X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=src%2Fveritysetup.c;h=8f45be4c18eecc65be19db84124f8da1ffe62a92;hb=a3777a6b2cde2c7133141474dd4c428220a3e9cc;hp=2ad27c44f18b8978e7778fa8b6b4d529167ccf0a;hpb=ab0f7346bca4a654a0dff747b5322db846a0eeb3;p=platform%2Fupstream%2Fcryptsetup.git

diff --git a/src/veritysetup.c b/src/veritysetup.c
index 2ad27c4..8f45be4 100644
--- a/src/veritysetup.c
+++ b/src/veritysetup.c
@@ -1,11 +1,13 @@
 /*
  * veritysetup - setup cryptographic volumes for dm-verity
  *
- * Copyright (C) 2012, Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2013, Red Hat, Inc. All rights reserved.
+ * Copyright (C) 2012-2013, Milan Broz
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
- * version 2 as published by the Free Software Foundation.
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -17,167 +19,123 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-/* TODO:
- * - init_by_name()
- * - support device without superblock
- * - audit alloc errors / error path
- * - change command names (cryptsetup style)
- * - extend superblock (UUID)
- * - warn if block_size > PAGE_SIZE
- * - configure.in/config.h defaults
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <errno.h>
-#include <string.h>
-#include <popt.h>
-
 #include "cryptsetup.h"
 
 #define PACKAGE_VERITY "veritysetup"
 
-#define MODE_VERIFY	0
-#define MODE_CREATE	1
-#define MODE_ACTIVATE	2
-#define MODE_DUMP	3
-
-static int mode = -1;
-static int use_superblock = 1; /* FIXME: no superblock not supported */
+static int use_superblock = 1;
 
-static const char *dm_device = NULL;
-static const char *data_device = NULL;
-static const char *hash_device = NULL;
 static const char *hash_algorithm = NULL;
-static const char *root_hash = NULL;
-
-static int version = 1;
-static int data_block_size = 4096;
-static int hash_block_size = 4096;
-static char *data_blocks_string = NULL;
+static int hash_type = 1;
+static int data_block_size = DEFAULT_VERITY_DATA_BLOCK;
+static int hash_block_size = DEFAULT_VERITY_HASH_BLOCK;
 static uint64_t data_blocks = 0;
-static char *hash_start_string = NULL;
 static const char *salt_string = NULL;
-static unsigned salt_size = 32;
-static uint64_t hash_start = 0;
+static uint64_t hash_offset = 0;
+static const char *opt_uuid = NULL;
 
-static int opt_verbose = 0;
-static int opt_debug = 0;
 static int opt_version_mode = 0;
 
-static int hex_to_bytes(const char *hex, char *result)
+static const char **action_argv;
+static int action_argc;
+
+static int _prepare_format(struct crypt_params_verity *params,
+			   const char *data_device,
+			   uint32_t flags)
 {
-	char buf[3] = "xx\0", *endp;
-	int i, len;
-
-	len = strlen(hex) / 2;
-	for (i = 0; i < len; i++) {
-		memcpy(buf, &hex[i * 2], 2);
-		result[i] = strtoul(buf, &endp, 16);
-		if (endp != &buf[2])
+	char *salt = NULL;
+	int len;
+
+	params->hash_name = hash_algorithm ?: DEFAULT_VERITY_HASH;
+	params->data_device = data_device;
+
+	if (salt_string && !strcmp(salt_string, "-")) {
+		params->salt_size = 0;
+		params->salt = NULL;
+	} else if (salt_string) {
+		len = crypt_hex_to_bytes(salt_string, &salt, 0);
+		if (len < 0) {
+			log_err(_("Invalid salt string specified.\n"));
 			return -EINVAL;
+		}
+		params->salt_size = len;
+		params->salt = salt;
+	} else {
+		params->salt_size = DEFAULT_VERITY_SALT_SIZE;
+		params->salt = NULL;
 	}
-	return i;
-}
 
