lib/setup.c

   1 #include <string.h>
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <inttypes.h>
   5 #include <sys/types.h>
   6 #include <sys/ioctl.h>
   7 #include <sys/mman.h>
   8 #include <fcntl.h>
   9 #include <unistd.h>
  10 #include <errno.h>
  11 #include <signal.h>
  12 #include <assert.h>
  13
  14 #include "libcryptsetup.h"
  15 #include "internal.h"
  16 #include "blockdev.h"
  17 #include "luks.h"
  18
  19 struct device_infos {
  20         uint64_t        size;
  21         int             readonly;
  22 };
  23
  24 static int memory_unsafe = 0;
  25 static char *default_backend = NULL;
  26
  27 #define at_least_one(a) ({ __typeof__(a) __at_least_one=(a); (__at_least_one)?__at_least_one:1; })
  28
  29 static void logger(struct crypt_options *options, int class, char *format, ...) {
  30         va_list argp;
  31         char *target;
  32
  33         va_start(argp, format);
  34         vasprintf(&target, format, argp);
  35         options->icb->log(class, target);
  36
  37         va_end(argp);
  38         free(target);
  39 }
  40
  41 static void hexprintICB(struct crypt_options *options, int class, char *d, int n)
  42 {
  43         int i;
  44         for(i = 0; i < n; i++)
  45                 logger(options, class, "%02hhx ", (char)d[i]);
  46 }
  47
  48 static int setup_enter(struct setup_backend *backend, void (*log)(int, char *))
  49 {
  50         int r;
  51
  52         /*
  53          * from here we could have sensible data in memory
  54          * so protect it from being swapped out
  55          */
  56         r = mlockall(MCL_CURRENT | MCL_FUTURE);
  57         if (r < 0) {
  58                 perror("mlockall failed");
  59                 log(CRYPT_LOG_ERROR, "WARNING!!! Possibly insecure memory. Are you root?\n");
  60                 memory_unsafe = 1;
  61         }
  62
  63         set_error(NULL);
  64
  65         if (backend) {
  66                 r = backend->init();
  67                 if (r < 0)
  68                         return r;
  69                 if (r > 0)
  70                         memory_unsafe = 1;
  71         }
  72
  73         return 0;
  74 }
  75
  76 static int setup_leave(struct setup_backend *backend)
  77 {
  78         if (backend)
  79                 backend->exit();
  80
  81         /* dangerous, we can't wipe all the memory */
  82         if (!memory_unsafe)
  83                 munlockall();
  84
  85         return 0;
  86 }
  87
  88 /*
  89  * Password processing behaviour matrix of process_key
  90  *
  91  * from binary file: check if there is sufficently large key material
  92  * interactive & from fd: hash if requested, otherwise crop or pad with '0'
  93  */
  94
  95 static char *process_key(struct crypt_options *options, char *pass, int passLen) {
  96         char *key = safe_alloc(options->key_size);
  97         memset(key, 0, options->key_size);
  98
  99         /* key is coming from binary file */
 100         if (options->key_file && strcmp(options->key_file, "-")) {
 101                 if(passLen < options->key_size) {
 102                         set_error("Could not read %d bytes from key file",
 103                                   options->key_size);
 104                         safe_free(key);
 105                         return NULL;
 106                 }
 107                 memcpy(key,pass,options->key_size);
 108                 return key;
 109         }
 110
 111         /* key is coming from tty, fd or binary stdin */
 112         if (options->hash) {
 113                 if (hash(NULL, options->hash,
 114                          key, options->key_size,
 115                          pass, passLen) < 0)
 116                 {
 117                         safe_free(key);
 118                         return NULL;
 119                 }
 120         } else if (passLen > options->key_size) {
 121                 memcpy(key, pass, options->key_size);
 122         } else {
 123                 memcpy(key, pass, passLen);
 124         }
 125
 126         return key;
 127 }
 128
