/*
* veritysetup - setup cryptographic volumes for dm-verity
*
- * Copyright (C) 2012, Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2023 Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2023 Milan Broz
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
-#define _FILE_OFFSET_BITS 64
-
-#include "config.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdint.h>
-#include <stdarg.h>
-#include <unistd.h>
-#include <errno.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/ioctl.h>
-#include <sys/mount.h>
-#include <arpa/inet.h>
-#include <popt.h>
-
-#include "crypto_backend.h"
-
-#define DEFAULT_BLOCK_SIZE 4096
-#define DM_VERITY_MAX_LEVELS 63
-
-#define DEFAULT_SALT_SIZE 32
-#define MAX_SALT_SIZE 384
-
-#define MODE_VERIFY 0
-#define MODE_CREATE 1
-#define MODE_ACTIVATE 2
-
-#define MAX_FORMAT_VERSION 1
-
-static int mode = -1;
-static int use_superblock = 1;
-
-static const char *dm_device;
-static const char *data_device;
-static const char *hash_device;
-static const char *hash_algorithm = NULL;
-static const char *root_hash;
-
-static int version = -1;
-static int data_block_size = 0;
-static int hash_block_size = 0;
-static char *data_blocks_string = NULL;
-static long long data_blocks = 0;
-static char *hash_start_string = NULL;
-static long long hash_start = 0;
-static const char *salt_string = NULL;
-
-static FILE *data_file;
-static FILE *hash_file;
-
-static off_t data_file_blocks;
-static off_t hash_file_blocks;
-static off_t used_hash_blocks;
-
-static char *root_hash_bytes;
-static char *calculated_digest;
-
-static char *salt_bytes;
-static unsigned salt_size;
-
-static unsigned digest_size;
-static unsigned char digest_size_bits;
-static unsigned char levels;
-static unsigned char hash_per_block_bits;
-
-static off_t hash_level_block[DM_VERITY_MAX_LEVELS];
-static off_t hash_level_size[DM_VERITY_MAX_LEVELS];
-
-static off_t superblock_position;
-
-static int retval = 0;
-
-static int opt_debug = 0;
-
-struct superblock {
- uint8_t signature[8];
- uint8_t version;
- uint8_t data_block_bits;
- uint8_t hash_block_bits;
- uint8_t pad1[1];
- uint16_t salt_size;
- uint8_t pad2[2];
- uint32_t data_blocks_hi;
- uint32_t data_blocks_lo;
- uint8_t algorithm[16];
- uint8_t salt[MAX_SALT_SIZE];
- uint8_t pad3[88];
-};
-
-#define DM_VERITY_SIGNATURE "verity\0\0"
-#define DM_VERITY_VERSION 0
+#include "cryptsetup.h"
+#include "veritysetup_args.h"
-__attribute__((format(printf, 5, 6)))
-void logger(struct crypt_device *cd, int level, const char *file,
- int line, const char *format, ...)
-{
- va_list argp;
- char *target = NULL;
+#define PACKAGE_VERITY "veritysetup"
- va_start(argp, format);
+static const char **action_argv;
+static int action_argc;
+static struct tools_log_params log_parms;
- if (vasprintf(&target, format, argp) > 0) {
- if (level >= 0) {
- printf("%s\n", target);
- } else if (opt_debug)
- printf("# %s\n", target);
- }
-
- va_end(argp);
- free(target);
+void tools_cleanup(void)
+{
+ tools_args_free(tool_core_args, ARRAY_SIZE(tool_core_args));
}
-__attribute__((__noreturn__))
-static void help(poptContext popt_context,
- enum poptCallbackReason reason,
- struct poptOption *key,
- const char *arg,
- void *data)
+static int _prepare_format(struct crypt_params_verity *params,
+ const char *data_device,
+ uint32_t flags)
{
- if (!strcmp(key->longName, "help")) {
- poptPrintHelp(popt_context, stdout, 0);
+ char *salt = NULL;
+ int len;
+
+ params->hash_name = ARG_STR(OPT_HASH_ID);
+ params->data_device = data_device;
+ params->fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
+ params->fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
+
+ if (ARG_STR(OPT_SALT_ID) && !strcmp(ARG_STR(OPT_SALT_ID), "-")) {
+ params->salt_size = 0;
+ params->salt = NULL;
+ } else if (ARG_SET(OPT_SALT_ID)) {
+ len = crypt_hex_to_bytes(ARG_STR(OPT_SALT_ID), &salt, 0);
+ if (len < 0) {
+ log_err(_("Invalid salt string specified."));
+ return -EINVAL;
+ }
+ params->salt_size = len;
+ params->salt = salt;
} else {
- printf("veritysetup");
- printf("\n");
+ params->salt_size = DEFAULT_VERITY_SALT_SIZE;
+ params->salt = NULL;
}
- exit(0);
-}
-static struct poptOption popt_help_options[] = {
- { NULL, 0, POPT_ARG_CALLBACK, help, 0, NULL, NULL },
- { "help", 'h', POPT_ARG_NONE, NULL, 0, "Show help", NULL },
- { "version", 0, POPT_ARG_NONE, NULL, 0, "Show version", NULL },
- POPT_TABLEEND
-};
+ params->data_block_size = ARG_UINT32(OPT_DATA_BLOCK_SIZE_ID);
+ params->hash_block_size = ARG_UINT32(OPT_HASH_BLOCK_SIZE_ID);
+ params->data_size = ARG_UINT64(OPT_DATA_BLOCKS_ID);
+ params->hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
+ params->fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
+ params->hash_type = ARG_UINT32(OPT_FORMAT_ID);
+ params->flags = flags;
-static struct poptOption popt_options[] = {
- { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, NULL, NULL },
- { "create", 'c', POPT_ARG_VAL, &mode, MODE_CREATE, "Create hash", NULL },
- { "verify", 'v', POPT_ARG_VAL, &mode, MODE_VERIFY, "Verify integrity", NULL },
- { "activate", 'a', POPT_ARG_VAL, &mode, MODE_ACTIVATE, "Activate the device", NULL },
- { "no-superblock", 0, POPT_ARG_VAL, &use_superblock, 0, "Do not create/use superblock" },
- { "format", 0, POPT_ARG_INT, &version, 0, "Format version (1 - normal format, 0 - original Chromium OS format)", "number" },
- { "data-block-size", 0, POPT_ARG_INT, &data_block_size, 0, "Block size on the data device", "bytes" },
- { "hash-block-size", 0, POPT_ARG_INT, &hash_block_size, 0, "Block size on the hash device", "bytes" },
- { "data-blocks", 0, POPT_ARG_STRING, &data_blocks_string, 0, "The number of blocks in the data file", "blocks" },
- { "hash-start", 0, POPT_ARG_STRING, &hash_start_string, 0, "Starting block on the hash device", "512-byte sectors" },
- { "algorithm", 0, POPT_ARG_STRING, &hash_algorithm, 0, "Hash algorithm (default sha256)", "string" },
- { "salt", 0, POPT_ARG_STRING, &salt_string, 0, "Salt", "hex string" },
- POPT_TABLEEND
-};
-
-__attribute__((__format__(__printf__, 1, 2), __noreturn__))
-static void exit_err(const char *msg, ...)
