src/cryptsetup.c

   1 /*
   2  * cryptsetup - setup cryptographic volumes for dm-crypt
   3  *
   4  * Copyright (C) 2004, Christophe Saout <christophe@saout.de>
   5  * Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
   6  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   7  * Copyright (C) 2009-2012, Milan Broz
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * version 2 as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 #include "cryptsetup.h"
  24
  25 static const char *opt_cipher = NULL;
  26 static const char *opt_hash = NULL;
  27 static int opt_verify_passphrase = 0;
  28
  29 static const char *opt_key_file = NULL;
  30 static int opt_keyfiles_count = 0;
  31 static const char *opt_keyfiles[MAX_KEYFILES];
  32
  33 static const char *opt_master_key_file = NULL;
  34 static const char *opt_header_backup_file = NULL;
  35 static const char *opt_uuid = NULL;
  36 static const char *opt_header_device = NULL;
  37 static const char *opt_type = "luks";
  38 static int opt_key_size = 0;
  39 static long opt_keyfile_size = 0;
  40 static long opt_new_keyfile_size = 0;
  41 static long opt_keyfile_offset = 0;
  42 static long opt_new_keyfile_offset = 0;
  43 static int opt_key_slot = CRYPT_ANY_SLOT;
  44 static uint64_t opt_size = 0;
  45 static uint64_t opt_offset = 0;
  46 static uint64_t opt_skip = 0;
  47 static int opt_skip_valid = 0;
  48 static int opt_readonly = 0;
  49 static int opt_iteration_time = DEFAULT_LUKS1_ITER_TIME;
  50 static int opt_version_mode = 0;
  51 static int opt_timeout = 0;
  52 static int opt_tries = 3;
  53 static int opt_align_payload = 0;
  54 static int opt_random = 0;
  55 static int opt_urandom = 0;
  56 static int opt_dump_master_key = 0;
  57 static int opt_shared = 0;
  58 static int opt_allow_discards = 0;
  59 static int opt_test_passphrase = 0;
  60 static int opt_hidden = 0;
  61
  62 static const char **action_argv;
  63 static int action_argc;
  64 static const char *null_action_argv[] = {NULL, NULL};
  65
  66 static int _verify_passphrase(int def)
  67 {
  68         /* Batch mode switch off verify - if not overrided by -y */
  69         if (opt_verify_passphrase)
  70                 def = 1;
  71         else if (opt_batch_mode)
  72                 def = 0;
  73
  74         /* Non-tty input doesn't allow verify */
  75         if (def && !isatty(STDIN_FILENO)) {
  76                 if (opt_verify_passphrase)
  77                         log_err(_("Can't do passphrase verification on non-tty inputs.\n"));
  78                 def = 0;
  79         }
  80
  81         return def;
  82 }
  83
  84 static int action_open_plain(void)
  85 {
  86         struct crypt_device *cd = NULL;
  87         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
  88         struct crypt_params_plain params = {
  89                 .hash = opt_hash ?: DEFAULT_PLAIN_HASH,
  90                 .skip = opt_skip,
  91                 .offset = opt_offset,
  92                 .size = opt_size,
  93         };
  94         char *password = NULL;
  95         size_t passwordLen;
  96         size_t key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS) / 8;
  97         uint32_t activate_flags = 0;
  98         int r;
  99
 100         if (params.hash && !strcmp(params.hash, "plain"))
 101                 params.hash = NULL;
 102
 103         /* FIXME: temporary hack */
 104         if (opt_key_file && strcmp(opt_key_file, "-"))
 105                 params.hash = NULL;
 106
 107         if ((opt_keyfile_offset || opt_keyfile_size) && opt_key_file)
 108                 log_std(("Ignoring keyfile offset and size options, keyfile read "
 109                          "size is always the same as encryption key size.\n"));
 110
 111         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(PLAIN),
 112                                       cipher, NULL, cipher_mode);
 113         if (r < 0) {
 114                 log_err("No known cipher specification pattern detected.\n");
 115                 goto out;
 116         }
 117
 118         if ((r = crypt_init(&cd, action_argv[0])))
 119                 goto out;
 120
 121         crypt_set_timeout(cd, opt_timeout);
 122         crypt_set_password_retry(cd, opt_tries);
 123
 124         r = crypt_format(cd, CRYPT_PLAIN,
 125                          cipher, cipher_mode,
 126                          NULL, NULL,
 127                          key_size,
 128                          &params);
 129         if (r < 0)
 130                 goto out;
 131
 132         if (opt_readonly)
 133                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 134
 135         if (opt_shared)
 136                 activate_flags |= CRYPT_ACTIVATE_SHARED;
 137
 138         if (opt_allow_discards)
 139                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 140
 141         if (opt_key_file)
 142                 /* With hashing, read the whole keyfile */
 143                 r = crypt_activate_by_keyfile_offset(cd, action_argv[1],
 144                         CRYPT_ANY_SLOT, opt_key_file,
 145                         params.hash ? 0 : key_size, 0,
 146                         activate_flags);
 147         else {
 148                 r = crypt_get_key(_("Enter passphrase: "),
 149                                   &password, &passwordLen,
 150                                   opt_keyfile_offset, opt_keyfile_size,
 151                                   NULL, opt_timeout,
 152                                   _verify_passphrase(0),
 153                                   cd);
 154                 if (r < 0)
 155                         goto out;
 156
 157                 r = crypt_activate_by_passphrase(cd, action_argv[1],
 158                         CRYPT_ANY_SLOT, password, passwordLen, activate_flags);
 159         }
 160 out:
 161         crypt_free(cd);
 162         crypt_safe_free(password);
 163
 164         return r;
 165 }
 166
 167 static int action_open_loopaes(void)
 168 {
 169         struct crypt_device *cd = NULL;
 170         struct crypt_params_loopaes params = {
 171                 .hash = opt_hash ?: NULL,
 172                 .offset = opt_offset,
 173                 .skip = opt_skip_valid ? opt_skip : opt_offset,
 174         };
 175         unsigned int key_size = (opt_key_size ?: DEFAULT_LOOPAES_KEYBITS) / 8;
 176         uint32_t activate_flags = 0;
 177         int r;
 178
 179         if (!opt_key_file) {
 180                 log_err(_("Option --key-file is required.\n"));
 181                 return -EINVAL;
 182         }
 183
 184         if (opt_readonly)
 185                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 186
 187         if (opt_allow_discards)
 188                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 189
 190         if ((r = crypt_init(&cd, action_argv[0])))
 191                 goto out;
 192
 193         r = crypt_format(cd, CRYPT_LOOPAES, opt_cipher ?: DEFAULT_LOOPAES_CIPHER,
 194                          NULL, NULL, NULL, key_size, &params);
 195         if (r < 0)
 196                 goto out;
 197
 198         r = crypt_activate_by_keyfile_offset(cd, action_argv[1], CRYPT_ANY_SLOT,
 199                                       opt_key_file, opt_keyfile_size,
 200                                       opt_keyfile_size, activate_flags);
 201 out:
 202         crypt_free(cd);
 203
 204         return r;
 205 }
 206
 207 static int action_open_tcrypt(void)
 208 {
 209         struct crypt_device *cd = NULL;
 210         struct crypt_params_tcrypt params = {
 211                 .keyfiles = opt_keyfiles,
 212                 .keyfiles_count = opt_keyfiles_count,
 213                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 214         };
 215         const char *activated_name;
 216         uint32_t flags = 0;
 217         int r;
 218
 219         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 220
 221         if ((r = crypt_init(&cd, action_argv[0])))
 222                 goto out;
 223
 224         /* TCRYPT header is encrypted, get passphrase now */
 225         r = crypt_get_key(_("Enter passphrase: "),
 226                           CONST_CAST(char**)&params.passphrase,
 227                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 228                           _verify_passphrase(0), cd);
