X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=src%2Fveritysetup.c;h=7de039b106b1aae420b2e247de8947f6aecd7163;hb=0d70651c5a17c6856287838bf81159fa91800865;hp=ee331be06c198a0de9f5fbbf048022718bb9dc56;hpb=f4101d0f8bd8c1ed360b9d09ac49e4ba5c9ddf10;p=platform%2Fupstream%2Fcryptsetup.git diff --git a/src/veritysetup.c b/src/veritysetup.c index ee331be..7de039b 100644 --- a/src/veritysetup.c +++ b/src/veritysetup.c @@ -17,35 +17,31 @@ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. */ -/* TODO: - * - support device without superblock - * - extend superblock (UUID) - * - add api tests - * - salt string "-" - * - man page - */ - #include #include #include #include #include +#include +#include #include #include +#include #include "cryptsetup.h" #define PACKAGE_VERITY "veritysetup" -static int use_superblock = 1; /* FIXME: no superblock not supported */ +static int use_superblock = 1; static const char *hash_algorithm = NULL; -static int version = 1; +static int hash_type = 1; static int data_block_size = DEFAULT_VERITY_DATA_BLOCK; static int hash_block_size = DEFAULT_VERITY_HASH_BLOCK; static uint64_t data_blocks = 0; static const char *salt_string = NULL; -static uint64_t hash_start = 0; +static uint64_t hash_offset = 0; +static const char *opt_uuid = NULL; static int opt_verbose = 0; static int opt_debug = 0; @@ -54,18 +50,28 @@ static int opt_version_mode = 0; static const char **action_argv; static int action_argc; -static int hex_to_bytes(const char *hex, char *result) +static size_t hex_to_bytes(const char *hex, char **result) { - char buf[3] = "xx\0", *endp; - int i, len; + char buf[3] = "xx\0", *endp, *bytes; + size_t i, len; + + len = strlen(hex); + if (len % 2) + return -EINVAL; + len /= 2; + + if (!(bytes = malloc(len))) + return -ENOMEM; - len = strlen(hex) / 2; for (i = 0; i < len; i++) { memcpy(buf, &hex[i * 2], 2); - result[i] = strtoul(buf, &endp, 16); - if (endp != &buf[2]) + bytes[i] = strtoul(buf, &endp, 16); + if (endp != &buf[2]) { + free(bytes); return -EINVAL; + } } + *result = bytes; return i; } @@ -118,43 +124,65 @@ static void _log(int level, const char *msg, void *usrptr __attribute__((unused) } } +static int _prepare_format(struct crypt_params_verity *params, + const char *data_device, + uint32_t flags) +{ + char *salt = NULL; + int len; + + params->hash_name = hash_algorithm ?: DEFAULT_VERITY_HASH; + params->data_device = data_device; + + if (salt_string && !strcmp(salt_string, "-")) { + params->salt_size = 0; + params->salt = NULL; + } else if (salt_string) { + len = hex_to_bytes(salt_string, &salt); + if (len < 0) { + log_err(_("Invalid salt string specified.\n")); + return -EINVAL; + } + params->salt_size = len; + params->salt = salt; + } else { + params->salt_size = DEFAULT_VERITY_SALT_SIZE; + params->salt = NULL; + } + + params->data_block_size = data_block_size; + params->hash_block_size = hash_block_size; + params->data_size = data_blocks; + params->hash_area_offset = hash_offset; + params->hash_type = hash_type; + params->flags = flags; + + return 0; +} + static int action_format(int arg) { struct crypt_device *cd = NULL; struct crypt_params_verity params = {}; - char salt_bytes[512]; + uint32_t flags = CRYPT_VERITY_CREATE_HASH; int r; if ((r = crypt_init(&cd, action_argv[1]))) goto out; - params.hash_name = hash_algorithm ?: DEFAULT_VERITY_HASH; - params.data_device = action_argv[0]; - - if (salt_string) { - params.salt_size = strlen(salt_string) / 2; - if (hex_to_bytes(salt_string, salt_bytes) != params.salt_size) { - r = -EINVAL; - goto out; - } - params.salt = salt_bytes; - } else - params.salt_size = DEFAULT_VERITY_SALT_SIZE; - - params.data_block_size = data_block_size; - params.hash_block_size = hash_block_size; - params.data_size = data_blocks; - params.hash_area_offset = hash_start; - params.version = version; - params.flags = CRYPT_VERITY_CREATE_HASH; if (!use_superblock) - params.flags |= CRYPT_VERITY_NO_HEADER; + flags |= CRYPT_VERITY_NO_HEADER; + + r = _prepare_format(¶ms, action_argv[0], flags); + if (r < 0) + goto out; - r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms); + r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, opt_uuid, NULL, 0, ¶ms); if (!r) crypt_dump(cd); out: crypt_free(cd); + free((char*)params.salt); return r; } @@ -167,31 +195,22 @@ static int _activate(const char *dm_device, struct crypt_device *cd = NULL; struct crypt_params_verity params = {}; uint32_t activate_flags = CRYPT_ACTIVATE_READONLY; - char root_hash_bytes[128]; + char *root_hash_bytes = NULL; + size_t hash_size; int r; if ((r = crypt_init(&cd, hash_device))) goto out; - params.flags |= flags; - if (use_superblock) { - params.hash_area_offset = hash_start; - r = crypt_load(cd, CRYPT_VERITY, ¶ms); - } else {/* - params.hash_name = hash_algorithm; - params.salt = salt_bytes; - params.salt_size = salt_size; - params.data_block_size = data_block_size; - params.hash_block_size = hash_block_size; - - params.data_size = data_blocks * data_block_size / 512; - params.version = version; - params.flags |= CRYPT_VERITY_NO_HEADER; + params.flags = flags; + params.hash_area_offset = hash_offset; r = crypt_load(cd, CRYPT_VERITY, ¶ms); - crypt_format(); */ - r = -EINVAL; - goto out; + } else { + r = _prepare_format(¶ms, data_device, flags | CRYPT_VERITY_NO_HEADER); + if (r < 0) + goto out; + r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms); } if (r < 0) goto out; @@ -199,19 +218,20 @@ static int _activate(const char *dm_device, if (r < 0) goto out; - if (hex_to_bytes(root_hash, root_hash_bytes) != - crypt_get_volume_key_size(cd)) { + hash_size = crypt_get_volume_key_size(cd); + if (hex_to_bytes(root_hash, &root_hash_bytes) != hash_size) { + log_err(_("Invalid root hash string specified.\n")); r = -EINVAL; goto out; } r = crypt_activate_by_volume_key(cd, dm_device, root_hash_bytes, - crypt_get_volume_key_size(cd), + hash_size, activate_flags); out: - if (!r) - crypt_dump(cd); crypt_free(cd); + free(root_hash_bytes); + free((char*)params.salt); return r; } @@ -247,13 +267,92 @@ static int action_remove(int arg) static int action_status(int arg) { + crypt_status_info ci; + struct crypt_active_device cad; + struct crypt_params_verity vp = {}; struct crypt_device *cd = NULL; - int r; + struct stat st; + char *backing_file; + unsigned i, path = 0; + int r = 0; + + /* perhaps a path, not a dm device name */ + if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st)) + path = 1; + + ci = crypt_status(NULL, action_argv[0]); + switch (ci) { + case CRYPT_INVALID: + r = -EINVAL; + break; + case CRYPT_INACTIVE: + if (path) + log_std("%s is inactive.\n", action_argv[0]); + else + log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]); + r = -ENODEV; + break; + case CRYPT_ACTIVE: + case CRYPT_BUSY: + if (path) + log_std("%s is active%s.\n", action_argv[0], + ci == CRYPT_BUSY ? " and is in use" : ""); + else + log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0], + ci == CRYPT_BUSY ? " and is in use" : ""); + + r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL); + if (r < 0 || !crypt_get_type(cd)) + goto out; - r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL); - if (!r) - r = crypt_dump(cd); + log_std(" type: %s\n", crypt_get_type(cd)); + + r = crypt_get_active_device(cd, action_argv[0], &cad); + if (r < 0) + goto out; + + log_std(" status: %s\n", + cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified"); + + r = crypt_get_verity_info(cd, &vp); + if (r < 0) + goto out; + + log_std(" hash type: %u\n", vp.hash_type); + log_std(" data block: %u\n", vp.data_block_size); + log_std(" hash block: %u\n", vp.hash_block_size); + log_std(" hash name: %s\n", vp.hash_name); + log_std(" salt: "); + if (vp.salt_size) + for(i = 0; i < vp.salt_size; i++) + log_std("%02hhx", (const char)vp.salt[i]); + else + log_std("-"); + log_std("\n"); + + log_std(" data device: %s\n", vp.data_device); + if (crypt_loop_device(vp.data_device)) { + backing_file = crypt_loop_backing_file(vp.data_device); + log_std(" data loop: %s\n", backing_file); + free(backing_file); + } + log_std(" size: %" PRIu64 " sectors\n", cad.size); + log_std(" mode: %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ? + "readonly" : "read/write"); + + log_std(" hash device: %s\n", vp.hash_device); + if (crypt_loop_device(vp.hash_device)) { + backing_file = crypt_loop_backing_file(vp.hash_device); + log_std(" hash loop: %s\n", backing_file); + free(backing_file); + } + log_std(" hash offset: %" PRIu64 " sectors\n", + vp.hash_area_offset * vp.hash_block_size / 512); + } +out: crypt_free(cd); + if (r == -ENOTSUP) + r = 0; return r; } @@ -266,7 +365,7 @@ static int action_dump(int arg) if ((r = crypt_init(&cd, action_argv[0]))) return r; - params.hash_area_offset = hash_start; + params.hash_area_offset = hash_offset; r = crypt_load(cd, CRYPT_VERITY, ¶ms); if (!r) crypt_dump(cd); @@ -406,6 +505,7 @@ static int run_action(struct action_type *action) int main(int argc, const char **argv) { static char *popt_tmp; + static const char *null_action_argv[] = {NULL}; static struct poptOption popt_help_options[] = { { NULL, '\0', POPT_ARG_CALLBACK, help, 0, NULL, NULL }, { "help", '?', POPT_ARG_NONE, NULL, 0, N_("Show this help message"), NULL }, @@ -418,19 +518,20 @@ int main(int argc, const char **argv) { "verbose", 'v', POPT_ARG_NONE, &opt_verbose, 0, N_("Shows more detailed error messages"), NULL }, { "debug", '\0', POPT_ARG_NONE, &opt_debug, 0, N_("Show debug messages"), NULL }, { "no-superblock", 0, POPT_ARG_VAL, &use_superblock, 0, N_("Do not use verity superblock"), NULL }, - { "format", 0, POPT_ARG_INT, &version, 0, N_("Format type (1 - normal, 0 - original Chromium OS)"), N_("number") }, + { "format", 0, POPT_ARG_INT, &hash_type, 0, N_("Format type (1 - normal, 0 - original Chrome OS)"), N_("number") }, { "data-block-size", 0, POPT_ARG_INT, &data_block_size, 0, N_("Block size on the data device"), N_("bytes") }, { "hash-block-size", 0, POPT_ARG_INT, &hash_block_size, 0, N_("Block size on the hash device"), N_("bytes") }, { "data-blocks", 0, POPT_ARG_STRING, &popt_tmp, 1, N_("The number of blocks in the data file"), N_("blocks") }, - { "hash-start", 0, POPT_ARG_STRING, &popt_tmp, 2, N_("Starting block on the hash device"), N_("512-byte sectors") }, - { "algorithm", 'h', POPT_ARG_STRING, &hash_algorithm, 0, N_("Hash algorithm"), N_("string") }, + { "hash-offset", 0, POPT_ARG_STRING, &popt_tmp, 2, N_("Starting offset on the hash device"), N_("bytes") }, + { "hash", 'h', POPT_ARG_STRING, &hash_algorithm, 0, N_("Hash algorithm"), N_("string") }, { "salt", 's', POPT_ARG_STRING, &salt_string, 0, N_("Salt"), N_("hex string") }, + { "uuid", '\0', POPT_ARG_STRING, &opt_uuid, 0, N_("UUID for device to use."), NULL }, POPT_TABLEEND }; poptContext popt_context; struct action_type *action; - const char *aname, *null_action_argv[] = {NULL}; + const char *aname; int r; crypt_set_log_callback(NULL, _log, NULL); @@ -448,8 +549,8 @@ int main(int argc, const char **argv) char *endp; errno = 0; - ull_value = strtoull(popt_tmp, &endp, 0); - if (*endp || !*popt_tmp || + ull_value = strtoull(popt_tmp, &endp, 10); + if (*endp || !*popt_tmp || !isdigit(*popt_tmp) || (errno == ERANGE && ull_value == ULLONG_MAX) || (errno != 0 && ull_value == 0)) r = POPT_ERROR_BADNUMBER; @@ -459,7 +560,7 @@ int main(int argc, const char **argv) data_blocks = ull_value; break; case 2: - hash_start = ull_value * 512; + hash_offset = ull_value; break; } @@ -504,6 +605,12 @@ int main(int argc, const char **argv) poptGetInvocationName(popt_context)); } + if (data_block_size < 0 || hash_block_size < 0 || hash_type < 0) { + usage(popt_context, EXIT_FAILURE, + _("Negative number for option not permitted."), + poptGetInvocationName(popt_context)); + } + if (opt_debug) { opt_verbose = 1; crypt_set_debug_level(-1);