src/cryptsetup.c

   1 /*
   2  * cryptsetup - setup cryptographic volumes for dm-crypt
   3  *
   4  * Copyright (C) 2004, Christophe Saout <christophe@saout.de>
   5  * Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
   6  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   7  * Copyright (C) 2009-2012, Milan Broz
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * as published by the Free Software Foundation; either version 2
  12  * of the License, or (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22  */
  23
  24 #include "cryptsetup.h"
  25
  26 static const char *opt_cipher = NULL;
  27 static const char *opt_hash = NULL;
  28 static int opt_verify_passphrase = 0;
  29
  30 static const char *opt_key_file = NULL;
  31 static int opt_keyfiles_count = 0;
  32 static const char *opt_keyfiles[MAX_KEYFILES];
  33
  34 static const char *opt_master_key_file = NULL;
  35 static const char *opt_header_backup_file = NULL;
  36 static const char *opt_uuid = NULL;
  37 static const char *opt_header_device = NULL;
  38 static const char *opt_type = "luks";
  39 static int opt_key_size = 0;
  40 static long opt_keyfile_size = 0;
  41 static long opt_new_keyfile_size = 0;
  42 static long opt_keyfile_offset = 0;
  43 static long opt_new_keyfile_offset = 0;
  44 static int opt_key_slot = CRYPT_ANY_SLOT;
  45 static uint64_t opt_size = 0;
  46 static uint64_t opt_offset = 0;
  47 static uint64_t opt_skip = 0;
  48 static int opt_skip_valid = 0;
  49 static int opt_readonly = 0;
  50 static int opt_iteration_time = DEFAULT_LUKS1_ITER_TIME;
  51 static int opt_version_mode = 0;
  52 static int opt_timeout = 0;
  53 static int opt_tries = 3;
  54 static int opt_align_payload = 0;
  55 static int opt_random = 0;
  56 static int opt_urandom = 0;
  57 static int opt_dump_master_key = 0;
  58 static int opt_shared = 0;
  59 static int opt_allow_discards = 0;
  60 static int opt_test_passphrase = 0;
  61 static int opt_tcrypt_hidden = 0;
  62 static int opt_tcrypt_system = 0;
  63
  64 static const char **action_argv;
  65 static int action_argc;
  66 static const char *null_action_argv[] = {NULL, NULL};
  67
  68 static int _verify_passphrase(int def)
  69 {
  70         /* Batch mode switch off verify - if not overrided by -y */
  71         if (opt_verify_passphrase)
  72                 def = 1;
  73         else if (opt_batch_mode)
  74                 def = 0;
  75
  76         /* Non-tty input doesn't allow verify */
  77         if (def && !isatty(STDIN_FILENO)) {
  78                 if (opt_verify_passphrase)
  79                         log_err(_("Can't do passphrase verification on non-tty inputs.\n"));
  80                 def = 0;
  81         }
  82
  83         return def;
  84 }
  85
  86 static int action_open_plain(void)
  87 {
  88         struct crypt_device *cd = NULL;
  89         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
  90         struct crypt_params_plain params = {
  91                 .hash = opt_hash ?: DEFAULT_PLAIN_HASH,
  92                 .skip = opt_skip,
  93                 .offset = opt_offset,
  94                 .size = opt_size,
  95         };
  96         char *password = NULL;
  97         size_t passwordLen;
  98         size_t key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS) / 8;
  99         uint32_t activate_flags = 0;
 100         int r;
 101
 102         if (params.hash && !strcmp(params.hash, "plain"))
 103                 params.hash = NULL;
 104
 105         /* FIXME: temporary hack */
 106         if (opt_key_file && strcmp(opt_key_file, "-"))
 107                 params.hash = NULL;
 108
 109         if ((opt_keyfile_offset || opt_keyfile_size) && opt_key_file)
 110                 log_std(_("Ignoring keyfile offset and size options, keyfile read "
 111                          "size is always the same as encryption key size.\n"));
 112
 113         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(PLAIN),
 114                                       cipher, NULL, cipher_mode);
 115         if (r < 0) {
 116                 log_err(_("No known cipher specification pattern detected.\n"));
 117                 goto out;
 118         }
 119
 120         if ((r = crypt_init(&cd, action_argv[0])))
 121                 goto out;
 122
 123         crypt_set_timeout(cd, opt_timeout);
 124         crypt_set_password_retry(cd, opt_tries);
 125
 126         r = crypt_format(cd, CRYPT_PLAIN,
 127                          cipher, cipher_mode,
 128                          NULL, NULL,
 129                          key_size,
 130                          &params);
 131         check_signal(&r);
 132         if (r < 0)
 133                 goto out;
 134
 135         if (opt_readonly)
 136                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 137
 138         if (opt_shared)
 139                 activate_flags |= CRYPT_ACTIVATE_SHARED;
 140
 141         if (opt_allow_discards)
 142                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 143
 144         if (opt_key_file)
 145                 /* With hashing, read the whole keyfile */
 146                 r = crypt_activate_by_keyfile_offset(cd, action_argv[1],
 147                         CRYPT_ANY_SLOT, opt_key_file,
 148                         params.hash ? 0 : key_size, 0,
 149                         activate_flags);
 150         else {
 151                 r = tools_get_key(_("Enter passphrase: "),
 152                                   &password, &passwordLen,
 153                                   opt_keyfile_offset, opt_keyfile_size,
 154                                   NULL, opt_timeout,
 155                                   _verify_passphrase(0), 0,
 156                                   cd);
 157                 if (r < 0)
 158                         goto out;
 159
 160                 r = crypt_activate_by_passphrase(cd, action_argv[1],
 161                         CRYPT_ANY_SLOT, password, passwordLen, activate_flags);
 162         }
 163 out:
 164         crypt_free(cd);
 165         crypt_safe_free(password);
 166
 167         return r;
 168 }
 169
 170 static int action_open_loopaes(void)
 171 {
 172         struct crypt_device *cd = NULL;
 173         struct crypt_params_loopaes params = {
 174                 .hash = opt_hash ?: NULL,
 175                 .offset = opt_offset,
 176                 .skip = opt_skip_valid ? opt_skip : opt_offset,
 177         };
 178         unsigned int key_size = (opt_key_size ?: DEFAULT_LOOPAES_KEYBITS) / 8;
 179         uint32_t activate_flags = 0;
 180         int r;
 181
 182         if (!opt_key_file) {
 183                 log_err(_("Option --key-file is required.\n"));
 184                 return -EINVAL;
 185         }
 186
