src/veritysetup.c

   1 /*
   2  * veritysetup - setup cryptographic volumes for dm-verity
   3  *
   4  * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
   5  * Copyright (C) 2012-2023 Milan Broz
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "cryptsetup.h"
  23 #include "veritysetup_args.h"
  24
  25 #define PACKAGE_VERITY "veritysetup"
  26
  27 static const char **action_argv;
  28 static int action_argc;
  29 static struct tools_log_params log_parms;
  30
  31 void tools_cleanup(void)
  32 {
  33         tools_args_free(tool_core_args, ARRAY_SIZE(tool_core_args));
  34 }
  35
  36 static int _prepare_format(struct crypt_params_verity *params,
  37                            const char *data_device,
  38                            uint32_t flags)
  39 {
  40         char *salt = NULL;
  41         int len;
  42
  43         params->hash_name = ARG_STR(OPT_HASH_ID);
  44         params->data_device = data_device;
  45         params->fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
  46         params->fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
  47
  48         if (ARG_STR(OPT_SALT_ID) && !strcmp(ARG_STR(OPT_SALT_ID), "-")) {
  49                 params->salt_size = 0;
  50                 params->salt = NULL;
  51         } else if (ARG_SET(OPT_SALT_ID)) {
  52                 len = crypt_hex_to_bytes(ARG_STR(OPT_SALT_ID), &salt, 0);
  53                 if (len < 0) {
  54                         log_err(_("Invalid salt string specified."));
  55                         return -EINVAL;
  56                 }
  57                 params->salt_size = len;
  58                 params->salt = salt;
  59         } else {
  60                 params->salt_size = DEFAULT_VERITY_SALT_SIZE;
  61                 params->salt = NULL;
  62         }
  63
  64         params->data_block_size = ARG_UINT32(OPT_DATA_BLOCK_SIZE_ID);
  65         params->hash_block_size = ARG_UINT32(OPT_HASH_BLOCK_SIZE_ID);
  66         params->data_size = ARG_UINT64(OPT_DATA_BLOCKS_ID);
  67         params->hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
  68         params->fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
  69         params->hash_type = ARG_UINT32(OPT_FORMAT_ID);
  70         params->flags = flags;
  71
  72         return 0;
  73 }
  74
  75 static int action_format(void)
  76 {
  77         struct crypt_device *cd = NULL;
  78         struct crypt_params_verity params = {};
  79         uint32_t flags = CRYPT_VERITY_CREATE_HASH;
  80         char *root_hash_bytes = NULL;
  81         size_t root_hash_size;
  82         int root_hash_fd = -1, i, r;
  83
  84         /* Try to create hash image if doesn't exist */
  85         r = open(action_argv[1], O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
  86         if (r < 0 && errno != EEXIST) {
  87                 log_err(_("Cannot create hash image %s for writing."), action_argv[1]);
  88                 return -EINVAL;
  89         } else if (r >= 0) {
  90                 log_dbg("Created hash image %s.", action_argv[1]);
  91                 close(r);
  92         }
  93         /* Try to create FEC image if doesn't exist */
  94         if (ARG_SET(OPT_FEC_DEVICE_ID)) {
  95                 r = open(ARG_STR(OPT_FEC_DEVICE_ID), O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
  96                 if (r < 0 && errno != EEXIST) {
  97                         log_err(_("Cannot create FEC image %s for writing."), ARG_STR(OPT_FEC_DEVICE_ID));
  98                         return -EINVAL;
  99                 } else if (r >= 0) {
 100                         log_dbg("Created FEC image %s.", ARG_STR(OPT_FEC_DEVICE_ID));
 101                         close(r);
 102                 }
 103         }
 104
 105         if ((r = crypt_init(&cd, action_argv[1])))
 106                 goto out;
 107
 108         if (ARG_SET(OPT_NO_SUPERBLOCK_ID))
 109                 flags |= CRYPT_VERITY_NO_HEADER;
 110
 111         r = _prepare_format(&params, action_argv[0], flags);
 112         if (r < 0)
 113                 goto out;
 114
 115         r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, ARG_STR(OPT_UUID_ID), NULL, 0, &params);
 116         if (r < 0)
 117                 goto out;
 118
 119         crypt_dump(cd);
 120
 121         /* Create or overwrite the root hash file */
 122         if (ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