-__attribute__((format(printf, 5, 6)))
-static void clogger(struct crypt_device *cd, int level, const char *file,
-		   int line, const char *format, ...)
-{
-	va_list argp;
-	char *target = NULL;
-
-	va_start(argp, format);
-
-	if (vasprintf(&target, format, argp) > 0) {
-		if (level >= 0) {
-			crypt_log(cd, level, target);
-#ifdef CRYPT_DEBUG
-		} else if (opt_debug)
-			printf("# %s:%d %s\n", file ?: "?", line, target);
-#else
-		} else if (opt_debug)
-			printf("# %s\n", target);
-#endif
-	}
+	params->data_block_size = data_block_size;
+	params->hash_block_size = hash_block_size;
+	params->data_size = data_blocks;
+	params->hash_area_offset = hash_offset;
+	params->hash_type = hash_type;
+	params->flags = flags;
 
-	va_end(argp);
-	free(target);
+	return 0;
 }
 
-static void _log(int level, const char *msg, void *usrptr __attribute__((unused)))
-{
-	switch(level) {
-
-	case CRYPT_LOG_NORMAL:
-		fputs(msg, stdout);
-		break;
-	case CRYPT_LOG_VERBOSE:
-		if (opt_verbose)
-			fputs(msg, stdout);
-		break;
-	case CRYPT_LOG_ERROR:
-		fputs(msg, stderr);
-		break;
-	case CRYPT_LOG_DEBUG:
-		if (opt_debug)
-			printf("# %s\n", msg);
-		break;
-	default:
-		fprintf(stderr, "Internal error on logging class for msg: %s", msg);
-		break;
-	}
-}
-
-static int action_dump(void)
+static int action_format(int arg)
 {
 	struct crypt_device *cd = NULL;
 	struct crypt_params_verity params = {};
+	uint32_t flags = CRYPT_VERITY_CREATE_HASH;
 	int r;
 
-	if ((r = crypt_init(&cd, hash_device)))
-		return r;
+	/* Try to create hash image if doesn't exist */
+	r = open(action_argv[1], O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
+	if (r < 0 && errno != EEXIST) {
+		log_err(_("Cannot create hash image %s for writing.\n"), action_argv[1]);
+		return -EINVAL;
+	} else if (r >= 0) {
+		log_dbg("Created hash image %s.", action_argv[1]);
+		close(r);
+	}
 
-	params.hash_area_offset = hash_start;
-	r = crypt_load(cd, CRYPT_VERITY, &params);
+	if ((r = crypt_init(&cd, action_argv[1])))
+		goto out;
+
+	if (!use_superblock)
+		flags |= CRYPT_VERITY_NO_HEADER;
+
+	r = _prepare_format(&params, action_argv[0], flags);
+	if (r < 0)
+		goto out;
+
+	r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, opt_uuid, NULL, 0, &params);
 	if (!r)
 		crypt_dump(cd);
+out:
 	crypt_free(cd);
+	free(CONST_CAST(char*)params.salt);
 	return r;
 }
 
-static int action_activate(int verify)
+static int _activate(const char *dm_device,
+		      const char *data_device,
+		      const char *hash_device,
+		      const char *root_hash,
+		      uint32_t flags)
 {
 	struct crypt_device *cd = NULL;
 	struct crypt_params_verity params = {};
 	uint32_t activate_flags = CRYPT_ACTIVATE_READONLY;
-	char root_hash_bytes[128];
+	char *root_hash_bytes = NULL;
+	ssize_t hash_size;
 	int r;
 
 	if ((r = crypt_init(&cd, hash_device)))
 		goto out;
 
