src/cryptsetup.c

   1 /*
   2  * cryptsetup - setup cryptographic volumes for dm-crypt
   3  *
   4  * Copyright (C) 2004, Christophe Saout <christophe@saout.de>
   5  * Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
   6  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   7  * Copyright (C) 2009-2012, Milan Broz
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * as published by the Free Software Foundation; either version 2
  12  * of the License, or (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22  */
  23
  24 #include "cryptsetup.h"
  25
  26 static const char *opt_cipher = NULL;
  27 static const char *opt_hash = NULL;
  28 static int opt_verify_passphrase = 0;
  29
  30 static const char *opt_key_file = NULL;
  31 static int opt_keyfiles_count = 0;
  32 static const char *opt_keyfiles[MAX_KEYFILES];
  33
  34 static const char *opt_master_key_file = NULL;
  35 static const char *opt_header_backup_file = NULL;
  36 static const char *opt_uuid = NULL;
  37 static const char *opt_header_device = NULL;
  38 static const char *opt_type = "luks";
  39 static int opt_key_size = 0;
  40 static long opt_keyfile_size = 0;
  41 static long opt_new_keyfile_size = 0;
  42 static long opt_keyfile_offset = 0;
  43 static long opt_new_keyfile_offset = 0;
  44 static int opt_key_slot = CRYPT_ANY_SLOT;
  45 static uint64_t opt_size = 0;
  46 static uint64_t opt_offset = 0;
  47 static uint64_t opt_skip = 0;
  48 static int opt_skip_valid = 0;
  49 static int opt_readonly = 0;
  50 static int opt_iteration_time = DEFAULT_LUKS1_ITER_TIME;
  51 static int opt_version_mode = 0;
  52 static int opt_timeout = 0;
  53 static int opt_tries = 3;
  54 static int opt_align_payload = 0;
  55 static int opt_random = 0;
  56 static int opt_urandom = 0;
  57 static int opt_dump_master_key = 0;
  58 static int opt_shared = 0;
  59 static int opt_allow_discards = 0;
  60 static int opt_test_passphrase = 0;
  61 static int opt_tcrypt_hidden = 0;
  62 static int opt_tcrypt_system = 0;
  63
  64 static const char **action_argv;
  65 static int action_argc;
  66 static const char *null_action_argv[] = {NULL, NULL};
  67
  68 static int _verify_passphrase(int def)
  69 {
  70         /* Batch mode switch off verify - if not overrided by -y */
  71         if (opt_verify_passphrase)
  72                 def = 1;
  73         else if (opt_batch_mode)
  74                 def = 0;
  75
  76         /* Non-tty input doesn't allow verify */
  77         if (def && !isatty(STDIN_FILENO)) {
  78                 if (opt_verify_passphrase)
  79                         log_err(_("Can't do passphrase verification on non-tty inputs.\n"));
  80                 def = 0;
  81         }
  82
  83         return def;
  84 }
  85
  86 static int action_open_plain(void)
  87 {
  88         struct crypt_device *cd = NULL;
  89         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
  90         struct crypt_params_plain params = {
  91                 .hash = opt_hash ?: DEFAULT_PLAIN_HASH,
  92                 .skip = opt_skip,
  93                 .offset = opt_offset,
  94                 .size = opt_size,
  95         };
  96         char *password = NULL;
  97         size_t passwordLen;
  98         size_t key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS) / 8;
  99         uint32_t activate_flags = 0;
 100         int r;
 101
 102         if (params.hash && !strcmp(params.hash, "plain"))
 103                 params.hash = NULL;
 104
 105         /* FIXME: temporary hack */
 106         if (opt_key_file && strcmp(opt_key_file, "-"))
 107                 params.hash = NULL;
 108
 109         if ((opt_keyfile_offset || opt_keyfile_size) && opt_key_file)
 110                 log_std(_("Ignoring keyfile offset and size options, keyfile read "
 111                          "size is always the same as encryption key size.\n"));
 112
 113         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(PLAIN),
 114                                       cipher, NULL, cipher_mode);
 115         if (r < 0) {
 116                 log_err(_("No known cipher specification pattern detected.\n"));
 117                 goto out;
 118         }
 119
 120         if ((r = crypt_init(&cd, action_argv[0])))
 121                 goto out;
 122
 123         crypt_set_timeout(cd, opt_timeout);
 124         crypt_set_password_retry(cd, opt_tries);
 125
 126         r = crypt_format(cd, CRYPT_PLAIN,
 127                          cipher, cipher_mode,
 128                          NULL, NULL,
 129                          key_size,
 130                          &params);
 131         check_signal(&r);
 132         if (r < 0)
 133                 goto out;
 134
 135         if (opt_readonly)
 136                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 137
 138         if (opt_shared)
 139                 activate_flags |= CRYPT_ACTIVATE_SHARED;
 140
 141         if (opt_allow_discards)
 142                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 143
 144         if (opt_key_file)
 145                 /* With hashing, read the whole keyfile */
 146                 r = crypt_activate_by_keyfile_offset(cd, action_argv[1],
 147                         CRYPT_ANY_SLOT, opt_key_file,
 148                         params.hash ? 0 : key_size, 0,
 149                         activate_flags);
 150         else {
 151                 r = tools_get_key(_("Enter passphrase: "),
 152                                   &password, &passwordLen,
 153                                   opt_keyfile_offset, opt_keyfile_size,
 154                                   NULL, opt_timeout,
 155                                   _verify_passphrase(0), 0,
 156                                   cd);
 157                 if (r < 0)
 158                         goto out;
 159
 160                 r = crypt_activate_by_passphrase(cd, action_argv[1],
 161                         CRYPT_ANY_SLOT, password, passwordLen, activate_flags);
 162         }
 163 out:
 164         crypt_free(cd);
 165         crypt_safe_free(password);
 166
 167         return r;
 168 }
 169
 170 static int action_open_loopaes(void)
 171 {
 172         struct crypt_device *cd = NULL;
 173         struct crypt_params_loopaes params = {
 174                 .hash = opt_hash ?: NULL,
 175                 .offset = opt_offset,
 176                 .skip = opt_skip_valid ? opt_skip : opt_offset,
 177         };
 178         unsigned int key_size = (opt_key_size ?: DEFAULT_LOOPAES_KEYBITS) / 8;
 179         uint32_t activate_flags = 0;
 180         int r;
 181
 182         if (!opt_key_file) {
 183                 log_err(_("Option --key-file is required.\n"));
 184                 return -EINVAL;
 185         }
 186
 187         if (opt_readonly)
 188                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 189
 190         if (opt_allow_discards)
 191                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 192
 193         if ((r = crypt_init(&cd, action_argv[0])))
 194                 goto out;
 195
 196         r = crypt_format(cd, CRYPT_LOOPAES, opt_cipher ?: DEFAULT_LOOPAES_CIPHER,
 197                          NULL, NULL, NULL, key_size, &params);
 198         check_signal(&r);
 199         if (r < 0)
 200                 goto out;
 201
 202         r = crypt_activate_by_keyfile_offset(cd, action_argv[1], CRYPT_ANY_SLOT,
 203                                       opt_key_file, opt_keyfile_size,
 204                                       opt_keyfile_size, activate_flags);
 205 out:
 206         crypt_free(cd);
 207
 208         return r;
 209 }
 210
 211 static int action_open_tcrypt(void)
 212 {
 213         struct crypt_device *cd = NULL;
 214         struct crypt_params_tcrypt params = {
 215                 .keyfiles = opt_keyfiles,
 216                 .keyfiles_count = opt_keyfiles_count,
 217                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 218         };
 219         const char *activated_name;
 220         uint32_t flags = 0;
 221         int r;
 222
 223         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 224
 225         if ((r = crypt_init(&cd, action_argv[0])))
 226                 goto out;
 227
 228         /* TCRYPT header is encrypted, get passphrase now */
 229         r = tools_get_key(_("Enter passphrase: "),
 230                           CONST_CAST(char**)&params.passphrase,
 231                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 232                           _verify_passphrase(0), 0, cd);
 233         if (r < 0)
 234                 goto out;
 235
 236         if (opt_tcrypt_hidden)
 237                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 238
