first 8 sectors - fs magic numbers etc. */
1105 r = wipe_device_header(cd->device, 8);
1107 log_err(cd, _("Can't wipe header on device %s.\n"), cd->device);
1111 r = LUKS_write_phdr(cd->device, &cd->hdr, cd);
1116 int crypt_format(struct crypt_device *cd,
1119 const char *cipher_mode,
1121 const char *volume_key,
1122 size_t volume_key_size,
1127 log_dbg("Formatting device %s as type %s.", cd->device ?: "(none)", cd->type ?: "(none)");
1132 r = init_crypto(cd);
1137 r = _crypt_format_plain(cd, cipher, cipher_mode,
1138 uuid, volume_key_size, params);
1139 else if (isLUKS(type))
1140 r = _crypt_format_luks1(cd, cipher, cipher_mode,
1141 uuid, volume_key, volume_key_size, params);
1143 /* FIXME: allow plugins here? */
1144 log_err(cd, _("Unknown crypt device type %s requested.\n"), type);
1148 if (!r && !(cd->type = strdup(type)))
1152 crypt_free_volume_key(cd->volume_key);
1153 cd->volume_key = NULL;
1159 int crypt_load(struct crypt_device *cd,
1160 const char *requested_type,
1163 struct luks_phdr hdr;
1166 log_dbg("Trying to load %s crypt type from device %s.",
1167 requested_type ?: "any", cd->device ?: "(none)");
1172 if (requested_type && !isLUKS(requested_type))
1175 r = init_crypto(cd);
1179 r = LUKS_read_phdr(cd->device, &hdr, 1, cd);
1182 memcpy(&cd->hdr, &hdr, sizeof(hdr));
1183 cd->type = strdup(requested_type);
1191 int crypt_header_backup(struct crypt_device *cd,
1192 const char *requested_type,
1193 const char *backup_file)
1197 if ((requested_type && !isLUKS(requested_type)) || !backup_file)
1200 r = init_crypto(cd);
1204 log_dbg("Requested header backup of device %s (%s) to "
1205 "file %s.", cd->device, requested_type, backup_file);
1207 return LUKS_hdr_backup(backup_file, cd->device, &cd->hdr, cd);
1210 int crypt_header_restore(struct crypt_device *cd,
1211 const char *requested_type,
1212 const char *backup_file)
1216 if (requested_type && !isLUKS(requested_type))
1219 /* Some hash functions need initialized gcrypt library */
1220 r = init_crypto(cd);
1224 log_dbg("Requested header restore to device %s (%s) from "
1225 "file %s.", cd->device, requested_type, backup_file);
1227 return LUKS_hdr_restore(backup_file, cd->device, &cd->hdr, cd);
1230 void crypt_free(struct crypt_device *cd)
1233 log_dbg("Releasing crypt device %s context.", cd->device);
1237 crypt_free_volume_key(cd->volume_key);
1242 /* used in plain device only */
1243 free((char*)cd->plain_hdr.hash);
1244 free(cd->plain_cipher);
1245 free(cd->plain_cipher_mode);
1246 free(cd->plain_uuid);
1252 int crypt_suspend(struct crypt_device *cd,
1255 crypt_status_info ci;
1256 int r, suspended = 0;
1258 log_dbg("Suspending volume %s.", name);
1260 ci = crypt_status(NULL, name);
1261 if (ci < CRYPT_ACTIVE) {
1262 log_err(cd, _("Volume %s is not active.\n"), name);
1266 if (!cd && dm_init(NULL, 1) < 0)
1269 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1270 NULL, NULL, NULL, NULL, &suspended, NULL);
1275 log_err(cd, _("Volume %s is already suspended.\n"), name);
1280 r = dm_suspend_and_wipe_key(name);
1282 log_err(cd, "Suspend is not supported for device %s.\n", name);
1284 log_err(cd, "Error during suspending device %s.\n", name);
1291 int crypt_resume_by_passphrase(struct crypt_device *cd,
1294 const char *passphrase,
1295 size_t passphrase_size)
1297 struct volume_key *vk = NULL;
1298 int r, suspended = 0;