 123                 root_hash_size = crypt_get_volume_key_size(cd);
 124                 root_hash_bytes = malloc(root_hash_size);
 125                 if (!root_hash_bytes) {
 126                         r = -ENOMEM;
 127                         goto out;
 128                 }
 129
 130                 r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash_bytes, &root_hash_size, NULL, 0);
 131                 if (r < 0)
 132                         goto out;
 133
 134                 root_hash_fd = open(ARG_STR(OPT_ROOT_HASH_FILE_ID), O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
 135                 if (root_hash_fd == -1) {
 136                         log_err(_("Cannot create root hash file %s for writing."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
 137                         r = -EINVAL;
 138                         goto out;
 139                 }
 140
 141                 for (i = 0; i < (int)root_hash_size; i++)
 142                         if (dprintf(root_hash_fd, "%02hhx", root_hash_bytes[i]) != 2) {
 143                                 log_err(_("Cannot write to root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
 144                                 r = -EIO;
 145                                 goto out;
 146                         }
 147
 148                 log_dbg("Created root hash file %s.", ARG_STR(OPT_ROOT_HASH_FILE_ID));
 149         }
 150 out:
 151         crypt_free(cd);
 152         free(CONST_CAST(char*)params.salt);
 153         free(root_hash_bytes);
 154         if (root_hash_fd != -1)
 155                 close(root_hash_fd);
 156         return r;
 157 }
 158
 159 static int _activate(const char *dm_device,
 160                       const char *data_device,
 161                       const char *hash_device,
 162                       const char *root_hash,
 163                       uint32_t flags)
 164 {
 165         struct crypt_device *cd = NULL;
 166         struct crypt_params_verity params = {};
 167         uint32_t activate_flags = CRYPT_ACTIVATE_READONLY;
 168         char *root_hash_bytes = NULL, *root_hash_from_file = NULL;
 169         ssize_t hash_size, hash_size_hex;
 170         struct stat st;
 171         char *signature = NULL;
 172         int signature_size = 0, root_hash_fd = -1, r;
 173
 174         if ((r = crypt_init_data_device(&cd, hash_device, data_device)))
 175                 goto out;
 176
 177         if (ARG_SET(OPT_IGNORE_CORRUPTION_ID))
 178                 activate_flags |= CRYPT_ACTIVATE_IGNORE_CORRUPTION;
 179         if (ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
 180                 activate_flags |= CRYPT_ACTIVATE_RESTART_ON_CORRUPTION;
 181         if (ARG_SET(OPT_PANIC_ON_CORRUPTION_ID))
 182                 activate_flags |= CRYPT_ACTIVATE_PANIC_ON_CORRUPTION;
 183         if (ARG_SET(OPT_IGNORE_ZERO_BLOCKS_ID))
 184                 activate_flags |= CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS;
 185         if (ARG_SET(OPT_CHECK_AT_MOST_ONCE_ID))
 186                 activate_flags |= CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE;
 187         if (ARG_SET(OPT_USE_TASKLETS_ID))
 188                 activate_flags |= CRYPT_ACTIVATE_TASKLETS;
 189
 190         if (!ARG_SET(OPT_NO_SUPERBLOCK_ID)) {
 191                 params.flags = flags;
 192                 params.hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
 193                 params.fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
 194                 params.fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
 195                 params.fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
 196                 r = crypt_load(cd, CRYPT_VERITY, &params);
 197                 if (r)
 198                         log_err(_("Device %s is not a valid VERITY device."), hash_device);
 199
 200         } else {
 201                 r = _prepare_format(&params, data_device, flags | CRYPT_VERITY_NO_HEADER);
 202                 if (r < 0)
 203                         goto out;
 204                 r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, &params);
 205         }
 206         if (r < 0)
 207                 goto out;
 208
 209         hash_size = crypt_get_volume_key_size(cd);
 210         hash_size_hex = 2 * hash_size;
 211
 212         if (!root_hash) {