 239         if (opt_tcrypt_system)
 240                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 241
 242         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 243         check_signal(&r);
 244         if (r < 0)
 245                 goto out;
 246
 247         if (opt_readonly)
 248                 flags |= CRYPT_ACTIVATE_READONLY;
 249
 250         if (activated_name)
 251                 r = crypt_activate_by_volume_key(cd, activated_name, NULL, 0, flags);
 252 out:
 253         if (r == -EPERM)
 254                 log_err(_("No device header detected with this passphrase.\n"));
 255         crypt_free(cd);
 256         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 257         return r;
 258 }
 259
 260 static int tcryptDump_with_volume_key(struct crypt_device *cd)
 261 {
 262         char *vk = NULL;
 263         size_t vk_size;
 264         unsigned i;
 265         int r;
 266
 267         crypt_set_confirm_callback(cd, yesDialog, NULL);
 268         if (!yesDialog(
 269             _("Header dump with volume key is sensitive information\n"
 270               "which allows access to encrypted partition without passphrase.\n"
 271               "This dump should be always stored encrypted on safe place."),
 272               NULL))
 273                 return -EPERM;
 274
 275         vk_size = crypt_get_volume_key_size(cd);
 276         vk = crypt_safe_alloc(vk_size);
 277         if (!vk)
 278                 return -ENOMEM;
 279
 280         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size, NULL, 0);
 281         if (r < 0)
 282                 goto out;
 283
 284         log_std("TCRYPT header information for %s\n", crypt_get_device_name(cd));
 285         log_std("Cipher chain:  \t%s\n", crypt_get_cipher(cd));
 286         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
 287         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
 288         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
 289         log_std("MK dump:\t");
 290
 291         for(i = 0; i < vk_size; i++) {
 292                 if (i && !(i % 16))
 293                         log_std("\n\t\t");
 294                 log_std("%02hhx ", (char)vk[i]);
 295         }
 296         log_std("\n");
 297 out:
 298         crypt_safe_free(vk);
 299         return r;
 300 }
 301
 302 static int action_tcryptDump(void)
 303 {
 304         struct crypt_device *cd = NULL;
 305         struct crypt_params_tcrypt params = {
 306                 .keyfiles = opt_keyfiles,
 307                 .keyfiles_count = opt_keyfiles_count,
 308                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 309         };
 310         int r;
 311
 312         if ((r = crypt_init(&cd, action_argv[0])))
 313                 goto out;
 314
 315         /* TCRYPT header is encrypted, get passphrase now */
 316         r = tools_get_key(_("Enter passphrase: "),
 317                           CONST_CAST(char**)&params.passphrase,
 318                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 319                           _verify_passphrase(0), 0, cd);
 320         if (r < 0)
 321                 goto out;
 322
 323         if (opt_tcrypt_hidden)
 324                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 325
 326         if (opt_tcrypt_system)
 327                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 328
 329         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 330         check_signal(&r);
 331         if (r < 0)
 332                 goto out;
 333
 334         if (opt_dump_master_key)
 335                 r = tcryptDump_with_volume_key(cd);
 336         else
 337                 r = crypt_dump(cd);
 338 out:
 339         if (r == -EPERM)
 340                 log_err(_("No device header detected with this passphrase.\n"));
 341         crypt_free(cd);
 342         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 343         return r;
 344 }
 345
 346 static int action_close(void)
 347 {
 348         struct crypt_device *cd = NULL;
 349         int r;
 350
 351         r = crypt_init_by_name(&cd, action_argv[0]);
 352         if (r == 0)
 353                 r = crypt_deactivate(cd, action_argv[0]);
 354
 355         crypt_free(cd);
 356         return r;
 357 }
 358
 359 static int action_resize(void)
 360 {
 361         struct crypt_device *cd = NULL;
 362         int r;
 363
 364         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 365         if (r == 0)
 366                 r = crypt_resize(cd, action_argv[0], opt_size);
 367
 368         crypt_free(cd);
 369         return r;
 370 }
 371
 372 static int action_status(void)
 373 {
 374         crypt_status_info ci;
 375         struct crypt_active_device cad;
 376         struct crypt_device *cd = NULL;
 377         char *backing_file;
 378         const char *device;
 379         int path = 0, r = 0;
 380
 381         /* perhaps a path, not a dm device name */
 382         if (strchr(action_argv[0], '/'))
 383                 path = 1;
 384
 385         ci = crypt_status(NULL, action_argv[0]);
 386         switch (ci) {
 387         case CRYPT_INVALID:
 388                 r = -EINVAL;
 389                 break;
 390         case CRYPT_INACTIVE:
 391                 if (path)
 392                         log_std("%s is inactive.\n", action_argv[0]);
 393                 else
 394                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 395                 r = -ENODEV;
 396                 break;
 397         case CRYPT_ACTIVE:
 398         case CRYPT_BUSY:
 399                 if (path)
 400                         log_std("%s is active%s.\n", action_argv[0],
 401                                 ci == CRYPT_BUSY ? " and is in use" : "");
 402                 else
 403                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 404                                 ci == CRYPT_BUSY ? " and is in use" : "");
 405
 406                 r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 407                 if (r < 0 || !crypt_get_type(cd))
 408                         goto out;
 409
 410                 log_std("  type:    %s\n", crypt_get_type(cd));
 411
 412                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 413                 if (r < 0)
 414                         goto out;
 415
 416                 log_std("  cipher:  %s-%s\n", crypt_get_cipher(cd), crypt_get_cipher_mode(cd));
 417                 log_std("  keysize: %d bits\n", crypt_get_volume_key_size(cd) * 8);
 418                 device = crypt_get_device_name(cd);
 419                 log_std("  device:  %s\n", device);
 420                 if (crypt_loop_device(device)) {
 421                         backing_file = crypt_loop_backing_file(device);
 422                         log_std("  loop:    %s\n", backing_file);
 423                         free(backing_file);
 424                 }
 425                 log_std("  offset:  %" PRIu64 " sectors\n", cad.offset);
 426                 log_std("  size:    %" PRIu64 " sectors\n", cad.size);
 427                 if (cad.iv_offset)
 428                         log_std("  skipped: %" PRIu64 " sectors\n", cad.iv_offset);
 429                 log_std("  mode:    %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 430                                            "readonly" : "read/write");
 431                 if (cad.flags & CRYPT_ACTIVATE_ALLOW_DISCARDS)
 432                         log_std("  flags:   discards\n");
 433         }
 434 out:
 435         crypt_free(cd);
 436         if (r == -ENOTSUP)
 437                 r = 0;
 438         return r;
 439 }
 440
 441 static int action_benchmark_kdf(const char *hash)
 442 {
 443         uint64_t kdf_iters;
 444         int r;
 445
 446         r = crypt_benchmark_kdf(NULL, "pbkdf2", hash, "foo", 3, "bar", 3,
 447                                 &kdf_iters);
 448         if (r < 0)
 449                 log_std("PBKDF2-%-9s     N/A\n", hash);
 450         else
 451                 log_std("PBKDF2-%-9s %7" PRIu64 " iterations per second\n",
 452                         hash, kdf_iters);
 453         return r;
 454 }
 455
 456 static int action_benchmark(void)
 457 {
 458         static struct {
 459                 const char *cipher;
 460                 const char *mode;
 461                 size_t key_size;
 462                 size_t iv_size;
 463         } bciphers[] = {
 464                 { "aes",     "cbc", 16, 16 },
 465                 { "serpent", "cbc", 16, 16 },
 466                 { "twofish", "cbc", 16, 16 },
 467                 { "aes",     "cbc", 32, 16 },