-	if (verify)
-		params.flags |= CRYPT_VERITY_CHECK_HASH;
-
 	if (use_superblock) {
-		params.hash_area_offset = hash_start;
-		r = crypt_load(cd, CRYPT_VERITY, &params);
-	} else {/*
-		params.hash_name = hash_algorithm;
-		params.salt = salt_bytes;
-		params.salt_size = salt_size;
-		params.data_block_size = data_block_size;
-		params.hash_block_size = hash_block_size;
-
-		params.data_size = data_blocks * data_block_size / 512;
-		params.version = version;
-		params.flags |= CRYPT_VERITY_NO_HEADER;
+		params.flags = flags;
+		params.hash_area_offset = hash_offset;
 		r = crypt_load(cd, CRYPT_VERITY, &params);
-		crypt_format(); */
-		r = -EINVAL;
-		goto out;
+	} else {
+		r = _prepare_format(&params, data_device, flags | CRYPT_VERITY_NO_HEADER);
+		if (r < 0)
+			goto out;
+		r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, &params);
 	}
 	if (r < 0)
 		goto out;
@@ -185,70 +143,176 @@ static int action_activate(int verify)
 	if (r < 0)
 		goto out;
 
-	if (hex_to_bytes(root_hash, root_hash_bytes) !=
-	    crypt_get_volume_key_size(cd)) {
+	hash_size = crypt_get_volume_key_size(cd);
+	if (crypt_hex_to_bytes(root_hash, &root_hash_bytes, 0) != hash_size) {
+		log_err(_("Invalid root hash string specified.\n"));
 		r = -EINVAL;
 		goto out;
 	}
-	r = crypt_activate_by_volume_key(cd, dm_device, root_hash_bytes,
-					 crypt_get_volume_key_size(cd),
+	r = crypt_activate_by_volume_key(cd, dm_device,
+					 root_hash_bytes,
+					 hash_size,
 					 activate_flags);
 out:
-	if (!r)
-		crypt_dump(cd);
 	crypt_free(cd);
+	free(root_hash_bytes);
+	free(CONST_CAST(char*)params.salt);
 	return r;
 }
 
-static int action_create(void)
+static int action_create(int arg)
+{
+	return _activate(action_argv[0],
+			 action_argv[1],
+			 action_argv[2],
+			 action_argv[3], 0);
+}
+
+static int action_verify(int arg)
+{
+	return _activate(NULL,
+			 action_argv[0],
+			 action_argv[1],
+			 action_argv[2],
+			 CRYPT_VERITY_CHECK_HASH);
+}
+
+static int action_remove(int arg)
 {
 	struct crypt_device *cd = NULL;
-	struct crypt_params_verity params = {};
-	char salt_bytes[512];
 	int r;
 
-	if ((r = crypt_init(&cd, hash_device)))
-		goto out;
+	r = crypt_init_by_name(&cd, action_argv[0]);
+	if (r == 0)
+		r = crypt_deactivate(cd, action_argv[0]);
+
+	crypt_free(cd);
+	return r;
+}
+
+static int action_status(int arg)
+{
+	crypt_status_info ci;
+	struct crypt_active_device cad;
+	struct crypt_params_verity vp = {};
+	struct crypt_device *cd = NULL;
+	struct stat st;
+	char *backing_file;
+	unsigned i, path = 0;
+	int r = 0;
+
+	/* perhaps a path, not a dm device name */
+	if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
+		path = 1;
+
+	ci = crypt_status(NULL, action_argv[0]);
+	switch (ci) {
+	case CRYPT_INVALID:
+		r = -EINVAL;
+		break;
+	case CRYPT_INACTIVE:
+		if (path)
+			log_std("%s is inactive.\n", action_argv[0]);
+		else
+			log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
+		r = -ENODEV;
+		break;
+	case CRYPT_ACTIVE:
+	case CRYPT_BUSY:
+		if (path)
+			log_std("%s is active%s.\n", action_argv[0],
+				ci == CRYPT_BUSY ? " and is in use" : "");
+		else
+			log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
+				ci == CRYPT_BUSY ? " and is in use" : "");
+
+		r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL);
+		if (r < 0 || !crypt_get_type(cd))
+			goto out;
+
+		log_std("  type:        %s\n", crypt_get_type(cd));
+
+		r = crypt_get_active_device(cd, action_argv[0], &cad);
+		if (r < 0)
+			goto out;
 