 187         if (opt_readonly)
 188                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 189
 190         if (opt_allow_discards)
 191                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 192
 193         if ((r = crypt_init(&cd, action_argv[0])))
 194                 goto out;
 195
 196         r = crypt_format(cd, CRYPT_LOOPAES, opt_cipher ?: DEFAULT_LOOPAES_CIPHER,
 197                          NULL, NULL, NULL, key_size, &params);
 198         check_signal(&r);
 199         if (r < 0)
 200                 goto out;
 201
 202         r = crypt_activate_by_keyfile_offset(cd, action_argv[1], CRYPT_ANY_SLOT,
 203                                       opt_key_file, opt_keyfile_size,
 204                                       opt_keyfile_size, activate_flags);
 205 out:
 206         crypt_free(cd);
 207
 208         return r;
 209 }
 210
 211 static int action_open_tcrypt(void)
 212 {
 213         struct crypt_device *cd = NULL;
 214         struct crypt_params_tcrypt params = {
 215                 .keyfiles = opt_keyfiles,
 216                 .keyfiles_count = opt_keyfiles_count,
 217                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 218         };
 219         const char *activated_name;
 220         uint32_t flags = 0;
 221         int r;
 222
 223         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 224
 225         if ((r = crypt_init(&cd, action_argv[0])))
 226                 goto out;
 227
 228         /* TCRYPT header is encrypted, get passphrase now */
 229         r = tools_get_key(_("Enter passphrase: "),
 230                           CONST_CAST(char**)&params.passphrase,
 231                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 232                           _verify_passphrase(0), 0, cd);
 233         if (r < 0)
 234                 goto out;
 235
 236         if (opt_tcrypt_hidden)
 237                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 238
 239         if (opt_tcrypt_system)
 240                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 241
 242         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 243         check_signal(&r);
 244         if (r < 0)
 245                 goto out;
 246
 247         if (opt_readonly)
 248                 flags |= CRYPT_ACTIVATE_READONLY;
 249
 250         if (activated_name)
 251                 r = crypt_activate_by_volume_key(cd, activated_name, NULL, 0, flags);
 252 out:
 253         if (r == -EPERM)
 254                 log_err(_("No device header detected with this passphrase.\n"));
 255         crypt_free(cd);
 256         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 257         return r;
 258 }
 259
 260 static int tcryptDump_with_volume_key(struct crypt_device *cd)
 261 {
 262         char *vk = NULL;
 263         size_t vk_size;
 264         unsigned i;
 265         int r;
 266
 267         crypt_set_confirm_callback(cd, yesDialog, NULL);
 268         if (!yesDialog(
 269             _("Header dump with volume key is sensitive information\n"
 270               "which allows access to encrypted partition without passphrase.\n"
 271               "This dump should be always stored encrypted on safe place."),
 272               NULL))
 273                 return -EPERM;
 274
 275         vk_size = crypt_get_volume_key_size(cd);
 276         vk = crypt_safe_alloc(vk_size);
 277         if (!vk)
 278                 return -ENOMEM;
 279
 280         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size, NULL, 0);
 281         if (r < 0)
 282                 goto out;
 283
 284         log_std("TCRYPT header information for %s\n", crypt_get_device_name(cd));
 285         log_std("Cipher chain:  \t%s\n", crypt_get_cipher(cd));
 286         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
 287         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
 288         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
 289         log_std("MK dump:\t");
 290
 291         for(i = 0; i < vk_size; i++) {
 292                 if (i && !(i % 16))
 293                         log_std("\n\t\t");
 294                 log_std("%02hhx ", (char)vk[i]);
 295         }
 296         log_std("\n");
 297 out:
 298         crypt_safe_free(vk);
 299         return r;
 300 }
 301
 302 static int action_tcryptDump(void)
 303 {
 304         struct crypt_device *cd = NULL;
 305         struct crypt_params_tcrypt params = {
 306                 .keyfiles = opt_keyfiles,
 307                 .keyfiles_count = opt_keyfiles_count,
 308                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 309         };
 310         int r;
 311
 312         if ((r = crypt_init(&cd, action_argv[0])))
 313                 goto out;
 314
 315         /* TCRYPT header is encrypted, get passphrase now */
 316         r = tools_get_key(_("Enter passphrase: "),
 317                           CONST_CAST(char**)&params.passphrase,
 318                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 319                           _verify_passphrase(0), 0, cd);
 320         if (r < 0)
 321                 goto out;
 322
 323         if (opt_tcrypt_hidden)
 324                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 325
 326         if (opt_tcrypt_system)
 327                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 328
 329         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 330         check_signal(&r);
 331         if (r < 0)
 332                 goto out;
 333
 334         if (opt_dump_master_key)
 335                 r = tcryptDump_with_volume_key(cd);
 336         else
 337                 r = crypt_dump(cd);
 338 out:
 339         if (r == -EPERM)
 340                 log_err(_("No device header detected with this passphrase.\n"));
 341         crypt_free(cd);
 342         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 343         return r;
 344 }
 345
 346 static int action_close(void)
 347 {
 348         struct crypt_device *cd = NULL;
 349         int r;
 350
 351         r = crypt_init_by_name(&cd, action_argv[0]);
 352         if (r == 0)
 353                 r = crypt_deactivate(cd, action_argv[0]);
 354
 355         crypt_free(cd);
 356         return r;
 357 }
 358
 359 static int action_resize(void)
 360 {
 361         struct crypt_device *cd = NULL;
 362         int r;
 363
 364         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 365         if (r == 0)
 366                 r = crypt_resize(cd, action_argv[0], opt_size);
 367
 368         crypt_free(cd);
 369         return r;
 370 }
 371
 372 static int action_status(void)
 373 {
 374         crypt_status_info ci;
 375         struct crypt_active_device cad;