 468                 { "serpent", "cbc", 32, 16 },
 469                 { "twofish", "cbc", 32, 16 },
 470                 { "aes",     "xts", 32, 16 },
 471                 { "serpent", "xts", 32, 16 },
 472                 { "twofish", "xts", 32, 16 },
 473                 { "aes",     "xts", 64, 16 },
 474                 { "serpent", "xts", 64, 16 },
 475                 { "twofish", "xts", 64, 16 },
 476                 {  NULL, NULL, 0, 0 }
 477         };
 478         static char *bkdfs[] = {
 479                 "sha1", "sha256", "sha512", "ripemd160", "whirlpool", NULL
 480         };
 481         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 482         double enc_mbr = 0, dec_mbr = 0;
 483         int key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS);
 484         int iv_size = 16, skipped = 0;
 485         int buffer_size = 1024 * 1024;
 486         char *c;
 487         int i, r;
 488
 489         log_std(_("# Tests are approximate using memory only (no storage IO).\n"));
 490         if (opt_hash) {
 491                 r = action_benchmark_kdf(opt_hash);
 492         } else if (opt_cipher) {
 493                 r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mode);
 494                 if (r < 0) {
 495                         log_err(_("No known cipher specification pattern detected.\n"));
 496                         return r;
 497                 }
 498                 if ((c  = strchr(cipher_mode, '-')))
 499                         *c = '\0';
 500
 501                 /* FIXME: not really clever :) */
 502                 if (strstr(cipher, "des") ||
 503                     strstr(cipher, "blowfish") ||
 504                     strstr(cipher, "cast5"))
 505                         iv_size = 8;
 506
 507                 r = crypt_benchmark(NULL, cipher, cipher_mode,
 508                                     key_size / 8, iv_size, buffer_size,
 509                                     &enc_mbr, &dec_mbr);
 510                 if (!r) {
 511                         log_std(N_("#  Algorithm | Key | Encryption | Decryption\n"));
 512                         log_std("%8s-%s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 513                                 cipher, cipher_mode, key_size, enc_mbr, dec_mbr);
 514                 } else if (r == -ENOENT)
 515                         log_err(_("Cipher %s is not available.\n"), opt_cipher);
 516         } else {
 517                 for (i = 0; bkdfs[i]; i++) {
 518                         r = action_benchmark_kdf(bkdfs[i]);
 519                         check_signal(&r);
 520                         if (r == -EINTR)
 521                                 break;
 522                 }
 523                 for (i = 0; bciphers[i].cipher; i++) {
 524                         r = crypt_benchmark(NULL, bciphers[i].cipher, bciphers[i].mode,
 525                                             bciphers[i].key_size, bciphers[i].iv_size,
 526                                             buffer_size, &enc_mbr, &dec_mbr);
 527                         check_signal(&r);
 528                         if (r == -ENOTSUP || r == -EINTR)
 529                                 break;
 530                         if (r == -ENOENT)
 531                                 skipped++;
 532                         if (i == 0)
 533                                 log_std(N_("#  Algorithm | Key | Encryption | Decryption\n"));
 534
 535                         snprintf(cipher, MAX_CIPHER_LEN, "%s-%s",
 536                                  bciphers[i].cipher, bciphers[i].mode);
 537                         if (!r)
 538                                 log_std("%12s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 539                                         cipher, bciphers[i].key_size*8, enc_mbr, dec_mbr);
 540                         else
 541                                 log_std("%12s  %4db %12s %12s\n", cipher,
 542                                         bciphers[i].key_size*8, _("N/A"), _("N/A"));
 543                 }
 544                 if (skipped && skipped == i)
 545                         r = -ENOTSUP;
 546         }
 547
 548         if (r == -ENOTSUP) {
 549                 log_err(_("Required kernel crypto interface not available.\n"));
 550 #ifdef ENABLE_AF_ALG
 551                 log_err( _("Ensure you have algif_skcipher kernel module loaded.\n"));
 552 #endif
 553         }
 554         return r;
 555 }
 556
 557 static int _read_mk(const char *file, char **key, int keysize)
 558 {
 559         int fd;
 560
 561         *key = crypt_safe_alloc(keysize);
 562         if (!*key)
 563                 return -ENOMEM;
 564
 565         fd = open(file, O_RDONLY);
 566         if (fd == -1) {
 567                 log_err(_("Cannot read keyfile %s.\n"), file);
 568                 goto fail;
 569         }
 570         if ((read(fd, *key, keysize) != keysize)) {
 571                 log_err(_("Cannot read %d bytes from keyfile %s.\n"), keysize, file);
 572                 close(fd);
 573                 goto fail;
 574         }
 575         close(fd);
 576         return 0;
 577 fail:
 578         crypt_safe_free(*key);
 579         *key = NULL;
 580         return -EINVAL;
 581 }
 582
 583 static int action_luksRepair(void)
 584 {
 585         struct crypt_device *cd = NULL;
 586         int r;
 587
 588         if ((r = crypt_init(&cd, action_argv[0])))
 589                 goto out;
 590
 591         /* Currently only LUKS1 allows repair */
 592         crypt_set_log_callback(cd, quiet_log, NULL);
 593         r = crypt_load(cd, CRYPT_LUKS1, NULL);
 594         crypt_set_log_callback(cd, tool_log, NULL);
 595         if (r == 0) {
 596                 log_verbose(_("No known problems detected for LUKS header.\n"));
 597                 goto out;
 598         }
 599
 600         r = yesDialog(_("Really try to repair LUKS device header?"),
 601                        NULL) ? 0 : -EINVAL;
 602         if (r == 0)
 603                 r = crypt_repair(cd, CRYPT_LUKS1, NULL);
 604 out:
 605         crypt_free(cd);
 606         return r;
 607 }
 608
 609 static int action_luksFormat(void)
 610 {
 611         int r = -EINVAL, keysize;
 612         const char *header_device;
 613         char *msg = NULL, *key = NULL, cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 614         char *password = NULL;
 615         size_t passwordLen;
 616         struct crypt_device *cd = NULL;
 617         struct crypt_params_luks1 params = {
 618                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 619                 .data_alignment = opt_align_payload,
 620                 .data_device = opt_header_device ? action_argv[0] : NULL,
 621         };
 622
 623         header_device = opt_header_device ?: action_argv[0];
 624
 625         if(asprintf(&msg, _("This will overwrite data on %s irrevocably."),
 626                     header_device) == -1) {
 627                 log_err(_("memory allocation error in action_luksFormat"));
 628                 r = -ENOMEM;
 629                 goto out;
 630         }
 631         r = yesDialog(msg, NULL) ? 0 : -EINVAL;
 632         free(msg);
 633         if (r < 0)
 634                 goto out;
 635
 636         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 637                                       cipher, NULL, cipher_mode);
 638         if (r < 0) {
 639                 log_err(_("No known cipher specification pattern detected.\n"));
 640                 goto out;
 641         }
 642
 643         if ((r = crypt_init(&cd, header_device))) {
 644                 if (opt_header_device)
 645                         log_err(_("Cannot use %s as on-disk header.\n"), header_device);
 646                 goto out;
 647         }
 648
 649         keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
 650
 651         crypt_set_timeout(cd, opt_timeout);
 652         if (opt_iteration_time)
 653                 crypt_set_iteration_time(cd, opt_iteration_time);
 654
 655         if (opt_random)
 656                 crypt_set_rng_type(cd, CRYPT_RNG_RANDOM);
 657         else if (opt_urandom)
 658                 crypt_set_rng_type(cd, CRYPT_RNG_URANDOM);
 659
 660         r = tools_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
 661                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 662                           opt_timeout, _verify_passphrase(1), 1, cd);
 663         if (r < 0)
 664                 goto out;
 665
 666         if (opt_master_key_file) {
 667                 r = _read_mk(opt_master_key_file, &key, keysize);
 668                 if (r < 0)
 669                         goto out;
 670         }
 671