-	params.hash_name = hash_algorithm ?: "sha256";
-	params.data_device = data_device;
+		log_std("  status:      %s\n",
+			cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified");
 
-	if (salt_string) {
-		if (hex_to_bytes(salt_string, salt_bytes) != salt_size) {
-			r = -EINVAL;
+		r = crypt_get_verity_info(cd, &vp);
+		if (r < 0)
 			goto out;
+
+		log_std("  hash type:   %u\n", vp.hash_type);
+		log_std("  data block:  %u\n", vp.data_block_size);
+		log_std("  hash block:  %u\n", vp.hash_block_size);
+		log_std("  hash name:   %s\n", vp.hash_name);
+		log_std("  salt:        ");
+		if (vp.salt_size)
+			for(i = 0; i < vp.salt_size; i++)
+				log_std("%02hhx", (const char)vp.salt[i]);
+		else
+			log_std("-");
+		log_std("\n");
+
+		log_std("  data device: %s\n", vp.data_device);
+		if (crypt_loop_device(vp.data_device)) {
+			backing_file = crypt_loop_backing_file(vp.data_device);
+			log_std("  data loop:   %s\n", backing_file);
+			free(backing_file);
 		}
-		params.salt = salt_bytes;
+		log_std("  size:        %" PRIu64 " sectors\n", cad.size);
+		log_std("  mode:        %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
+					   "readonly" : "read/write");
+
+		log_std("  hash device: %s\n", vp.hash_device);
+		if (crypt_loop_device(vp.hash_device)) {
+			backing_file = crypt_loop_backing_file(vp.hash_device);
+			log_std("  hash loop:   %s\n", backing_file);
+			free(backing_file);
+		}
+		log_std("  hash offset: %" PRIu64 " sectors\n",
+			vp.hash_area_offset * vp.hash_block_size / 512);
 	}
+out:
+	crypt_free(cd);
+	if (r == -ENOTSUP)
+		r = 0;
+	return r;
+}
 
-	params.salt_size = salt_size;
-	params.data_block_size = data_block_size;
-	params.hash_block_size = hash_block_size;
-	params.data_size = data_blocks;
-	params.hash_area_offset = hash_start;
-	params.version = version;
-	params.flags = CRYPT_VERITY_CREATE_HASH;
-	if (!use_superblock)
-		params.flags |= CRYPT_VERITY_NO_HEADER;
+static int action_dump(int arg)
+{
+	struct crypt_device *cd = NULL;
+	struct crypt_params_verity params = {};
+	int r;
+
+	if ((r = crypt_init(&cd, action_argv[0])))
+		return r;
 
-	r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, &params);
+	params.hash_area_offset = hash_offset;
+	r = crypt_load(cd, CRYPT_VERITY, &params);
 	if (!r)
 		crypt_dump(cd);
-out:
 	crypt_free(cd);
 	return r;
 }
 
-static __attribute__ ((noreturn)) void usage(poptContext popt_context,
-					     int exitcode, const char *error,
-					     const char *more)
-{
-	poptPrintUsage(popt_context, stderr, 0);
-	if (error)
-		log_err("%s: %s\n", more, error);
-	poptFreeContext(popt_context);
-	exit(exitcode);
-}
+static struct action_type {
+	const char *type;
+	int (*handler)(int);
+	int required_action_argc;
+	const char *arg_desc;
+	const char *desc;
+} action_types[] = {
+	{ "format",	action_format, 2, N_("<data_device> <hash_device>"),N_("format device") },
+	{ "verify",	action_verify, 3, N_("<data_device> <hash_device> <root_hash>"),N_("verify device") },
+	{ "create",	action_create, 4, N_("<name> <data_device> <hash_device> <root_hash>"),N_("create active device") },
+	{ "remove",	action_remove, 1, N_("<name>"),N_("remove (deactivate) device") },
+	{ "status",	action_status, 1, N_("<name>"),N_("show active device status") },
+	{ "dump",	action_dump,   1, N_("<hash_device>"),N_("show on-disk information") },
+	{ NULL, NULL, 0, NULL, NULL }
+};
 