 376         struct crypt_device *cd = NULL;
 377         char *backing_file;
 378         const char *device;
 379         int path = 0, r = 0;
 380
 381         /* perhaps a path, not a dm device name */
 382         if (strchr(action_argv[0], '/'))
 383                 path = 1;
 384
 385         ci = crypt_status(NULL, action_argv[0]);
 386         switch (ci) {
 387         case CRYPT_INVALID:
 388                 r = -EINVAL;
 389                 break;
 390         case CRYPT_INACTIVE:
 391                 if (path)
 392                         log_std("%s is inactive.\n", action_argv[0]);
 393                 else
 394                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 395                 r = -ENODEV;
 396                 break;
 397         case CRYPT_ACTIVE:
 398         case CRYPT_BUSY:
 399                 if (path)
 400                         log_std("%s is active%s.\n", action_argv[0],
 401                                 ci == CRYPT_BUSY ? " and is in use" : "");
 402                 else
 403                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 404                                 ci == CRYPT_BUSY ? " and is in use" : "");
 405
 406                 r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 407                 if (r < 0 || !crypt_get_type(cd))
 408                         goto out;
 409
 410                 log_std("  type:    %s\n", crypt_get_type(cd));
 411
 412                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 413                 if (r < 0)
 414                         goto out;
 415
 416                 log_std("  cipher:  %s-%s\n", crypt_get_cipher(cd), crypt_get_cipher_mode(cd));
 417                 log_std("  keysize: %d bits\n", crypt_get_volume_key_size(cd) * 8);
 418                 device = crypt_get_device_name(cd);
 419                 log_std("  device:  %s\n", device);
 420                 if (crypt_loop_device(device)) {
 421                         backing_file = crypt_loop_backing_file(device);
 422                         log_std("  loop:    %s\n", backing_file);
 423                         free(backing_file);
 424                 }
 425                 log_std("  offset:  %" PRIu64 " sectors\n", cad.offset);
 426                 log_std("  size:    %" PRIu64 " sectors\n", cad.size);
 427                 if (cad.iv_offset)
 428                         log_std("  skipped: %" PRIu64 " sectors\n", cad.iv_offset);
 429                 log_std("  mode:    %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 430                                            "readonly" : "read/write");
 431                 if (cad.flags & CRYPT_ACTIVATE_ALLOW_DISCARDS)
 432                         log_std("  flags:   discards\n");
 433         }
 434 out:
 435         crypt_free(cd);
 436         if (r == -ENOTSUP)
 437                 r = 0;
 438         return r;
 439 }
 440
 441 static int action_benchmark_kdf(const char *hash)
 442 {
 443         uint64_t kdf_iters;
 444         int r;
 445
 446         r = crypt_benchmark_kdf(NULL, "pbkdf2", hash, "foo", 3, "bar", 3,
 447                                 &kdf_iters);
 448         if (r < 0)
 449                 log_std("PBKDF2-%-9s     N/A\n", hash);
 450         else
 451                 log_std("PBKDF2-%-9s %7" PRIu64 " iterations per second\n",
 452                         hash, kdf_iters);
 453         return r;
 454 }
 455
 456 static int action_benchmark(void)
 457 {
 458         static struct {
 459                 const char *cipher;
 460                 const char *mode;
 461                 size_t key_size;
 462                 size_t iv_size;
 463         } bciphers[] = {
 464                 { "aes",     "cbc", 16, 16 },
 465                 { "serpent", "cbc", 16, 16 },
 466                 { "twofish", "cbc", 16, 16 },
 467                 { "aes",     "cbc", 32, 16 },
 468                 { "serpent", "cbc", 32, 16 },
 469                 { "twofish", "cbc", 32, 16 },
 470                 { "aes",     "xts", 32, 16 },
 471                 { "serpent", "xts", 32, 16 },
 472                 { "twofish", "xts", 32, 16 },
 473                 { "aes",     "xts", 64, 16 },
 474                 { "serpent", "xts", 64, 16 },
 475                 { "twofish", "xts", 64, 16 },
 476                 {  NULL, NULL, 0, 0 }
 477         };
 478         static char *bkdfs[] = {
 479                 "sha1", "sha256", "sha512", "ripemd160", "whirlpool", NULL
 480         };
 481         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 482         double enc_mbr = 0, dec_mbr = 0;
 483         int key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS);
 484         int iv_size = 16, skipped = 0;
 485         int buffer_size = 1024 * 1024;
 486         char *c;
 487         int i, r;
 488
 489         log_std(_("# Tests are approximate using memory only (no storage IO).\n"));
 490         if (opt_hash) {
 491                 r = action_benchmark_kdf(opt_hash);
 492         } else if (opt_cipher) {
 493                 r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mode);
 494                 if (r < 0) {
 495                         log_err(_("No known cipher specification pattern detected.\n"));
 496                         return r;
 497                 }
 498                 if ((c  = strchr(cipher_mode, '-')))
 499                         *c = '\0';
 500
 501                 /* FIXME: not really clever :) */
 502                 if (strstr(cipher, "des") ||
 503                     strstr(cipher, "blowfish") ||
 504                     strstr(cipher, "cast5"))
 505                         iv_size = 8;
 506
 507                 r = crypt_benchmark(NULL, cipher, cipher_mode,
 508                                     key_size / 8, iv_size, buffer_size,
 509                                     &enc_mbr, &dec_mbr);
 510                 if (!r) {
 511                         log_std(N_("#  Algorithm | Key | Encryption | Decryption\n"));
 512                         log_std("%8s-%s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 513                                 cipher, cipher_mode, key_size, enc_mbr, dec_mbr);
 514                 } else if (r == -ENOENT)
 515                         log_err(_("Cipher %s is not available.\n"), opt_cipher);
 516         } else {
 517                 for (i = 0; bkdfs[i]; i++) {
 518                         r = action_benchmark_kdf(bkdfs[i]);
 519                         check_signal(&r);
 520                         if (r == -EINTR)
 521                                 break;
 522                 }
 523                 for (i = 0; bciphers[i].cipher; i++) {
 524                         r = crypt_benchmark(NULL, bciphers[i].cipher, bciphers[i].mode,