 229         if (r < 0)
 230                 goto out;
 231
 232         if (opt_hidden)
 233                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 234
 235         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 236         if (r < 0)
 237                 goto out;
 238
 239         if (opt_readonly)
 240                 flags |= CRYPT_ACTIVATE_READONLY;
 241
 242         if (activated_name)
 243                 r = crypt_activate_by_volume_key(cd, activated_name, NULL, 0, flags);
 244 out:
 245         crypt_free(cd);
 246         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 247         return r;
 248 }
 249
 250 static int tcryptDump_with_volume_key(struct crypt_device *cd)
 251 {
 252         char *vk = NULL;
 253         size_t vk_size;
 254         unsigned i;
 255         int r;
 256
 257         crypt_set_confirm_callback(cd, yesDialog, NULL);
 258         if (!yesDialog(
 259             _("Header dump with volume key is sensitive information\n"
 260               "which allows access to encrypted partition without passphrase.\n"
 261               "This dump should be always stored encrypted on safe place."),
 262               NULL))
 263                 return -EPERM;
 264
 265         vk_size = crypt_get_volume_key_size(cd);
 266         vk = crypt_safe_alloc(vk_size);
 267         if (!vk)
 268                 return -ENOMEM;
 269
 270         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size, NULL, 0);
 271         if (r < 0)
 272                 goto out;
 273
 274         log_std("TCRYPT header information for %s\n", crypt_get_device_name(cd));
 275         log_std("Cipher chain:  \t%s\n", crypt_get_cipher(cd));
 276         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
 277         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
 278         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
 279         log_std("MK dump:\t");
 280
 281         for(i = 0; i < vk_size; i++) {
 282                 if (i && !(i % 16))
 283                         log_std("\n\t\t");
 284                 log_std("%02hhx ", (char)vk[i]);
 285         }
 286         log_std("\n");
 287 out:
 288         crypt_safe_free(vk);
 289         return r;
 290 }
 291
 292 static int action_tcryptDump(void)
 293 {
 294         struct crypt_device *cd = NULL;
 295         struct crypt_params_tcrypt params = {
 296                 .keyfiles = opt_keyfiles,
 297                 .keyfiles_count = opt_keyfiles_count,
 298                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 299         };
 300         int r;
 301
 302         if ((r = crypt_init(&cd, action_argv[0])))
 303                 goto out;
 304
 305         /* TCRYPT header is encrypted, get passphrase now */
 306         r = crypt_get_key(_("Enter passphrase: "),
 307                           CONST_CAST(char**)&params.passphrase,
 308                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 309                           _verify_passphrase(0), cd);
 310         if (r < 0)
 311                 goto out;
 312
 313         if (opt_hidden)
 314                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 315
 316         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 317         if (r < 0)
 318                 goto out;
 319
 320         if (opt_dump_master_key)
 321                 r = tcryptDump_with_volume_key(cd);
 322         else
 323                 r = crypt_dump(cd);
 324 out:
 325         crypt_free(cd);
 326         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 327         return r;
 328 }
 329
 330 static int action_close(void)
 331 {
 332         struct crypt_device *cd = NULL;
 333         int r;
 334
 335         r = crypt_init_by_name(&cd, action_argv[0]);
 336         if (r == 0)
 337                 r = crypt_deactivate(cd, action_argv[0]);
 338
 339         crypt_free(cd);
 340         return r;
 341 }
 342
 343 static int action_resize(void)
 344 {
 345         struct crypt_device *cd = NULL;
 346         int r;
 347
 348         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 349         if (r == 0)
 350                 r = crypt_resize(cd, action_argv[0], opt_size);
 351
 352         crypt_free(cd);
 353         return r;
 354 }
 355
 356 static int action_status(void)
 357 {
 358         crypt_status_info ci;
 359         struct crypt_active_device cad;
 360         struct crypt_device *cd = NULL;
 361         struct stat st;
 362         char *backing_file;
 363         const char *device;
 364         int path = 0, r = 0;
 365
 366         /* perhaps a path, not a dm device name */
 367         if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
 368                 path = 1;
 369
 370         ci = crypt_status(NULL, action_argv[0]);
 371         switch (ci) {
 372         case CRYPT_INVALID:
 373                 r = -EINVAL;
 374                 break;
 375         case CRYPT_INACTIVE:
 376                 if (path)
 377                         log_std("%s is inactive.\n", action_argv[0]);
 378                 else
 379                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 380                 r = -ENODEV;
 381                 break;
 382         case CRYPT_ACTIVE:
 383         case CRYPT_BUSY:
 384                 if (path)
 385                         log_std("%s is active%s.\n", action_argv[0],
 386                                 ci == CRYPT_BUSY ? " and is in use" : "");
 387                 else
 388                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 389                                 ci == CRYPT_BUSY ? " and is in use" : "");
 390
 391                 r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 392                 if (r < 0 || !crypt_get_type(cd))
 393                         goto out;
 394
 395                 log_std("  type:    %s\n", crypt_get_type(cd));
 396
 397                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 398                 if (r < 0)
 399                         goto out;
 400
 401                 log_std("  cipher:  %s-%s\n", crypt_get_cipher(cd), crypt_get_cipher_mode(cd));
 402                 log_std("  keysize: %d bits\n", crypt_get_volume_key_size(cd) * 8);
 403                 device = crypt_get_device_name(cd);
 404                 log_std("  device:  %s\n", device);
 405                 if (crypt_loop_device(device)) {
 406                         backing_file = crypt_loop_backing_file(device);
 407                         log_std("  loop:    %s\n", backing_file);
 408                         free(backing_file);
 409                 }
 410                 log_std("  offset:  %" PRIu64 " sectors\n", cad.offset);
 411                 log_std("  size:    %" PRIu64 " sectors\n", cad.size);
 412                 if (cad.iv_offset)
 413                         log_std("  skipped: %" PRIu64 " sectors\n", cad.iv_offset);
 414                 log_std("  mode:    %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 415                                            "readonly" : "read/write");
 416                 if (cad.flags & CRYPT_ACTIVATE_ALLOW_DISCARDS)
 417                         log_std("  flags:   discards\n");
 418         }
 419 out:
 420         crypt_free(cd);
 421         if (r == -ENOTSUP)
 422                 r = 0;
 423         return r;
 424 }
 425
 426 static int action_benchmark_kdf(const char *hash)
 427 {
 428         uint64_t kdf_iters;
 429         int r;
 430
 431         r = crypt_benchmark_kdf(NULL, "pbkdf2", hash, "foo", 3, "bar", 3,
 432                                 &kdf_iters);
 433         if (r < 0)
 434                 log_std("PBKDF2-%-9s     N/A\n", hash);
 435         else
 436                 log_std("PBKDF2-%-9s %7" PRIu64 " iterations per second\n",
 437                         hash, kdf_iters);
 438         return r;
 439 }
 440
 441 static int action_benchmark(void)
 442 {
 443         static struct {
 444                 const char *cipher;
 445                 const char *mode;
 446                 size_t key_size;
 447                 size_t iv_size;
 448         } bciphers[] = {
 449                 { "aes",     "cbc", 16, 16 },
 450                 { "serpent", "cbc", 16, 16 },
 451                 { "twofish", "cbc", 16, 16 },
 452                 { "aes",     "cbc", 32, 16 },