 672         r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode,
 673                          opt_uuid, key, keysize, &params);
 674         check_signal(&r);
 675         if (r < 0)
 676                 goto out;
 677
 678         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 679                                             key, keysize,
 680                                             password, passwordLen);
 681 out:
 682         crypt_free(cd);
 683         crypt_safe_free(key);
 684         crypt_safe_free(password);
 685
 686         return r;
 687 }
 688
 689 static int action_open_luks(void)
 690 {
 691         struct crypt_device *cd = NULL;
 692         const char *data_device, *header_device, *activated_name;
 693         char *key = NULL;
 694         uint32_t flags = 0;
 695         int r, keysize;
 696
 697         if (opt_header_device) {
 698                 header_device = uuid_or_device(opt_header_device);
 699                 data_device = action_argv[0];
 700         } else {
 701                 header_device = uuid_or_device(action_argv[0]);
 702                 data_device = NULL;
 703         }
 704
 705         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 706
 707         if ((r = crypt_init(&cd, header_device)))
 708                 goto out;
 709
 710         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 711                 goto out;
 712
 713         if (data_device &&
 714             (r = crypt_set_data_device(cd, data_device)))
 715                 goto out;
 716
 717         if (!data_device && (crypt_get_data_offset(cd) < 8)) {
 718                 log_err(_("Reduced data offset is allowed only for detached LUKS header.\n"));
 719                 r = -EINVAL;
 720                 goto out;
 721         }
 722
 723         crypt_set_timeout(cd, opt_timeout);
 724         crypt_set_password_retry(cd, opt_tries);
 725         crypt_set_password_verify(cd, _verify_passphrase(0));
 726
 727         if (opt_iteration_time)
 728                 crypt_set_iteration_time(cd, opt_iteration_time);
 729
 730         if (opt_readonly)
 731                 flags |= CRYPT_ACTIVATE_READONLY;
 732
 733         if (opt_allow_discards)
 734                 flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 735
 736         if (opt_master_key_file) {
 737                 keysize = crypt_get_volume_key_size(cd);
 738                 r = _read_mk(opt_master_key_file, &key, keysize);
 739                 if (r < 0)
 740                         goto out;
 741                 r = crypt_activate_by_volume_key(cd, activated_name,
 742                                                  key, keysize, flags);
 743         } else if (opt_key_file) {
 744                 crypt_set_password_retry(cd, 1);
 745                 r = crypt_activate_by_keyfile_offset(cd, activated_name,
 746                         opt_key_slot, opt_key_file, opt_keyfile_size,
 747                         opt_keyfile_offset, flags);
 748         } else
 749                 r = crypt_activate_by_passphrase(cd, activated_name,
 750                         opt_key_slot, NULL, 0, flags);
 751 out:
 752         crypt_safe_free(key);
 753         crypt_free(cd);
 754         return r;
 755 }
 756
 757 static int verify_keyslot(struct crypt_device *cd, int key_slot,
 758                           char *msg_last, char *msg_pass,
 759                           const char *key_file, int keyfile_offset,
 760                           int keyfile_size)
 761 {
 762         crypt_keyslot_info ki;
 763         char *password = NULL;
 764         size_t passwordLen;
 765         int i, r;
 766
 767         ki = crypt_keyslot_status(cd, key_slot);
 768         if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !yesDialog(msg_last, NULL))
 769                 return -EPERM;
 770
 771         r = tools_get_key(msg_pass, &password, &passwordLen,
 772                           keyfile_offset, keyfile_size, key_file, opt_timeout,
 773                           _verify_passphrase(0), 0, cd);
 774         if(r < 0)
 775                 goto out;
 776
 777         if (ki == CRYPT_SLOT_ACTIVE_LAST) {
 778                 /* check the last keyslot */
 779                 r = crypt_activate_by_passphrase(cd, NULL, key_slot,
 780                                                  password, passwordLen, 0);
 781         } else {
 782                 /* try all other keyslots */
 783                 for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1); i++) {
 784                         if (i == key_slot)
 785                                 continue;
 786                         ki = crypt_keyslot_status(cd, key_slot);
 787                         if (ki == CRYPT_SLOT_ACTIVE)
 788                         r = crypt_activate_by_passphrase(cd, NULL, i,
 789                                                          password, passwordLen, 0);
 790                         if (r == i)
 791                                 break;
 792                 }
 793         }
 794
 795         if (r == -EPERM)
 796                 log_err(_("No key available with this passphrase.\n"));
 797 out:
 798         crypt_safe_free(password);
 799         return r;
 800 }
 801
 802 static int action_luksKillSlot(void)
 803 {
 804         struct crypt_device *cd = NULL;
 805         int r;
 806
 807         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 808                 goto out;
 809
 810         crypt_set_confirm_callback(cd, yesDialog, NULL);
 811         crypt_set_timeout(cd, opt_timeout);
 812
 813         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 814                 goto out;
 815
 816         switch (crypt_keyslot_status(cd, opt_key_slot)) {
 817         case CRYPT_SLOT_ACTIVE_LAST:
 818         case CRYPT_SLOT_ACTIVE:
 819                 log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 820                 break;
 821         case CRYPT_SLOT_INACTIVE:
 822                 log_err(_("Key %d not active. Can't wipe.\n"), opt_key_slot);
 823         case CRYPT_SLOT_INVALID:
 824                 r = -EINVAL;
 825                 goto out;
 826         }
 827
 828         if (!opt_batch_mode) {
 829                 r = verify_keyslot(cd, opt_key_slot,
 830                         _("This is the last keyslot. Device will become unusable after purging this key."),
 831                         _("Enter any remaining LUKS passphrase: "),
 832                         opt_key_file, opt_keyfile_offset, opt_keyfile_size);
 833                 if (r < 0)
 834                         goto out;
 835         }
 836
 837         r = crypt_keyslot_destroy(cd, opt_key_slot);
 838 out:
 839         crypt_free(cd);
 840         return r;
 841 }
 842
 843 static int action_luksRemoveKey(void)
 844 {
 845         struct crypt_device *cd = NULL;
 846         char *password = NULL;
 847         size_t passwordLen;
 848         int r;
 849
 850         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 851                 goto out;
 852
 853         crypt_set_confirm_callback(cd, yesDialog, NULL);
 854         crypt_set_timeout(cd, opt_timeout);
 855
 856         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 857                 goto out;
 858
 859         r = tools_get_key(_("Enter LUKS passphrase to be deleted: "),
 860                       &password, &passwordLen,
 861                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 862                       opt_timeout,
 863                       _verify_passphrase(0), 0,
 864                       cd);
 865         if(r < 0)
 866                 goto out;
 867
 868         r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 869                                          password, passwordLen, 0);
 870         check_signal(&r);
 871         if (r < 0)
 872                 goto out;
 873
 874         opt_key_slot = r;
 875         log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 876
 877         if (crypt_keyslot_status(cd, opt_key_slot) == CRYPT_SLOT_ACTIVE_LAST &&
 878             !yesDialog(_("This is the last keyslot. "
 879                           "Device will become unusable after purging this key."),
 880                         NULL)) {
 881                 r = -EPERM;
 882                 goto out;
 883         }
 884
 885         r = crypt_keyslot_destroy(cd, opt_key_slot);
 886 out:
 887         crypt_safe_free(password);
 888         crypt_free(cd);
 889         return r;
 890 }
 891
 892 static int action_luksAddKey(void)
 893 {
 894         int r = -EINVAL, keysize = 0;
 895         char *key = NULL;
 896         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 897         char *password = NULL, *password_new = NULL;