 213                 root_hash_fd = open(ARG_STR(OPT_ROOT_HASH_FILE_ID), O_RDONLY);
 214                 if (root_hash_fd == -1) {
 215                         log_err(_("Cannot read root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
 216                         goto out;
 217                 }
 218
 219                 if (fstat(root_hash_fd, &st) || !S_ISREG(st.st_mode) || st.st_size < hash_size_hex) {
 220                         log_err(_("Invalid root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
 221                         r = -EINVAL;
 222                         goto out;
 223                 }
 224
 225                 root_hash_from_file = malloc(hash_size_hex + 1);
 226                 if (!root_hash_from_file) {
 227                         r = -ENOMEM;
 228                         goto out;
 229                 }
 230
 231                 if (read_buffer(root_hash_fd, root_hash_from_file, hash_size_hex) != hash_size_hex) {
 232                         log_err(_("Cannot read root hash file %s."), root_hash_from_file);
 233                         goto out;
 234                 }
 235
 236                 root_hash_from_file[hash_size_hex] = '\0';
 237                 root_hash = root_hash_from_file;
 238         }
 239
 240         if (crypt_hex_to_bytes(root_hash, &root_hash_bytes, 0) != hash_size) {
 241                 log_err(_("Invalid root hash string specified."));
 242                 r = -EINVAL;
 243                 goto out;
 244         }
 245
 246         if (ARG_SET(OPT_ROOT_HASH_SIGNATURE_ID)) {
 247                 // FIXME: check max file size
 248                 if (stat(ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID), &st) || !S_ISREG(st.st_mode) || !st.st_size) {
 249                         log_err(_("Invalid signature file %s."), ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID));
 250                         r = -EINVAL;
 251                         goto out;
 252                 }
 253                 signature_size = st.st_size;
 254                 r = tools_read_vk(ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID), &signature, signature_size);
 255                 if (r < 0) {
 256                         log_err(_("Cannot read signature file %s."), ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID));
 257                         goto out;
 258                 }
 259         }
 260         r = crypt_activate_by_signed_key(cd, dm_device,
 261                                          root_hash_bytes,
 262                                          hash_size,
 263                                          signature, signature_size,
 264                                          activate_flags);
 265 out:
 266         crypt_safe_free(signature);
 267         crypt_free(cd);
 268         free(root_hash_from_file);
 269         free(root_hash_bytes);
 270         free(CONST_CAST(char*)params.salt);
 271         if (root_hash_fd != -1)
 272                 close(root_hash_fd);
 273         return r;
 274 }
 275
 276 static int action_open(void)
 277 {
 278         if (action_argc < 4 && !ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
 279                 log_err(_("Command requires <root_hash> or --root-hash-file option as argument."));
 280                 return -EINVAL;
 281         }
 282
 283         return _activate(action_argv[1],
 284                          action_argv[0],
 285                          action_argv[2],
 286                          ARG_SET(OPT_ROOT_HASH_FILE_ID) ? NULL : action_argv[3],
 287                          ARG_SET(OPT_ROOT_HASH_SIGNATURE_ID) ? CRYPT_VERITY_ROOT_HASH_SIGNATURE : 0);
 288 }
 289
 290 static int action_verify(void)
 291 {
 292         if (action_argc < 3 && !ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
 293                 log_err(_("Command requires <root_hash> or --root-hash-file option as argument."));
 294                 return -EINVAL;
 295         }
 296
 297         return _activate(NULL,
 298                          action_argv[0],
 299                          action_argv[1],
 300                          ARG_SET(OPT_ROOT_HASH_FILE_ID) ? NULL : action_argv[2],
 301                          CRYPT_VERITY_CHECK_HASH);
 302 }
 303
 304 static int action_close(void)
 305 {
 306         struct crypt_device *cd = NULL;
 307         crypt_status_info ci;
 308         uint32_t flags = 0;