 static void help(poptContext popt_context,
 		 enum poptCallbackReason reason __attribute__((unused)),
@@ -256,29 +320,49 @@ static void help(poptContext popt_context,
 		 const char *arg __attribute__((unused)),
 		 void *data __attribute__((unused)))
 {
+	struct action_type *action;
+
 	if (key->shortName == '?') {
 		log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
 		poptPrintHelp(popt_context, stdout, 0);
+		log_std(_("\n"
+			 "<action> is one of:\n"));
+		for(action = action_types; action->type; action++)
+			log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
+		log_std(_("\n"
+			 "<name> is the device to create under %s\n"
+			 "<data_device> is the data device\n"
+			 "<hash_device> is the device containing verification data\n"
+			 "<root_hash> hash of the root node on <hash_device>\n"),
+			crypt_get_dir());
+
+		log_std(_("\nDefault compiled-in dm-verity parameters:\n"
+			 "\tHash: %s, Data block (bytes): %u, "
+			 "Hash block (bytes): %u, Salt size: %u, Hash format: %u\n"),
+			DEFAULT_VERITY_HASH, DEFAULT_VERITY_DATA_BLOCK,
+			DEFAULT_VERITY_HASH_BLOCK, DEFAULT_VERITY_SALT_SIZE,
+			1);
 		exit(EXIT_SUCCESS);
 	} else
 		usage(popt_context, EXIT_SUCCESS, NULL, NULL);
 }
 
-static void _dbg_version_and_cmd(int argc, const char **argv)
+static int run_action(struct action_type *action)
 {
-	int i;
+	int r;
 
-	log_std("# %s %s processing \"", PACKAGE_VERITY, PACKAGE_VERSION);
-	for (i = 0; i < argc; i++) {
-		if (i)
-			log_std(" ");
-		log_std("%s", argv[i]);
-	}
-	log_std("\"\n");
+	log_dbg("Running command %s.", action->type);
+
+	r = action->handler(0);
+
+	show_status(r);
+	return translate_errno(r);
 }
 