 898         size_t password_size = 0, password_new_size = 0;
 899         struct crypt_device *cd = NULL;
 900
 901         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 902                 goto out;
 903
 904         crypt_set_confirm_callback(cd, yesDialog, NULL);
 905
 906         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 907                 goto out;
 908
 909         keysize = crypt_get_volume_key_size(cd);
 910         /* FIXME: lib cannot properly set verification for new/old passphrase */
 911         crypt_set_password_verify(cd, _verify_passphrase(0));
 912         crypt_set_timeout(cd, opt_timeout);
 913         if (opt_iteration_time)
 914                 crypt_set_iteration_time(cd, opt_iteration_time);
 915
 916         if (opt_master_key_file) {
 917                 r = _read_mk(opt_master_key_file, &key, keysize);
 918                 if (r < 0)
 919                         goto out;
 920                 //FIXME: process keyfile arg
 921                 r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 922                                                     key, keysize, NULL, 0);
 923         } else if (opt_key_file || opt_new_key_file) {
 924                 r = crypt_keyslot_add_by_keyfile_offset(cd, opt_key_slot,
 925                         opt_key_file, opt_keyfile_size, opt_keyfile_offset,
 926                         opt_new_key_file, opt_new_keyfile_size, opt_new_keyfile_offset);
 927         } else {
 928                 r = tools_get_key(_("Enter any passphrase: "),
 929                               &password, &password_size, 0, 0, NULL,
 930                               opt_timeout, _verify_passphrase(0), 0, cd);
 931
 932                 if (r < 0)
 933                         goto out;
 934
 935                 /* Check password before asking for new one */
 936                 r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 937                                                  password, password_size, 0);
 938                 check_signal(&r);
 939                 if (r < 0)
 940                         goto out;
 941
 942                 r = tools_get_key(_("Enter new passphrase for key slot: "),
 943                                   &password_new, &password_new_size, 0, 0, NULL,
 944                                   opt_timeout, _verify_passphrase(0), 1, cd);
 945                 if (r < 0)
 946                         goto out;
 947
 948                 r = crypt_keyslot_add_by_passphrase(cd, opt_key_slot,
 949                                                     password, password_size,
 950                                                     password_new, password_new_size);
 951         }
 952 out:
 953         crypt_safe_free(password);
 954         crypt_safe_free(password_new);
 955         crypt_safe_free(key);
 956         crypt_free(cd);
 957         return r;
 958 }
 959
 960 static int action_luksChangeKey(void)
 961 {
 962         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 963         struct crypt_device *cd = NULL;
 964         char *password = NULL, *password_new = NULL;
 965         size_t password_size = 0, password_new_size = 0;
 966         int r;
 967
 968         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 969                 goto out;
 970
 971         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 972                 goto out;
 973
 974         if (opt_iteration_time)
 975                 crypt_set_iteration_time(cd, opt_iteration_time);
 976
 977         r = tools_get_key(_("Enter LUKS passphrase to be changed: "),
 978                       &password, &password_size,
 979                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 980                       opt_timeout, _verify_passphrase(0), 0, cd);
 981         if (r < 0)
 982                 goto out;
 983
 984         /* Check password before asking for new one */
 985         r = crypt_activate_by_passphrase(cd, NULL, opt_key_slot,
 986                                          password, password_size, 0);
 987         check_signal(&r);
 988         if (r < 0)
 989                 goto out;
 990
 991         r = tools_get_key(_("Enter new LUKS passphrase: "),
 992                           &password_new, &password_new_size,
 993                           opt_new_keyfile_offset, opt_new_keyfile_size,
 994                           opt_new_key_file,
 995                           opt_timeout, _verify_passphrase(0), 1, cd);
 996         if (r < 0)
 997                 goto out;
 998
 999         r = crypt_keyslot_change_by_passphrase(cd, opt_key_slot, opt_key_slot,
1000                 password, password_size, password_new, password_new_size);
1001 out:
1002         crypt_safe_free(password);
1003         crypt_safe_free(password_new);
1004         crypt_free(cd);
1005         return r;
1006 }
1007
1008 static int action_isLuks(void)
1009 {
1010         struct crypt_device *cd = NULL;
1011         int r;
1012
1013         if ((r = crypt_init(&cd, action_argv[0])))
1014                 goto out;
1015
1016         crypt_set_log_callback(cd, quiet_log, NULL);
1017         r = crypt_load(cd, CRYPT_LUKS1, NULL);
1018 out:
1019         crypt_free(cd);
1020         return r;
1021 }
1022
1023 static int action_luksUUID(void)
1024 {
1025         struct crypt_device *cd = NULL;
1026         const char *existing_uuid = NULL;
1027         int r;
1028
1029         if ((r = crypt_init(&cd, action_argv[0])))
1030                 goto out;
1031
1032         crypt_set_confirm_callback(cd, yesDialog, NULL);
1033
1034         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1035                 goto out;
1036
1037         if (opt_uuid)
1038                 r = crypt_set_uuid(cd, opt_uuid);
1039         else {
1040                 existing_uuid = crypt_get_uuid(cd);
1041                 log_std("%s\n", existing_uuid ?: "");
1042                 r = existing_uuid ? 0 : 1;
1043         }
1044 out:
1045         crypt_free(cd);
1046         return r;
1047 }
1048
1049 static int luksDump_with_volume_key(struct crypt_device *cd)
1050 {
1051         char *vk = NULL, *password = NULL;
1052         size_t passwordLen = 0;
1053         size_t vk_size;
1054         unsigned i;
1055         int r;
1056
1057         crypt_set_confirm_callback(cd, yesDialog, NULL);
1058         if (!yesDialog(
1059             _("Header dump with volume key is sensitive information\n"
1060               "which allows access to encrypted partition without passphrase.\n"
1061               "This dump should be always stored encrypted on safe place."),
1062               NULL))
1063                 return -EPERM;
1064
1065         vk_size = crypt_get_volume_key_size(cd);
1066         vk = crypt_safe_alloc(vk_size);
1067         if (!vk)
1068                 return -ENOMEM;
1069
1070         r = tools_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
1071                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
1072                           opt_timeout, 0, 0, cd);
1073         if (r < 0)
1074                 goto out;
1075
1076         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size,
1077                                  password, passwordLen);
1078         check_signal(&r);
1079         if (r < 0)
1080                 goto out;
1081
1082         log_std("LUKS header information for %s\n", crypt_get_device_name(cd));
1083         log_std("Cipher name:   \t%s\n", crypt_get_cipher(cd));
1084         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
1085         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
1086         log_std("UUID:          \t%s\n", crypt_get_uuid(cd));
1087         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
1088         log_std("MK dump:\t");
1089
1090         for(i = 0; i < vk_size; i++) {
1091                 if (i && !(i % 16))
1092                         log_std("\n\t\t");
1093                 log_std("%02hhx ", (char)vk[i]);
1094         }
1095         log_std("\n");
1096
1097 out:
1098         crypt_safe_free(password);
1099         crypt_safe_free(vk);
1100         return r;
1101 }
1102
1103 static int action_luksDump(void)
1104 {
1105         struct crypt_device *cd = NULL;
1106         int r;
1107
1108         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1109                 goto out;
1110
1111         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1112                 goto out;
1113
1114         if (opt_dump_master_key)
1115                 r = luksDump_with_volume_key(cd);
1116         else
1117                 r = crypt_dump(cd);
1118 out:
1119         crypt_free(cd);
1120         return r;