1300 log_dbg("Resuming volume %s.", name);
1302 if (!isLUKS(cd->type)) {
1303 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1308 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1309 NULL, NULL, NULL, NULL, &suspended, NULL);
1314 log_err(cd, _("Volume %s is not suspended.\n"), name);
1319 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1320 passphrase_size, &cd->hdr, &vk, cd);
1322 r = volume_key_by_terminal_passphrase(cd, keyslot, &vk);
1326 r = dm_resume_and_reinstate_key(name, vk->keylength, vk->key);
1328 log_err(cd, "Resume is not supported for device %s.\n", name);
1330 log_err(cd, "Error during resuming device %s.\n", name);
1334 crypt_free_volume_key(vk);
1335 return r < 0 ? r : keyslot;
1338 int crypt_resume_by_keyfile(struct crypt_device *cd,
1341 const char *keyfile,
1342 size_t keyfile_size)
1344 struct volume_key *vk = NULL;
1345 char *passphrase_read = NULL;
1346 unsigned int passphrase_size_read;
1347 int r, suspended = 0;
1349 log_dbg("Resuming volume %s.", name);
1351 if (!isLUKS(cd->type)) {
1352 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1357 r = dm_query_device(name, NULL, NULL, NULL, NULL,
1358 NULL, NULL, NULL, NULL, &suspended, NULL);
1363 log_err(cd, _("Volume %s is not suspended.\n"), name);
1370 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1371 &passphrase_size_read, keyfile, keyfile_size);
1373 if(!passphrase_read)
1376 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1377 passphrase_size_read, &cd->hdr, &vk, cd);
1378 safe_free(passphrase_read);
1383 r = dm_resume_and_reinstate_key(name, vk->keylength, vk->key);
1385 log_err(cd, "Error during resuming device %s.\n", name);
1389 crypt_free_volume_key(vk);
1390 return r < 0 ? r : keyslot;
1393 // slot manipulation
1394 int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
1395 int keyslot, // -1 any
1396 const char *passphrase, // NULL -> terminal
1397 size_t passphrase_size,
1398 const char *new_passphrase, // NULL -> terminal
1399 size_t new_passphrase_size)
1401 struct volume_key *vk = NULL;
1402 char *password = NULL, *new_password = NULL;
1403 unsigned int passwordLen, new_passwordLen;
1406 log_dbg("Adding new keyslot, existing passphrase %sprovided,"
1407 "new passphrase %sprovided.",
1408 passphrase ? "" : "not ", new_passphrase ? "" : "not ");
1410 if (!isLUKS(cd->type)) {
1411 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1415 r = keyslot_verify_or_find_empty(cd, &keyslot);
1419 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1420 /* No slots used, try to use pre-generated key in header */
1421 if (cd->volume_key) {
1422 vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key);
1423 r = vk ? 0 : -ENOMEM;
1425 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1428 } else if (passphrase) {
1429 /* Passphrase provided, use it to unlock existing keyslot */
1430 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, passphrase,
1431 passphrase_size, &cd->hdr, &vk, cd);
1433 /* Passphrase not provided, ask first and use it to unlock existing keyslot */
1434 key_from_terminal(cd, _("Enter any passphrase: "),
1435 &password, &passwordLen, 0);
1441 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password,
1442 passwordLen, &cd->hdr, &vk, cd);
1443 safe_free(password);
1449 if (new_passphrase) {
1450 new_password = (char *)new_passphrase;