 129 static int get_device_infos(const char *device, struct device_infos *infos)
 130 {
 131         char buf[128];
 132         uint64_t size;
 133         unsigned long size_small;
 134         int readonly = 0;
 135         int ret = -1;
 136         int fd;
 137
 138         /* Try to open read-write to check whether it is a read-only device */
 139         fd = open(device, O_RDWR);
 140         if (fd < 0) {
 141                 if (errno == EROFS) {
 142                         readonly = 1;
 143                         fd = open(device, O_RDONLY);
 144                 }
 145         } else {
 146                 close(fd);
 147                 fd = open(device, O_RDONLY);
 148         }
 149         if (fd < 0) {
 150                 set_error("Error opening device: %s",
 151                           strerror_r(errno, buf, 128));
 152                 return -1;
 153         }
 154
 155 #ifdef BLKROGET
 156         /* If the device can be opened read-write, i.e. readonly is still 0, then
 157          * check whether BKROGET says that it is read-only. E.g. read-only loop
 158          * devices may be openend read-write but are read-only according to BLKROGET
 159          */
 160         if (readonly == 0) {
 161                 if (ioctl(fd, BLKROGET, &readonly) < 0) {
 162                         set_error("BLKROGET failed on device: %s",
 163                                   strerror_r(errno, buf, 128));
 164                         return -1;
 165                 }
 166         }
 167 #else
 168 #error BLKROGET not available
 169 #endif
 170
 171 #ifdef BLKGETSIZE64
 172         if (ioctl(fd, BLKGETSIZE64, &size) >= 0) {
 173                 size >>= SECTOR_SHIFT;
 174                 ret = 0;
 175                 goto out;
 176         }
 177 #endif
 178
 179 #ifdef BLKGETSIZE
 180         if (ioctl(fd, BLKGETSIZE, &size_small) >= 0) {
 181                 size = (uint64_t)size_small;
 182                 ret = 0;
 183                 goto out;
 184         }
 185 #else
 186 #       error Need at least the BLKGETSIZE ioctl!
 187 #endif
 188
 189         set_error("BLKGETSIZE ioctl failed on device: %s",
 190                   strerror_r(errno, buf, 128));
 191
 192 out:
 193         if (ret == 0) {
 194                 infos->size = size;
 195                 infos->readonly = readonly;
 196         }
 197         close(fd);
 198         return ret;
 199 }
 200
 201 static int parse_into_name_and_mode(const char *nameAndMode, char *name,
 202                                     char *mode)
 203 {
 204 /* Token content stringification, see info cpp/stringification */
 205 #define str(s) #s
 206 #define xstr(s) str(s)
 207 #define scanpattern1 "%" xstr(LUKS_CIPHERNAME_L) "[^-]-%" xstr(LUKS_CIPHERMODE_L)  "s"
 208 #define scanpattern2 "%" xstr(LUKS_CIPHERNAME_L) "[^-]"
 209
 210         int r;
 211
 212         if(sscanf(nameAndMode,scanpattern1, name, mode) != 2) {
 213                 if((r = sscanf(nameAndMode,scanpattern2,name)) == 1) {
 214                         strncpy(mode,"cbc-plain",10);
 215                 }
 216                 else {
 217                         set_error("no known cipher-spec pattern detected");
 218                         return -EINVAL;
 219                 }
 220         }
 221
 222         return 0;
 223
 224 #undef sp1
 225 #undef sp2
 226 #undef str
 227 #undef xstr
 228 }
 229
 230 /* Select free keyslot or verifies that the one specified is empty */
 231 static int keyslot_from_option(int keySlotOption, struct luks_phdr *hdr) {
 232         if(keySlotOption != -1) {
 233                 if(keySlotOption >= LUKS_NUMKEYS) {
 234                         set_error("slot %d too high, please pick between 0 and %d", keySlotOption, LUKS_NUMKEYS);
 235                         return -EINVAL;
 236                 } else if(hdr->keyblock[keySlotOption].active != LUKS_KEY_DISABLED) {
 237                         set_error("slot %d full, please pick another one", keySlotOption);
 238                         return -EINVAL;
 239                 } else {
 240                         return keySlotOption;
 241                 }