1121 }
1122
1123 static int action_luksSuspend(void)
1124 {
1125         struct crypt_device *cd = NULL;
1126         int r;
1127
1128         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
1129         if (!r)
1130                 r = crypt_suspend(cd, action_argv[0]);
1131
1132         crypt_free(cd);
1133         return r;
1134 }
1135
1136 static int action_luksResume(void)
1137 {
1138         struct crypt_device *cd = NULL;
1139         int r;
1140
1141         if ((r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device)))
1142                 goto out;
1143
1144         crypt_set_timeout(cd, opt_timeout);
1145         crypt_set_password_retry(cd, opt_tries);
1146         crypt_set_password_verify(cd, _verify_passphrase(0));
1147
1148         if (opt_key_file)
1149                 r = crypt_resume_by_keyfile_offset(cd, action_argv[0], CRYPT_ANY_SLOT,
1150                         opt_key_file, opt_keyfile_size, opt_keyfile_offset);
1151         else
1152                 r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
1153                                                NULL, 0);
1154 out:
1155         crypt_free(cd);
1156         return r;
1157 }
1158
1159 static int action_luksBackup(void)
1160 {
1161         struct crypt_device *cd = NULL;
1162         int r;
1163
1164         if (!opt_header_backup_file) {
1165                 log_err(_("Option --header-backup-file is required.\n"));
1166                 return -EINVAL;
1167         }
1168
1169         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1170                 goto out;
1171
1172         crypt_set_confirm_callback(cd, yesDialog, NULL);
1173
1174         r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
1175 out:
1176         crypt_free(cd);
1177         return r;
1178 }
1179
1180 static int action_luksRestore(void)
1181 {
1182         struct crypt_device *cd = NULL;
1183         int r = 0;
1184
1185         if (!opt_header_backup_file) {
1186                 log_err(_("Option --header-backup-file is required.\n"));
1187                 return -EINVAL;
1188         }
1189
1190         if ((r = crypt_init(&cd, action_argv[0])))
1191                 goto out;
1192
1193         crypt_set_confirm_callback(cd, yesDialog, NULL);
1194         r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
1195 out:
1196         crypt_free(cd);
1197         return r;
1198 }
1199
1200 static int action_open(void)
1201 {
1202         if (!opt_type)
1203                 return -EINVAL;
1204
1205         if (!strcmp(opt_type, "luks") || !strcmp(opt_type, "luks1")) {
1206                 if (action_argc < 2 && !opt_test_passphrase)
1207                         goto args;
1208                 return action_open_luks();
1209         } else if (!strcmp(opt_type, "plain")) {
1210                 if (action_argc < 2)
1211                         goto args;
1212                 return action_open_plain();
1213         } else if (!strcmp(opt_type, "loopaes")) {
1214                 if (action_argc < 2)
1215                         goto args;
1216                 return action_open_loopaes();
1217         } else if (!strcmp(opt_type, "tcrypt")) {
1218                 if (action_argc < 2 && !opt_test_passphrase)
1219                         goto args;
1220                 return action_open_tcrypt();
1221         }
1222
1223         log_err(_("Unrecognized metadata device type %s.\n"), opt_type);
1224         return -EINVAL;
1225 args:
1226         log_err(_("Command requires device and mapped name as arguments.\n"));
1227         return -EINVAL;
1228 }
1229
1230 static struct action_type {
1231         const char *type;
1232         int (*handler)(void);
1233         int required_action_argc;
1234         int required_memlock;
1235         const char *arg_desc;
1236         const char *desc;
1237 } action_types[] = {
1238         { "open",         action_open,         1, 1, N_("<device> [--type <type>] [<name>]"),N_("open device as mapping <name>") },
1239         { "close",        action_close,        1, 1, N_("<name>"), N_("close device (remove mapping)") },
1240         { "resize",       action_resize,       1, 1, N_("<name>"), N_("resize active device") },
1241         { "status",       action_status,       1, 0, N_("<name>"), N_("show device status") },
1242         { "benchmark",    action_benchmark,    0, 0, N_("<name>"), N_("benchmark cipher") },
1243         { "repair",       action_luksRepair,   1, 1, N_("<device>"), N_("try to repair on-disk metadata") },
1244         { "luksFormat",   action_luksFormat,   1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
1245         { "luksAddKey",   action_luksAddKey,   1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
1246         { "luksRemoveKey",action_luksRemoveKey,1, 1, N_("<device> [<key file>]"), N_("removes supplied key or key file from LUKS device") },
1247         { "luksChangeKey",action_luksChangeKey,1, 1, N_("<device> [<key file>]"), N_("changes supplied key or key file of LUKS device") },
1248         { "luksKillSlot", action_luksKillSlot, 2, 1, N_("<device> <key slot>"), N_("wipes key with number <key slot> from LUKS device") },
1249         { "luksUUID",     action_luksUUID,     1, 0, N_("<device>"), N_("print UUID of LUKS device") },
1250         { "isLuks",       action_isLuks,       1, 0, N_("<device>"), N_("tests <device> for LUKS partition header") },
1251         { "luksDump",     action_luksDump,     1, 1, N_("<device>"), N_("dump LUKS partition information") },
1252         { "tcryptDump",   action_tcryptDump,   1, 1, N_("<device>"), N_("dump TCRYPT device information") },
1253         { "luksSuspend",  action_luksSuspend,  1, 1, N_("<device>"), N_("Suspend LUKS device and wipe key (all IOs are frozen).") },
1254         { "luksResume",   action_luksResume,   1, 1, N_("<device>"), N_("Resume suspended LUKS device.") },
1255         { "luksHeaderBackup", action_luksBackup,1,1, N_("<device>"), N_("Backup LUKS device header and keyslots") },
1256         { "luksHeaderRestore",action_luksRestore,1,1,N_("<device>"), N_("Restore LUKS device header and keyslots") },
1257         {}
1258 };
1259
1260 static void help(poptContext popt_context,
1261                  enum poptCallbackReason reason __attribute__((unused)),
1262                  struct poptOption *key,
1263                  const char *arg __attribute__((unused)),
1264                  void *data __attribute__((unused)))
1265 {
1266         if (key->shortName == '?') {
1267                 struct action_type *action;
1268
1269                 log_std("%s\n",PACKAGE_STRING);
1270
1271                 poptPrintHelp(popt_context, stdout, 0);
1272
1273                 log_std(_("\n"
1274                          "<action> is one of:\n"));
1275
1276                 for(action = action_types; action->type; action++)
1277                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
1278
1279                 log_std(_("\n"
1280                           "You can also use old <action> syntax aliases:\n"
1281                           "\topen: create (plainOpen), luksOpen, loopaesOpen, tcryptOpen\n"
1282                           "\tclose: remove (plainClose), luksClose, loopaesClose, tcryptClose\n"));
1283                 log_std(_("\n"
1284                          "<name> is the device to create under %s\n"
1285                          "<device> is the encrypted device\n"
1286                          "<key slot> is the LUKS key slot number to modify\n"
1287                          "<key file> optional key file for the new key for luksAddKey action\n"),
1288                         crypt_get_dir());
1289
1290                 log_std(_("\nDefault compiled-in key and passphrase parameters:\n"
1291                          "\tMaximum keyfile size: %dkB, "
1292                          "Maximum interactive passphrase length %d (characters)\n"
1293                          "Default PBKDF2 iteration time for LUKS: %d (ms)\n"),
1294                          DEFAULT_KEYFILE_SIZE_MAXKB, DEFAULT_PASSPHRASE_SIZE_MAX,
1295                          DEFAULT_LUKS1_ITER_TIME);
1296
1297                 log_std(_("\nDefault compiled-in device cipher parameters:\n"
1298                          "\tloop-AES: %s, Key %d bits\n"
1299                          "\tplain: %s, Key: %d bits, Password hashing: %s\n"
1300                          "\tLUKS1: %s, Key: %d bits, LUKS header hashing: %s, RNG: %s\n"),
1301                          DEFAULT_LOOPAES_CIPHER, DEFAULT_LOOPAES_KEYBITS,
1302                          DEFAULT_CIPHER(PLAIN), DEFAULT_PLAIN_KEYBITS, DEFAULT_PLAIN_HASH,
1303                          DEFAULT_CIPHER(LUKS1), DEFAULT_LUKS1_KEYBITS, DEFAULT_LUKS1_HASH,