 525                                             bciphers[i].key_size, bciphers[i].iv_size,
 526                                             buffer_size, &enc_mbr, &dec_mbr);
 527                         check_signal(&r);
 528                         if (r == -ENOTSUP || r == -EINTR)
 529                                 break;
 530                         if (r == -ENOENT)
 531                                 skipped++;
 532                         if (i == 0)
 533                                 log_std(N_("#  Algorithm | Key | Encryption | Decryption\n"));
 534
 535                         snprintf(cipher, MAX_CIPHER_LEN, "%s-%s",
 536                                  bciphers[i].cipher, bciphers[i].mode);
 537                         if (!r)
 538                                 log_std("%12s  %4db  %5.1f MiB/s  %5.1f MiB/s\n",
 539                                         cipher, bciphers[i].key_size*8, enc_mbr, dec_mbr);
 540                         else
 541                                 log_std("%12s  %4db %12s %12s\n", cipher,
 542                                         bciphers[i].key_size*8, _("N/A"), _("N/A"));
 543                 }
 544                 if (skipped && skipped == i)
 545                         r = -ENOTSUP;
 546         }
 547
 548         if (r == -ENOTSUP)
 549                 log_err( _("Required kernel crypto interface not available.\n"
 550                            "Ensure you have algif_skcipher kernel module loaded.\n"));
 551         return r;
 552 }
 553
 554 static int _read_mk(const char *file, char **key, int keysize)
 555 {
 556         int fd;
 557
 558         *key = crypt_safe_alloc(keysize);
 559         if (!*key)
 560                 return -ENOMEM;
 561
 562         fd = open(file, O_RDONLY);
 563         if (fd == -1) {
 564                 log_err(_("Cannot read keyfile %s.\n"), file);
 565                 goto fail;
 566         }
 567         if ((read(fd, *key, keysize) != keysize)) {
 568                 log_err(_("Cannot read %d bytes from keyfile %s.\n"), keysize, file);
 569                 close(fd);
 570                 goto fail;
 571         }
 572         close(fd);
 573         return 0;
 574 fail:
 575         crypt_safe_free(*key);
 576         *key = NULL;
 577         return -EINVAL;
 578 }
 579
 580 static int action_luksRepair(void)
 581 {
 582         struct crypt_device *cd = NULL;
 583         int r;
 584
 585         if ((r = crypt_init(&cd, action_argv[0])))
 586                 goto out;
 587
 588         /* Currently only LUKS1 allows repair */
 589         crypt_set_log_callback(cd, quiet_log, NULL);
 590         r = crypt_load(cd, CRYPT_LUKS1, NULL);
 591         crypt_set_log_callback(cd, tool_log, NULL);
 592         if (r == 0) {
 593                 log_verbose(_("No known problems detected for LUKS header.\n"));
 594                 goto out;
 595         }
 596
 597         r = yesDialog(_("Really try to repair LUKS device header?"),
 598                        NULL) ? 0 : -EINVAL;
 599         if (r == 0)
 600                 r = crypt_repair(cd, CRYPT_LUKS1, NULL);
 601 out:
 602         crypt_free(cd);
 603         return r;
 604 }
 605
 606 static int action_luksFormat(void)
 607 {
 608         int r = -EINVAL, keysize;
 609         const char *header_device;
 610         char *msg = NULL, *key = NULL, cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 611         char *password = NULL;
 612         size_t passwordLen;
 613         struct crypt_device *cd = NULL;
 614         struct crypt_params_luks1 params = {
 615                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 616                 .data_alignment = opt_align_payload,
 617                 .data_device = opt_header_device ? action_argv[0] : NULL,
 618         };
 619
 620         header_device = opt_header_device ?: action_argv[0];
 621
 622         if(asprintf(&msg, _("This will overwrite data on %s irrevocably."),
 623                     header_device) == -1) {
 624                 log_err(_("memory allocation error in action_luksFormat"));
 625                 r = -ENOMEM;
 626                 goto out;
 627         }
 628         r = yesDialog(msg, NULL) ? 0 : -EINVAL;
 629         free(msg);
 630         if (r < 0)
 631                 goto out;
 632
 633         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 634                                       cipher, NULL, cipher_mode);
 635         if (r < 0) {
 636                 log_err(_("No known cipher specification pattern detected.\n"));
 637                 goto out;
 638         }
 639
 640         if ((r = crypt_init(&cd, header_device))) {
 641                 if (opt_header_device)
 642                         log_err(_("Cannot use %s as on-disk header.\n"), header_device);
 643                 goto out;
 644         }
 645
 646         keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
 647
 648         crypt_set_timeout(cd, opt_timeout);
 649         if (opt_iteration_time)
 650                 crypt_set_iteration_time(cd, opt_iteration_time);
 651
 652         if (opt_random)
 653                 crypt_set_rng_type(cd, CRYPT_RNG_RANDOM);
 654         else if (opt_urandom)
 655                 crypt_set_rng_type(cd, CRYPT_RNG_URANDOM);
 656
 657         r = tools_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
 658                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 659                           opt_timeout, _verify_passphrase(1), 1, cd);
 660         if (r < 0)
 661                 goto out;
 662
 663         if (opt_master_key_file) {
 664                 r = _read_mk(opt_master_key_file, &key, keysize);
 665                 if (r < 0)
 666                         goto out;
 667         }
 668
 669         r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode,
 670                          opt_uuid, key, keysize, &params);
 671         check_signal(&r);
 672         if (r < 0)
 673                 goto out;
 674
 675         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 676                                             key, keysize,
 677                                             password, passwordLen);
 678 out:
 679         crypt_free(cd);
 680         crypt_safe_free(key);
 681         crypt_safe_free(password);
 682
 683         return r;
 684 }
 685
 686 static int action_open_luks(void)
 687 {
 688         struct crypt_device *cd = NULL;
 689         const char *data_device, *header_device, *activated_name;
 690         char *key = NULL;
 691         uint32_t flags = 0;
 692         int r, keysize;
 693
 694         if (opt_header_device) {
 695                 header_device = uuid_or_device(opt_header_device);
 696                 data_device = action_argv[0];
 697         } else {