1451 new_passwordLen = new_passphrase_size;
1453 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1454 &new_password, &new_passwordLen, 1);
1461 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1462 &cd->hdr, vk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1467 if (!new_passphrase)
1468 safe_free(new_password);
1469 crypt_free_volume_key(vk);
1470 return r ?: keyslot;
1473 int crypt_keyslot_add_by_keyfile(struct crypt_device *cd,
1475 const char *keyfile,
1476 size_t keyfile_size,
1477 const char *new_keyfile,
1478 size_t new_keyfile_size)
1480 struct volume_key *vk=NULL;
1481 char *password=NULL; unsigned int passwordLen;
1482 char *new_password = NULL; unsigned int new_passwordLen;
1485 log_dbg("Adding new keyslot, existing keyfile %s, new keyfile %s.",
1486 keyfile ?: "[none]", new_keyfile ?: "[none]");
1488 if (!isLUKS(cd->type)) {
1489 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1493 r = keyslot_verify_or_find_empty(cd, &keyslot);
1497 if (!LUKS_keyslot_active_count(&cd->hdr)) {
1498 /* No slots used, try to use pre-generated key in header */
1499 if (cd->volume_key) {
1500 vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key);
1501 r = vk ? 0 : -ENOMEM;
1503 log_err(cd, _("Cannot add key slot, all slots disabled and no volume key provided.\n"));
1507 /* Read password from file of (if NULL) from terminal */
1509 key_from_file(cd, _("Enter any passphrase: "), &password, &passwordLen,
1510 keyfile, keyfile_size);
1512 key_from_terminal(cd, _("Enter any passphrase: "),
1513 &password, &passwordLen, 0);
1518 r = LUKS_open_key_with_hdr(cd->device, CRYPT_ANY_SLOT, password, passwordLen,
1520 safe_free(password);
1527 key_from_file(cd, _("Enter new passphrase for key slot: "),
1528 &new_password, &new_passwordLen, new_keyfile,
1531 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1532 &new_password, &new_passwordLen, 1);
1539 r = LUKS_set_key(cd->device, keyslot, new_password, new_passwordLen,
1540 &cd->hdr, vk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1542 safe_free(new_password);
1543 crypt_free_volume_key(vk);
1544 return r < 0 ? r : keyslot;
1547 int crypt_keyslot_add_by_volume_key(struct crypt_device *cd,
1549 const char *volume_key,
1550 size_t volume_key_size,
1551 const char *passphrase,
1552 size_t passphrase_size)
1554 struct volume_key *vk = NULL;
1556 char *new_password = NULL; unsigned int new_passwordLen;
1558 log_dbg("Adding new keyslot %d using volume key.", keyslot);
1560 if (!isLUKS(cd->type)) {
1561 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1566 vk = crypt_alloc_volume_key(volume_key_size, volume_key);
1567 else if (cd->volume_key)
1568 vk = crypt_alloc_volume_key(cd->volume_key->keylength, cd->volume_key->key);
1573 r = LUKS_verify_volume_key(&cd->hdr, vk);
1575 log_err(cd, _("Volume key does not match the volume.\n"));
1579 r = keyslot_verify_or_find_empty(cd, &keyslot);
1584 key_from_terminal(cd, _("Enter new passphrase for key slot: "),
1585 &new_password, &new_passwordLen, 1);
1586 passphrase = new_password;
1587 passphrase_size = new_passwordLen;
1590 r = LUKS_set_key(cd->device, keyslot, passphrase, passphrase_size,
1591 &cd->hdr, vk, cd->iteration_time, &cd->PBKDF2_per_sec, cd);
1594 safe_free(new_password);
1595 crypt_free_volume_key(vk);
1596 return r ?: keyslot;
1599 int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot)