-{
- va_list args;
- va_start(args, msg);
- vfprintf(stderr, msg, args);
- va_end(args);
- fputc('\n', stderr);
- exit(2);
+ return 0;
}
-__attribute__((__noreturn__))
-static void stream_err(FILE *f, const char *msg)
+static int action_format(void)
{
- if (ferror(f)) {
- perror(msg);
- exit(2);
- } else if (feof(f)) {
- exit_err("eof on %s", msg);
- } else {
- exit_err("unknown error on %s", msg);
+ struct crypt_device *cd = NULL;
+ struct crypt_params_verity params = {};
+ uint32_t flags = CRYPT_VERITY_CREATE_HASH;
+ char *root_hash_bytes = NULL;
+ size_t root_hash_size;
+ int root_hash_fd = -1, i, r;
+
+ /* Try to create hash image if doesn't exist */
+ r = open(action_argv[1], O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
+ if (r < 0 && errno != EEXIST) {
+ log_err(_("Cannot create hash image %s for writing."), action_argv[1]);
+ return -EINVAL;
+ } else if (r >= 0) {
+ log_dbg("Created hash image %s.", action_argv[1]);
+ close(r);
+ }
+ /* Try to create FEC image if doesn't exist */
+ if (ARG_SET(OPT_FEC_DEVICE_ID)) {
+ r = open(ARG_STR(OPT_FEC_DEVICE_ID), O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
+ if (r < 0 && errno != EEXIST) {
+ log_err(_("Cannot create FEC image %s for writing."), ARG_STR(OPT_FEC_DEVICE_ID));
+ return -EINVAL;
+ } else if (r >= 0) {
+ log_dbg("Created FEC image %s.", ARG_STR(OPT_FEC_DEVICE_ID));
+ close(r);
+ }
}
-}
-static void *xmalloc(size_t s)
-{
- void *ptr = malloc(!s ? 1 : s);
- if (!ptr) exit_err("out of memory");
- return ptr;
-}
+ if ((r = crypt_init(&cd, action_argv[1])))
+ goto out;
-static char *xstrdup(const char *str)
-{
- return strcpy(xmalloc(strlen(str) + 1), str);
-}
+ if (ARG_SET(OPT_NO_SUPERBLOCK_ID))
+ flags |= CRYPT_VERITY_NO_HEADER;
-static char *xprint(unsigned long long num)
-{
- size_t s = snprintf(NULL, 0, "%llu", num);
- char *p = xmalloc(s + 1);
- snprintf(p, s + 1, "%llu", num);
- return p;
-}
+ r = _prepare_format(¶ms, action_argv[0], flags);
+ if (r < 0)
+ goto out;
-static char *xhexprint(char *bytes, size_t len)
-{
- size_t i;
- char *p = xmalloc(len * 2 + 1);
- p[0] = 0;
- for (i = 0; i < len; i++)
- snprintf(p + i * 2, 3, "%02x", bytes[i]);
- return p;
-}
+ r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, ARG_STR(OPT_UUID_ID), NULL, 0, ¶ms);
+ if (r < 0)
+ goto out;
-static off_t get_size(FILE *f, const char *name)
-{
- struct stat st;
- int h = fileno(f);
- if (h < 0) {
- perror("fileno");
- exit(2);
- }
- if (fstat(h, &st)) {
- perror("fstat");
- exit(2);
- }
- if (S_ISREG(st.st_mode)) {
- return st.st_size;
- } else if (S_ISBLK(st.st_mode)) {
- unsigned long long size64;
- unsigned long sizeul;
- if (!ioctl(h, BLKGETSIZE64, &size64)) {
- return_size64:
- if ((off_t)size64 < 0 || (off_t)size64 != size64) {
- size_overflow:
- exit_err("%s: device size overflow", name);
- }
- return size64;
- }
- if (!ioctl(h, BLKGETSIZE, &sizeul)) {
- size64 = (unsigned long long)sizeul * 512;
- if (size64 / 512 != sizeul) goto size_overflow;
- goto return_size64;
+ crypt_dump(cd);
+
+ /* Create or overwrite the root hash file */
+ if (ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
+ root_hash_size = crypt_get_volume_key_size(cd);
+ root_hash_bytes = malloc(root_hash_size);
+ if (!root_hash_bytes) {
+ r = -ENOMEM;
+ goto out;
}
- perror("BLKGETSIZE");
- exit(2);
- } else {
- exit_err("%s is not a file or a block device", name);
- }
- return -1; /* never reached, shut up warning */
-}
-static void block_fseek(FILE *f, off_t block, int block_size)
-{
- unsigned long long pos = (unsigned long long)block * block_size;
- if (pos / block_size != block ||
- (off_t)pos < 0 ||
- (off_t)pos != pos)
- exit_err("seek position overflow");
- if (fseeko(f, pos, SEEK_SET)) {
- perror("fseek");
- exit(2);
- }
-}
+ r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash_bytes, &root_hash_size, NULL, 0);
+ if (r < 0)
+ goto out;
-static off_t verity_position_at_level(off_t block, int level)
-{
- return block >> (level * hash_per_block_bits);
-}
+ root_hash_fd = open(ARG_STR(OPT_ROOT_HASH_FILE_ID), O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR);
+ if (root_hash_fd == -1) {
+ log_err(_("Cannot create root hash file %s for writing."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
+ r = -EINVAL;
+ goto out;
+ }
-static void calculate_positions(void)
-{
- unsigned long long hash_position;
- int i;
-
- digest_size_bits = 0;
- while (1 << digest_size_bits < digest_size)
- digest_size_bits++;
- hash_per_block_bits = 0;
- while (((hash_block_size / digest_size) >> hash_per_block_bits) > 1)
- hash_per_block_bits++;
- if (!hash_per_block_bits)
- exit_err("at least two hashes must fit in a hash file block");
- levels = 0;
-
- if (data_file_blocks) {
- while (hash_per_block_bits * levels < 64 &&
- (unsigned long long)(data_file_blocks - 1) >>
- (hash_per_block_bits * levels))
- levels++;
- }
+ for (i = 0; i < (int)root_hash_size; i++)
+ if (dprintf(root_hash_fd, "%02hhx", root_hash_bytes[i]) != 2) {
+ log_err(_("Cannot write to root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
+ r = -EIO;
+ goto out;
+ }
- if (levels > DM_VERITY_MAX_LEVELS)
- exit_err("too many tree levels");
-
- hash_position = hash_start * 512 / hash_block_size;
- for (i = levels - 1; i >= 0; i--) {
- off_t s;
- hash_level_block[i] = hash_position;
- s = verity_position_at_level(data_file_blocks, i);
- s = (s >> hash_per_block_bits) +
- !!(s & ((1 << hash_per_block_bits) - 1));
- hash_level_size[i] = s;
- if (hash_position + s < hash_position ||
- (off_t)(hash_position + s) < 0 ||
- (off_t)(hash_position + s) != hash_position + s)
- exit_err("hash device offset overflow");
- hash_position += s;
+ log_dbg("Created root hash file %s.", ARG_STR(OPT_ROOT_HASH_FILE_ID));
}
- used_hash_blocks = hash_position;
+out:
+ crypt_free(cd);
+ free(CONST_CAST(char*)params.salt);
+ free(root_hash_bytes);
+ if (root_hash_fd != -1)
+ close(root_hash_fd);
+ return r;
}
-static void create_or_verify_zero(FILE *wr, char *left_block, unsigned left_bytes)
+static int _activate(const char *dm_device,
+ const char *data_device,
+ const char *hash_device,
+ const char *root_hash,
+ uint32_t flags)
{
- if (left_bytes) {
- if (mode != MODE_CREATE) {
- unsigned x;
- if (fread(left_block, left_bytes, 1, wr) != 1)
- stream_err(wr, "read");
- for (x = 0; x < left_bytes; x++) if (left_block[x]) {
- retval = 1;
- fprintf(stderr, "spare area is not zeroed at position %lld\n", (long long)ftello(wr) - left_bytes);
- }
- } else {
- if (fwrite(left_block, left_bytes, 1, wr) != 1)
- stream_err(wr, "write");
- }
- }
-}
+ struct crypt_device *cd = NULL;
+ struct crypt_params_verity params = {};
+ uint32_t activate_flags = CRYPT_ACTIVATE_READONLY;
+ char *root_hash_bytes = NULL, *root_hash_from_file = NULL;
+ ssize_t hash_size, hash_size_hex;
+ struct stat st;
+ char *signature = NULL;
+ int signature_size = 0, root_hash_fd = -1, r;
+
+ if ((r = crypt_init_data_device(&cd, hash_device, data_device)))
+ goto out;
+
+ if (ARG_SET(OPT_IGNORE_CORRUPTION_ID))
+ activate_flags |= CRYPT_ACTIVATE_IGNORE_CORRUPTION;
+ if (ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
+ activate_flags |= CRYPT_ACTIVATE_RESTART_ON_CORRUPTION;
+ if (ARG_SET(OPT_PANIC_ON_CORRUPTION_ID))
+ activate_flags |= CRYPT_ACTIVATE_PANIC_ON_CORRUPTION;
+ if (ARG_SET(OPT_IGNORE_ZERO_BLOCKS_ID))
+ activate_flags |= CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS;
+ if (ARG_SET(OPT_CHECK_AT_MOST_ONCE_ID))
+ activate_flags |= CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE;
+ if (ARG_SET(OPT_USE_TASKLETS_ID))
+ activate_flags |= CRYPT_ACTIVATE_TASKLETS;
+
+ if (!ARG_SET(OPT_NO_SUPERBLOCK_ID)) {
+ params.flags = flags;
+ params.hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
+ params.fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
+ params.fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
+ params.fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
+ r = crypt_load(cd, CRYPT_VERITY, ¶ms);
+ if (r)
+ log_err(_("Device %s is not a valid VERITY device."), hash_device);
-static void create_or_verify_stream(FILE *rd, FILE *wr, int block_size, off_t blocks)
-{
- char *left_block = xmalloc(hash_block_size);
- char *data_buffer = xmalloc(block_size);
- char *read_digest = mode != MODE_CREATE ? xmalloc(digest_size) : NULL;
- off_t blocks_to_write = (blocks >> hash_per_block_bits) +
- !!(blocks & ((1 << hash_per_block_bits) - 1));
- struct crypt_hash *ctx = NULL;
-
- if (crypt_hash_init(&ctx, hash_algorithm))
- exit_err("hash_init failed");
-
- memset(left_block, 0, hash_block_size);
- while (blocks_to_write--) {
- unsigned x;
- unsigned left_bytes = hash_block_size;
- for (x = 0; x < 1 << hash_per_block_bits; x++) {
- if (!blocks)
- break;
- blocks--;
- if (fread(data_buffer, block_size, 1, rd) != 1)
- stream_err(rd, "read");
- if (version >= 1) {
- if (crypt_hash_write(ctx, salt_bytes, salt_size))
- exit_err("hash_write failed");
- }
- if (crypt_hash_write(ctx, data_buffer, block_size))
- exit_err("hash_write failed");
- if (!version) {
- if (crypt_hash_write(ctx, salt_bytes, salt_size))
- exit_err("hash_write failed");
- }
- if (crypt_hash_final(ctx, calculated_digest, digest_size))
- exit_err("hash_final failed");
- if (!wr)
- break;
- if (mode != MODE_CREATE) {
- if (fread(read_digest, digest_size, 1, wr) != 1)
- stream_err(wr, "read");
- if (memcmp(read_digest, calculated_digest, digest_size)) {
- retval = 1;
- fprintf(stderr, "verification failed at position %lld in %s file\n", (long long)ftello(rd) - block_size, rd == data_file ? "data" : "metadata");
- }
- } else {
- if (fwrite(calculated_digest, digest_size, 1, wr) != 1)
- stream_err(wr, "write");
- }
- if (!version) {
- left_bytes -= digest_size;
- } else {
- create_or_verify_zero(wr, left_block, (1 << digest_size_bits) - digest_size);
- left_bytes -= 1 << digest_size_bits;
- }
- }
- if (wr)
- create_or_verify_zero(wr, left_block, left_bytes);
- }
- if (mode == MODE_CREATE && wr) {
- if (fflush(wr)) {
- perror("fflush");
- exit(1);
- }
- if (ferror(wr)) {
- stream_err(wr, "write");
+ } else {
+ r = _prepare_format(¶ms, data_device, flags | CRYPT_VERITY_NO_HEADER);
+ if (r < 0)
+ goto out;
+ r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms);
+ }
+ if (r < 0)
+ goto out;
+
+ hash_size = crypt_get_volume_key_size(cd);
+ hash_size_hex = 2 * hash_size;
+
+ if (!root_hash) {
+ root_hash_fd = open(ARG_STR(OPT_ROOT_HASH_FILE_ID), O_RDONLY);
+ if (root_hash_fd == -1) {
+ log_err(_("Cannot read root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
+ goto out;
}
- }
- crypt_hash_destroy(ctx);
- free(left_block);
- free(data_buffer);
- if (mode != MODE_CREATE)
- free(read_digest);
-}
-static char **make_target_line(void)
-{
- const int line_elements = 14;
- char **line = xmalloc(line_elements * sizeof(char *));
- int i = 0;
- char *algorithm_copy = xstrdup(hash_algorithm);
- /* transform ripemdXXX to rmdXXX */
- if (!strncmp(algorithm_copy, "ripemd", 6))
- memmove(algorithm_copy + 1, algorithm_copy + 4, strlen(algorithm_copy + 4) + 1);
- if (!strcmp(algorithm_copy, "whirlpool"))
- strcpy(algorithm_copy, "wp512");
- line[i++] = xstrdup("0");
- line[i++] = xprint((unsigned long long)data_file_blocks * data_block_size / 512);
- line[i++] = xstrdup("verity");
- line[i++] = xprint(version);
- line[i++] = xstrdup(data_device);
- line[i++] = xstrdup(hash_device);
- line[i++] = xprint(data_block_size);
- line[i++] = xprint(hash_block_size);
- line[i++] = xprint(data_file_blocks);
- line[i++] = xprint(hash_start * 512 / hash_block_size);
- line[i++] = algorithm_copy;
- line[i++] = xhexprint(calculated_digest, digest_size);
- line[i++] = !salt_size ? xstrdup("-") : xhexprint(salt_bytes, salt_size);
- line[i++] = NULL;
- if (i > line_elements)
- exit_err("INTERNAL ERROR: insufficient array size");
- return line;
-}
+ if (fstat(root_hash_fd, &st) || !S_ISREG(st.st_mode) || st.st_size < hash_size_hex) {
+ log_err(_("Invalid root hash file %s."), ARG_STR(OPT_ROOT_HASH_FILE_ID));
+ r = -EINVAL;
+ goto out;
+ }
-static void free_target_line(char **line)
-{
- int i;
- for (i = 0; line[i]; i++)
- free(line[i]);
- free(line);
-}
+ root_hash_from_file = malloc(hash_size_hex + 1);
+ if (!root_hash_from_file) {
+ r = -ENOMEM;
+ goto out;
+ }
-static void create_or_verify(void)
-{
- int i;
-
- memset(calculated_digest, 0, digest_size);
- if (mode != MODE_ACTIVATE)
- for (i = 0; i < levels; i++) {
- block_fseek(hash_file, hash_level_block[i], hash_block_size);
- if (!i) {
- block_fseek(data_file, 0, data_block_size);
- create_or_verify_stream(data_file, hash_file, data_block_size, data_file_blocks);
- } else {
- FILE *hash_file_2 = fopen(hash_device, "r");
- if (!hash_file_2) {
- perror(hash_device);
- exit(2);
- }
- block_fseek(hash_file_2, hash_level_block[i - 1], hash_block_size);
- create_or_verify_stream(hash_file_2, hash_file, hash_block_size, hash_level_size[i - 1]);
- fclose(hash_file_2);
- }
+ if (read_buffer(root_hash_fd, root_hash_from_file, hash_size_hex) != hash_size_hex) {
+ log_err(_("Cannot read root hash file %s."), root_hash_from_file);
+ goto out;
}
- if (levels) {
- block_fseek(hash_file, hash_level_block[levels - 1], hash_block_size);
- create_or_verify_stream(hash_file, NULL, hash_block_size, 1);
- } else {
- block_fseek(data_file, 0, data_block_size);
- create_or_verify_stream(data_file, NULL, data_block_size, data_file_blocks);
+ root_hash_from_file[hash_size_hex] = '\0';
+ root_hash = root_hash_from_file;
}
- if (mode != MODE_CREATE) {
- if (memcmp(calculated_digest, root_hash_bytes, digest_size)) {
- fprintf(stderr, "verification failed in the root block\n");
- retval = 1;
+ if (crypt_hex_to_bytes(root_hash, &root_hash_bytes, 0) != hash_size) {
+ log_err(_("Invalid root hash string specified."));
+ r = -EINVAL;
+ goto out;
+ }
+
+ if (ARG_SET(OPT_ROOT_HASH_SIGNATURE_ID)) {
+ // FIXME: check max file size
+ if (stat(ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID), &st) || !S_ISREG(st.st_mode) || !st.st_size) {
+ log_err(_("Invalid signature file %s."), ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID));
+ r = -EINVAL;
+ goto out;
}
- if (!retval && mode == MODE_VERIFY)
- fprintf(stderr, "hash successfully verified\n");
- } else {
- char **target_line;
- char *p;
- if (fsync(fileno(hash_file))) {
- perror("fsync");
- exit(1);
+ signature_size = st.st_size;
+ r = tools_read_vk(ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID), &signature, signature_size);
+ if (r < 0) {
+ log_err(_("Cannot read signature file %s."), ARG_STR(OPT_ROOT_HASH_SIGNATURE_ID));
+ goto out;
}
- printf("hash device size: %llu\n", (unsigned long long)used_hash_blocks * hash_block_size);
- printf("data block size %u, hash block size %u, %u tree levels\n", data_block_size, hash_block_size, levels);
- if (salt_size)
- p = xhexprint(salt_bytes, salt_size);
- else
- p = xstrdup("-");
- printf("salt: %s\n", p);
- free(p);
- p = xhexprint(calculated_digest, digest_size);
- printf("root hash: %s\n", p);
- free(p);
- printf("target line:");
- target_line = make_target_line();
- for (i = 0; target_line[i]; i++)
- printf(" %s", target_line[i]);
- free_target_line(target_line);
- printf("\n");
}
+ r = crypt_activate_by_signed_key(cd, dm_device,
+ root_hash_bytes,
+ hash_size,
+ signature, signature_size,
+ activate_flags);
+out:
+ crypt_safe_free(signature);
+ crypt_free(cd);
+ free(root_hash_from_file);
+ free(root_hash_bytes);
+ free(CONST_CAST(char*)params.salt);
+ if (root_hash_fd != -1)
+ close(root_hash_fd);
+ return r;
}
-__attribute__((__noreturn__))
-static void activate(void)
+static int action_open(void)
{
- int i;
- size_t len = 1;
- char *table_arg;
- char **target_line = make_target_line();
- for (i = 0; target_line[i]; i++) {
- if (i)
- len++;
- len += strlen(target_line[i]);
- }
- table_arg = xmalloc(len);
- table_arg[0] = 0;
- for (i = 0; target_line[i]; i++) {
- if (i)
- strcat(table_arg, " ");
- strcat(table_arg, target_line[i]);
+ if (action_argc < 4 && !ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
+ log_err(_("Command requires <root_hash> or --root-hash-file option as argument."));
+ return -EINVAL;
}
- free_target_line(target_line);
- execlp("dmsetup", "dmsetup", "-r", "create", dm_device, "--table", table_arg, NULL);
- perror("dmsetup");
- exit(2);
+
+ return _activate(action_argv[1],
+ action_argv[0],
+ action_argv[2],
+ ARG_SET(OPT_ROOT_HASH_FILE_ID) ? NULL : action_argv[3],
+ ARG_SET(OPT_ROOT_HASH_SIGNATURE_ID) ? CRYPT_VERITY_ROOT_HASH_SIGNATURE : 0);
}
-static void get_hex(const char *string, char **result, size_t len, const char *description)
+static int action_verify(void)
{
- size_t rl = strlen(string);
- unsigned u;
- if (strspn(string, "0123456789ABCDEFabcdef") != rl)
- exit_err("invalid %s", description);
- if (rl != len * 2)
- exit_err("invalid length of %s", description);
- *result = xmalloc(len);
- memset(*result, 0, len);
- for (u = 0; u < rl; u++) {
- unsigned char c = (string[u] & 15) + (string[u] > '9' ? 9 : 0);
- (*result)[u / 2] |= c << (((u & 1) ^ 1) << 2);
+ if (action_argc < 3 && !ARG_SET(OPT_ROOT_HASH_FILE_ID)) {
+ log_err(_("Command requires <root_hash> or --root-hash-file option as argument."));
+ return -EINVAL;
}
-}
-static struct superblock superblock;
+ return _activate(NULL,
+ action_argv[0],
+ action_argv[1],
+ ARG_SET(OPT_ROOT_HASH_FILE_ID) ? NULL : action_argv[2],
+ CRYPT_VERITY_CHECK_HASH);
+}
-static void load_superblock(void)
+static int action_close(void)
{
- long long sb_data_blocks;
-
- block_fseek(hash_file, superblock_position, 1);
- if (fread(&superblock, sizeof(struct superblock), 1, hash_file) != 1)
- stream_err(hash_file, "read");
- if (memcmp(superblock.signature, DM_VERITY_SIGNATURE, sizeof(superblock.signature)))
- exit_err("superblock not found on the hash device");
- if (superblock.version > MAX_FORMAT_VERSION)
- exit_err("unknown version");
- if (superblock.data_block_bits < 9 || superblock.data_block_bits >= 31)
- exit_err("invalid data_block_bits in the superblock");
- if (superblock.hash_block_bits < 9 || superblock.hash_block_bits >= 31)
- exit_err("invalid data_block_bits in the superblock");
- sb_data_blocks = ((unsigned long long)ntohl(superblock.data_blocks_hi) << 31 << 1) | ntohl(superblock.data_blocks_lo);
- if (sb_data_blocks < 0 || (off_t)sb_data_blocks < 0 || (off_t)sb_data_blocks != sb_data_blocks)
- exit_err("invalid data blocks in the superblock");
- if (!memchr(superblock.algorithm, 0, sizeof(superblock.algorithm)))
- exit_err("invalid hash algorithm in the superblock");
- if (ntohs(superblock.salt_size) > MAX_SALT_SIZE)
- exit_err("invalid salt_size in the superblock");
-
- if (version == -1) {
- version = superblock.version;
- } else {
- if (version != superblock.version)
- exit_err("version (%d) does not match superblock value (%d)", version, superblock.version);
- }
+ struct crypt_device *cd = NULL;
+ crypt_status_info ci;
+ uint32_t flags = 0;
+ int r;
- if (!data_block_size) {
- data_block_size = 1 << superblock.data_block_bits;
- } else {
- if (data_block_size != 1 << superblock.data_block_bits)
- exit_err("data block size (%d) does not match superblock value (%d)", data_block_size, 1 << superblock.data_block_bits);
- }
+ if (ARG_SET(OPT_DEFERRED_ID))
+ flags |= CRYPT_DEACTIVATE_DEFERRED;
+ if (ARG_SET(OPT_CANCEL_DEFERRED_ID))
+ flags |= CRYPT_DEACTIVATE_DEFERRED_CANCEL;
- if (!hash_block_size) {
- hash_block_size = 1 << superblock.hash_block_bits;
- } else {
- if (hash_block_size != 1 << superblock.hash_block_bits)
- exit_err("hash block size (%d) does not match superblock value (%d)", hash_block_size, 1 << superblock.hash_block_bits);
- }
+ r = crypt_init_by_name(&cd, action_argv[0]);
+ if (r == 0)
+ r = crypt_deactivate_by_name(cd, action_argv[0], flags);
- if (!data_blocks_string) {
- data_blocks = sb_data_blocks;
- data_blocks_string = (char *)"";
- } else {
- if (data_blocks != sb_data_blocks)
- exit_err("data blocks (%lld) does not match superblock value (%lld)", data_blocks, sb_data_blocks);
+ if (!r && ARG_SET(OPT_DEFERRED_ID)) {
+ ci = crypt_status(cd, action_argv[0]);
+ if (ci == CRYPT_ACTIVE || ci == CRYPT_BUSY)
+ log_std(_("Device %s is still active and scheduled for deferred removal.\n"),
+ action_argv[0]);
}
- if (!hash_algorithm) {
- hash_algorithm = (char *)superblock.algorithm;
- } else {
- if (strcmp(hash_algorithm, (char *)superblock.algorithm))
- exit_err("hash algorithm (%s) does not match superblock value (%s)", hash_algorithm, superblock.algorithm);
- }
-
- if (!salt_bytes) {
- salt_size = ntohs(superblock.salt_size);
- salt_bytes = xmalloc(salt_size);
- memcpy(salt_bytes, superblock.salt, salt_size);
- } else {
- if (salt_size != ntohs(superblock.salt_size) ||
- memcmp(salt_bytes, superblock.salt, salt_size))
- exit_err("salt does not match superblock value");
- }
+ crypt_free(cd);
+ return r;
}
-static void save_superblock(void)
+static int action_status(void)
{
- memset(&superblock, 0, sizeof(struct superblock));
-
- memcpy(&superblock.signature, DM_VERITY_SIGNATURE, sizeof(superblock.signature));
- superblock.version = version;
- superblock.data_block_bits = ffs(data_block_size) - 1;
- superblock.hash_block_bits = ffs(hash_block_size) - 1;
- superblock.salt_size = htons(salt_size);
- superblock.data_blocks_hi = htonl(data_file_blocks >> 31 >> 1);
- superblock.data_blocks_lo = htonl(data_file_blocks & 0xFFFFFFFF);
- strncpy((char *)superblock.algorithm, hash_algorithm, sizeof superblock.algorithm);
- memcpy(superblock.salt, salt_bytes, salt_size);
-
- block_fseek(hash_file, superblock_position, 1);
- if (fwrite(&superblock, sizeof(struct superblock), 1, hash_file) != 1)
- stream_err(hash_file, "write");
-}
-
-int main(int argc, const char **argv)
-{
- poptContext popt_context;
- int r;
- const char *s;
- char *end;
+ crypt_status_info ci;
+ struct crypt_active_device cad;
+ struct crypt_params_verity vp = {};
+ struct crypt_device *cd = NULL;
+ struct stat st;
+ char *backing_file, *root_hash;
+ size_t root_hash_size;
+ unsigned path = 0;
+ int r = 0;
+
+ /* perhaps a path, not a dm device name */
+ if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
+ path = 1;
+
+ ci = crypt_status(NULL, action_argv[0]);
+ switch (ci) {
+ case CRYPT_INVALID:
+ r = -EINVAL;
+ break;
+ case CRYPT_INACTIVE:
+ if (path)
+ log_std("%s is inactive.\n", action_argv[0]);
+ else
+ log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
+ r = -ENODEV;
+ break;
+ case CRYPT_ACTIVE:
+ case CRYPT_BUSY:
+ if (path)
+ log_std("%s is active%s.\n", action_argv[0],
+ ci == CRYPT_BUSY ? " and is in use" : "");
+ else
+ log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
+ ci == CRYPT_BUSY ? " and is in use" : "");
+
+ r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL);
+ if (r < 0)
+ goto out;
+
+ log_std(" type: %s\n", crypt_get_type(cd) ?: "n/a");
+
+ r = crypt_get_active_device(cd, action_argv[0], &cad);
+ if (r < 0)
+ goto out;
+
+ /* Print only VERITY type devices */
+ r = crypt_get_verity_info(cd, &vp);
+ if (r < 0)
+ goto out;
+
+ log_std(" status: %s%s\n",
+ cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified",
+ vp.flags & CRYPT_VERITY_ROOT_HASH_SIGNATURE ? " (with signature)" : "");
+
+ log_std(" hash type: %u\n", vp.hash_type);
+ log_std(" data block: %u\n", vp.data_block_size);
+ log_std(" hash block: %u\n", vp.hash_block_size);
+ log_std(" hash name: %s\n", vp.hash_name);
+ log_std(" salt: ");
+ if (vp.salt_size)
+ crypt_log_hex(NULL, vp.salt, vp.salt_size, "", 0, NULL);
+ else
+ log_std("-");
+ log_std("\n");
- if (sizeof(struct superblock) != 512)
- exit_err("INTERNAL ERROR: bad superblock size %ld", (long)sizeof(struct superblock));
+ log_std(" data device: %s\n", vp.data_device);
+ if ((backing_file = crypt_loop_backing_file(vp.data_device))) {
+ log_std(" data loop: %s\n", backing_file);
+ free(backing_file);
+ }
+ log_std(" size: %" PRIu64 " sectors\n", cad.size);
+ log_std(" mode: %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
+ "readonly" : "read/write");
+
+ log_std(" hash device: %s\n", vp.hash_device);
+ if ((backing_file = crypt_loop_backing_file(vp.hash_device))) {
+ log_std(" hash loop: %s\n", backing_file);
+ free(backing_file);
+ }
+ log_std(" hash offset: %" PRIu64 " sectors\n",
+ vp.hash_area_offset * vp.hash_block_size / 512);
+
+ if (vp.fec_device) {
+ log_std(" FEC device: %s\n", vp.fec_device);
+ if ((backing_file = crypt_loop_backing_file(ARG_STR(OPT_FEC_DEVICE_ID)))) {
+ log_std(" FEC loop: %s\n", backing_file);
+ free(backing_file);
+ }
+ log_std(" FEC offset: %" PRIu64 " sectors\n",
+ vp.fec_area_offset * vp.hash_block_size / 512);
+ log_std(" FEC roots: %u\n", vp.fec_roots);
+ }
- popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
+ root_hash_size = crypt_get_volume_key_size(cd);
+ if (root_hash_size > 0 && (root_hash = malloc(root_hash_size))) {
+ r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash, &root_hash_size, NULL, 0);
+ if (!r) {
+ log_std(" root hash: ");
+ crypt_log_hex(NULL, root_hash, root_hash_size, "", 0, NULL);
+ log_std("\n");
+ }
+ free(root_hash);
+ }
- poptSetOtherOptionHelp(popt_context, "[-c | -v | -a] [<device name> if activating] <data device> <hash device> [<root hash> if activating or verifying] [OPTION...]");
+ if (cad.flags & (CRYPT_ACTIVATE_IGNORE_CORRUPTION|
+ CRYPT_ACTIVATE_RESTART_ON_CORRUPTION|
+ CRYPT_ACTIVATE_PANIC_ON_CORRUPTION|
+ CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS|
+ CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE|
+ CRYPT_ACTIVATE_TASKLETS))
+ log_std(" flags: %s%s%s%s%s%s\n",
+ (cad.flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) ? "ignore_corruption " : "",
+ (cad.flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) ? "restart_on_corruption " : "",
+ (cad.flags & CRYPT_ACTIVATE_PANIC_ON_CORRUPTION) ? "panic_on_corruption " : "",
+ (cad.flags & CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS) ? "ignore_zero_blocks " : "",
+ (cad.flags & CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) ? "check_at_most_once" : "",
+ (cad.flags & CRYPT_ACTIVATE_TASKLETS) ? "try_verify_in_tasklet" : "");
+ }
+out:
+ crypt_free(cd);
+ if (r == -ENOTSUP)
+ r = 0;
+ return r;
+}
- if (argc <= 1) {
- poptPrintHelp(popt_context, stdout, 0);
- exit(1);
- }
+static int action_dump(void)
+{
+ struct crypt_device *cd = NULL;
+ struct crypt_params_verity params = {};
+ int r;
- r = poptGetNextOpt(popt_context);
- if (r < -1)
- exit_err("bad option %s", poptBadOption(popt_context, 0));
+ if ((r = crypt_init(&cd, action_argv[0])))
+ return r;
- if (mode < 0)
- exit_err("verify, create or activate mode not specified");
+ params.hash_area_offset = ARG_UINT64(OPT_HASH_OFFSET_ID);
+ params.fec_area_offset = ARG_UINT64(OPT_FEC_OFFSET_ID);
+ params.fec_device = ARG_STR(OPT_FEC_DEVICE_ID);
+ params.fec_roots = ARG_UINT32(OPT_FEC_ROOTS_ID);
- if (mode == MODE_ACTIVATE) {
- dm_device = poptGetArg(popt_context);
- if (!dm_device)
- exit_err("device name is missing");
- if (!*dm_device || strchr(dm_device, '/'))
- exit_err("invalid device name to activate");
- }
+ r = crypt_load(cd, CRYPT_VERITY, ¶ms);
+ if (!r)
+ crypt_dump(cd);
+ else
+ log_err(_("Device %s is not a valid VERITY device."), action_argv[0]);
- data_device = poptGetArg(popt_context);
- if (!data_device)
- exit_err("data device is missing");
+ crypt_free(cd);
+ return r;
+}
- hash_device = poptGetArg(popt_context);
- if (!hash_device)
- exit_err("metadata device is missing");
+static struct action_type {
+ const char *type;
+ int (*handler)(void);
+ int required_action_argc;
+ const char *arg_desc;
+ const char *desc;
+} action_types[] = {
+ { "format", action_format, 2, N_("<data_device> <hash_device>"),N_("format device") },
+ { "verify", action_verify, 2, N_("<data_device> <hash_device> [<root_hash>]"),N_("verify device") },
+ { "open", action_open, 3, N_("<data_device> <name> <hash_device> [<root_hash>]"),N_("open device as <name>") },
+ { "close", action_close, 1, N_("<name>"),N_("close device (remove mapping)") },
+ { "status", action_status, 1, N_("<name>"),N_("show active device status") },
+ { "dump", action_dump, 1, N_("<hash_device>"),N_("show on-disk information") },
+ { NULL, NULL, 0, NULL, NULL }
+};
- if (mode != MODE_CREATE) {
- root_hash = poptGetArg(popt_context);
- if (!root_hash)
- exit_err("root hash not specified");
- }
+static void help(poptContext popt_context,
+ enum poptCallbackReason reason __attribute__((unused)),
+ struct poptOption *key,
+ const char *arg __attribute__((unused)),
+ void *data __attribute__((unused)))
+{
+ struct action_type *action;
- s = poptGetArg(popt_context);
- if (s)
- exit_err("extra argument %s", s);
+ if (key->shortName == '?') {
+ tools_package_version(PACKAGE_VERITY, false);
+ poptPrintHelp(popt_context, stdout, 0);
+ log_std(_("\n"
+ "<action> is one of:\n"));
+ for(action = action_types; action->type; action++)
+ log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
+ log_std(_("\n"
+ "<name> is the device to create under %s\n"
+ "<data_device> is the data device\n"
+ "<hash_device> is the device containing verification data\n"
+ "<root_hash> hash of the root node on <hash_device>\n"),
+ crypt_get_dir());
+
+ log_std(_("\nDefault compiled-in dm-verity parameters:\n"
+ "\tHash: %s, Data block (bytes): %u, "
+ "Hash block (bytes): %u, Salt size: %u, Hash format: %u\n"),
+ DEFAULT_VERITY_HASH, DEFAULT_VERITY_DATA_BLOCK,
+ DEFAULT_VERITY_HASH_BLOCK, DEFAULT_VERITY_SALT_SIZE,
+ 1);
+ tools_cleanup();
+ poptFreeContext(popt_context);
+ exit(EXIT_SUCCESS);
+ } else if (key->shortName == 'V') {
+ tools_package_version(PACKAGE_VERITY, false);
+ tools_cleanup();
+ poptFreeContext(popt_context);
+ exit(EXIT_SUCCESS);
+ } else
+ usage(popt_context, EXIT_SUCCESS, NULL, NULL);
+}
- data_file = fopen(data_device, "r");
- if (!data_file) {
- perror(data_device);
- exit(2);
- }
+static int run_action(struct action_type *action)
+{
+ int r;
- hash_file = fopen(hash_device, mode != MODE_CREATE ? "r" : "r+");
- if (!hash_file && errno == ENOENT && mode == MODE_CREATE)
- hash_file = fopen(hash_device, "w+");
- if (!hash_file) {
- perror(hash_device);
- exit(2);
- }
+ log_dbg("Running command %s.", action->type);
- if (data_blocks_string) {
- data_blocks = strtoll(data_blocks_string, &end, 10);
- if (!*data_blocks_string || *end)
- exit_err("invalid number of data blocks");
- }
+ r = action->handler();
- if (hash_start_string) {
- hash_start = strtoll(hash_start_string, &end, 10);
- if (!*hash_start_string || *end)
- exit_err("invalid hash start");
- }
+ show_status(r);
+ return translate_errno(r);
+}
- if (hash_start < 0 ||
- (unsigned long long)hash_start * 512 / 512 != hash_start ||
- (off_t)(hash_start * 512) < 0 ||
- (off_t)(hash_start * 512) != hash_start * 512) exit_err("invalid hash start");
-
- if (salt_string || !use_superblock) {
- if (!salt_string || !strcmp(salt_string, "-"))
- salt_string = "";
- salt_size = strlen(salt_string) / 2;
- if (salt_size > MAX_SALT_SIZE)
- exit_err("too long salt (max %d bytes)", MAX_SALT_SIZE);
- get_hex(salt_string, &salt_bytes, salt_size, "salt");
- }
+static void basic_options_cb(poptContext popt_context,
+ enum poptCallbackReason reason __attribute__((unused)),
+ struct poptOption *key,
+ const char *arg,
+ void *data __attribute__((unused)))
+{
+ tools_parse_arg_value(popt_context, tool_core_args[key->val].type, tool_core_args + key->val, arg, key->val, NULL);
- if (use_superblock) {
- superblock_position = hash_start * 512;
- if (mode != MODE_CREATE)
- load_superblock();
+ switch (key->val) {
+ case OPT_DEBUG_ID:
+ log_parms.debug = true;
+ /* fall through */
+ case OPT_VERBOSE_ID:
+ log_parms.verbose = true;
}
+}
- if (version == -1)
- version = MAX_FORMAT_VERSION;
- if (version < 0 || version > MAX_FORMAT_VERSION)
- exit_err("invalid format version");
-
- if (!data_block_size)
- data_block_size = DEFAULT_BLOCK_SIZE;
- if (!hash_block_size)
- hash_block_size = data_block_size;
+int main(int argc, const char **argv)
+{
+ static const char *null_action_argv[] = {NULL};
+ static struct poptOption popt_help_options[] = {
+ { NULL, '\0', POPT_ARG_CALLBACK, help, 0, NULL, NULL },
+ { "help", '?', POPT_ARG_NONE, NULL, 0, N_("Show this help message"), NULL },
+ { "usage", '\0', POPT_ARG_NONE, NULL, 0, N_("Display brief usage"), NULL },
+ { "version",'V', POPT_ARG_NONE, NULL, 0, N_("Print package version"), NULL },