 698                 header_device = uuid_or_device(action_argv[0]);
 699                 data_device = NULL;
 700         }
 701
 702         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 703
 704         if ((r = crypt_init(&cd, header_device)))
 705                 goto out;
 706
 707         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 708                 goto out;
 709
 710         if (data_device &&
 711             (r = crypt_set_data_device(cd, data_device)))
 712                 goto out;
 713
 714         if (!data_device && (crypt_get_data_offset(cd) < 8)) {
 715                 log_err(_("Reduced data offset is allowed only for detached LUKS header.\n"));
 716                 r = -EINVAL;
 717                 goto out;
 718         }
 719
 720         crypt_set_timeout(cd, opt_timeout);
 721         crypt_set_password_retry(cd, opt_tries);
 722         crypt_set_password_verify(cd, _verify_passphrase(0));
 723
 724         if (opt_iteration_time)
 725                 crypt_set_iteration_time(cd, opt_iteration_time);
 726
 727         if (opt_readonly)
 728                 flags |= CRYPT_ACTIVATE_READONLY;
 729
 730         if (opt_allow_discards)
 731                 flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 732
 733         if (opt_master_key_file) {
 734                 keysize = crypt_get_volume_key_size(cd);
 735                 r = _read_mk(opt_master_key_file, &key, keysize);
 736                 if (r < 0)
 737                         goto out;
 738                 r = crypt_activate_by_volume_key(cd, activated_name,
 739                                                  key, keysize, flags);
 740         } else if (opt_key_file) {
 741                 crypt_set_password_retry(cd, 1);
 742                 r = crypt_activate_by_keyfile_offset(cd, activated_name,
 743                         opt_key_slot, opt_key_file, opt_keyfile_size,
 744                         opt_keyfile_offset, flags);
 745         } else
 746                 r = crypt_activate_by_passphrase(cd, activated_name,
 747                         opt_key_slot, NULL, 0, flags);
 748 out:
 749         crypt_safe_free(key);
 750         crypt_free(cd);
 751         return r;
 752 }
 753
 754 static int verify_keyslot(struct crypt_device *cd, int key_slot,
 755                           char *msg_last, char *msg_pass,
 756                           const char *key_file, int keyfile_offset,
 757                           int keyfile_size)
 758 {
 759         crypt_keyslot_info ki;
 760         char *password = NULL;
 761         size_t passwordLen;
 762         int i, r;
 763
 764         ki = crypt_keyslot_status(cd, key_slot);
 765         if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !yesDialog(msg_last, NULL))
 766                 return -EPERM;
 767
 768         r = tools_get_key(msg_pass, &password, &passwordLen,
 769                           keyfile_offset, keyfile_size, key_file, opt_timeout,
 770                           _verify_passphrase(0), 0, cd);
 771         if(r < 0)
 772                 goto out;
 773
 774         if (ki == CRYPT_SLOT_ACTIVE_LAST) {
 775                 /* check the last keyslot */
 776                 r = crypt_activate_by_passphrase(cd, NULL, key_slot,
 777                                                  password, passwordLen, 0);
 778         } else {
 779                 /* try all other keyslots */
 780                 for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1); i++) {
 781                         if (i == key_slot)
 782                                 continue;
 783                         ki = crypt_keyslot_status(cd, key_slot);
 784                         if (ki == CRYPT_SLOT_ACTIVE)
 785                         r = crypt_activate_by_passphrase(cd, NULL, i,
 786                                                          password, passwordLen, 0);
 787                         if (r == i)
 788                                 break;
 789                 }
 790         }
 791
 792         if (r == -EPERM)
 793                 log_err(_("No key available with this passphrase.\n"));
 794 out:
 795         crypt_safe_free(password);
 796         return r;
 797 }
 798
 799 static int action_luksKillSlot(void)
 800 {
 801         struct crypt_device *cd = NULL;
 802         int r;
 803
 804         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 805                 goto out;
 806
 807         crypt_set_confirm_callback(cd, yesDialog, NULL);
 808         crypt_set_timeout(cd, opt_timeout);
 809
 810         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 811                 goto out;
 812
 813         switch (crypt_keyslot_status(cd, opt_key_slot)) {
 814         case CRYPT_SLOT_ACTIVE_LAST:
 815         case CRYPT_SLOT_ACTIVE:
 816                 log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 817                 break;
 818         case CRYPT_SLOT_INACTIVE:
 819                 log_err(_("Key %d not active. Can't wipe.\n"), opt_key_slot);
 820         case CRYPT_SLOT_INVALID:
 821                 r = -EINVAL;
 822                 goto out;
 823         }
 824
 825         if (!opt_batch_mode) {
 826                 r = verify_keyslot(cd, opt_key_slot,
 827                         _("This is the last keyslot. Device will become unusable after purging this key."),
 828                         _("Enter any remaining LUKS passphrase: "),
 829                         opt_key_file, opt_keyfile_offset, opt_keyfile_size);
 830                 if (r < 0)
 831                         goto out;
 832         }
 833
 834         r = crypt_keyslot_destroy(cd, opt_key_slot);
 835 out:
 836         crypt_free(cd);
 837         return r;
 838 }
 839
 840 static int action_luksRemoveKey(void)
 841 {
 842         struct crypt_device *cd = NULL;
 843         char *password = NULL;
 844         size_t passwordLen;
 845         int r;
 846
 847         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 848                 goto out;
 849
 850         crypt_set_confirm_callback(cd, yesDialog, NULL);
 851         crypt_set_timeout(cd, opt_timeout);
 852
 853         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 854                 goto out;
 855
 856         r = tools_get_key(_("Enter LUKS passphrase to be deleted: "),
 857                       &password, &passwordLen,
 858                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 859                       opt_timeout,
 860                       _verify_passphrase(0), 0,
 861                       cd);
 862         if(r < 0)
 863                 goto out;
 864
 865         r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 866                                          password, passwordLen, 0);