 242         } else {
 243                 int i;
 244                 /* Find empty key slot */
 245                 for(i=0; i<LUKS_NUMKEYS; i++) {
 246                         if(hdr->keyblock[i].active == LUKS_KEY_DISABLED) break;
 247                 }
 248                 if(i==LUKS_NUMKEYS) {
 249                         set_error("All slots full");
 250                         return -EINVAL;
 251                 }
 252                 return i;
 253         }
 254 }
 255
 256 static int __crypt_create_device(int reload, struct setup_backend *backend,
 257                                  struct crypt_options *options)
 258 {
 259         struct crypt_options tmp = {
 260                 .name = options->name,
 261         };
 262         struct device_infos infos;
 263         char *key = NULL;
 264         int keyLen;
 265         char *processed_key = NULL;
 266         int r;
 267
 268         r = backend->status(0, &tmp, NULL);
 269         if (reload) {
 270                 if (r < 0)
 271                         return r;
 272         } else {
 273                 if (r >= 0) {
 274                         set_error("Device already exists");
 275                         return -EEXIST;
 276                 }
 277                 if (r != -ENODEV)
 278                         return r;
 279         }
 280
 281         if (options->key_size < 0 || options->key_size > 1024) {
 282                 set_error("Invalid key size");
 283                 return -EINVAL;
 284         }
 285
 286         if (get_device_infos(options->device, &infos) < 0)
 287                 return -ENOTBLK;
 288
 289         if (!options->size) {
 290                 options->size = infos.size;
 291                 if (!options->size) {
 292                         set_error("Not a block device");
 293                         return -ENOTBLK;
 294                 }
 295                 if (options->size <= options->offset) {
 296                         set_error("Invalid offset");
 297                         return -EINVAL;
 298                 }
 299                 options->size -= options->offset;
 300         }
 301
 302         if (infos.readonly)
 303                 options->flags |= CRYPT_FLAG_READONLY;
 304
 305         get_key("Enter passphrase: ", &key, &keyLen, options->key_size, options->key_file, options->passphrase_fd, options->timeout, options->flags);
 306         if (!key) {
 307                 set_error("Key reading error");
 308                 return -ENOENT;
 309         }
 310
 311         processed_key = process_key(options,key,keyLen);
 312         safe_free(key);
 313
 314         if (!processed_key) {
 315                 const char *error=get_error();
 316                 if(error) {
 317                         char *c_error_handling_sucks;
 318                         asprintf(&c_error_handling_sucks,"Key processing error: %s",error);
 319                         set_error(c_error_handling_sucks);
 320                         free(c_error_handling_sucks);
 321                 } else
 322                         set_error("Key processing error");
 323                 return -ENOENT;
 324         }
 325
 326         r = backend->create(reload, options, processed_key);
 327
 328         safe_free(processed_key);
 329
 330         return r;
 331 }
 332
 333 static int __crypt_query_device(int details, struct setup_backend *backend,
 334                                 struct crypt_options *options)
 335 {
 336         int r = backend->status(details, options, NULL);
 337         if (r == -ENODEV)
 338                 return 0;
 339         else if (r >= 0)
 340                 return 1;
 341         else
 342                 return r;
 343 }
 344
 345 static int __crypt_resize_device(int details, struct setup_backend *backend,
 346                                 struct crypt_options *options)
 347 {
 348         struct crypt_options tmp = {
 349                 .name = options->name,
 350         };
 351         struct device_infos infos;
 352         char *key = NULL;
 353         int r;
 354