 309         int r;
 310
 311         if (ARG_SET(OPT_DEFERRED_ID))
 312                 flags |= CRYPT_DEACTIVATE_DEFERRED;
 313         if (ARG_SET(OPT_CANCEL_DEFERRED_ID))
 314                 flags |= CRYPT_DEACTIVATE_DEFERRED_CANCEL;
 315
 316         r = crypt_init_by_name(&cd, action_argv[0]);
 317         if (r == 0)
 318                 r = crypt_deactivate_by_name(cd, action_argv[0], flags);
 319
 320         if (!r && ARG_SET(OPT_DEFERRED_ID)) {
 321                 ci = crypt_status(cd, action_argv[0]);
 322                 if (ci == CRYPT_ACTIVE || ci == CRYPT_BUSY)
 323                         log_std(_("Device %s is still active and scheduled for deferred removal.\n"),
 324                                   action_argv[0]);
 325         }
 326
 327         crypt_free(cd);
 328         return r;
 329 }
 330
 331 static int action_status(void)
 332 {
 333         crypt_status_info ci;
 334         struct crypt_active_device cad;
 335         struct crypt_params_verity vp = {};
 336         struct crypt_device *cd = NULL;
 337         struct stat st;
 338         char *backing_file, *root_hash;
 339         size_t root_hash_size;
 340         unsigned path = 0;
 341         int r = 0;
 342
 343         /* perhaps a path, not a dm device name */
 344         if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
 345                 path = 1;
 346
 347         ci = crypt_status(NULL, action_argv[0]);
 348         switch (ci) {
 349         case CRYPT_INVALID:
 350                 r = -EINVAL;
 351                 break;
 352         case CRYPT_INACTIVE:
 353                 if (path)
 354                         log_std("%s is inactive.\n", action_argv[0]);
 355                 else
 356                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 357                 r = -ENODEV;
 358                 break;
 359         case CRYPT_ACTIVE:
 360         case CRYPT_BUSY:
 361                 if (path)
 362                         log_std("%s is active%s.\n", action_argv[0],
 363                                 ci == CRYPT_BUSY ? " and is in use" : "");
 364                 else
 365                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 366                                 ci == CRYPT_BUSY ? " and is in use" : "");
 367
 368                 r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL);
 369                 if (r < 0)
 370                         goto out;
 371
 372                 log_std("  type:        %s\n", crypt_get_type(cd) ?: "n/a");
 373
 374                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 375                 if (r < 0)
 376                         goto out;
 377
 378                 /* Print only VERITY type devices */
 379                 r = crypt_get_verity_info(cd, &vp);
 380                 if (r < 0)
 381                         goto out;
 382
 383                 log_std("  status:      %s%s\n",
 384                         cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified",
 385                         vp.flags & CRYPT_VERITY_ROOT_HASH_SIGNATURE ? " (with signature)" : "");
 386
 387                 log_std("  hash type:   %u\n", vp.hash_type);
 388                 log_std("  data block:  %u\n", vp.data_block_size);
 389                 log_std("  hash block:  %u\n", vp.hash_block_size);
 390                 log_std("  hash name:   %s\n", vp.hash_name);
 391                 log_std("  salt:        ");
 392                 if (vp.salt_size)
 393                         crypt_log_hex(NULL, vp.salt, vp.salt_size, "", 0, NULL);
 394                 else
 395                         log_std("-");
 396                 log_std("\n");
 397
 398                 log_std("  data device: %s\n", vp.data_device);
 399                 if ((backing_file = crypt_loop_backing_file(vp.data_device))) {
 400                         log_std("  data loop:   %s\n", backing_file);
 401                         free(backing_file);
 402                 }
 403                 log_std("  size:        %" PRIu64 " sectors\n", cad.size);
 404                 log_std("  mode:        %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 405                                            "readonly" : "read/write");
 406
 407                 log_std("  hash device: %s\n", vp.hash_device);
 408                 if ((backing_file = crypt_loop_backing_file(vp.hash_device))) {
 409                         log_std("  hash loop:   %s\n", backing_file);
 410                         free(backing_file);
 411                 }
 412                 log_std("  hash offset: %" PRIu64 " sectors\n",
 413                         vp.hash_area_offset * vp.hash_block_size / 512);
 414
 415                 if (vp.fec_device) {
 416                         log_std("  FEC device:  %s\n", vp.fec_device);
 417                         if ((backing_file = crypt_loop_backing_file(ARG_STR(OPT_FEC_DEVICE_ID)))) {
 418                                 log_std("  FEC loop:    %s\n", backing_file);
 419                                 free(backing_file);
 420                         }
 421                         log_std("  FEC offset:  %" PRIu64 " sectors\n",
 422                                 vp.fec_area_offset * vp.hash_block_size / 512);
 423                         log_std("  FEC roots:   %u\n", vp.fec_roots);
 424                 }
 425
 426                 root_hash_size = crypt_get_volume_key_size(cd);
 427                 if (root_hash_size > 0 && (root_hash = malloc(root_hash_size))) {
 428                         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash, &root_hash_size, NULL, 0);
 429                         if (!r) {
 430                                 log_std("  root hash:   ");
 431                                 crypt_log_hex(NULL, root_hash, root_hash_size, "", 0, NULL);
 432                                 log_std("\n");
 433                         }
 434                         free(root_hash);
 435                 }
 436
 437                 if (cad.flags & (CRYPT_ACTIVATE_IGNORE_CORRUPTION|
 438                                  CRYPT_ACTIVATE_RESTART_ON_CORRUPTION|
 439                                  CRYPT_ACTIVATE_PANIC_ON_CORRUPTION|
 440                                  CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS|
 441                                  CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE|
 442                                  CRYPT_ACTIVATE_TASKLETS))
 443                         log_std("  flags:       %s%s%s%s%s%s\n",
 444                                 (cad.flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) ? "ignore_corruption " : "",
 445                                 (cad.flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) ? "restart_on_corruption " : "",
 446                                 (cad.flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION) ? "panic_on_corruption " : "",
 447                                 (cad.flags & CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS) ? "ignore_zero_blocks " : "",
 448                                 (cad.flags & CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) ? "check_at_most_once" : "",
 449                                 (cad.flags & CRYPT_ACTIVATE_TASKLETS) ? "try_verify_in_tasklet" : "");
 450         }
 451 out:
 452         crypt_free(cd);
 453         if (r == -ENOTSUP)
 454                 r = 0;
 455         return r;
 456 }
 457
 458 static int action_dump(void)
 459 {
 460         struct crypt_device *cd = NULL;
 461         struct crypt_params_verity params = {};
 462         int r;
 463
 464         if ((r = crypt_init(&cd, action_argv[0])))
 465                 return r;
 466
 467         params.hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
 468         params.fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
 469         params.fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
 470         params.fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
 471
 472         r = crypt_load(cd, CRYPT_VERITY, &params);
 473         if (!r)
 474                 crypt_dump(cd);
 475         else
 476                 log_err(_("Device %s is not a valid VERITY device."), action_argv[0]);
 477
 478         crypt_free(cd);
 479         return r;
 480 }
 481
 482 static struct action_type {
 483         const char *type;
 484         int (*handler)(void);
 485         int required_action_argc;
 486         const char *arg_desc;
 487         const char *desc;
 488 } action_types[] = {
 489         { "format",     action_format, 2, N_("<data_device> <hash_device>"),N_("format device") },
 490         { "verify",     action_verify, 2, N_("<data_device> <hash_device> [<root_hash>]"),N_("verify device") },
 491         { "open",       action_open,   3, N_("<data_device> <name> <hash_device> [<root_hash>]"),N_("open device as <name>") },
 492         { "close",      action_close,  1, N_("<name>"),N_("close device (remove mapping)") },
 493         { "status",     action_status, 1, N_("<name>"),N_("show active device status") },
 494         { "dump",       action_dump,   1, N_("<hash_device>"),N_("show on-disk information") },
 495         { NULL, NULL, 0, NULL, NULL }
 496 };
 497
 498 static void help(poptContext popt_context,
 499                  enum poptCallbackReason reason __attribute__((unused)),
 500                  struct poptOption *key,
 501                  const char *arg __attribute__((unused)),
 502                  void *data __attribute__((unused)))
 503 {
 504         struct action_type *action;
 505
 506         if (key->shortName == '?') {
 507                 tools_package_version(PACKAGE_VERITY, false);
 508                 poptPrintHelp(popt_context, stdout, 0);
 509                 log_std(_("\n"
 510                          "<action> is one of:\n"));
 511                 for(action = action_types; action->type; action++)
 512                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
 513                 log_std(_("\n"
 514                          "<name> is the device to create under %s\n"
 515                          "<data_device> is the data device\n"
 516                          "<hash_device> is the device containing verification data\n"
 517                          "<root_hash> hash of the root node on <hash_device>\n"),
 518                         crypt_get_dir());
 519
 520                 log_std(_("\nDefault compiled-in dm-verity parameters:\n"
 521                          "\tHash: %s, Data block (bytes): %u, "
 522                          "Hash block (bytes): %u, Salt size: %u, Hash format: %u\n"),
 523                         DEFAULT_VERITY_HASH, DEFAULT_VERITY_DATA_BLOCK,
 524                         DEFAULT_VERITY_HASH_BLOCK, DEFAULT_VERITY_SALT_SIZE,
 525                         1);
 526                 tools_cleanup();
 527                 poptFreeContext(popt_context);
 528                 exit(EXIT_SUCCESS);
 529         } else if (key->shortName == 'V') {
 530                 tools_package_version(PACKAGE_VERITY, false);
 531                 tools_cleanup();
 532                 poptFreeContext(popt_context);
 533                 exit(EXIT_SUCCESS);
 534         } else
 535                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
 536 }
 537
 538 static int run_action(struct action_type *action)
 539 {
 540         int r;
 541
 542         log_dbg("Running command %s.", action->type);
 543
 544         r = action->handler();
 545
 546         show_status(r);
 547         return translate_errno(r);
 548 }
 549
 550 static void basic_options_cb(poptContext popt_context,
 551                  enum poptCallbackReason reason __attribute__((unused)),
 552                  struct poptOption *key,
 553                  const char *arg,
 554                  void *data __attribute__((unused)))
 555 {
 556         tools_parse_arg_value(popt_context, tool_core_args[key->val].type, tool_core_args + key->val, arg, key->val, NULL);
 557
 558         switch (key->val) {
 559         case OPT_DEBUG_ID:
 560                 log_parms.debug = true;
 561                 /* fall through */
 562         case OPT_VERBOSE_ID:
 563                 log_parms.verbose = true;
 564         }
 565 }
 566
 567 int main(int argc, const char **argv)
 568 {
 569         static const char *null_action_argv[] = {NULL};
 570         static struct poptOption popt_help_options[] = {
 571                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
 572                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
 573                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
 574                 { "version",'V', POPT_ARG_NONE,     NULL, 0, N_("Print package version"),  NULL },
 575                 POPT_TABLEEND
 576         };
 577         static struct poptOption popt_basic_options[] = {
 578                 { NULL,    '\0', POPT_ARG_CALLBACK, basic_options_cb, 0, NULL, NULL },
 579 #define ARG(A, B, C, D, E, F, G, H) { A, B, C, NULL, A ## _ID, D, E },
 580 #include "veritysetup_arg_list.h"
 581 #undef ARG
 582                 POPT_TABLEEND
 583         };