 867         check_signal(&r);
 868         if (r < 0)
 869                 goto out;
 870
 871         opt_key_slot = r;
 872         log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 873
 874         if (crypt_keyslot_status(cd, opt_key_slot) == CRYPT_SLOT_ACTIVE_LAST &&
 875             !yesDialog(_("This is the last keyslot. "
 876                           "Device will become unusable after purging this key."),
 877                         NULL)) {
 878                 r = -EPERM;
 879                 goto out;
 880         }
 881
 882         r = crypt_keyslot_destroy(cd, opt_key_slot);
 883 out:
 884         crypt_safe_free(password);
 885         crypt_free(cd);
 886         return r;
 887 }
 888
 889 static int action_luksAddKey(void)
 890 {
 891         int r = -EINVAL, keysize = 0;
 892         char *key = NULL;
 893         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 894         char *password = NULL, *password_new = NULL;
 895         size_t password_size = 0, password_new_size = 0;
 896         struct crypt_device *cd = NULL;
 897
 898         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 899                 goto out;
 900
 901         crypt_set_confirm_callback(cd, yesDialog, NULL);
 902
 903         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 904                 goto out;
 905
 906         keysize = crypt_get_volume_key_size(cd);
 907         /* FIXME: lib cannot properly set verification for new/old passphrase */
 908         crypt_set_password_verify(cd, _verify_passphrase(0));
 909         crypt_set_timeout(cd, opt_timeout);
 910         if (opt_iteration_time)
 911                 crypt_set_iteration_time(cd, opt_iteration_time);
 912
 913         if (opt_master_key_file) {
 914                 r = _read_mk(opt_master_key_file, &key, keysize);
 915                 if (r < 0)
 916                         goto out;
 917                 //FIXME: process keyfile arg
 918                 r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 919                                                     key, keysize, NULL, 0);
 920         } else if (opt_key_file || opt_new_key_file) {
 921                 r = crypt_keyslot_add_by_keyfile_offset(cd, opt_key_slot,
 922                         opt_key_file, opt_keyfile_size, opt_keyfile_offset,
 923                         opt_new_key_file, opt_new_keyfile_size, opt_new_keyfile_offset);
 924         } else {
 925                 r = tools_get_key(_("Enter any passphrase: "),
 926                               &password, &password_size, 0, 0, NULL,
 927                               opt_timeout, _verify_passphrase(0), 0, cd);
 928
 929                 if (r < 0)
 930                         goto out;
 931
 932                 /* Check password before asking for new one */
 933                 r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 934                                                  password, password_size, 0);
 935                 check_signal(&r);
 936                 if (r < 0)
 937                         goto out;
 938
 939                 r = tools_get_key(_("Enter new passphrase for key slot: "),
 940                                   &password_new, &password_new_size, 0, 0, NULL,
 941                                   opt_timeout, _verify_passphrase(0), 1, cd);
 942                 if (r < 0)
 943                         goto out;
 944
 945                 r = crypt_keyslot_add_by_passphrase(cd, opt_key_slot,
 946                                                     password, password_size,
 947                                                     password_new, password_new_size);
 948         }
 949 out:
 950         crypt_safe_free(password);
 951         crypt_safe_free(password_new);
 952         crypt_safe_free(key);
 953         crypt_free(cd);
 954         return r;
 955 }
 956
 957 static int action_luksChangeKey(void)
 958 {
 959         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 960         struct crypt_device *cd = NULL;
 961         char *password = NULL, *password_new = NULL;
 962         size_t password_size = 0, password_new_size = 0;
 963         int r;
 964
 965         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 966                 goto out;
 967
 968         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 969                 goto out;
 970
 971         if (opt_iteration_time)
 972                 crypt_set_iteration_time(cd, opt_iteration_time);
 973
 974         r = tools_get_key(_("Enter LUKS passphrase to be changed: "),
 975                       &password, &password_size,
 976                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 977                       opt_timeout, _verify_passphrase(0), 0, cd);
 978         if (r < 0)
 979                 goto out;
 980
 981         /* Check password before asking for new one */
 982         r = crypt_activate_by_passphrase(cd, NULL, opt_key_slot,
 983                                          password, password_size, 0);
 984         check_signal(&r);
 985         if (r < 0)
 986                 goto out;
 987
 988         r = tools_get_key(_("Enter new LUKS passphrase: "),
 989                           &password_new, &password_new_size,
 990                           opt_new_keyfile_offset, opt_new_keyfile_size,
 991                           opt_new_key_file,
 992                           opt_timeout, _verify_passphrase(0), 1, cd);
 993         if (r < 0)
 994                 goto out;
 995
 996         r = crypt_keyslot_change_by_passphrase(cd, opt_key_slot, opt_key_slot,
 997                 password, password_size, password_new, password_new_size);
 998 out:
 999         crypt_safe_free(password);
1000         crypt_safe_free(password_new);
1001         crypt_free(cd);
1002         return r;
1003 }
1004
1005 static int action_isLuks(void)
1006 {
1007         struct crypt_device *cd = NULL;
1008         int r;
1009
1010         if ((r = crypt_init(&cd, action_argv[0])))
1011                 goto out;
1012
1013         crypt_set_log_callback(cd, quiet_log, NULL);
1014         r = crypt_load(cd, CRYPT_LUKS1, NULL);
1015 out:
1016         crypt_free(cd);
1017         return r;
1018 }
1019
1020 static int action_luksUUID(void)
1021 {
1022         struct crypt_device *cd = NULL;
1023         const char *existing_uuid = NULL;
1024         int r;
1025
1026         if ((r = crypt_init(&cd, action_argv[0])))
1027                 goto out;
1028
1029         crypt_set_confirm_callback(cd, yesDialog, NULL);
1030
1031         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1032                 goto out;
1033
1034         if (opt_uuid)
1035                 r = crypt_set_uuid(cd, opt_uuid);
1036         else {