1304                          DEFAULT_RNG);
1305                 exit(EXIT_SUCCESS);
1306         } else
1307                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
1308 }
1309
1310 static void help_args(struct action_type *action, poptContext popt_context)
1311 {
1312         char buf[128];
1313
1314         snprintf(buf, sizeof(buf), _("%s: requires %s as arguments"), action->type, action->arg_desc);
1315         usage(popt_context, EXIT_FAILURE, buf, poptGetInvocationName(popt_context));
1316 }
1317
1318 static int run_action(struct action_type *action)
1319 {
1320         int r;
1321
1322         log_dbg("Running command %s.", action->type);
1323
1324         if (action->required_memlock)
1325                 crypt_memory_lock(NULL, 1);
1326
1327         set_int_handler(0);
1328         r = action->handler();
1329
1330         if (action->required_memlock)
1331                 crypt_memory_lock(NULL, 0);
1332
1333         /* Some functions returns keyslot # */
1334         if (r > 0)
1335                 r = 0;
1336         check_signal(&r);
1337
1338         show_status(r);
1339         return translate_errno(r);
1340 }
1341
1342 int main(int argc, const char **argv)
1343 {
1344         static char *popt_tmp;
1345         static struct poptOption popt_help_options[] = {
1346                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
1347                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
1348                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
1349                 POPT_TABLEEND
1350         };
1351         static struct poptOption popt_options[] = {
1352                 { NULL,                '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
1353                 { "version",           '\0', POPT_ARG_NONE, &opt_version_mode,          0, N_("Print package version"), NULL },
1354                 { "verbose",           'v',  POPT_ARG_NONE, &opt_verbose,               0, N_("Shows more detailed error messages"), NULL },
1355                 { "debug",             '\0', POPT_ARG_NONE, &opt_debug,                 0, N_("Show debug messages"), NULL },
1356                 { "cipher",            'c',  POPT_ARG_STRING, &opt_cipher,              0, N_("The cipher used to encrypt the disk (see /proc/crypto)"), NULL },
1357                 { "hash",              'h',  POPT_ARG_STRING, &opt_hash,                0, N_("The hash used to create the encryption key from the passphrase"), NULL },
1358                 { "verify-passphrase", 'y',  POPT_ARG_NONE, &opt_verify_passphrase,     0, N_("Verifies the passphrase by asking for it twice"), NULL },
1359                 { "key-file",          'd',  POPT_ARG_STRING, &opt_key_file,            5, N_("Read the key from a file."), NULL },
1360                 { "master-key-file",  '\0',  POPT_ARG_STRING, &opt_master_key_file,     0, N_("Read the volume (master) key from file."), NULL },
1361                 { "dump-master-key",  '\0',  POPT_ARG_NONE, &opt_dump_master_key,       0, N_("Dump volume (master) key instead of keyslots info."), NULL },
1362                 { "key-size",          's',  POPT_ARG_INT, &opt_key_size,               0, N_("The size of the encryption key"), N_("BITS") },
1363                 { "keyfile-size",      'l',  POPT_ARG_LONG, &opt_keyfile_size,          0, N_("Limits the read from keyfile"), N_("bytes") },
1364                 { "keyfile-offset",   '\0',  POPT_ARG_LONG, &opt_keyfile_offset,        0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
1365                 { "new-keyfile-size", '\0',  POPT_ARG_LONG, &opt_new_keyfile_size,      0, N_("Limits the read from newly added keyfile"), N_("bytes") },
1366                 { "new-keyfile-offset",'\0', POPT_ARG_LONG, &opt_new_keyfile_offset,    0, N_("Number of bytes to skip in newly added keyfile"), N_("bytes") },
1367                 { "key-slot",          'S',  POPT_ARG_INT, &opt_key_slot,               0, N_("Slot number for new key (default is first free)"), NULL },
1368                 { "size",              'b',  POPT_ARG_STRING, &popt_tmp,                1, N_("The size of the device"), N_("SECTORS") },
1369                 { "offset",            'o',  POPT_ARG_STRING, &popt_tmp,                2, N_("The start offset in the backend device"), N_("SECTORS") },
1370                 { "skip",              'p',  POPT_ARG_STRING, &popt_tmp,                3, N_("How many sectors of the encrypted data to skip at the beginning"), N_("SECTORS") },
1371                 { "readonly",          'r',  POPT_ARG_NONE, &opt_readonly,              0, N_("Create a readonly mapping"), NULL },
1372                 { "iter-time",         'i',  POPT_ARG_INT, &opt_iteration_time,         0, N_("PBKDF2 iteration time for LUKS (in ms)"), N_("msecs") },
1373                 { "batch-mode",        'q',  POPT_ARG_NONE, &opt_batch_mode,            0, N_("Do not ask for confirmation"), NULL },
1374                 { "timeout",           't',  POPT_ARG_INT, &opt_timeout,                0, N_("Timeout for interactive passphrase prompt (in seconds)"), N_("secs") },
1375                 { "tries",             'T',  POPT_ARG_INT, &opt_tries,                  0, N_("How often the input of the passphrase can be retried"), NULL },
1376                 { "align-payload",     '\0', POPT_ARG_INT, &opt_align_payload,          0, N_("Align payload at <n> sector boundaries - for luksFormat"), N_("SECTORS") },
1377                 { "header-backup-file",'\0', POPT_ARG_STRING, &opt_header_backup_file,  0, N_("File with LUKS header and keyslots backup."), NULL },
1378                 { "use-random",        '\0', POPT_ARG_NONE, &opt_random,                0, N_("Use /dev/random for generating volume key."), NULL },
1379                 { "use-urandom",       '\0', POPT_ARG_NONE, &opt_urandom,               0, N_("Use /dev/urandom for generating volume key."), NULL },
1380                 { "shared",            '\0', POPT_ARG_NONE, &opt_shared,                0, N_("Share device with another non-overlapping crypt segment."), NULL },
1381                 { "uuid",              '\0', POPT_ARG_STRING, &opt_uuid,                0, N_("UUID for device to use."), NULL },
1382                 { "allow-discards",    '\0', POPT_ARG_NONE, &opt_allow_discards,        0, N_("Allow discards (aka TRIM) requests for device."), NULL },
1383                 { "header",            '\0', POPT_ARG_STRING, &opt_header_device,       0, N_("Device or file with separated LUKS header."), NULL },
1384                 { "test-passphrase",   '\0', POPT_ARG_NONE, &opt_test_passphrase,       0, N_("Do not activate device, just check passphrase."), NULL },
1385                 { "tcrypt-hidden",     '\0', POPT_ARG_NONE, &opt_tcrypt_hidden,         0, N_("Use hidden header (hidden TCRYPT device)."), NULL },
1386                 { "tcrypt-system",     '\0', POPT_ARG_NONE, &opt_tcrypt_system,         0, N_("Device is system TCRYPT drive (with bootloader)."), NULL },
1387                 { "type",               'M', POPT_ARG_STRING, &opt_type,                0, N_("Type of device metadata: luks, plain, loopaes, tcrypt."), NULL },
1388                 { "force-password",    '\0', POPT_ARG_NONE, &opt_force_password,        0, N_("Disable password quality check (if enabled)."), NULL },
1389                 POPT_TABLEEND
1390         };
1391         poptContext popt_context;
1392         struct action_type *action;
1393         const char *aname;
1394         int r;
1395
1396         crypt_set_log_callback(NULL, tool_log, NULL);
1397
1398         setlocale(LC_ALL, "");
1399         bindtextdomain(PACKAGE, LOCALEDIR);
1400         textdomain(PACKAGE);
1401
1402         crypt_fips_self_check(NULL);
1403
1404         popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
1405         poptSetOtherOptionHelp(popt_context,
1406                                _("[OPTION...] <action> <action-specific>"));
1407
1408         while((r = poptGetNextOpt(popt_context)) > 0) {
1409                 unsigned long long ull_value;
1410                 char *endp;
1411
1412                 if (r == 5) {
1413                         if (opt_keyfiles_count < MAX_KEYFILES)
1414                                 opt_keyfiles[opt_keyfiles_count++] = poptGetOptArg(popt_context);
1415                         continue;
1416                 }
1417
1418                 errno = 0;
1419                 ull_value = strtoull(popt_tmp, &endp, 0);
1420                 if (*endp || !*popt_tmp ||
1421                     (errno == ERANGE && ull_value == ULLONG_MAX) ||
1422                     (errno != 0 && ull_value == 0))
1423                         r = POPT_ERROR_BADNUMBER;