 453                 { "serpent", "cbc", 32, 16 },
 454                 { "twofish", "cbc", 32, 16 },
 455                 { "aes",     "xts", 32, 16 },
 456                 { "serpent", "xts", 32, 16 },
 457                 { "twofish", "xts", 32, 16 },
 458                 { "aes",     "xts", 64, 16 },
 459                 { "serpent", "xts", 64, 16 },
 460                 { "twofish", "xts", 64, 16 },
 461                 {  NULL, NULL, 0, 0 }
 462         };
 463         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 464         double enc_mbr = 0, dec_mbr = 0;
 465         int key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS);
 466         int iv_size = 16, skipped = 0;
 467         int buffer_size = 1024 * 1024;
 468         char *c;
 469         int i, r;
 470
 471         log_std("# Tests are approximate using memory only (no storage IO).\n");
 472         if (opt_hash) {
 473                 r = action_benchmark_kdf(opt_hash);
 474         } else if (opt_cipher) {
 475                 r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mode);
 476                 if (r < 0) {
 477                         log_err(_("No known cipher specification pattern detected.\n"));
 478                         return r;
 479                 }
 480                 if ((c  = strchr(cipher_mode, '-')))
 481                         *c = '\0';
 482
 483                 /* FIXME: not really clever :) */
 484                 if (strstr(cipher, "des") ||
 485                     strstr(cipher, "blowfish") ||
 486                     strstr(cipher, "cast5"))
 487                         iv_size = 8;
 488
 489                 r = crypt_benchmark(NULL, cipher, cipher_mode,
 490                                     key_size / 8, iv_size, buffer_size,
 491                                     &enc_mbr, &dec_mbr);
 492                 if (!r) {
 493                         log_std("#  Algorithm | Key | Encryption | Decryption\n");
 494                         log_std("%8s-%s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 495                                 cipher, cipher_mode, key_size, enc_mbr, dec_mbr);
 496                 } else if (r == -ENOENT)
 497                         log_err(_("Cipher %s is not available.\n"), opt_cipher);
 498         } else {
 499                 action_benchmark_kdf("sha1");
 500                 action_benchmark_kdf("sha256");
 501                 action_benchmark_kdf("sha512");
 502                 action_benchmark_kdf("ripemd160");
 503                 action_benchmark_kdf("whirlpool");
 504                 for (i = 0; bciphers[i].cipher; i++) {
 505                         r = crypt_benchmark(NULL, bciphers[i].cipher, bciphers[i].mode,
 506                                             bciphers[i].key_size, bciphers[i].iv_size,
 507                                             buffer_size, &enc_mbr, &dec_mbr);
 508                         if (r == -ENOTSUP)
 509                                 break;
 510                         if (r == -ENOENT)
 511                                 skipped++;
 512                         if (i == 0)
 513                                 log_std("#  Algorithm | Key | Encryption | Decryption\n");
 514
 515                         snprintf(cipher, MAX_CIPHER_LEN, "%s-%s",
 516                                  bciphers[i].cipher, bciphers[i].mode);
 517                         if (!r)
 518                                 log_std("%12s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 519                                         cipher, bciphers[i].key_size*8, enc_mbr, dec_mbr);
 520                         else
 521                                 log_std("%12s  %4db %12s %12s\n", cipher,
 522                                         bciphers[i].key_size*8, _("N/A"), _("N/A"));
 523                 }
 524                 if (skipped && skipped == i)
 525                         r = -ENOTSUP;
 526         }
 527
 528         if (r == -ENOTSUP)
 529                 log_err( _("Required kernel crypto interface not available.\n"
 530                            "Ensure you have algif_skcipher kernel module loaded.\n"));
 531         return r;
 532 }
 533
 534 static int _read_mk(const char *file, char **key, int keysize)
 535 {
 536         int fd;
 537
 538         *key = crypt_safe_alloc(keysize);
 539         if (!*key)
 540                 return -ENOMEM;
 541
 542         fd = open(file, O_RDONLY);
 543         if (fd == -1) {
 544                 log_err("Cannot read keyfile %s.\n", file);
 545                 goto fail;
 546         }
 547         if ((read(fd, *key, keysize) != keysize)) {
 548                 log_err("Cannot read %d bytes from keyfile %s.\n", keysize, file);
 549                 close(fd);
 550                 goto fail;
 551         }
 552         close(fd);
 553         return 0;
 554 fail:
 555         crypt_safe_free(*key);
 556         *key = NULL;
 557         return -EINVAL;
 558 }
 559
 560 static int action_luksRepair(void)
 561 {
 562         struct crypt_device *cd = NULL;
 563         int r;
 564
 565         if ((r = crypt_init(&cd, action_argv[0])))
 566                 goto out;
 567
 568         /* Currently only LUKS1 allows repair */
 569         crypt_set_log_callback(cd, quiet_log, NULL);
 570         r = crypt_load(cd, CRYPT_LUKS1, NULL);
 571         crypt_set_log_callback(cd, tool_log, NULL);
 572         if (r == 0) {
 573                 log_verbose( _("No known problems detected for LUKS header.\n"));
 574                 goto out;
 575         }
 576
 577         r = yesDialog(_("Really try to repair LUKS device header?"),
 578                        NULL) ? 0 : -EINVAL;
 579         if (r == 0)
 580                 r = crypt_repair(cd, CRYPT_LUKS1, NULL);
 581 out:
 582         crypt_free(cd);
 583         return r;
 584 }
 585
 586 static int action_luksFormat(void)
 587 {
 588         int r = -EINVAL, keysize;
 589         const char *header_device;
 590         char *msg = NULL, *key = NULL, cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 591         char *password = NULL;
 592         size_t passwordLen;
 593         struct crypt_device *cd = NULL;
 594         struct crypt_params_luks1 params = {
 595                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 596                 .data_alignment = opt_align_payload,
 597                 .data_device = opt_header_device ? action_argv[0] : NULL,
 598         };
 599
 600         header_device = opt_header_device ?: action_argv[0];
 601
 602         if(asprintf(&msg, _("This will overwrite data on %s irrevocably."),
 603                     header_device) == -1) {
 604                 log_err(_("memory allocation error in action_luksFormat"));
 605                 r = -ENOMEM;
 606                 goto out;
 607         }
 608         r = yesDialog(msg, NULL) ? 0 : -EINVAL;
 609         free(msg);
 610         if (r < 0)
 611                 goto out;
 612
 613         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 614                                       cipher, NULL, cipher_mode);
 615         if (r < 0) {
 616                 log_err(_("No known cipher specification pattern detected.\n"));
 617                 goto out;
 618         }
 619
 620         if ((r = crypt_init(&cd, header_device))) {
 621                 if (opt_header_device)
 622                         log_err(_("Cannot use %s as on-disk header.\n"), header_device);
 623                 goto out;
 624         }
 625
 626         keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
 627
 628         crypt_set_timeout(cd, opt_timeout);
 629         if (opt_iteration_time)
 630                 crypt_set_iteration_time(cd, opt_iteration_time);
 631
 632         if (opt_random)
 633                 crypt_set_rng_type(cd, CRYPT_RNG_RANDOM);
 634         else if (opt_urandom)
 635                 crypt_set_rng_type(cd, CRYPT_RNG_URANDOM);
 636
 637         r = crypt_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
 638                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 639                           opt_timeout, _verify_passphrase(1), cd);
 640         if (r < 0)
 641                 goto out;
 642
 643         if (opt_master_key_file) {
 644                 r = _read_mk(opt_master_key_file, &key, keysize);
 645                 if (r < 0)