1601 crypt_keyslot_info ki;
1603 log_dbg("Destroying keyslot %d.", keyslot);
1605 if (!isLUKS(cd->type)) {
1606 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1610 ki = crypt_keyslot_status(cd, keyslot);
1611 if (ki == CRYPT_SLOT_INVALID) {
1612 log_err(cd, _("Key slot %d is invalid.\n"), keyslot);
1616 if (ki == CRYPT_SLOT_INACTIVE) {
1617 log_err(cd, _("Key slot %d is not used.\n"), keyslot);
1621 return LUKS_del_key(cd->device, keyslot, &cd->hdr, cd);
1624 // activation/deactivation of device mapping
1625 int crypt_activate_by_passphrase(struct crypt_device *cd,
1628 const char *passphrase,
1629 size_t passphrase_size,
1632 crypt_status_info ci;
1633 struct volume_key *vk = NULL;
1634 char *prompt = NULL;
1637 log_dbg("%s volume %s [keyslot %d] using %spassphrase.",
1638 name ? "Activating" : "Checking", name ?: "",
1639 keyslot, passphrase ? "" : "[none] ");
1641 /* plain, use hashed passphrase */
1642 if (isPLAIN(cd->type))
1643 return create_device_helper(cd, name, cd->plain_hdr.hash,
1644 cd->plain_cipher, cd->plain_cipher_mode, NULL, passphrase, passphrase_size,
1645 cd->volume_key->keylength, 0, cd->plain_hdr.skip,
1646 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1649 ci = crypt_status(NULL, name);
1650 if (ci == CRYPT_INVALID)
1652 else if (ci >= CRYPT_ACTIVE) {
1653 log_err(cd, _("Device %s already exists.\n"), name);
1658 if(asprintf(&prompt, _("Enter passphrase for %s: "), cd->device) < 0)
1661 /* provided passphrase, do not retry */
1663 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1664 passphrase_size, &cd->hdr, &vk, cd);
1666 r = volume_key_by_terminal_passphrase(cd, keyslot, &vk);
1671 r = open_from_hdr_and_vk(cd, vk, name, flags);
1674 crypt_free_volume_key(vk);
1677 return r < 0 ? r : keyslot;
1680 int crypt_activate_by_keyfile(struct crypt_device *cd,
1683 const char *keyfile,
1684 size_t keyfile_size,
1687 crypt_status_info ci;
1688 struct volume_key *vk = NULL;
1689 char *passphrase_read = NULL;
1690 unsigned int passphrase_size_read;
1693 log_dbg("Activating volume %s [keyslot %d] using keyfile %s.",
1694 name ?: "", keyslot, keyfile ?: "[none]");
1696 if (!isLUKS(cd->type)) {
1697 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1702 ci = crypt_status(NULL, name);
1703 if (ci == CRYPT_INVALID)
1705 else if (ci >= CRYPT_ACTIVE) {
1706 log_err(cd, _("Device %s already exists.\n"), name);
1714 key_from_file(cd, _("Enter passphrase: "), &passphrase_read,
1715 &passphrase_size_read, keyfile, keyfile_size);
1716 if(!passphrase_read)
1719 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase_read,
1720 passphrase_size_read, &cd->hdr, &vk, cd);
1721 safe_free(passphrase_read);
1727 r = open_from_hdr_and_vk(cd, vk, name, flags);
1730 crypt_free_volume_key(vk);
1732 return r < 0 ? r : keyslot;
1735 int crypt_activate_by_volume_key(struct crypt_device *cd,
1737 const char *volume_key,
1738 size_t volume_key_size,
1741 crypt_status_info ci;
1742 struct volume_key *vk;
1745 log_dbg("Activating volume %s by volume key.", name);
1747 /* use key directly, no hash */
1748 if (isPLAIN(cd->type))
1749 return create_device_helper(cd, name, NULL,
1750 cd->plain_cipher, cd->plain_cipher_mode, NULL, volume_key, volume_key_size,
1751 cd->volume_key->keylength, 0, cd->plain_hdr.skip,
1752 cd->plain_hdr.offset, cd->plain_uuid, flags & CRYPT_ACTIVATE_READONLY, 0, 0);