 355         r = backend->status(1, &tmp, &key);
 356         if (r < 0)
 357                 return r;
 358
 359         if (get_device_infos(tmp.device, &infos) < 0)
 360                 return -EINVAL;
 361
 362         if (!options->size) {
 363                 options->size = infos.size;
 364                 if (!options->size) {
 365                         set_error("Not a block device");
 366                         return -ENOTBLK;
 367                 }
 368                 if (options->size <= tmp.offset) {
 369                         set_error("Invalid offset");
 370                         return -EINVAL;
 371                 }
 372                 options->size -= tmp.offset;
 373         }
 374         tmp.size = options->size;
 375
 376         if (infos.readonly)
 377                 options->flags |= CRYPT_FLAG_READONLY;
 378
 379         r = backend->create(1, &tmp, key);
 380
 381         safe_free(key);
 382
 383         return r;
 384 }
 385
 386 static int __crypt_remove_device(int arg, struct setup_backend *backend,
 387                                  struct crypt_options *options)
 388 {
 389         int r;
 390
 391         r = backend->status(0, options, NULL);
 392         if (r < 0)
 393                 return r;
 394         if (r > 0) {
 395                 set_error("Device busy");
 396                 return -EBUSY;
 397         }
 398
 399         return backend->remove(options);
 400 }
 401
 402 static int __crypt_luks_format(int arg, struct setup_backend *backend, struct crypt_options *options)
 403 {
 404         int r;
 405
 406         struct luks_phdr header;
 407         struct luks_masterkey *mk=NULL;
 408         char *password=NULL;
 409         char cipherName[LUKS_CIPHERNAME_L];
 410         char cipherMode[LUKS_CIPHERMODE_L];
 411         int passwordLen;
 412         int PBKDF2perSecond;
 413         int keyIndex;
 414
 415         if (!LUKS_device_ready(options->device, O_RDWR | O_EXCL)) {
 416                 set_error("Can not access device");
 417                 r = -ENOTBLK; goto out;
 418         }
 419
 420         mk = LUKS_generate_masterkey(options->key_size);
 421         if(NULL == mk) return -ENOMEM;
 422
 423 #ifdef LUKS_DEBUG
 424 #define printoffset(entry) logger(options, CRYPT_LOG_ERROR, ("offset of " #entry " = %d\n", (char *)(&header.entry)-(char *)(&header))
 425
 426         logger(options, CRYPT_LOG_ERROR, "sizeof phdr %d, key slot %d\n",sizeof(struct luks_phdr),sizeof(header.keyblock[0]));
 427
 428         printoffset(magic);
 429         printoffset(version);
 430         printoffset(cipherName);
 431         printoffset(cipherMode);
 432         printoffset(hashSpec);
 433         printoffset(payloadOffset);
 434         printoffset(keyBytes);
 435         printoffset(mkDigest);
 436         printoffset(mkDigestSalt);
 437         printoffset(mkDigestIterations);
 438         printoffset(uuid);
 439 #endif
 440
 441         r = parse_into_name_and_mode(options->cipher, cipherName, cipherMode);
 442         if(r < 0) return r;
 443
 444         r = LUKS_generate_phdr(&header,mk,cipherName, cipherMode,LUKS_STRIPES, options->align_payload);
 445         if(r < 0) {
 446                 set_error("Can't generate phdr");
 447                 return r;
 448         }
 449
 450         keyIndex = keyslot_from_option(options->key_slot, &header);
 451
 452         PBKDF2perSecond = LUKS_benchmarkt_iterations();
 453         header.keyblock[keyIndex].passwordIterations = at_least_one(PBKDF2perSecond * ((float)options->iteration_time / 1000.0));
 454 #ifdef LUKS_DEBUG
 455         logger(options->icb->log,CRYPT_LOG_ERROR, "pitr %d\n", header.keyblock[0].passwordIterations);
 456 #endif
 457         get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->new_key_file, options->passphrase_fd, options->timeout, options->flags);
 458         if(!password) {
 459                 r = -EINVAL; goto out;
 460         }
 461
 462         /* Set key, also writes phdr */
 463         r = LUKS_set_key(options->device, keyIndex, password, passwordLen, &header, mk, backend);
 464         if(r < 0) goto out;