1037                 existing_uuid = crypt_get_uuid(cd);
1038                 log_std("%s\n", existing_uuid ?: "");
1039                 r = existing_uuid ? 0 : 1;
1040         }
1041 out:
1042         crypt_free(cd);
1043         return r;
1044 }
1045
1046 static int luksDump_with_volume_key(struct crypt_device *cd)
1047 {
1048         char *vk = NULL, *password = NULL;
1049         size_t passwordLen = 0;
1050         size_t vk_size;
1051         unsigned i;
1052         int r;
1053
1054         crypt_set_confirm_callback(cd, yesDialog, NULL);
1055         if (!yesDialog(
1056             _("Header dump with volume key is sensitive information\n"
1057               "which allows access to encrypted partition without passphrase.\n"
1058               "This dump should be always stored encrypted on safe place."),
1059               NULL))
1060                 return -EPERM;
1061
1062         vk_size = crypt_get_volume_key_size(cd);
1063         vk = crypt_safe_alloc(vk_size);
1064         if (!vk)
1065                 return -ENOMEM;
1066
1067         r = tools_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
1068                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
1069                           opt_timeout, 0, 0, cd);
1070         if (r < 0)
1071                 goto out;
1072
1073         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size,
1074                                  password, passwordLen);
1075         check_signal(&r);
1076         if (r < 0)
1077                 goto out;
1078
1079         log_std("LUKS header information for %s\n", crypt_get_device_name(cd));
1080         log_std("Cipher name:   \t%s\n", crypt_get_cipher(cd));
1081         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
1082         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
1083         log_std("UUID:          \t%s\n", crypt_get_uuid(cd));
1084         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
1085         log_std("MK dump:\t");
1086
1087         for(i = 0; i < vk_size; i++) {
1088                 if (i && !(i % 16))
1089                         log_std("\n\t\t");
1090                 log_std("%02hhx ", (char)vk[i]);
1091         }
1092         log_std("\n");
1093
1094 out:
1095         crypt_safe_free(password);
1096         crypt_safe_free(vk);
1097         return r;
1098 }
1099
1100 static int action_luksDump(void)
1101 {
1102         struct crypt_device *cd = NULL;
1103         int r;
1104
1105         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1106                 goto out;
1107
1108         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1109                 goto out;
1110
1111         if (opt_dump_master_key)
1112                 r = luksDump_with_volume_key(cd);
1113         else
1114                 r = crypt_dump(cd);
1115 out:
1116         crypt_free(cd);
1117         return r;
1118 }
1119
1120 static int action_luksSuspend(void)
1121 {
1122         struct crypt_device *cd = NULL;
1123         int r;
1124
1125         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
1126         if (!r)
1127                 r = crypt_suspend(cd, action_argv[0]);
1128
1129         crypt_free(cd);
1130         return r;
1131 }
1132
1133 static int action_luksResume(void)
1134 {
1135         struct crypt_device *cd = NULL;
1136         int r;
1137
1138         if ((r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device)))
1139                 goto out;
1140
1141         crypt_set_timeout(cd, opt_timeout);
1142         crypt_set_password_retry(cd, opt_tries);
1143         crypt_set_password_verify(cd, _verify_passphrase(0));
1144
1145         if (opt_key_file)
1146                 r = crypt_resume_by_keyfile_offset(cd, action_argv[0], CRYPT_ANY_SLOT,
1147                         opt_key_file, opt_keyfile_size, opt_keyfile_offset);
1148         else
1149                 r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
1150                                                NULL, 0);
1151 out:
1152         crypt_free(cd);
1153         return r;
1154 }
1155
1156 static int action_luksBackup(void)
1157 {
1158         struct crypt_device *cd = NULL;
1159         int r;
1160
1161         if (!opt_header_backup_file) {
1162                 log_err(_("Option --header-backup-file is required.\n"));
1163                 return -EINVAL;
1164         }
1165
1166         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1167                 goto out;
1168
1169         crypt_set_confirm_callback(cd, yesDialog, NULL);
1170
1171         r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
1172 out:
1173         crypt_free(cd);
1174         return r;
1175 }
1176
1177 static int action_luksRestore(void)
1178 {
1179         struct crypt_device *cd = NULL;
1180         int r = 0;
1181
1182         if (!opt_header_backup_file) {
1183                 log_err(_("Option --header-backup-file is required.\n"));
1184                 return -EINVAL;
1185         }
1186
1187         if ((r = crypt_init(&cd, action_argv[0])))
1188                 goto out;
1189
1190         crypt_set_confirm_callback(cd, yesDialog, NULL);
1191         r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
1192 out:
1193         crypt_free(cd);
1194         return r;
1195 }
1196
1197 static int action_open(void)
1198 {
1199         if (!opt_type)
1200                 return -EINVAL;
1201
1202         if (!strcmp(opt_type, "luks") || !strcmp(opt_type, "luks1")) {
1203                 if (action_argc < 2 && !opt_test_passphrase)
1204                         goto args;
1205                 return action_open_luks();
1206         } else if (!strcmp(opt_type, "plain")) {
1207                 if (action_argc < 2)
1208                         goto args;
1209                 return action_open_plain();
1210         } else if (!strcmp(opt_type, "loopaes")) {
1211                 if (action_argc < 2)
1212                         goto args;
1213                 return action_open_loopaes();
1214         } else if (!strcmp(opt_type, "tcrypt")) {
1215                 if (action_argc < 2 && !opt_test_passphrase)
1216                         goto args;
1217                 return action_open_tcrypt();
1218         }
1219
1220         log_err(_("Unrecognized metadata device type %s.\n"), opt_type);
1221         return -EINVAL;
1222 args:
1223         log_err(_("Command requires device and mapped name as arguments.\n"));
1224         return -EINVAL;
1225 }
1226
1227 static struct action_type {
1228         const char *type;
1229         int (*handler)(void);
1230         int required_action_argc;
1231         int required_memlock;
1232         const char *arg_desc;
1233         const char *desc;
1234 } action_types[] = {