1424
1425                 switch(r) {
1426                         case 1:
1427                                 opt_size = ull_value;
1428                                 break;
1429                         case 2:
1430                                 opt_offset = ull_value;
1431                                 break;
1432                         case 3:
1433                                 opt_skip = ull_value;
1434                                 opt_skip_valid = 1;
1435                                 break;
1436                 }
1437
1438                 if (r < 0)
1439                         break;
1440         }
1441
1442         if (r < -1)
1443                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
1444                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
1445         if (opt_version_mode) {
1446                 log_std("%s %s\n", PACKAGE_NAME, PACKAGE_VERSION);
1447                 poptFreeContext(popt_context);
1448                 exit(EXIT_SUCCESS);
1449         }
1450
1451         if (!(aname = poptGetArg(popt_context)))
1452                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
1453                       poptGetInvocationName(popt_context));
1454
1455         action_argc = 0;
1456         action_argv = poptGetArgs(popt_context);
1457         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
1458         if(!action_argv)
1459                 action_argv = null_action_argv;
1460
1461         /* Count args, somewhat unnice, change? */
1462         while(action_argv[action_argc] != NULL)
1463                 action_argc++;
1464
1465         /* Handle aliases */
1466         if (!strcmp(aname, "create")) {
1467                 /* create command had historically switched arguments */
1468                 if (action_argv[0] && action_argv[1]) {
1469                         const char *tmp = action_argv[0];
1470                         action_argv[0] = action_argv[1];
1471                         action_argv[1] = tmp;
1472                 }
1473                 aname = "open";
1474                 opt_type = "plain";
1475         } else if (!strcmp(aname, "plainOpen")) {
1476                 aname = "open";
1477                 opt_type = "plain";
1478         } else if (!strcmp(aname, "luksOpen")) {
1479                 aname = "open";
1480                 opt_type = "luks";
1481         } else if (!strcmp(aname, "loopaesOpen")) {
1482                 aname = "open";
1483                 opt_type = "loopaes";
1484         } else if (!strcmp(aname, "tcryptOpen")) {
1485                 aname = "open";
1486                 opt_type = "tcrypt";
1487         } else if (!strcmp(aname, "remove") ||
1488                    !strcmp(aname, "plainClose") ||
1489                    !strcmp(aname, "luksClose") ||
1490                    !strcmp(aname, "loopaesClose") ||
1491                    !strcmp(aname, "tcryptClose")) {
1492                 aname = "close";
1493         }
1494
1495         for(action = action_types; action->type; action++)
1496                 if (strcmp(action->type, aname) == 0)
1497                         break;
1498
1499         if (!action->type)
1500                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
1501                       poptGetInvocationName(popt_context));
1502
1503         if(action_argc < action->required_action_argc)
1504                 help_args(action, popt_context);
1505
1506         /* FIXME: rewrite this from scratch */
1507
1508         if (opt_shared && (strcmp(aname, "open") || strcmp(opt_type, "plain")) )
1509                 usage(popt_context, EXIT_FAILURE,
1510                       _("Option --shared is allowed only for open of plain device.\n"),
1511                       poptGetInvocationName(popt_context));
1512
1513         if (opt_allow_discards && strcmp(aname, "open"))
1514                 usage(popt_context, EXIT_FAILURE,
1515                       _("Option --allow-discards is allowed only for open operation.\n"),
1516                       poptGetInvocationName(popt_context));
1517
1518         if (opt_key_size &&
1519            strcmp(aname, "luksFormat") &&
1520            strcmp(aname, "open") &&
1521            strcmp(aname, "benchmark"))
1522                 usage(popt_context, EXIT_FAILURE,
1523                       _("Option --key-size is allowed only for luksFormat, open and benchmark.\n"
1524                         "To limit read from keyfile use --keyfile-size=(bytes)."),
1525                       poptGetInvocationName(popt_context));
1526
1527         if (opt_test_passphrase && (strcmp(aname, "open") ||
1528             (strcmp(opt_type, "luks") && strcmp(opt_type, "tcrypt"))))
1529                 usage(popt_context, EXIT_FAILURE,
1530                       _("Option --test-passphrase is allowed only for open of LUKS and TCRYPT devices.\n"),
1531                       poptGetInvocationName(popt_context));
1532
1533         if (opt_key_size % 8)
1534                 usage(popt_context, EXIT_FAILURE,
1535                       _("Key size must be a multiple of 8 bits"),
1536                       poptGetInvocationName(popt_context));
1537
1538         if (!strcmp(aname, "luksKillSlot") && action_argc > 1)
1539                 opt_key_slot = atoi(action_argv[1]);
1540         if (opt_key_slot != CRYPT_ANY_SLOT &&
1541             (opt_key_slot < 0 || opt_key_slot >= crypt_keyslot_max(CRYPT_LUKS1)))
1542                 usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."),
1543                       poptGetInvocationName(popt_context));
1544
1545         if ((!strcmp(aname, "luksRemoveKey") ||
1546              !strcmp(aname, "luksFormat")) &&
1547              action_argc > 1) {
1548                 if (opt_key_file)
1549                         log_err(_("Option --key-file takes precedence over specified key file argument.\n"));
1550                 else
1551                         opt_key_file = action_argv[1];
1552         }
1553
1554         if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0 ||
1555             opt_keyfile_offset < 0 || opt_new_keyfile_offset < 0)
1556                 usage(popt_context, EXIT_FAILURE,
1557                       _("Negative number for option not permitted."),
1558                       poptGetInvocationName(popt_context));
1559
1560         if (opt_random && opt_urandom)
1561                 usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
1562                       poptGetInvocationName(popt_context));
1563
1564         if ((opt_random || opt_urandom) && strcmp(aname, "luksFormat"))
1565                 usage(popt_context, EXIT_FAILURE, _("Option --use-[u]random is allowed only for luksFormat."),
1566                       poptGetInvocationName(popt_context));
1567
1568         if (opt_uuid && strcmp(aname, "luksFormat") && strcmp(aname, "luksUUID"))
1569                 usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed only for luksFormat and luksUUID."),
1570                       poptGetInvocationName(popt_context));
1571
1572         if (opt_align_payload && strcmp(aname, "luksFormat"))
1573                 usage(popt_context, EXIT_FAILURE, _("Option --align-payload is allowed only for luksFormat."),
1574                       poptGetInvocationName(popt_context));
1575
1576         if (opt_skip && (strcmp(aname, "open") ||
1577             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1578                 usage(popt_context, EXIT_FAILURE,
1579                 _("Option --skip is supported only for open of plain and loopaes devices.\n"),
1580                 poptGetInvocationName(popt_context));
1581
1582         if (opt_offset && (strcmp(aname, "open") ||
1583             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1584                 usage(popt_context, EXIT_FAILURE,
1585                 _("Option --offset is supported only for open of plain and loopaes devices.\n"),
1586                 poptGetInvocationName(popt_context));
1587
1588         if ((opt_tcrypt_hidden || opt_tcrypt_system) && strcmp(aname, "tcryptDump") &&
1589             (strcmp(aname, "open") || strcmp(opt_type, "tcrypt")))
1590                 usage(popt_context, EXIT_FAILURE,
1591                 _("Option --tcrypt-hidden or --tcrypt-system is supported only for TCRYPT device.\n"),
1592                 poptGetInvocationName(popt_context));
1593
1594         if (opt_debug) {
1595                 opt_verbose = 1;
1596                 crypt_set_debug_level(-1);
1597                 dbg_version_and_cmd(argc, argv);
1598         }
1599
1600         r = run_action(action);
1601         poptFreeContext(popt_context);
1602         return r;
1603 }