 465
 466         r = 0;
 467 out:
 468         LUKS_dealloc_masterkey(mk);
 469         safe_free(password);
 470         return r;
 471 }
 472
 473 static int __crypt_luks_open(int arg, struct setup_backend *backend, struct crypt_options *options)
 474 {
 475         struct luks_masterkey *mk=NULL;
 476         struct luks_phdr hdr;
 477         char *password; int passwordLen;
 478         struct device_infos infos;
 479         struct crypt_options tmp = {
 480                 .name = options->name,
 481         };
 482         char *dmCipherSpec;
 483         int r, tries = options->tries;
 484
 485         r = backend->status(0, &tmp, NULL);
 486         if (r >= 0) {
 487                 set_error("Device already exists");
 488                 return -EEXIST;
 489         }
 490
 491         if (!LUKS_device_ready(options->device, O_RDONLY | O_EXCL)) {
 492                 set_error("Can not access device");
 493                 return -ENOTBLK;
 494         }
 495
 496         if (get_device_infos(options->device, &infos) < 0) {
 497                 set_error("Can't get device information.\n");
 498                 return -ENOTBLK;
 499         }
 500
 501         if (infos.readonly)
 502                 options->flags |= CRYPT_FLAG_READONLY;
 503
 504 start:
 505         mk=NULL;
 506
 507         if(get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->key_file,  options->passphrase_fd, options->timeout, options->flags))
 508                 tries--;
 509         else
 510                 tries = 0;
 511
 512         if(!password) {
 513                 r = -EINVAL; goto out;
 514         }
 515
 516         r = LUKS_open_any_key(options->device, password, passwordLen, &hdr, &mk, backend);
 517         if(r < 0) {
 518                 set_error("No key available with this passphrase.\n");
 519                 goto out1;
 520         } else
 521                 logger(options, CRYPT_LOG_NORMAL,"key slot %d unlocked.\n", r);
 522
 523
 524         options->offset = hdr.payloadOffset;
 525         asprintf(&dmCipherSpec, "%s-%s", hdr.cipherName, hdr.cipherMode);
 526         if(!dmCipherSpec) {
 527                 r = -ENOMEM;
 528                 goto out2;
 529         }
 530         options->cipher = dmCipherSpec;
 531         options->key_size = mk->keyLength;
 532         options->skip = 0;
 533
 534         options->size = infos.size;
 535         if (!options->size) {
 536                 set_error("Not a block device.\n");
 537                 r = -ENOTBLK; goto out2;
 538         }
 539         if (options->size <= options->offset) {
 540                 set_error("Invalid offset");
 541                 r = -EINVAL; goto out2;
 542         }
 543         options->size -= options->offset;
 544         r = backend->create(0, options, mk->key);
 545
 546  out2:
 547         free(dmCipherSpec);
 548  out1:
 549         safe_free(password);
 550  out:
 551         LUKS_dealloc_masterkey(mk);
 552         if (r == -EPERM && tries > 0)
 553                 goto start;
 554
 555         return r;
 556 }
 557
 558 static int __crypt_luks_add_key(int arg, struct setup_backend *backend, struct crypt_options *options)
 559 {
 560         struct luks_masterkey *mk=NULL;
 561         struct luks_phdr hdr;
 562         char *password=NULL; unsigned int passwordLen;
 563         unsigned int i; unsigned int keyIndex;
 564         const char *device = options->device;
 565         int r;
 566         int key_slot = options->key_slot;
 567
 568         if (!LUKS_device_ready(options->device, O_RDWR)) {
 569                 set_error("Can not access device");
 570                 r = -ENOTBLK; goto out;
 571         }
 572
 573         r = LUKS_read_phdr(device, &hdr);
 574         if(r < 0) return r;
 575
 576
 577         keyIndex = keyslot_from_option(options->key_slot, &hdr);
 578
 579         get_key("Enter any LUKS passphrase: ",
 580                 &password,
 581                 &passwordLen,
 582                 0,
 583                 options->key_file,
 584                 options->passphrase_fd,
 585                 options->timeout,