1754 if (!isLUKS(cd->type)) {
1755 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1760 ci = crypt_status(NULL, name);
1761 if (ci == CRYPT_INVALID)
1763 else if (ci >= CRYPT_ACTIVE) {
1764 log_err(cd, _("Device %s already exists.\n"), name);
1769 vk = crypt_alloc_volume_key(volume_key_size, volume_key);
1772 r = LUKS_verify_volume_key(&cd->hdr, vk);
1775 log_err(cd, _("Volume key does not match the volume.\n"));
1778 r = open_from_hdr_and_vk(cd, vk, name, flags);
1780 crypt_free_volume_key(vk);
1785 int crypt_deactivate(struct crypt_device *cd, const char *name)
1792 log_dbg("Deactivating volume %s.", name);
1794 if (!cd && dm_init(NULL, 1) < 0)
1797 switch (crypt_status(cd, name)) {
1799 r = dm_remove_device(name, 0, 0);
1802 log_err(cd, _("Device %s is busy.\n"), name);
1805 case CRYPT_INACTIVE:
1806 log_err(cd, _("Device %s is not active.\n"), name);
1810 log_err(cd, _("Invalid device %s.\n"), name);
1820 // misc helper functions
1821 int crypt_volume_key_get(struct crypt_device *cd,
1824 size_t *volume_key_size,
1825 const char *passphrase,
1826 size_t passphrase_size)
1828 struct volume_key *vk;
1829 char *processed_key = NULL;
1832 key_len = crypt_get_volume_key_size(cd);
1833 if (key_len > *volume_key_size) {
1834 log_err(cd, _("Volume key buffer too small.\n"));
1838 if (isPLAIN(cd->type) && cd->plain_hdr.hash) {
1839 processed_key = process_key(cd, cd->plain_hdr.hash, NULL, key_len,
1840 passphrase, passphrase_size);
1841 if (!processed_key) {
1842 log_err(cd, _("Cannot retrieve volume key for plain device.\n"));
1845 memcpy(volume_key, processed_key, key_len);
1846 *volume_key_size = key_len;
1847 safe_free(processed_key);
1851 if (isLUKS(cd->type)) {
1852 r = LUKS_open_key_with_hdr(cd->device, keyslot, passphrase,
1853 passphrase_size, &cd->hdr, &vk, cd);
1856 memcpy(volume_key, vk->key, vk->keylength);
1857 *volume_key_size = vk->keylength;
1860 crypt_free_volume_key(vk);
1864 log_err(cd, _("This operation is not supported for %s crypt device.\n"), cd->type ?: "(none)");
1868 int crypt_volume_key_verify(struct crypt_device *cd,
1869 const char *volume_key,
1870 size_t volume_key_size)
1872 struct volume_key *vk;
1875 if (!isLUKS(cd->type)) {
1876 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1880 vk = crypt_alloc_volume_key(volume_key_size, volume_key);
1884 r = LUKS_verify_volume_key(&cd->hdr, vk);
1887 log_err(cd, _("Volume key does not match the volume.\n"));
1889 crypt_free_volume_key(vk);
1894 void crypt_set_timeout(struct crypt_device *cd, uint64_t timeout_sec)
1896 log_dbg("Timeout set to %" PRIu64 " miliseconds.", timeout_sec);
1897 cd->timeout = timeout_sec;
1900 void crypt_set_password_retry(struct crypt_device *cd, int tries)
1902 log_dbg("Password retry count set to %d.", tries);
1906 void crypt_set_iterarion_time(struct crypt_device *cd, uint64_t iteration_time_ms)
1908 log_dbg("Iteration time set to %" PRIu64 " miliseconds.", iteration_time_ms);
1909 cd->iteration_time = iteration_time_ms;
1912 void crypt_set_password_verify(struct crypt_device *cd, int password_verify)
1914 log_dbg("Password verification %s.", password_verify ? "enabled" : "disabled");
1915 cd->password_verify = password_verify ? 1 : 0;
1918 int crypt_memory_lock(struct crypt_device *cd, int lock)
1920 return lock ? crypt_memlock_inc(cd) : crypt_memlock_dec(cd);