 646                         goto out;
 647         }
 648
 649         r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode,
 650                          opt_uuid, key, keysize, &params);
 651         if (r < 0)
 652                 goto out;
 653
 654         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 655                                             key, keysize,
 656                                             password, passwordLen);
 657 out:
 658         crypt_free(cd);
 659         crypt_safe_free(key);
 660         crypt_safe_free(password);
 661
 662         return r;
 663 }
 664
 665 static int action_open_luks(void)
 666 {
 667         struct crypt_device *cd = NULL;
 668         const char *data_device, *header_device, *activated_name;
 669         char *key = NULL;
 670         uint32_t flags = 0;
 671         int r, keysize;
 672
 673         if (opt_header_device) {
 674                 header_device = uuid_or_device(opt_header_device);
 675                 data_device = action_argv[0];
 676         } else {
 677                 header_device = uuid_or_device(action_argv[0]);
 678                 data_device = NULL;
 679         }
 680
 681         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 682
 683         if ((r = crypt_init(&cd, header_device)))
 684                 goto out;
 685
 686         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 687                 goto out;
 688
 689         if (data_device &&
 690             (r = crypt_set_data_device(cd, data_device)))
 691                 goto out;
 692
 693         if (!data_device && (crypt_get_data_offset(cd) < 8)) {
 694                 log_err(_("Reduced data offset is allowed only for detached LUKS header.\n"));
 695                 r = -EINVAL;
 696                 goto out;
 697         }
 698
 699         crypt_set_timeout(cd, opt_timeout);
 700         crypt_set_password_retry(cd, opt_tries);
 701         crypt_set_password_verify(cd, _verify_passphrase(0));
 702
 703         if (opt_iteration_time)
 704                 crypt_set_iteration_time(cd, opt_iteration_time);
 705
 706         if (opt_readonly)
 707                 flags |= CRYPT_ACTIVATE_READONLY;
 708
 709         if (opt_allow_discards)
 710                 flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 711
 712         if (opt_master_key_file) {
 713                 keysize = crypt_get_volume_key_size(cd);
 714                 r = _read_mk(opt_master_key_file, &key, keysize);
 715                 if (r < 0)
 716                         goto out;
 717                 r = crypt_activate_by_volume_key(cd, activated_name,
 718                                                  key, keysize, flags);
 719         } else if (opt_key_file) {
 720                 crypt_set_password_retry(cd, 1);
 721                 r = crypt_activate_by_keyfile_offset(cd, activated_name,
 722                         opt_key_slot, opt_key_file, opt_keyfile_size,
 723                         opt_keyfile_offset, flags);
 724         } else
 725                 r = crypt_activate_by_passphrase(cd, activated_name,
 726                         opt_key_slot, NULL, 0, flags);
 727 out:
 728         crypt_safe_free(key);
 729         crypt_free(cd);
 730         return r;
 731 }
 732
 733 static int verify_keyslot(struct crypt_device *cd, int key_slot,
 734                           char *msg_last, char *msg_pass,
 735                           const char *key_file, int keyfile_offset,
 736                           int keyfile_size)
 737 {
 738         crypt_keyslot_info ki;
 739         char *password = NULL;
 740         size_t passwordLen;
 741         int i, r;
 742
 743         ki = crypt_keyslot_status(cd, key_slot);
 744         if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !yesDialog(msg_last, NULL))
 745                 return -EPERM;
 746
 747         r = crypt_get_key(msg_pass, &password, &passwordLen,
 748                           keyfile_offset, keyfile_size, key_file, opt_timeout,
 749                           _verify_passphrase(0), cd);
 750         if(r < 0)
 751                 goto out;
 752
 753         if (ki == CRYPT_SLOT_ACTIVE_LAST) {
 754                 /* check the last keyslot */
 755                 r = crypt_activate_by_passphrase(cd, NULL, key_slot,
 756                                                  password, passwordLen, 0);
 757         } else {
 758                 /* try all other keyslots */
 759                 for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1); i++) {
 760                         if (i == key_slot)
 761                                 continue;
 762                         ki = crypt_keyslot_status(cd, key_slot);
 763                         if (ki == CRYPT_SLOT_ACTIVE)
 764                         r = crypt_activate_by_passphrase(cd, NULL, i,
 765                                                          password, passwordLen, 0);
 766                         if (r == i)
 767                                 break;
 768                 }
 769         }
 770
 771         if (r == -EPERM)
 772                 log_err(_("No key available with this passphrase.\n"));
 773 out:
 774         crypt_safe_free(password);
 775         return r;
 776 }
 777
 778 static int action_luksKillSlot(void)
 779 {
 780         struct crypt_device *cd = NULL;
 781         int r;
 782
 783         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 784                 goto out;
 785
 786         crypt_set_confirm_callback(cd, yesDialog, NULL);
 787         crypt_set_timeout(cd, opt_timeout);
 788
 789         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 790                 goto out;
 791
 792         switch (crypt_keyslot_status(cd, opt_key_slot)) {
 793         case CRYPT_SLOT_ACTIVE_LAST:
 794         case CRYPT_SLOT_ACTIVE:
 795                 log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 796                 break;
 797         case CRYPT_SLOT_INACTIVE:
 798                 log_err(_("Key %d not active. Can't wipe.\n"), opt_key_slot);
 799         case CRYPT_SLOT_INVALID:
 800                 r = -EINVAL;
 801                 goto out;
 802         }
 803
 804         if (!opt_batch_mode) {
 805                 r = verify_keyslot(cd, opt_key_slot,
 806                         _("This is the last keyslot. Device will become unusable after purging this key."),
 807                         _("Enter any remaining LUKS passphrase: "),
 808                         opt_key_file, opt_keyfile_offset, opt_keyfile_size);
 809                 if (r < 0)
 810                         goto out;
 811         }
 812
 813         r = crypt_keyslot_destroy(cd, opt_key_slot);
 814 out:
 815         crypt_free(cd);
 816         return r;
 817 }
 818
 819 static int action_luksRemoveKey(void)
 820 {
 821         struct crypt_device *cd = NULL;
 822         char *password = NULL;
 823         size_t passwordLen;
 824         int r;
 825
 826         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 827                 goto out;
 828
 829         crypt_set_confirm_callback(cd, yesDialog, NULL);
 830         crypt_set_timeout(cd, opt_timeout);
 831
 832         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 833                 goto out;
 834
 835         r = crypt_get_key(_("Enter LUKS passphrase to be deleted: "),
 836                       &password, &passwordLen,
 837                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 838                       opt_timeout,
 839                       _verify_passphrase(0),
 840                       cd);
 841         if(r < 0)
 842                 goto out;
 843
 844         r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 845                                          password, passwordLen, 0);
 846         if (r < 0)
 847                 goto out;
 848
 849         opt_key_slot = r;
 850         log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 851
 852         if (crypt_keyslot_status(cd, opt_key_slot) == CRYPT_SLOT_ACTIVE_LAST &&
 853             !yesDialog(_("This is the last keyslot. "
 854                           "Device will become unusable after purging this key."),
 855                         NULL)) {
 856                 r = -EPERM;
 857                 goto out;
 858         }
 859