 586                 options->flags & ~(CRYPT_FLAG_VERIFY | CRYPT_FLAG_VERIFY_IF_POSSIBLE));
 587
 588         if(!password) {
 589                 r = -EINVAL; goto out;
 590         }
 591         r = LUKS_open_any_key(device, password, passwordLen, &hdr, &mk, backend);
 592         if(r < 0) {
 593                 options->icb->log(CRYPT_LOG_ERROR,"No key available with this passphrase.\n");
 594                 r = -EPERM; goto out;
 595         } else
 596                 logger(options, CRYPT_LOG_NORMAL,"key slot %d unlocked.\n", r);
 597
 598         safe_free(password);
 599
 600         get_key("Enter new passphrase for key slot: ",
 601                 &password,
 602                 &passwordLen,
 603                 0,
 604                 options->new_key_file,
 605                 options->passphrase_fd,
 606                 options->timeout,
 607                 options->flags);
 608         if(!password) {
 609                 r = -EINVAL; goto out;
 610         }
 611
 612         hdr.keyblock[keyIndex].passwordIterations = at_least_one(LUKS_benchmarkt_iterations() * ((float)options->iteration_time / 1000));
 613
 614         r = LUKS_set_key(device, keyIndex, password, passwordLen, &hdr, mk, backend);
 615         if(r < 0) goto out;
 616
 617         r = 0;
 618 out:
 619         safe_free(password);
 620         LUKS_dealloc_masterkey(mk);
 621         return r;
 622 }
 623
 624 static int luks_remove_helper(int arg, struct setup_backend *backend, struct crypt_options *options, int supply_it)
 625 {
 626         struct luks_masterkey *mk;
 627         struct luks_phdr hdr;
 628         char *password=NULL;
 629         unsigned int passwordLen;
 630         const char *device = options->device;
 631         int keyIndex;
 632         int openedIndex;
 633         int r;
 634         if (!LUKS_device_ready(options->device, O_RDWR)) {
 635             set_error("Can not access device");
 636             r = -ENOTBLK; goto out;
 637         }
 638
 639         if(supply_it) {
 640             get_key("Enter LUKS passphrase to be deleted: ",&password,&passwordLen, 0, options->new_key_file, options->passphrase_fd, options->timeout, options->flags);
 641             if(!password) {
 642                     r = -EINVAL; goto out;
 643             }
 644             keyIndex = LUKS_open_any_key(device, password, passwordLen, &hdr, &mk, backend);
 645             if(keyIndex < 0) {
 646                     options->icb->log(CRYPT_LOG_ERROR,"No remaining key available with this passphrase.\n");
 647                     r = -EPERM; goto out;
 648             } else
 649                 logger(options, CRYPT_LOG_NORMAL,"key slot %d selected for deletion.\n", keyIndex);
 650             safe_free(password);
 651         } else {
 652             keyIndex = options->key_slot;
 653         }
 654
 655         if(LUKS_is_last_keyslot(options->device, keyIndex) &&
 656            !(options->icb->yesDialog(_("This is the last keyslot. Device will become unusable after purging this key.")))) {
 657                 r = -EINVAL;
 658                 goto out;
 659         }
 660
 661         if(options->flags & CRYPT_FLAG_VERIFY_ON_DELKEY) {
 662                 options->flags &= ~CRYPT_FLAG_VERIFY_ON_DELKEY;
 663                 get_key("Enter any remaining LUKS passphrase: ",&password,&passwordLen, 0, options->key_file, options->passphrase_fd, options->timeout, options->flags);
 664                 if(!password) {
 665                         r = -EINVAL; goto out;
 666                 }
 667                 openedIndex = LUKS_open_any_key(device, password, passwordLen, &hdr, &mk, backend);
 668                 /* Clean up */
 669                 if (openedIndex >= 0) {
 670                         LUKS_dealloc_masterkey(mk);
 671                         mk = NULL;
 672                 }
 673                 if(openedIndex < 0 || keyIndex == openedIndex) {
 674                             options->icb->log(CRYPT_LOG_ERROR,"No remaining key available with this passphrase.\n");
 675                             r = -EPERM; goto out;