1924 crypt_status_info crypt_status(struct crypt_device *cd, const char *name)
1928 if (!cd && dm_init(NULL, 1) < 0)
1929 return CRYPT_INVALID;
1931 r = dm_status_device(name);
1936 if (r < 0 && r != -ENODEV)
1937 return CRYPT_INVALID;
1940 return CRYPT_ACTIVE;
1945 return CRYPT_INACTIVE;
1948 static void hexprintICB(struct crypt_device *cd, char *d, int n)
1951 for(i = 0; i < n; i++)
1952 log_std(cd, "%02hhx ", (char)d[i]);
1955 int crypt_dump(struct crypt_device *cd)
1958 if (!isLUKS(cd->type)) { //FIXME
1959 log_err(cd, _("This operation is supported only for LUKS device.\n"));
1963 log_std(cd, "LUKS header information for %s\n\n", cd->device);
1964 log_std(cd, "Version: \t%d\n", cd->hdr.version);
1965 log_std(cd, "Cipher name: \t%s\n", cd->hdr.cipherName);
1966 log_std(cd, "Cipher mode: \t%s\n", cd->hdr.cipherMode);
1967 log_std(cd, "Hash spec: \t%s\n", cd->hdr.hashSpec);
1968 log_std(cd, "Payload offset:\t%d\n", cd->hdr.payloadOffset);
1969 log_std(cd, "MK bits: \t%d\n", cd->hdr.keyBytes * 8);
1970 log_std(cd, "MK digest: \t");
1971 hexprintICB(cd, cd->hdr.mkDigest, LUKS_DIGESTSIZE);
1973 log_std(cd, "MK salt: \t");
1974 hexprintICB(cd, cd->hdr.mkDigestSalt, LUKS_SALTSIZE/2);
1975 log_std(cd, "\n \t");
1976 hexprintICB(cd, cd->hdr.mkDigestSalt+LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1978 log_std(cd, "MK iterations: \t%d\n", cd->hdr.mkDigestIterations);
1979 log_std(cd, "UUID: \t%s\n\n", cd->hdr.uuid);
1980 for(i = 0; i < LUKS_NUMKEYS; i++) {
1981 if(cd->hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
1982 log_std(cd, "Key Slot %d: ENABLED\n",i);
1983 log_std(cd, "\tIterations: \t%d\n",
1984 cd->hdr.keyblock[i].passwordIterations);
1985 log_std(cd, "\tSalt: \t");
1986 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt,
1988 log_std(cd, "\n\t \t");
1989 hexprintICB(cd, cd->hdr.keyblock[i].passwordSalt +
1990 LUKS_SALTSIZE/2, LUKS_SALTSIZE/2);
1993 log_std(cd, "\tKey material offset:\t%d\n",
1994 cd->hdr.keyblock[i].keyMaterialOffset);
1995 log_std(cd, "\tAF stripes: \t%d\n",
1996 cd->hdr.keyblock[i].stripes);
1999 log_std(cd, "Key Slot %d: DISABLED\n", i);
2002 log_std(cd, "DNAME: %s\n", crypt_get_device_name(cd) ?: "");
2007 const char *crypt_get_cipher(struct crypt_device *cd)
2009 if (isPLAIN(cd->type))
2010 return cd->plain_cipher;
2012 if (isLUKS(cd->type))
2013 return cd->hdr.cipherName;
2018 const char *crypt_get_cipher_mode(struct crypt_device *cd)
2020 if (isPLAIN(cd->type))
2021 return cd->plain_cipher_mode;
2023 if (isLUKS(cd->type))
2024 return cd->hdr.cipherMode;
2029 const char *crypt_get_uuid(struct crypt_device *cd)
2031 if (isLUKS(cd->type))
2032 return cd->hdr.uuid;
2037 const char *crypt_get_device_name(struct crypt_device *cd)
2042 int crypt_get_volume_key_size(struct crypt_device *cd)
2044 if (isPLAIN(cd->type))
2045 return cd->volume_key->keylength;
2047 if (isLUKS(cd->type))
2048 return cd->hdr.keyBytes;
2053 uint64_t crypt_get_data_offset(struct crypt_device *cd)
2055 if (isPLAIN(cd->type))
2056 return cd->plain_hdr.offset;
2058 if (isLUKS(cd->type))
2059 return cd->hdr.payloadOffset;
2064 crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot)
2066 if (!isLUKS(cd->type)) {
2067 log_err(cd, _("This operation is supported only for LUKS device.\n"));
2068 return CRYPT_SLOT_INVALID;
2071 return LUKS_keyslot_info(&cd->hdr, keyslot);