+ POPT_TABLEEND
+ };
+ static struct poptOption popt_basic_options[] = {
+ { NULL, '\0', POPT_ARG_CALLBACK, basic_options_cb, 0, NULL, NULL },
+#define ARG(A, B, C, D, E, F, G, H) { A, B, C, NULL, A ## _ID, D, E },
+#include "veritysetup_arg_list.h"
+#undef ARG
+ POPT_TABLEEND
+ };
+ static struct poptOption popt_options[] = {
+ { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
+ { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_basic_options, 0, NULL, NULL },
+ POPT_TABLEEND
+ };
- if (data_block_size < 512 || (data_block_size & (data_block_size - 1)) || data_block_size >= 1U << 31)
- exit_err("invalid data block size");
+ poptContext popt_context;
+ struct action_type *action;
+ const char *aname;
+ int r;
- if (hash_block_size < 512 || (hash_block_size & (hash_block_size - 1)) || hash_block_size >= 1U << 31)
- exit_err("invalid hash block size");
+ crypt_set_log_callback(NULL, tool_log, &log_parms);
- if (data_blocks < 0 || (off_t)data_blocks < 0 || (off_t)data_blocks != data_blocks)
- exit_err("invalid number of data blocks");
+ setlocale(LC_ALL, "");
+ bindtextdomain(PACKAGE, LOCALEDIR);
+ textdomain(PACKAGE);
- data_file_blocks = get_size(data_file, data_device) / data_block_size;
- hash_file_blocks = get_size(hash_file, hash_device) / hash_block_size;
+ popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
+ poptSetOtherOptionHelp(popt_context,
+ _("[OPTION...] <action> <action-specific>"));
- if (data_file_blocks < data_blocks)
- exit_err("data file is too small");
- if (data_blocks_string)
- data_file_blocks = data_blocks;
+ while((r = poptGetNextOpt(popt_context)) > 0) {}
- if (use_superblock) {
- hash_start = hash_start + (sizeof(struct superblock) + 511) / 512;
- hash_start = (hash_start + (hash_block_size / 512 - 1)) & ~(long long)(hash_block_size / 512 - 1);
+ if (r < -1)
+ usage(popt_context, EXIT_FAILURE, poptStrerror(r),
+ poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
+
+ if (!(aname = poptGetArg(popt_context)))
+ usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
+ poptGetInvocationName(popt_context));
+
+ action_argc = 0;
+ action_argv = poptGetArgs(popt_context);
+ /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
+ if(!action_argv)
+ action_argv = null_action_argv;
+
+ /* Count args, somewhat unnice, change? */
+ while(action_argv[action_argc] != NULL)
+ action_argc++;
+
+ /* Handle aliases */
+ if (!strcmp(aname, "create") && action_argc > 1) {
+ /* create command had historically switched arguments */
+ if (action_argv[0] && action_argv[1]) {
+ const char *tmp = action_argv[0];
+ action_argv[0] = action_argv[1];
+ action_argv[1] = tmp;
+ }
+ aname = "open";
+ } else if (!strcmp(aname, "remove")) {
+ aname = "close";
}
- if ((unsigned long long)hash_start * 512 % hash_block_size)
- exit_err("hash start not aligned on block size");
-
- if (!hash_algorithm)
- hash_algorithm = "sha256";
- if (strlen(hash_algorithm) >= sizeof(superblock.algorithm) && use_superblock)
- exit_err("hash algorithm name is too long");
-
- if (crypt_backend_init(NULL))
- exit_err("cannot initialize crypto backend");
+ for (action = action_types; action->type; action++)
+ if (strcmp(action->type, aname) == 0)
+ break;
- digest_size = crypt_hash_size(hash_algorithm);
- if (!digest_size) exit_err("hash algorithm %s not found", hash_algorithm);
+ if (!action->type)
+ usage(popt_context, EXIT_FAILURE, _("Unknown action."),
+ poptGetInvocationName(popt_context));
- if (!salt_bytes) {
- salt_size = DEFAULT_SALT_SIZE;
- salt_bytes = xmalloc(salt_size);
- if (crypt_backend_rng(salt_bytes, salt_size, CRYPT_RND_SALT, 0))
- exit_err("rng failed");
+ if (action_argc < action->required_action_argc) {
+ char buf[128];
+ if (snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc) < 0)
+ buf[0] = '\0';
+ usage(popt_context, EXIT_FAILURE, buf,
+ poptGetInvocationName(popt_context));
}
- calculated_digest = xmalloc(digest_size);
+ tools_check_args(action->type, tool_core_args, ARRAY_SIZE(tool_core_args), popt_context);
- if (mode != MODE_CREATE) {
- get_hex(root_hash, &root_hash_bytes, digest_size, "root_hash");
- }
+ if (ARG_SET(OPT_IGNORE_CORRUPTION_ID) && ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
+ usage(popt_context, EXIT_FAILURE,
+ _("Option --ignore-corruption and --restart-on-corruption cannot be used together."),
+ poptGetInvocationName(popt_context));
- calculate_positions();
+ if (ARG_SET(OPT_PANIC_ON_CORRUPTION_ID) && ARG_SET(OPT_RESTART_ON_CORRUPTION_ID))
+ usage(popt_context, EXIT_FAILURE,
+ _("Option --panic-on-corruption and --restart-on-corruption cannot be used together."),
+ poptGetInvocationName(popt_context));
- create_or_verify();
+ if (ARG_SET(OPT_CANCEL_DEFERRED_ID) && ARG_SET(OPT_DEFERRED_ID))
+ usage(popt_context, EXIT_FAILURE,
+ _("Options --cancel-deferred and --deferred cannot be used at the same time."),
+ poptGetInvocationName(popt_context));
- if (use_superblock) {
- if (mode == MODE_CREATE)
- save_superblock();
+ if (ARG_SET(OPT_DEBUG_ID)) {
+ crypt_set_debug_level(CRYPT_DEBUG_ALL);
+ dbg_version_and_cmd(argc, argv);
}
- fclose(data_file);
- fclose(hash_file);
-
- if (mode == MODE_ACTIVATE && !retval)
- activate();
-
- free(salt_bytes);
- free(calculated_digest);
- if (mode != MODE_CREATE)
- free(root_hash_bytes);
+ r = run_action(action);
+ tools_cleanup();
poptFreeContext(popt_context);
-
- return retval;
+ return r;
}