 676                 } else
 677                         logger(options, CRYPT_LOG_NORMAL,"key slot %d verified.\n", keyIndex);
 678         }
 679         r = LUKS_del_key(device, keyIndex);
 680         if(r < 0) goto out;
 681
 682         r = 0;
 683 out:
 684         safe_free(password);
 685         return r;
 686 }
 687
 688 static int __crypt_luks_kill_slot(int arg, struct setup_backend *backend, struct crypt_options *options) {
 689         return luks_remove_helper(arg, backend, options, 0);
 690 }
 691
 692 static int __crypt_luks_remove_key(int arg, struct setup_backend *backend, struct crypt_options *options) {
 693         return luks_remove_helper(arg, backend, options, 1);
 694 }
 695
 696
 697 static int crypt_job(int (*job)(int arg, struct setup_backend *backend,
 698                                 struct crypt_options *options),
 699                      int arg, struct crypt_options *options)
 700 {
 701         struct setup_backend *backend;
 702         int r;
 703
 704         backend = get_setup_backend(default_backend);
 705
 706         setup_enter(backend,options->icb->log);
 707
 708         if (!backend) {
 709                 set_error("No setup backend available");
 710                 r = -ENOSYS;
 711                 goto out;
 712         }
 713
 714         r = job(arg, backend, options);
 715 out:
 716         setup_leave(backend);
 717         if (backend)
 718                 put_setup_backend(backend);
 719
 720         if (r >= 0)
 721                 set_error(NULL);
 722
 723         return r;
 724 }
 725
 726 int crypt_create_device(struct crypt_options *options)
 727 {
 728         return crypt_job(__crypt_create_device, 0, options);
 729 }
 730
 731 int crypt_update_device(struct crypt_options *options)
 732 {
 733         return crypt_job(__crypt_create_device, 1, options);
 734 }
 735
 736 int crypt_resize_device(struct crypt_options *options)
 737 {
 738         return crypt_job(__crypt_resize_device, 0, options);
 739 }
 740
 741 int crypt_query_device(struct crypt_options *options)
 742 {
 743         return crypt_job(__crypt_query_device, 1, options);
 744 }
 745
 746 int crypt_remove_device(struct crypt_options *options)
 747 {
 748         return crypt_job(__crypt_remove_device, 0, options);
 749
 750 }
 751
 752 int crypt_luksFormat(struct crypt_options *options)
 753 {
 754         return crypt_job(__crypt_luks_format, 0, options);
 755 }
 756
 757 int crypt_luksOpen(struct crypt_options *options)
 758 {
 759         return crypt_job(__crypt_luks_open, 0, options);
 760 }
 761
 762 int crypt_luksKillSlot(struct crypt_options *options)
 763 {
 764         return crypt_job(__crypt_luks_kill_slot, 0, options);
 765 }
 766
 767 int crypt_luksRemoveKey(struct crypt_options *options)
 768 {
 769         return crypt_job(__crypt_luks_remove_key, 0, options);
 770 }
 771
 772 int crypt_luksAddKey(struct crypt_options *options)
 773 {
 774         return crypt_job(__crypt_luks_add_key, 0, options);
 775 }
 776
 777 int crypt_luksUUID(struct crypt_options *options)
 778 {
 779         struct luks_phdr hdr;
 780         int r;
 781
 782         r = LUKS_read_phdr(options->device,&hdr);
 783         if(r < 0) return r;
 784
 785         options->icb->log(CRYPT_LOG_NORMAL,hdr.uuid);
 786         options->icb->log(CRYPT_LOG_NORMAL,"\n");
 787         return 0;
 788 }
 789
 790 int crypt_isLuks(struct crypt_options *options)
 791 {
 792         struct luks_phdr hdr;
 793         return LUKS_read_phdr(options->device,&hdr);
 794 }
 795
 796 int crypt_luksDump(struct crypt_options *options)
 797 {
 798         struct luks_phdr hdr;
 799         int r,i;
 800
 801         r = LUKS_read_phdr(options->device,&hdr);
 802         if(r < 0) return r;
 803
 804         logger(options, CRYPT_LOG_NORMAL, "LUKS header information for %s\n\n",options->device);
 805         logger(options, CRYPT_LOG_NORMAL, "Version:       \t%d\n",hdr.version);
 806         logger(options, CRYPT_LOG_NORMAL, "Cipher name:   \t%s\n",hdr.cipherName);
 807         logger(options, CRYPT_LOG_NORMAL, "Cipher mode:   \t%s\n",hdr.cipherMode);