 int main(int argc, const char **argv)
 {
+	static char *popt_tmp;
+	static const char *null_action_argv[] = {NULL};
 	static struct poptOption popt_help_options[] = {
 		{ NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
 		{ "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
@@ -286,127 +370,111 @@ int main(int argc, const char **argv)
 		POPT_TABLEEND
 	};
 	static struct poptOption popt_options[] = {
-		{ NULL,                '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
-		{ "version",           '\0', POPT_ARG_NONE, &opt_version_mode,          0, N_("Print package version"), NULL },
-		{ "verbose",            0 /*v*/,  POPT_ARG_NONE, &opt_verbose,               0, N_("Shows more detailed error messages"), NULL },
-		{ "debug",             '\0', POPT_ARG_NONE, &opt_debug,                 0, N_("Show debug messages"), NULL },
-		{ "create",		'c',	POPT_ARG_VAL, &mode, MODE_CREATE, "Create hash", NULL },
-		{ "verify",		'v',	POPT_ARG_VAL, &mode, MODE_VERIFY, "Verify integrity", NULL },
-		{ "activate",		'a',	POPT_ARG_VAL, &mode, MODE_ACTIVATE, "Activate the device", NULL },
-		{ "dump",		'd',	POPT_ARG_VAL, &mode, MODE_DUMP, "Dump the device", NULL },
-		{ "no-superblock",	0,	POPT_ARG_VAL, &use_superblock, 0, "Do not create/use superblock" },
-		{ "format",		0,	POPT_ARG_INT, &version, 0, "Format version (1 - normal format, 0 - original Chromium OS format)", "number" },
-		{ "data-block-size",	0, 	POPT_ARG_INT, &data_block_size, 0, "Block size on the data device", "bytes" },
-		{ "hash-block-size",	0, 	POPT_ARG_INT, &hash_block_size, 0, "Block size on the hash device", "bytes" },
-		{ "data-blocks",	0,	POPT_ARG_STRING, &data_blocks_string, 0, "The number of blocks in the data file", "blocks" },
-		{ "hash-start",		0,	POPT_ARG_STRING, &hash_start_string, 0, "Starting block on the hash device", "512-byte sectors" },
-		{ "algorithm",		0,	POPT_ARG_STRING, &hash_algorithm, 0, "Hash algorithm (default sha256)", "string" },
-		{ "salt",		0,	POPT_ARG_STRING, &salt_string, 0, "Salt", "hex string" },
+		{ NULL,              '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
+		{ "version",         '\0', POPT_ARG_NONE, &opt_version_mode, 0, N_("Print package version"), NULL },
+		{ "verbose",         'v',  POPT_ARG_NONE, &opt_verbose,      0, N_("Shows more detailed error messages"), NULL },
+		{ "debug",           '\0', POPT_ARG_NONE, &opt_debug,        0, N_("Show debug messages"), NULL },
+		{ "no-superblock",   0,    POPT_ARG_VAL,  &use_superblock,   0, N_("Do not use verity superblock"), NULL },
+		{ "format",          0,    POPT_ARG_INT,  &hash_type,        0, N_("Format type (1 - normal, 0 - original Chrome OS)"), N_("number") },
+		{ "data-block-size", 0,    POPT_ARG_INT,  &data_block_size,  0, N_("Block size on the data device"), N_("bytes") },
+		{ "hash-block-size", 0,    POPT_ARG_INT,  &hash_block_size,  0, N_("Block size on the hash device"), N_("bytes") },
+		{ "data-blocks",     0,    POPT_ARG_STRING, &popt_tmp,       1, N_("The number of blocks in the data file"), N_("blocks") },
+		{ "hash-offset",     0,    POPT_ARG_STRING, &popt_tmp,       2, N_("Starting offset on the hash device"), N_("bytes") },
+		{ "hash",            'h',  POPT_ARG_STRING, &hash_algorithm, 0, N_("Hash algorithm"), N_("string") },
+		{ "salt",            's',  POPT_ARG_STRING, &salt_string,    0, N_("Salt"), N_("hex string") },
+		{ "uuid",            '\0', POPT_ARG_STRING, &opt_uuid,       0, N_("UUID for device to use."), NULL },
 		POPT_TABLEEND
 	};
+
 	poptContext popt_context;
+	struct action_type *action;
+	const char *aname;
 	int r;
-	char *end;
 
-	crypt_set_log_callback(NULL, _log, NULL);
+	crypt_set_log_callback(NULL, tool_log, NULL);
 
 	setlocale(LC_ALL, "");
 	bindtextdomain(PACKAGE, LOCALEDIR);
 	textdomain(PACKAGE);
 
 	popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
+	poptSetOtherOptionHelp(popt_context,
+	                       _("[OPTION...] <action> <action-specific>"));
+
+	while((r = poptGetNextOpt(popt_context)) > 0) {
+		unsigned long long ull_value;
+		char *endp;
+
+		errno = 0;
+		ull_value = strtoull(popt_tmp, &endp, 10);
+		if (*endp || !*popt_tmp || !isdigit(*popt_tmp) ||
+		    (errno == ERANGE && ull_value == ULLONG_MAX) ||
+		    (errno != 0 && ull_value == 0))
+			r = POPT_ERROR_BADNUMBER;
+
+		switch(r) {
+			case 1:
+				data_blocks = ull_value;
+				break;
+			case 2:
+				hash_offset = ull_value;
+				break;
+		}
 
-	poptSetOtherOptionHelp(popt_context, "[-c|-v|-a|-d] [<device name> if activating] <data device> <hash device> [<root hash> if activating or verifying] [OPTION...]");
-
-	if (argc <= 1) {
-		poptPrintHelp(popt_context, stdout, 0);
-		exit(1);
+		if (r < 0)
+			break;
 	}
 