 584         static struct poptOption popt_options[] = {
 585                 { NULL,              '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
 586                 { NULL,              '\0', POPT_ARG_INCLUDE_TABLE, popt_basic_options, 0, NULL, NULL },
 587                 POPT_TABLEEND
 588         };
 589
 590         poptContext popt_context;
 591         struct action_type *action;
 592         const char *aname;
 593         int r;
 594
 595         crypt_set_log_callback(NULL, tool_log, &log_parms);
 596
 597         setlocale(LC_ALL, "");
 598         bindtextdomain(PACKAGE, LOCALEDIR);
 599         textdomain(PACKAGE);
 600
 601         popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
 602         poptSetOtherOptionHelp(popt_context,
 603                                _("[OPTION...] <action> <action-specific>"));
 604
 605         while((r = poptGetNextOpt(popt_context)) > 0) {}
 606
 607         if (r < -1)
 608                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
 609                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
 610
 611         if (!(aname = poptGetArg(popt_context)))
 612                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
 613                       poptGetInvocationName(popt_context));
 614
 615         action_argc = 0;
 616         action_argv = poptGetArgs(popt_context);
 617         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
 618         if(!action_argv)
 619                 action_argv = null_action_argv;
 620
 621         /* Count args, somewhat unnice, change? */
 622         while(action_argv[action_argc] != NULL)
 623                 action_argc++;
 624
 625         /* Handle aliases */
 626         if (!strcmp(aname, "create") && action_argc > 1) {
 627                 /* create command had historically switched arguments */
 628                 if (action_argv[0] && action_argv[1]) {
 629                         const char *tmp = action_argv[0];
 630                         action_argv[0] = action_argv[1];
 631                         action_argv[1] = tmp;
 632                 }
 633                 aname = "open";
 634         } else if (!strcmp(aname, "remove")) {
 635                 aname = "close";
 636         }
 637
 638         for (action = action_types; action->type; action++)
 639                 if (strcmp(action->type, aname) == 0)
 640                         break;
 641
 642         if (!action->type)
 643                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
 644                       poptGetInvocationName(popt_context));
 645
 646         if (action_argc < action->required_action_argc) {
 647                 char buf[128];
 648                 if (snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc) < 0)
 649                         buf[0] = '\0';
 650                 usage(popt_context, EXIT_FAILURE, buf,
 651                       poptGetInvocationName(popt_context));
 652         }
 653
 654         tools_check_args(action->type, tool_core_args, ARRAY_SIZE(tool_core_args), popt_context);
 655
 656         if (ARG_SET(OPT_IGNORE_CORRUPTION_ID) && ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
 657                 usage(popt_context, EXIT_FAILURE,
 658                 _("Option --ignore-corruption and --restart-on-corruption cannot be used together."),
 659                 poptGetInvocationName(popt_context));
 660
 661         if (ARG_SET(OPT_PANIC_ON_CORRUPTION_ID) && ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
 662                 usage(popt_context, EXIT_FAILURE,
 663                 _("Option --panic-on-corruption and --restart-on-corruption cannot be used together."),
 664                 poptGetInvocationName(popt_context));
 665
 666         if (ARG_SET(OPT_CANCEL_DEFERRED_ID) && ARG_SET(OPT_DEFERRED_ID))
 667                 usage(popt_context, EXIT_FAILURE,
 668                       _("Options --cancel-deferred and --deferred cannot be used at the same time."),
 669                       poptGetInvocationName(popt_context));
 670
 671         if (ARG_SET(OPT_DEBUG_ID)) {
 672                 crypt_set_debug_level(CRYPT_DEBUG_ALL);
 673                 dbg_version_and_cmd(argc, argv);
 674         }
 675
 676         r = run_action(action);
 677         tools_cleanup();
 678         poptFreeContext(popt_context);
 679         return r;
 680 }