 808         logger(options, CRYPT_LOG_NORMAL, "Hash spec:     \t%s\n",hdr.hashSpec);
 809         logger(options, CRYPT_LOG_NORMAL, "Payload offset:\t%d\n",hdr.payloadOffset);
 810         logger(options, CRYPT_LOG_NORMAL, "MK bits:       \t%d\n",hdr.keyBytes*8);
 811         logger(options, CRYPT_LOG_NORMAL, "MK digest:     \t");
 812         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigest,LUKS_DIGESTSIZE);
 813         logger(options, CRYPT_LOG_NORMAL, "\n");
 814         logger(options, CRYPT_LOG_NORMAL, "MK salt:       \t");
 815         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigestSalt,LUKS_SALTSIZE/2);
 816         logger(options, CRYPT_LOG_NORMAL, "\n               \t");
 817         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.mkDigestSalt+LUKS_SALTSIZE/2,LUKS_SALTSIZE/2);
 818         logger(options, CRYPT_LOG_NORMAL, "\n");
 819         logger(options, CRYPT_LOG_NORMAL, "MK iterations: \t%d\n",hdr.mkDigestIterations);
 820         logger(options, CRYPT_LOG_NORMAL, "UUID:          \t%s\n\n",hdr.uuid);
 821         for(i=0;i<LUKS_NUMKEYS;i++) {
 822                 if(hdr.keyblock[i].active == LUKS_KEY_ENABLED) {
 823                         logger(options, CRYPT_LOG_NORMAL, "Key Slot %d: ENABLED\n",i);
 824                         logger(options, CRYPT_LOG_NORMAL, "\tIterations:         \t%d\n",hdr.keyblock[i].passwordIterations);
 825                         logger(options, CRYPT_LOG_NORMAL, "\tSalt:               \t");
 826                         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.keyblock[i].passwordSalt,LUKS_SALTSIZE/2);
 827                         logger(options, CRYPT_LOG_NORMAL, "\n\t                      \t");
 828                         hexprintICB(options, CRYPT_LOG_NORMAL, hdr.keyblock[i].passwordSalt+LUKS_SALTSIZE/2,LUKS_SALTSIZE/2);
 829                         logger(options, CRYPT_LOG_NORMAL, "\n");
 830
 831                         logger(options, CRYPT_LOG_NORMAL, "\tKey material offset:\t%d\n",hdr.keyblock[i].keyMaterialOffset);
 832                         logger(options, CRYPT_LOG_NORMAL, "\tAF stripes:            \t%d\n",hdr.keyblock[i].stripes);
 833                 }
 834                 else
 835                         logger(options, CRYPT_LOG_NORMAL, "Key Slot %d: DISABLED\n",i);
 836         }
 837         return 0;
 838 }
 839
 840
 841 void crypt_get_error(char *buf, size_t size)
 842 {
 843         const char *error = get_error();
 844
 845         if (!buf || size < 1)
 846                 set_error(NULL);
 847         else if (error) {
 848                 strncpy(buf, error, size - 1);
 849                 buf[size - 1] = '\0';
 850                 set_error(NULL);
 851         } else
 852                 buf[0] = '\0';
 853 }
 854
 855 void crypt_put_options(struct crypt_options *options)
 856 {
 857         if (options->flags & CRYPT_FLAG_FREE_DEVICE) {
 858                 free((char *)options->device);
 859                 options->device = NULL;
 860                 options->flags &= ~CRYPT_FLAG_FREE_DEVICE;
 861         }
 862         if (options->flags & CRYPT_FLAG_FREE_CIPHER) {
 863                 free((char *)options->cipher);
 864                 options->cipher = NULL;
 865                 options->flags &= ~CRYPT_FLAG_FREE_CIPHER;
 866         }
 867 }
 868
 869 void crypt_set_default_backend(const char *backend)
 870 {
 871         if (default_backend)
 872                 free(default_backend);
 873         if (backend)
 874                 default_backend = strdup(backend);
 875         else
 876                 default_backend = NULL;
 877 }
 878
 879 const char *crypt_get_dir(void)
 880 {
 881         struct setup_backend *backend;
 882         const char *dir;
 883
 884         backend = get_setup_backend(default_backend);
 885         if (!backend)
 886                 return NULL;
 887
 888         dir = backend->dir();
 889
 890         put_setup_backend(backend);
 891
 892         return dir;
 893 }
 894
 895 // Local Variables:
 896 // c-basic-offset: 8
 897 // indent-tabs-mode: nil
 898 // End: