* LUKS - Linux Unified Key Setup
*
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
+ * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include <sys/types.h>
#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <linux/fs.h>
#include <netinet/in.h>
#include <fcntl.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
+#include <assert.h>
#include <uuid/uuid.h>
#include "luks.h"
return div_round_up(x, m) * m;
}
+/* Get size of struct luks_phrd with all keyslots material space */
+static uint64_t LUKS_device_sectors(size_t keyLen, unsigned int stripes)
+{
+ uint64_t keyslot_sectors, sector;
+ int i;
+
+ keyslot_sectors = div_round_up(keyLen * stripes, SECTOR_SIZE);
+ sector = round_up_modulo(LUKS_PHDR_SIZE, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
+
+ for (i = 0; i < LUKS_NUMKEYS; i++) {
+ sector = round_up_modulo(sector, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
+ sector += keyslot_sectors;
+ }
+
+ return sector;
+}
+
+static int LUKS_check_device_size(const char *device,
+ uint64_t min_sectors,
+ size_t keyLength)
+{
+ uint64_t dev_size, req_sectors;
+
+ req_sectors = LUKS_device_sectors(keyLength, LUKS_STRIPES);
+ if (min_sectors > req_sectors)
+ req_sectors = min_sectors;
+
+ if(device_size(device, &dev_size)) {
+ log_dbg("Cannot get device size for device %s.", device);
+ return -EIO;
+ }
+
+ return (req_sectors > (dev_size >> SECTOR_SHIFT));
+}
+
+/* Check keyslot to prevent access outside of header and keyslot area */
+static int LUKS_check_keyslot_size(const struct luks_phdr *phdr, unsigned int keyIndex)
+{
+ uint32_t secs_per_stripes;
+
+ /* First sectors is the header itself */
+ if (phdr->keyblock[keyIndex].keyMaterialOffset * SECTOR_SIZE < sizeof(*phdr)) {
+ log_dbg("Invalid offset %u in keyslot %u.",
+ phdr->keyblock[keyIndex].keyMaterialOffset, keyIndex);
+ return 1;
+ }
+
+ /* Ignore following check for detached header where offset can be zero. */
+ if (phdr->payloadOffset == 0)
+ return 0;
+
+ if (phdr->payloadOffset <= phdr->keyblock[keyIndex].keyMaterialOffset) {
+ log_dbg("Invalid offset %u in keyslot %u (beyond data area offset %u).",
+ phdr->keyblock[keyIndex].keyMaterialOffset, keyIndex,
+ phdr->payloadOffset);
+ return 1;
+ }
+
+ secs_per_stripes = div_round_up(phdr->keyBytes * phdr->keyblock[keyIndex].stripes, SECTOR_SIZE);
+
+ if (phdr->payloadOffset < (phdr->keyblock[keyIndex].keyMaterialOffset + secs_per_stripes)) {
+ log_dbg("Invalid keyslot size %u (offset %u, stripes %u) in "
+ "keyslot %u (beyond data area offset %u).",
+ secs_per_stripes,
+ phdr->keyblock[keyIndex].keyMaterialOffset,
+ phdr->keyblock[keyIndex].stripes,
+ keyIndex, phdr->payloadOffset);
+ return 1;
+ }
+
+ return 0;
+}
+
static const char *dbg_slot_state(crypt_keyslot_info ki)
{
switch(ki) {
return -EINVAL;
}
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(device, hdr, 1, 0, ctx);
if (r)
return r;
buffer_size = hdr_file.payloadOffset << SECTOR_SHIFT;
if (r || buffer_size < LUKS_ALIGN_KEYSLOTS) {
- log_err(ctx, _("Backup file do not contain valid LUKS header.\n"));
+ log_err(ctx, _("Backup file doesn't contain valid LUKS header.\n"));
r = -EINVAL;
goto out;
}
}
close(devfd);
- r = LUKS_read_phdr(device, hdr, 0, ctx);
+ r = LUKS_read_phdr(device, hdr, 0, 0, ctx);
if (r == 0) {
log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device);
if(hdr->payloadOffset != hdr_file.payloadOffset ||
close(devfd);
/* Be sure to reload new data */
- r = LUKS_read_phdr(device, hdr, 0, ctx);
+ r = LUKS_read_phdr(device, hdr, 1, 0, ctx);
out:
if (devfd != -1)
close(devfd);
return r;
}
+/* This routine should do some just basic recovery for known problems. */
+static int _keyslot_repair(const char *device, struct luks_phdr *phdr, struct crypt_device *ctx)
+{
+ struct luks_phdr temp_phdr;
+ const unsigned char *sector = (const unsigned char*)phdr;
+ struct volume_key *vk;
+ uint64_t PBKDF2_per_sec = 1;
+ int i, bad, r, need_write = 0;
+
+ if (phdr->keyBytes != 16 && phdr->keyBytes != 32) {
+ log_err(ctx, _("Non standard key size, manual repair required.\n"));
+ return -EINVAL;
+ }
+ /* cryptsetup 1.0 did not align to 4k, cannot repair this one */
+ if (phdr->keyblock[0].keyMaterialOffset < (LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE)) {
+ log_err(ctx, _("Non standard keyslots alignment, manual repair required.\n"));
+ return -EINVAL;
+ }
+
+ vk = crypt_alloc_volume_key(phdr->keyBytes, NULL);
+
+ log_verbose(ctx, _("Repairing keyslots.\n"));
+
+ log_dbg("Generating second header with the same parameters for check.");
+ /* cipherName, cipherMode, hashSpec, uuid are already null terminated */
+ /* payloadOffset - cannot check */
+ r = LUKS_generate_phdr(&temp_phdr, vk, phdr->cipherName, phdr->cipherMode,
+ phdr->hashSpec,phdr->uuid, LUKS_STRIPES,
+ phdr->payloadOffset, 0,
+ 1, &PBKDF2_per_sec,
+ "/dev/null", ctx);
+ if (r < 0) {
+ log_err(ctx, _("Repair failed."));
+ goto out;
+ }
+
+ for(i = 0; i < LUKS_NUMKEYS; ++i) {
+ if (phdr->keyblock[i].active == LUKS_KEY_ENABLED) {
+ log_dbg("Skipping repair for active keyslot %i.", i);
+ continue;
+ }
+
+ bad = 0;
+ if (phdr->keyblock[i].keyMaterialOffset != temp_phdr.keyblock[i].keyMaterialOffset) {
+ log_err(ctx, _("Keyslot %i: offset repaired (%u -> %u).\n"), i,
+ (unsigned)phdr->keyblock[i].keyMaterialOffset,
+ (unsigned)temp_phdr.keyblock[i].keyMaterialOffset);
+ phdr->keyblock[i].keyMaterialOffset = temp_phdr.keyblock[i].keyMaterialOffset;
+ bad = 1;
+ }
+
+ if (phdr->keyblock[i].stripes != temp_phdr.keyblock[i].stripes) {
+ log_err(ctx, _("Keyslot %i: stripes repaired (%u -> %u).\n"), i,
+ (unsigned)phdr->keyblock[i].stripes,
+ (unsigned)temp_phdr.keyblock[i].stripes);
+ phdr->keyblock[i].stripes = temp_phdr.keyblock[i].stripes;
+ bad = 1;
+ }
+
+ /* Known case - MSDOS partition table signature */
+ if (i == 6 && sector[0x1fe] == 0x55 && sector[0x1ff] == 0xaa) {
+ log_err(ctx, _("Keyslot %i: bogus partition signature.\n"), i);
+ bad = 1;
+ }
+
+ if(bad) {
+ log_err(ctx, _("Keyslot %i: salt wiped.\n"), i);
+ phdr->keyblock[i].active = LUKS_KEY_DISABLED;
+ memset(&phdr->keyblock[i].passwordSalt, 0x00, LUKS_SALTSIZE);
+ phdr->keyblock[i].passwordIterations = 0;
+ }
+
+ if (bad)
+ need_write = 1;
+ }
+
+ if (need_write) {
+ log_verbose(ctx, _("Writing LUKS header to disk.\n"));
+ r = LUKS_write_phdr(device, phdr, ctx);
+ }
+out:
+ crypt_free_volume_key(vk);
+ memset(&temp_phdr, 0, sizeof(temp_phdr));
+ return r;
+}
+
static int _check_and_convert_hdr(const char *device,
struct luks_phdr *hdr,
int require_luks_device,
+ int repair,
struct crypt_device *ctx)
{
int r = 0;
log_dbg("LUKS header not detected.");
if (require_luks_device)
log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
- else
- set_error(_("Device %s is not a valid LUKS device."), device);
- r = -EINVAL;
+ return -EINVAL;
} else if((hdr->version = ntohs(hdr->version)) != 1) { /* Convert every uint16/32_t item from network byte order */
log_err(ctx, _("Unsupported LUKS version %d.\n"), hdr->version);
- r = -EINVAL;
- } else if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
+ return -EINVAL;
+ }
+
+ hdr->hashSpec[LUKS_HASHSPEC_L - 1] = '\0';
+ if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
log_err(ctx, _("Requested LUKS hash %s is not supported.\n"), hdr->hashSpec);
- r = -EINVAL;
- } else {
- hdr->payloadOffset = ntohl(hdr->payloadOffset);
- hdr->keyBytes = ntohl(hdr->keyBytes);
- hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
-
- for(i = 0; i < LUKS_NUMKEYS; ++i) {
- hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
- hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
- hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
- hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
+ return -EINVAL;
+ }
+
+ /* Header detected */
+ hdr->payloadOffset = ntohl(hdr->payloadOffset);
+ hdr->keyBytes = ntohl(hdr->keyBytes);
+ hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
+
+ for(i = 0; i < LUKS_NUMKEYS; ++i) {
+ hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
+ hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
+ hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
+ hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
+ if (LUKS_check_keyslot_size(hdr, i)) {
+ log_err(ctx, _("LUKS keyslot %u is invalid.\n"), i);
+ r = -EINVAL;
}
}
+ /* Avoid unterminated strings */
+ hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0';
+ hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0';
+ hdr->uuid[UUID_STRING_L - 1] = '\0';
+
+ if (repair) {
+ if (r == -EINVAL)
+ r = _keyslot_repair(device, hdr, ctx);
+ else
+ log_verbose(ctx, _("No known problems detected for LUKS header.\n"));
+ }
+
return r;
}
r = -EIO;
else {
LUKS_fix_header_compatible(hdr);
- r = _check_and_convert_hdr(backup_file, hdr, require_luks_device, ctx);
+ r = _check_and_convert_hdr(backup_file, hdr,
+ require_luks_device, 0, ctx);
}
close(devfd);
int LUKS_read_phdr(const char *device,
struct luks_phdr *hdr,
int require_luks_device,
+ int repair,
struct crypt_device *ctx)
{
ssize_t hdr_size = sizeof(struct luks_phdr);
int devfd = 0, r = 0;
- uint64_t size;
+
+ if (repair && !require_luks_device)
+ return -EINVAL;
log_dbg("Reading LUKS header of size %d from device %s",
hdr_size, device);
if (read_blockwise(devfd, hdr, hdr_size) < hdr_size)
r = -EIO;
else
- r = _check_and_convert_hdr(device, hdr, require_luks_device, ctx);
+ r = _check_and_convert_hdr(device, hdr, require_luks_device,
+ repair, ctx);
-#ifdef BLKGETSIZE64
- if (r == 0 && (ioctl(devfd, BLKGETSIZE64, &size) < 0 ||
- size < (uint64_t)hdr->payloadOffset)) {
- log_err(ctx, _("LUKS header detected but device %s is too small.\n"), device);
- r = -EINVAL;
- }
-#endif
close(devfd);
-
return r;
}
log_dbg("Updating LUKS header of size %d on device %s",
sizeof(struct luks_phdr), device);
+ if (LUKS_check_device_size(device, hdr->payloadOffset, hdr->keyBytes)) {
+ log_err(ctx, _("Device %s is too small.\n"), device);
+ return -EINVAL;
+ }
+
devfd = open(device,O_RDWR | O_DIRECT | O_SYNC);
if(-1 == devfd) {
log_err(ctx, _("Cannot open device %s.\n"), device);
/* Re-read header from disk to be sure that in-memory and on-disk data are the same. */
if (!r) {
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(device, hdr, 1, 0, ctx);
if (r)
log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"), device);
}
unsigned int alignOffset,
uint32_t iteration_time_ms,
uint64_t *PBKDF2_per_sec,
+ const char *metadata_device,
struct crypt_device *ctx)
{
unsigned int i=0;
int currentSector;
char luksMagic[] = LUKS_MAGIC;
- if (alignPayload == 0)
+ /* For separate metadata device allow zero alignment */
+ if (alignPayload == 0 && !metadata_device)
alignPayload = DEFAULT_DISK_ALIGNMENT / SECTOR_SIZE;
if (PBKDF2_HMAC_ready(hashSpec) < 0) {
header->version, header->hashSpec ,header->cipherName, header->cipherMode,
header->keyBytes);
- r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_NORMAL);
+ r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_SALT);
if(r < 0) {
log_err(ctx, _("Cannot create LUKS header: reading random salt failed.\n"));
return r;
currentSector = round_up_modulo(currentSector + blocksPerStripeSet,
LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
}
- currentSector = round_up_modulo(currentSector, alignPayload);
- /* alignOffset - offset from natural device alignment provided by topology info */
- header->payloadOffset = currentSector + alignOffset;
+ if (metadata_device) {
+ /* for separate metadata device use alignPayload directly */
+ header->payloadOffset = alignPayload;
+ } else {
+ /* alignOffset - offset from natural device alignment provided by topology info */
+ currentSector = round_up_modulo(currentSector, alignPayload);
+ header->payloadOffset = currentSector + alignOffset;
+ }
uuid_unparse(partitionUuid, header->uuid);
uint64_t *PBKDF2_per_sec,
struct crypt_device *ctx)
{
- char derivedKey[hdr->keyBytes];
+ struct volume_key *derived_key;
char *AfKey = NULL;
unsigned int AFEKSize;
uint64_t PBKDF2_temp;
log_dbg("Key slot %d use %d password iterations.", keyIndex, hdr->keyblock[keyIndex].passwordIterations);
+ derived_key = crypt_alloc_volume_key(hdr->keyBytes, NULL);
+ if (!derived_key)
+ return -ENOMEM;
+
r = crypt_random_get(ctx, hdr->keyblock[keyIndex].passwordSalt,
- LUKS_SALTSIZE, CRYPT_RND_NORMAL);
+ LUKS_SALTSIZE, CRYPT_RND_SALT);
if (r < 0)
return r;
-// assert((vk->keylength % TWOFISH_BLOCKSIZE) == 0); FIXME
-
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
hdr->keyblock[keyIndex].passwordIterations,
- derivedKey, hdr->keyBytes);
+ derived_key->key, hdr->keyBytes);
if (r < 0)
goto out;
/*
* AF splitting, the masterkey stored in vk->key is split to AfKey
*/
+ assert(vk->keylength == hdr->keyBytes);
AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
AfKey = crypt_safe_alloc(AFEKSize);
if (!AfKey) {
r = LUKS_encrypt_to_storage(AfKey,
AFEKSize,
hdr,
- derivedKey,
- hdr->keyBytes,
+ derived_key,
device,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);
if (r < 0) {
- if(!get_error())
- log_err(ctx, _("Failed to write to key storage.\n"));
+ log_err(ctx, _("Failed to write to key storage.\n"));
goto out;
}
r = 0;
out:
crypt_safe_free(AfKey);
- memset(derivedKey, 0, sizeof(derivedKey));
+ crypt_free_volume_key(derived_key);
return r;
}
struct crypt_device *ctx)
{
crypt_keyslot_info ki = LUKS_keyslot_info(hdr, keyIndex);
- char derivedKey[hdr->keyBytes];
+ struct volume_key *derived_key;
char *AfKey;
size_t AFEKSize;
int r;
if (ki < CRYPT_SLOT_ACTIVE)
return -ENOENT;
- // assert((vk->keylength % TWOFISH_BLOCKSIZE) == 0); FIXME
+ derived_key = crypt_alloc_volume_key(hdr->keyBytes, NULL);
+ if (!derived_key)
+ return -ENOMEM;
+ assert(vk->keylength == hdr->keyBytes);
AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
AfKey = crypt_safe_alloc(AFEKSize);
if (!AfKey)
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
hdr->keyblock[keyIndex].passwordIterations,
- derivedKey, hdr->keyBytes);
+ derived_key->key, hdr->keyBytes);
if (r < 0)
goto out;
r = LUKS_decrypt_from_storage(AfKey,
AFEKSize,
hdr,
- derivedKey,
- hdr->keyBytes,
+ derived_key,
device,
hdr->keyblock[keyIndex].keyMaterialOffset,
ctx);
log_verbose(ctx, _("Key slot %d unlocked.\n"), keyIndex);
out:
crypt_safe_free(AfKey);
- memset(derivedKey, 0, sizeof(derivedKey));
+ crypt_free_volume_key(derived_key);
return r;
}
return -EPERM;
}
-/*
- * Wipe patterns according to Gutmann's Paper
- */
-
-static void wipeSpecial(char *buffer, size_t buffer_size, unsigned int turn)
-{
- unsigned int i;
-
- unsigned char write_modes[][3] = {
- {"\x55\x55\x55"}, {"\xaa\xaa\xaa"}, {"\x92\x49\x24"},
- {"\x49\x24\x92"}, {"\x24\x92\x49"}, {"\x00\x00\x00"},
- {"\x11\x11\x11"}, {"\x22\x22\x22"}, {"\x33\x33\x33"},
- {"\x44\x44\x44"}, {"\x55\x55\x55"}, {"\x66\x66\x66"},
- {"\x77\x77\x77"}, {"\x88\x88\x88"}, {"\x99\x99\x99"},
- {"\xaa\xaa\xaa"}, {"\xbb\xbb\xbb"}, {"\xcc\xcc\xcc"},
- {"\xdd\xdd\xdd"}, {"\xee\xee\xee"}, {"\xff\xff\xff"},
- {"\x92\x49\x24"}, {"\x49\x24\x92"}, {"\x24\x92\x49"},
- {"\x6d\xb6\xdb"}, {"\xb6\xdb\x6d"}, {"\xdb\x6d\xb6"}
- };
-
- for(i = 0; i < buffer_size / 3; ++i) {
- memcpy(buffer, write_modes[turn], 3);
- buffer += 3;
- }
-}
-
-static int wipe(const char *device, unsigned int from, unsigned int to)
-{
- int devfd, r = 0;
- char *buffer;
- unsigned int i, bufLen;
- ssize_t written;
-
- devfd = open(device, O_RDWR | O_DIRECT | O_SYNC);
- if(devfd == -1)
- return -EINVAL;
-
- bufLen = (to - from) * SECTOR_SIZE;
- buffer = malloc(bufLen);
- if(!buffer) {
- close(devfd);
- return -ENOMEM;
- }
-
- for(i = 0; i < 39; ++i) {
- if (i < 5) crypt_random_get(NULL, buffer, bufLen,
- CRYPT_RND_NORMAL);
- else if(i >= 5 && i < 32) wipeSpecial(buffer, bufLen, i - 5);
- else if(i >= 32 && i < 38) crypt_random_get(NULL, buffer, bufLen,
- CRYPT_RND_NORMAL);
- else if(i >= 38 && i < 39) memset(buffer, 0xFF, bufLen);
-
- written = write_lseek_blockwise(devfd, buffer, bufLen,
- from * SECTOR_SIZE);
- if (written < 0 || written != bufLen) {
- r = -EIO;
- break;
- }
- }
-
- free(buffer);
- close(devfd);
-
- return r;
-}
-
int LUKS_del_key(const char *device,
unsigned int keyIndex,
struct luks_phdr *hdr,
unsigned int startOffset, endOffset, stripesLen;
int r;
- r = LUKS_read_phdr(device, hdr, 1, ctx);
+ r = LUKS_read_phdr(device, hdr, 1, 0, ctx);
if (r)
return r;
stripesLen = hdr->keyBytes * hdr->keyblock[keyIndex].stripes;
endOffset = startOffset + div_round_up(stripesLen, SECTOR_SIZE);
- r = wipe(device, startOffset, endOffset);
+ r = crypt_wipe(device, startOffset * SECTOR_SIZE,
+ (endOffset - startOffset) * SECTOR_SIZE,
+ CRYPT_WIPE_DISK, 0);
if (r) {
log_err(ctx, _("Cannot wipe device %s.\n"), device);
return r;
{
int r;
char *dm_cipher = NULL;
+ enum devcheck device_check;
struct crypt_dm_active_device dmd = {
- .device = crypt_get_device_name(cd),
- .cipher = NULL,
+ .target = DM_CRYPT,
.uuid = crypt_get_uuid(cd),
- .key = vk->key,
- .key_size = vk->keylength,
- .offset = crypt_get_data_offset(cd),
- .iv_offset = 0,
+ .flags = flags,
.size = 0,
- .flags = flags
+ .data_device = crypt_get_device_name(cd),
+ .u.crypt = {
+ .cipher = NULL,
+ .vk = vk,
+ .offset = crypt_get_data_offset(cd),
+ .iv_offset = 0,
+ }
};
- r = device_check_and_adjust(cd, dmd.device, DEV_EXCL,
- &dmd.size, &dmd.offset, &flags);
+ if (dmd.flags & CRYPT_ACTIVATE_SHARED)
+ device_check = DEV_SHARED;
+ else
+ device_check = DEV_EXCL;
+
+ r = device_check_and_adjust(cd, dmd.data_device, device_check,
+ &dmd.size, &dmd.u.crypt.offset,
+ &dmd.flags);
if (r)
return r;
if (r < 0)
return -ENOMEM;
- dmd.cipher = dm_cipher;
+ dmd.u.crypt.cipher = dm_cipher;
r = dm_create_device(name, CRYPT_LUKS1, &dmd, 0);
free(dm_cipher);