 860         r = crypt_keyslot_destroy(cd, opt_key_slot);
 861 out:
 862         crypt_safe_free(password);
 863         crypt_free(cd);
 864         return r;
 865 }
 866
 867 static int action_luksAddKey(void)
 868 {
 869         int r = -EINVAL, keysize = 0;
 870         char *key = NULL;
 871         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 872         struct crypt_device *cd = NULL;
 873
 874         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 875                 goto out;
 876
 877         crypt_set_confirm_callback(cd, yesDialog, NULL);
 878
 879         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 880                 goto out;
 881
 882         keysize = crypt_get_volume_key_size(cd);
 883         /* FIXME: lib cannot properly set verification for new/old passphrase */
 884         crypt_set_password_verify(cd, _verify_passphrase(0));
 885         crypt_set_timeout(cd, opt_timeout);
 886         if (opt_iteration_time)
 887                 crypt_set_iteration_time(cd, opt_iteration_time);
 888
 889         if (opt_master_key_file) {
 890                 r = _read_mk(opt_master_key_file, &key, keysize);
 891                 if (r < 0)
 892                         goto out;
 893                 //FIXME: process keyfile arg
 894                 r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 895                                                     key, keysize, NULL, 0);
 896         } else if (opt_key_file || opt_new_key_file) {
 897                 r = crypt_keyslot_add_by_keyfile_offset(cd, opt_key_slot,
 898                         opt_key_file, opt_keyfile_size, opt_keyfile_offset,
 899                         opt_new_key_file, opt_new_keyfile_size, opt_new_keyfile_offset);
 900         } else {
 901                 r = crypt_keyslot_add_by_passphrase(cd, opt_key_slot,
 902                                                     NULL, 0, NULL, 0);
 903         }
 904 out:
 905         crypt_free(cd);
 906         crypt_safe_free(key);
 907         return r;
 908 }
 909
 910 static int action_luksChangeKey(void)
 911 {
 912         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 913         struct crypt_device *cd = NULL;
 914         char *password = NULL, *password_new = NULL;
 915         size_t password_size = 0, password_new_size = 0;
 916         int r;
 917
 918         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 919                 goto out;
 920
 921         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 922                 goto out;
 923
 924         if (opt_iteration_time)
 925                 crypt_set_iteration_time(cd, opt_iteration_time);
 926
 927         r = crypt_get_key(_("Enter LUKS passphrase to be changed: "),
 928                       &password, &password_size,
 929                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 930                       opt_timeout, _verify_passphrase(0), cd);
 931         if (r < 0)
 932                 goto out;
 933
 934         /* Check password before asking for new one */
 935         r = crypt_activate_by_passphrase(cd, NULL, opt_key_slot,
 936                                          password, password_size, 0);
 937         if (r < 0)
 938                 goto out;
 939
 940         r = crypt_get_key(_("Enter new LUKS passphrase: "),
 941                           &password_new, &password_new_size,
 942                           opt_new_keyfile_offset, opt_new_keyfile_size,
 943                           opt_new_key_file,
 944                           opt_timeout, _verify_passphrase(0), cd);
 945         if (r < 0)
 946                 goto out;
 947
 948         r = crypt_keyslot_change_by_passphrase(cd, opt_key_slot, opt_key_slot,
 949                 password, password_size, password_new, password_new_size);
 950 out:
 951         crypt_safe_free(password);
 952         crypt_safe_free(password_new);
 953         crypt_free(cd);
 954         return r;
 955 }
 956
 957 static int action_isLuks(void)
 958 {
 959         struct crypt_device *cd = NULL;
 960         int r;
 961
 962         if ((r = crypt_init(&cd, action_argv[0])))
 963                 goto out;
 964
 965         crypt_set_log_callback(cd, quiet_log, NULL);
 966         r = crypt_load(cd, CRYPT_LUKS1, NULL);
 967 out:
 968         crypt_free(cd);
 969         return r;
 970 }
 971
 972 static int action_luksUUID(void)
 973 {
 974         struct crypt_device *cd = NULL;
 975         const char *existing_uuid = NULL;
 976         int r;
 977
 978         if ((r = crypt_init(&cd, action_argv[0])))
 979                 goto out;
 980
 981         crypt_set_confirm_callback(cd, yesDialog, NULL);
 982
 983         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 984                 goto out;
 985
 986         if (opt_uuid)
 987                 r = crypt_set_uuid(cd, opt_uuid);
 988         else {
 989                 existing_uuid = crypt_get_uuid(cd);
 990                 log_std("%s\n", existing_uuid ?: "");
 991                 r = existing_uuid ? 0 : 1;
 992         }
 993 out:
 994         crypt_free(cd);
 995         return r;
 996 }
 997
 998 static int luksDump_with_volume_key(struct crypt_device *cd)
 999 {
1000         char *vk = NULL, *password = NULL;
1001         size_t passwordLen = 0;
1002         size_t vk_size;
1003         unsigned i;
1004         int r;
1005
1006         crypt_set_confirm_callback(cd, yesDialog, NULL);
1007         if (!yesDialog(
1008             _("Header dump with volume key is sensitive information\n"
1009               "which allows access to encrypted partition without passphrase.\n"
1010               "This dump should be always stored encrypted on safe place."),
1011               NULL))
1012                 return -EPERM;
1013
1014         vk_size = crypt_get_volume_key_size(cd);
1015         vk = crypt_safe_alloc(vk_size);
1016         if (!vk)
1017                 return -ENOMEM;
1018
1019         r = crypt_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
1020                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
1021                           opt_timeout, 0, cd);
1022         if (r < 0)
1023                 goto out;
1024
1025         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size,
1026                                  password, passwordLen);
1027         if (r < 0)
1028                 goto out;
1029
1030         log_std("LUKS header information for %s\n", crypt_get_device_name(cd));
1031         log_std("Cipher name:   \t%s\n", crypt_get_cipher(cd));
1032         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
1033         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
1034         log_std("UUID:          \t%s\n", crypt_get_uuid(cd));
1035         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
1036         log_std("MK dump:\t");
1037
1038         for(i = 0; i < vk_size; i++) {
1039                 if (i && !(i % 16))
1040                         log_std("\n\t\t");
1041                 log_std("%02hhx ", (char)vk[i]);
1042         }
1043         log_std("\n");
1044
1045 out:
1046         crypt_safe_free(password);
1047         crypt_safe_free(vk);
1048         return r;
1049 }
1050
1051 static int action_luksDump(void)
1052 {
1053         struct crypt_device *cd = NULL;
1054         int r;
1055
1056         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1057                 goto out;
1058
1059         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1060                 goto out;
1061
1062         if (opt_dump_master_key)
1063                 r = luksDump_with_volume_key(cd);
1064         else
1065                 r = crypt_dump(cd);
1066 out:
1067         crypt_free(cd);
1068         return r;
1069 }
1070
1071 static int action_luksSuspend(void)
1072 {
1073         struct crypt_device *cd = NULL;
1074         int r;
1075
1076         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
1077         if (!r)
1078                 r = crypt_suspend(cd, action_argv[0]);
1079
1080         crypt_free(cd);
1081         return r;
1082 }
1083
1084 static int action_luksResume(void)
1085 {
1086         struct crypt_device *cd = NULL;
1087         int r;
1088
1089         if ((r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device)))
1090                 goto out;
1091
1092         crypt_set_timeout(cd, opt_timeout);