-	r = poptGetNextOpt(popt_context);
 	if (r < -1)
 		usage(popt_context, EXIT_FAILURE, poptStrerror(r),
 		      poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
+
 	if (opt_version_mode) {
 		log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
 		poptFreeContext(popt_context);
 		exit(EXIT_SUCCESS);
 	}
 
-	if (mode < 0)
+	if (!(aname = poptGetArg(popt_context)))
+		usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
+		      poptGetInvocationName(popt_context));
+	for(action = action_types; action->type; action++)
+		if (strcmp(action->type, aname) == 0)
+			break;
+	if (!action->type)
 		usage(popt_context, EXIT_FAILURE, _("Unknown action."),
 		      poptGetInvocationName(popt_context));
 
-	if (mode == MODE_ACTIVATE) {
-		dm_device = poptGetArg(popt_context);
-		if (!dm_device || !*dm_device)
-			usage(popt_context, EXIT_FAILURE,
-			      _("Missing activation device name."),
-			      poptGetInvocationName(popt_context));
-	}
+	action_argc = 0;
+	action_argv = poptGetArgs(popt_context);
+	/* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
+	if(!action_argv)
+		action_argv = null_action_argv;
 
-	data_device = poptGetArg(popt_context);
-	if (!data_device)
-		usage(popt_context, EXIT_FAILURE, _("Missing data device name."),
-		      poptGetInvocationName(popt_context));
+	/* Count args, somewhat unnice, change? */
+	while(action_argv[action_argc] != NULL)
+		action_argc++;
 
-	hash_device = poptGetArg(popt_context);
-	if (!hash_device)
-		usage(popt_context, EXIT_FAILURE, _("Missing hash device name."),
+	if(action_argc < action->required_action_argc) {
+		char buf[128];
+		snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc);
+		usage(popt_context, EXIT_FAILURE, buf,
 		      poptGetInvocationName(popt_context));
-
-	if (mode == MODE_ACTIVATE || mode == MODE_VERIFY) {
-		root_hash = poptGetArg(popt_context);
-		if (!root_hash)
-		usage(popt_context, EXIT_FAILURE, _("Root hash not specified."),
-		      poptGetInvocationName(popt_context));
-	}
-
-	if (data_blocks_string) {
-		data_blocks = strtoll(data_blocks_string, &end, 10);
-		if (!*data_blocks_string || *end)
-			usage(popt_context, EXIT_FAILURE,
-			      _("Invalid number of data blocks."),
-			      poptGetInvocationName(popt_context));
 	}
 
-	/* hash start */
-	if (hash_start_string) {
-		hash_start = strtoll(hash_start_string, &end, 10);
-		if (!*hash_start_string || *end)
-			usage(popt_context, EXIT_FAILURE,
-			      _("Invalid hash device offset."),
-			      poptGetInvocationName(popt_context));
-		hash_start *= 512;
-	}
-
-	if (salt_string || !use_superblock) {
-		if (!salt_string || !strcmp(salt_string, "-"))
-			salt_string = "";
-		salt_size = strlen(salt_string) / 2;
+	if (data_block_size < 0 || hash_block_size < 0 || hash_type < 0) {
+		usage(popt_context, EXIT_FAILURE,
+		      _("Negative number for option not permitted."),
+		      poptGetInvocationName(popt_context));
 	}
 
 	if (opt_debug) {
 		opt_verbose = 1;
 		crypt_set_debug_level(-1);
-		_dbg_version_and_cmd(argc, argv);
-	}
-
-	switch (mode) {
-		case MODE_ACTIVATE:
-			r = action_activate(0);
-			break;
-		case MODE_VERIFY:
-			r = action_activate(1);
-			break;
-		case MODE_CREATE:
-			r = action_create();
-			break;
-		case MODE_DUMP:
-			r = action_dump();
-			break;
+		dbg_version_and_cmd(argc, argv);
 	}
 
+	r = run_action(action);
 	poptFreeContext(popt_context);
 	return r;
 }