1093         crypt_set_password_retry(cd, opt_tries);
1094         crypt_set_password_verify(cd, _verify_passphrase(0));
1095
1096         if (opt_key_file)
1097                 r = crypt_resume_by_keyfile_offset(cd, action_argv[0], CRYPT_ANY_SLOT,
1098                         opt_key_file, opt_keyfile_size, opt_keyfile_offset);
1099         else
1100                 r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
1101                                                NULL, 0);
1102 out:
1103         crypt_free(cd);
1104         return r;
1105 }
1106
1107 static int action_luksBackup(void)
1108 {
1109         struct crypt_device *cd = NULL;
1110         int r;
1111
1112         if (!opt_header_backup_file) {
1113                 log_err(_("Option --header-backup-file is required.\n"));
1114                 return -EINVAL;
1115         }
1116
1117         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1118                 goto out;
1119
1120         crypt_set_confirm_callback(cd, yesDialog, NULL);
1121
1122         r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
1123 out:
1124         crypt_free(cd);
1125         return r;
1126 }
1127
1128 static int action_luksRestore(void)
1129 {
1130         struct crypt_device *cd = NULL;
1131         int r = 0;
1132
1133         if (!opt_header_backup_file) {
1134                 log_err(_("Option --header-backup-file is required.\n"));
1135                 return -EINVAL;
1136         }
1137
1138         if ((r = crypt_init(&cd, action_argv[0])))
1139                 goto out;
1140
1141         crypt_set_confirm_callback(cd, yesDialog, NULL);
1142         r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
1143 out:
1144         crypt_free(cd);
1145         return r;
1146 }
1147
1148 static int action_open(void)
1149 {
1150         if (!opt_type)
1151                 return -EINVAL;
1152
1153         if (!strcmp(opt_type, "luks") || !strcmp(opt_type, "luks1")) {
1154                 if (action_argc < 2 && !opt_test_passphrase)
1155                         goto args;
1156                 return action_open_luks();
1157         } else if (!strcmp(opt_type, "plain")) {
1158                 if (action_argc < 2)
1159                         goto args;
1160                 return action_open_plain();
1161         } else if (!strcmp(opt_type, "loopaes")) {
1162                 if (action_argc < 2)
1163                         goto args;
1164                 return action_open_loopaes();
1165         } else if (!strcmp(opt_type, "tcrypt")) {
1166                 if (action_argc < 2 && !opt_test_passphrase)
1167                         goto args;
1168                 return action_open_tcrypt();
1169         }
1170
1171         log_err(_("Unrecognized metadata device type %s.\n"), opt_type);
1172         return -EINVAL;
1173 args:
1174         log_err(_("Command requires device and mapped name as arguments.\n"));
1175         return -EINVAL;
1176 }
1177
1178 static struct action_type {
1179         const char *type;
1180         int (*handler)(void);
1181         int required_action_argc;
1182         int required_memlock;
1183         const char *arg_desc;
1184         const char *desc;
1185 } action_types[] = {
1186         { "open",         action_open,         1, 1, N_("<device> [--type <type>] [<name>]"),N_("open device as mapping <name>") },
1187         { "close",        action_close,        1, 1, N_("<name>"), N_("close device (remove mapping)") },
1188         { "resize",       action_resize,       1, 1, N_("<name>"), N_("resize active device") },
1189         { "status",       action_status,       1, 0, N_("<name>"), N_("show device status") },
1190         { "benchmark",    action_benchmark,    0, 0, N_("<name>"), N_("benchmark cipher") },
1191         { "repair",       action_luksRepair,   1, 1, N_("<device>"), N_("try to repair on-disk metadata") },
1192         { "luksFormat",   action_luksFormat,   1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
1193         { "luksAddKey",   action_luksAddKey,   1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
1194         { "luksRemoveKey",action_luksRemoveKey,1, 1, N_("<device> [<key file>]"), N_("removes supplied key or key file from LUKS device") },
1195         { "luksChangeKey",action_luksChangeKey,1, 1, N_("<device> [<key file>]"), N_("changes supplied key or key file of LUKS device") },
1196         { "luksKillSlot", action_luksKillSlot, 2, 1, N_("<device> <key slot>"), N_("wipes key with number <key slot> from LUKS device") },
1197         { "luksUUID",     action_luksUUID,     1, 0, N_("<device>"), N_("print UUID of LUKS device") },
1198         { "isLuks",       action_isLuks,       1, 0, N_("<device>"), N_("tests <device> for LUKS partition header") },
1199         { "luksDump",     action_luksDump,     1, 1, N_("<device>"), N_("dump LUKS partition information") },
1200         { "tcryptDump",   action_tcryptDump,   1, 1, N_("<device>"), N_("dump TCRYPT device information") },
1201         { "luksSuspend",  action_luksSuspend,  1, 1, N_("<device>"), N_("Suspend LUKS device and wipe key (all IOs are frozen).") },
1202         { "luksResume",   action_luksResume,   1, 1, N_("<device>"), N_("Resume suspended LUKS device.") },
1203         { "luksHeaderBackup", action_luksBackup,1,1, N_("<device>"), N_("Backup LUKS device header and keyslots") },
1204         { "luksHeaderRestore",action_luksRestore,1,1,N_("<device>"), N_("Restore LUKS device header and keyslots") },
1205         {}
1206 };
1207
1208 static void help(poptContext popt_context,
1209                  enum poptCallbackReason reason __attribute__((unused)),
1210                  struct poptOption *key,
1211                  const char *arg __attribute__((unused)),
1212                  void *data __attribute__((unused)))
1213 {
1214         if (key->shortName == '?') {
1215                 struct action_type *action;
1216
1217                 log_std("%s\n",PACKAGE_STRING);
1218
1219                 poptPrintHelp(popt_context, stdout, 0);
1220
1221                 log_std(_("\n"
1222                          "<action> is one of:\n"));
1223
1224                 for(action = action_types; action->type; action++)
1225                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
1226
1227                 log_std(_("\n"
1228                           "You can also use old <action> syntax aliases:\n"
1229                           "\topen: create (plainOpen), luksOpen, loopaesOpen, tcryptOpen\n"
1230                           "\tclose: remove (plainClose), luksClose, loopaesClose, tcryptClose\n"));
1231                 log_std(_("\n"
1232                          "<name> is the device to create under %s\n"
1233                          "<device> is the encrypted device\n"
1234                          "<key slot> is the LUKS key slot number to modify\n"
1235                          "<key file> optional key file for the new key for luksAddKey action\n"),
1236                         crypt_get_dir());
1237
1238                 log_std(_("\nDefault compiled-in key and passphrase parameters:\n"
1239                          "\tMaximum keyfile size: %dkB, "
1240                          "Maximum interactive passphrase length %d (characters)\n"
1241                          "Default PBKDF2 iteration time for LUKS: %d (ms)\n"),
1242                          DEFAULT_KEYFILE_SIZE_MAXKB, DEFAULT_PASSPHRASE_SIZE_MAX,
1243                          DEFAULT_LUKS1_ITER_TIME);
1244
1245                 log_std(_("\nDefault compiled-in device cipher parameters:\n"
1246                          "\tloop-AES: %s, Key %d bits\n"
1247                          "\tplain: %s, Key: %d bits, Password hashing: %s\n"
1248                          "\tLUKS1: %s, Key: %d bits, LUKS header hashing: %s, RNG: %s\n"),
1249                          DEFAULT_LOOPAES_CIPHER, DEFAULT_LOOPAES_KEYBITS,
1250                          DEFAULT_CIPHER(PLAIN), DEFAULT_PLAIN_KEYBITS, DEFAULT_PLAIN_HASH,
1251                          DEFAULT_CIPHER(LUKS1), DEFAULT_LUKS1_KEYBITS, DEFAULT_LUKS1_HASH,
1252                          DEFAULT_RNG);
1253                 exit(EXIT_SUCCESS);
1254         } else
1255                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
1256 }
1257
1258 static void help_args(struct action_type *action, poptContext popt_context)
1259 {
1260         char buf[128];
1261
1262         snprintf(buf, sizeof(buf), _("%s: requires %s as arguments"), action->type, action->arg_desc);
1263         usage(popt_context, EXIT_FAILURE, buf, poptGetInvocationName(popt_context));
1264 }
1265
1266 static int run_action(struct action_type *action)
1267 {
1268         int r;
1269
1270         log_dbg("Running command %s.", action->type);
1271
1272         if (action->required_memlock)
1273                 crypt_memory_lock(NULL, 1);
1274
1275         r = action->handler();
1276
1277         if (action->required_memlock)
1278                 crypt_memory_lock(NULL, 0);
1279
1280         /* Some functions returns keyslot # */
1281         if (r > 0)
1282                 r = 0;
1283
1284         show_status(r);
1285         return translate_errno(r);
1286 }
1287
1288 int main(int argc, const char **argv)
1289 {
1290         static char *popt_tmp;
1291         static struct poptOption popt_help_options[] = {
1292                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
1293                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
1294                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
1295                 POPT_TABLEEND
1296         };
1297         static struct poptOption popt_options[] = {
1298                 { NULL,                '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
1299                 { "version",           '\0', POPT_ARG_NONE, &opt_version_mode,          0, N_("Print package version"), NULL },
1300                 { "verbose",           'v',  POPT_ARG_NONE, &opt_verbose,               0, N_("Shows more detailed error messages"), NULL },
1301                 { "debug",             '\0', POPT_ARG_NONE, &opt_debug,                 0, N_("Show debug messages"), NULL },
1302                 { "cipher",            'c',  POPT_ARG_STRING, &opt_cipher,              0, N_("The cipher used to encrypt the disk (see /proc/crypto)"), NULL },
1303                 { "hash",              'h',  POPT_ARG_STRING, &opt_hash,                0, N_("The hash used to create the encryption key from the passphrase"), NULL },
1304                 { "verify-passphrase", 'y',  POPT_ARG_NONE, &opt_verify_passphrase,     0, N_("Verifies the passphrase by asking for it twice"), NULL },
1305                 { "key-file",          'd',  POPT_ARG_STRING, &opt_key_file,            5, N_("Read the key from a file."), NULL },
1306                 { "master-key-file",  '\0',  POPT_ARG_STRING, &opt_master_key_file,     0, N_("Read the volume (master) key from file."), NULL },
1307                 { "dump-master-key",  '\0',  POPT_ARG_NONE, &opt_dump_master_key,       0, N_("Dump volume (master) key instead of keyslots info."), NULL },
1308                 { "key-size",          's',  POPT_ARG_INT, &opt_key_size,               0, N_("The size of the encryption key"), N_("BITS") },
1309                 { "keyfile-size",      'l',  POPT_ARG_LONG, &opt_keyfile_size,          0, N_("Limits the read from keyfile"), N_("bytes") },
1310                 { "keyfile-offset",   '\0',  POPT_ARG_LONG, &opt_keyfile_offset,        0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
1311                 { "new-keyfile-size", '\0',  POPT_ARG_LONG, &opt_new_keyfile_size,      0, N_("Limits the read from newly added keyfile"), N_("bytes") },
1312                 { "new-keyfile-offset",'\0', POPT_ARG_LONG, &opt_new_keyfile_offset,    0, N_("Number of bytes to skip in newly added keyfile"), N_("bytes") },
1313                 { "key-slot",          'S',  POPT_ARG_INT, &opt_key_slot,               0, N_("Slot number for new key (default is first free)"), NULL },
1314                 { "size",              'b',  POPT_ARG_STRING, &popt_tmp,                1, N_("The size of the device"), N_("SECTORS") },
1315                 { "offset",            'o',  POPT_ARG_STRING, &popt_tmp,                2, N_("The start offset in the backend device"), N_("SECTORS") },
1316                 { "skip",              'p',  POPT_ARG_STRING, &popt_tmp,                3, N_("How many sectors of the encrypted data to skip at the beginning"), N_("SECTORS") },
1317                 { "readonly",          'r',  POPT_ARG_NONE, &opt_readonly,              0, N_("Create a readonly mapping"), NULL },
1318                 { "iter-time",         'i',  POPT_ARG_INT, &opt_iteration_time,         0, N_("PBKDF2 iteration time for LUKS (in ms)"), N_("msecs") },
1319                 { "batch-mode",        'q',  POPT_ARG_NONE, &opt_batch_mode,            0, N_("Do not ask for confirmation"), NULL },
1320                 { "timeout",           't',  POPT_ARG_INT, &opt_timeout,                0, N_("Timeout for interactive passphrase prompt (in seconds)"), N_("secs") },
1321                 { "tries",             'T',  POPT_ARG_INT, &opt_tries,                  0, N_("How often the input of the passphrase can be retried"), NULL },
1322                 { "align-payload",     '\0', POPT_ARG_INT, &opt_align_payload,          0, N_("Align payload at <n> sector boundaries - for luksFormat"), N_("SECTORS") },
1323                 { "header-backup-file",'\0', POPT_ARG_STRING, &opt_header_backup_file,  0, N_("File with LUKS header and keyslots backup."), NULL },
1324                 { "use-random",        '\0', POPT_ARG_NONE, &opt_random,                0, N_("Use /dev/random for generating volume key."), NULL },
1325                 { "use-urandom",       '\0', POPT_ARG_NONE, &opt_urandom,               0, N_("Use /dev/urandom for generating volume key."), NULL },
1326                 { "shared",            '\0', POPT_ARG_NONE, &opt_shared,                0, N_("Share device with another non-overlapping crypt segment."), NULL },
1327                 { "uuid",              '\0', POPT_ARG_STRING, &opt_uuid,                0, N_("UUID for device to use."), NULL },
1328                 { "allow-discards",    '\0', POPT_ARG_NONE, &opt_allow_discards,        0, N_("Allow discards (aka TRIM) requests for device."), NULL },
1329                 { "header",            '\0', POPT_ARG_STRING, &opt_header_device,       0, N_("Device or file with separated LUKS header."), NULL },
1330                 { "test-passphrase",   '\0', POPT_ARG_NONE, &opt_test_passphrase,       0, N_("Do not activate device, just check passphrase."), NULL },
1331                 { "hidden",            '\0', POPT_ARG_NONE, &opt_hidden,                0, N_("Use hidden header (hidden TCRYPT device) ."), NULL },
1332                 { "type",              'M',  POPT_ARG_STRING, &opt_type,                0, N_("Type of device metadata: luks, plain, loopaes, tcrypt."), NULL },
1333                 POPT_TABLEEND
1334         };
1335         poptContext popt_context;
1336         struct action_type *action;
1337         const char *aname;
1338         int r;
1339
1340         crypt_set_log_callback(NULL, tool_log, NULL);
1341
1342         setlocale(LC_ALL, "");
1343         bindtextdomain(PACKAGE, LOCALEDIR);
1344         textdomain(PACKAGE);
1345
1346         crypt_fips_self_check(NULL);
1347
1348         popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
1349         poptSetOtherOptionHelp(popt_context,
1350                                _("[OPTION...] <action> <action-specific>"));
1351
1352         while((r = poptGetNextOpt(popt_context)) > 0) {
1353                 unsigned long long ull_value;
1354                 char *endp;
1355
1356                 if (r == 5) {
1357                         if (opt_keyfiles_count < MAX_KEYFILES)
1358                                 opt_keyfiles[opt_keyfiles_count++] = poptGetOptArg(popt_context);
1359                         continue;
1360                 }
1361
1362                 errno = 0;
1363                 ull_value = strtoull(popt_tmp, &endp, 0);
1364                 if (*endp || !*popt_tmp ||
1365                     (errno == ERANGE && ull_value == ULLONG_MAX) ||
1366                     (errno != 0 && ull_value == 0))
1367                         r = POPT_ERROR_BADNUMBER;
1368
1369                 switch(r) {
1370                         case 1:
1371                                 opt_size = ull_value;
1372                                 break;
1373                         case 2:
1374                                 opt_offset = ull_value;
1375                                 break;
1376                         case 3:
1377                                 opt_skip = ull_value;
1378                                 opt_skip_valid = 1;
1379                                 break;
1380                 }
1381
1382                 if (r < 0)
1383                         break;
1384         }
1385
1386         if (r < -1)
1387                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
1388                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
1389         if (opt_version_mode) {
1390                 log_std("%s %s\n", PACKAGE_NAME, PACKAGE_VERSION);
1391                 poptFreeContext(popt_context);
1392                 exit(EXIT_SUCCESS);
1393         }
1394
1395         if (!(aname = poptGetArg(popt_context)))
1396                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
1397                       poptGetInvocationName(popt_context));
1398
1399         action_argc = 0;
1400         action_argv = poptGetArgs(popt_context);
1401         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
1402         if(!action_argv)
1403                 action_argv = null_action_argv;
1404
1405         /* Count args, somewhat unnice, change? */
1406         while(action_argv[action_argc] != NULL)
1407                 action_argc++;
1408
1409         /* Handle aliases */
1410         if (!strcmp(aname, "create")) {
1411                 /* create command had historically switched arguments */
1412                 if (action_argv[0] && action_argv[1]) {
1413                         const char *tmp = action_argv[0];
1414                         action_argv[0] = action_argv[1];
1415                         action_argv[1] = tmp;
1416                 }
1417                 aname = "open";
1418                 opt_type = "plain";
1419         } else if (!strcmp(aname, "plainOpen")) {
1420                 aname = "open";
1421                 opt_type = "plain";
1422         } else if (!strcmp(aname, "luksOpen")) {
1423                 aname = "open";
1424                 opt_type = "luks";
1425         } else if (!strcmp(aname, "loopaesOpen")) {
1426                 aname = "open";
1427                 opt_type = "loopaes";
1428         } else if (!strcmp(aname, "tcryptOpen")) {
1429                 aname = "open";
1430                 opt_type = "tcrypt";
1431         } else if (!strcmp(aname, "remove") ||
1432                    !strcmp(aname, "plainClose") ||
1433                    !strcmp(aname, "luksClose") ||
1434                    !strcmp(aname, "loopaesClose") ||
1435                    !strcmp(aname, "tcryptClose")) {
1436                 aname = "close";
1437         }
1438
1439         for(action = action_types; action->type; action++)
1440                 if (strcmp(action->type, aname) == 0)
1441                         break;
1442
1443         if (!action->type)
1444                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
1445                       poptGetInvocationName(popt_context));
1446
1447         if(action_argc < action->required_action_argc)
1448                 help_args(action, popt_context);
1449
1450         /* FIXME: rewrite this from scratch */
1451
1452         if (opt_shared && (strcmp(aname, "open") || strcmp(opt_type, "plain")) )
1453                 usage(popt_context, EXIT_FAILURE,
1454                       _("Option --shared is allowed only for open of plain device.\n"),
1455                       poptGetInvocationName(popt_context));
1456
1457         if (opt_allow_discards && strcmp(aname, "open"))
1458                 usage(popt_context, EXIT_FAILURE,
1459                       _("Option --allow-discards is allowed only for open operation.\n"),
1460                       poptGetInvocationName(popt_context));
1461
1462         if (opt_key_size &&
1463            strcmp(aname, "luksFormat") &&
1464            strcmp(aname, "open") &&
1465            strcmp(aname, "benchmark"))
1466                 usage(popt_context, EXIT_FAILURE,
1467                       _("Option --key-size is allowed only for luksFormat, open and benchmark.\n"
1468                         "To limit read from keyfile use --keyfile-size=(bytes)."),
1469                       poptGetInvocationName(popt_context));
1470
1471         if (opt_test_passphrase && (strcmp(aname, "open") ||
1472             (strcmp(opt_type, "luks") && strcmp(opt_type, "tcrypt"))))
1473                 usage(popt_context, EXIT_FAILURE,
1474                       _("Option --test-passphrase is allowed only for open of LUKS and TCRYPT devices.\n"),
1475                       poptGetInvocationName(popt_context));
1476
1477         if (opt_key_size % 8)
1478                 usage(popt_context, EXIT_FAILURE,
1479                       _("Key size must be a multiple of 8 bits"),
1480                       poptGetInvocationName(popt_context));
1481
1482         if (!strcmp(aname, "luksKillSlot") && action_argc > 1)
1483                 opt_key_slot = atoi(action_argv[1]);
1484         if (opt_key_slot != CRYPT_ANY_SLOT &&
1485             (opt_key_slot < 0 || opt_key_slot >= crypt_keyslot_max(CRYPT_LUKS1)))
1486                 usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."),
1487                       poptGetInvocationName(popt_context));
1488
1489         if ((!strcmp(aname, "luksRemoveKey") ||
1490              !strcmp(aname, "luksFormat")) &&
1491              action_argc > 1) {
1492                 if (opt_key_file)
1493                         log_err(_("Option --key-file takes precedence over specified key file argument.\n"));
1494                 else
1495                         opt_key_file = action_argv[1];
1496         }
1497
1498         if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0 ||
1499             opt_keyfile_offset < 0 || opt_new_keyfile_offset < 0)
1500                 usage(popt_context, EXIT_FAILURE,
1501                       _("Negative number for option not permitted."),
1502                       poptGetInvocationName(popt_context));
1503
1504         if (opt_random && opt_urandom)
1505                 usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
1506                       poptGetInvocationName(popt_context));
1507
1508         if ((opt_random || opt_urandom) && strcmp(aname, "luksFormat"))
1509                 usage(popt_context, EXIT_FAILURE, _("Option --use-[u]random is allowed only for luksFormat."),
1510                       poptGetInvocationName(popt_context));
1511
1512         if (opt_uuid && strcmp(aname, "luksFormat") && strcmp(aname, "luksUUID"))
1513                 usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed only for luksFormat and luksUUID."),
1514                       poptGetInvocationName(popt_context));
1515
1516         if (opt_align_payload && strcmp(aname, "luksFormat"))
1517                 usage(popt_context, EXIT_FAILURE, _("Option --align-payload is allowed only for luksFormat."),
1518                       poptGetInvocationName(popt_context));
1519
1520         if (opt_skip && (strcmp(aname, "open") ||
1521             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1522                 usage(popt_context, EXIT_FAILURE,
1523                 _("Option --skip is supported only for open of plain and loopaes devices.\n"),
1524                 poptGetInvocationName(popt_context));
1525
1526         if (opt_offset && (strcmp(aname, "open") ||
1527             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1528                 usage(popt_context, EXIT_FAILURE,
1529                 _("Option --offset is supported only for open of plain and loopaes devices.\n"),
1530                 poptGetInvocationName(popt_context));
1531
1532         if (opt_hidden && strcmp(aname, "tcryptDump") &&
1533             (strcmp(aname, "open") || strcmp(opt_type, "tcrypt")))
1534                 usage(popt_context, EXIT_FAILURE,
1535                 _("Option --hidden is supported only for TCRYPT device.\n"),
1536                 poptGetInvocationName(popt_context));
1537
1538         if (opt_debug) {
1539                 opt_verbose = 1;
1540                 crypt_set_debug_level(-1);
1541                 dbg_version_and_cmd(argc, argv);
1542         }
1543
1544         r = run_action(action);
1545         poptFreeContext(popt_context);
1546         return r;
1547 }