1235         { "open",         action_open,         1, 1, N_("<device> [--type <type>] [<name>]"),N_("open device as mapping <name>") },
1236         { "close",        action_close,        1, 1, N_("<name>"), N_("close device (remove mapping)") },
1237         { "resize",       action_resize,       1, 1, N_("<name>"), N_("resize active device") },
1238         { "status",       action_status,       1, 0, N_("<name>"), N_("show device status") },
1239         { "benchmark",    action_benchmark,    0, 0, N_("<name>"), N_("benchmark cipher") },
1240         { "repair",       action_luksRepair,   1, 1, N_("<device>"), N_("try to repair on-disk metadata") },
1241         { "luksFormat",   action_luksFormat,   1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
1242         { "luksAddKey",   action_luksAddKey,   1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
1243         { "luksRemoveKey",action_luksRemoveKey,1, 1, N_("<device> [<key file>]"), N_("removes supplied key or key file from LUKS device") },
1244         { "luksChangeKey",action_luksChangeKey,1, 1, N_("<device> [<key file>]"), N_("changes supplied key or key file of LUKS device") },
1245         { "luksKillSlot", action_luksKillSlot, 2, 1, N_("<device> <key slot>"), N_("wipes key with number <key slot> from LUKS device") },
1246         { "luksUUID",     action_luksUUID,     1, 0, N_("<device>"), N_("print UUID of LUKS device") },
1247         { "isLuks",       action_isLuks,       1, 0, N_("<device>"), N_("tests <device> for LUKS partition header") },
1248         { "luksDump",     action_luksDump,     1, 1, N_("<device>"), N_("dump LUKS partition information") },
1249         { "tcryptDump",   action_tcryptDump,   1, 1, N_("<device>"), N_("dump TCRYPT device information") },
1250         { "luksSuspend",  action_luksSuspend,  1, 1, N_("<device>"), N_("Suspend LUKS device and wipe key (all IOs are frozen).") },
1251         { "luksResume",   action_luksResume,   1, 1, N_("<device>"), N_("Resume suspended LUKS device.") },
1252         { "luksHeaderBackup", action_luksBackup,1,1, N_("<device>"), N_("Backup LUKS device header and keyslots") },
1253         { "luksHeaderRestore",action_luksRestore,1,1,N_("<device>"), N_("Restore LUKS device header and keyslots") },
1254         {}
1255 };
1256
1257 static void help(poptContext popt_context,
1258                  enum poptCallbackReason reason __attribute__((unused)),
1259                  struct poptOption *key,
1260                  const char *arg __attribute__((unused)),
1261                  void *data __attribute__((unused)))
1262 {
1263         if (key->shortName == '?') {
1264                 struct action_type *action;
1265
1266                 log_std("%s\n",PACKAGE_STRING);
1267
1268                 poptPrintHelp(popt_context, stdout, 0);
1269
1270                 log_std(_("\n"
1271                          "<action> is one of:\n"));
1272
1273                 for(action = action_types; action->type; action++)
1274                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
1275
1276                 log_std(_("\n"
1277                           "You can also use old <action> syntax aliases:\n"
1278                           "\topen: create (plainOpen), luksOpen, loopaesOpen, tcryptOpen\n"
1279                           "\tclose: remove (plainClose), luksClose, loopaesClose, tcryptClose\n"));
1280                 log_std(_("\n"
1281                          "<name> is the device to create under %s\n"
1282                          "<device> is the encrypted device\n"
1283                          "<key slot> is the LUKS key slot number to modify\n"
1284                          "<key file> optional key file for the new key for luksAddKey action\n"),
1285                         crypt_get_dir());
1286
1287                 log_std(_("\nDefault compiled-in key and passphrase parameters:\n"
1288                          "\tMaximum keyfile size: %dkB, "
1289                          "Maximum interactive passphrase length %d (characters)\n"
1290                          "Default PBKDF2 iteration time for LUKS: %d (ms)\n"),
1291                          DEFAULT_KEYFILE_SIZE_MAXKB, DEFAULT_PASSPHRASE_SIZE_MAX,
1292                          DEFAULT_LUKS1_ITER_TIME);
1293
1294                 log_std(_("\nDefault compiled-in device cipher parameters:\n"
1295                          "\tloop-AES: %s, Key %d bits\n"
1296                          "\tplain: %s, Key: %d bits, Password hashing: %s\n"
1297                          "\tLUKS1: %s, Key: %d bits, LUKS header hashing: %s, RNG: %s\n"),
1298                          DEFAULT_LOOPAES_CIPHER, DEFAULT_LOOPAES_KEYBITS,
1299                          DEFAULT_CIPHER(PLAIN), DEFAULT_PLAIN_KEYBITS, DEFAULT_PLAIN_HASH,
1300                          DEFAULT_CIPHER(LUKS1), DEFAULT_LUKS1_KEYBITS, DEFAULT_LUKS1_HASH,
1301                          DEFAULT_RNG);
1302                 exit(EXIT_SUCCESS);
1303         } else
1304                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
1305 }
1306
1307 static void help_args(struct action_type *action, poptContext popt_context)
1308 {
1309         char buf[128];
1310
1311         snprintf(buf, sizeof(buf), _("%s: requires %s as arguments"), action->type, action->arg_desc);
1312         usage(popt_context, EXIT_FAILURE, buf, poptGetInvocationName(popt_context));
1313 }
1314
1315 static int run_action(struct action_type *action)
1316 {
1317         int r;
1318
1319         log_dbg("Running command %s.", action->type);
1320
1321         if (action->required_memlock)
1322                 crypt_memory_lock(NULL, 1);
1323
1324         set_int_handler(0);
1325         r = action->handler();
1326
1327         if (action->required_memlock)
1328                 crypt_memory_lock(NULL, 0);
1329
1330         /* Some functions returns keyslot # */
1331         if (r > 0)
1332                 r = 0;
1333         check_signal(&r);
1334
1335         show_status(r);
1336         return translate_errno(r);
1337 }
1338
1339 int main(int argc, const char **argv)
1340 {
1341         static char *popt_tmp;
1342         static struct poptOption popt_help_options[] = {
1343                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
1344                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
1345                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
1346                 POPT_TABLEEND
1347         };
1348         static struct poptOption popt_options[] = {
1349                 { NULL,                '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
1350                 { "version",           '\0', POPT_ARG_NONE, &opt_version_mode,          0, N_("Print package version"), NULL },
1351                 { "verbose",           'v',  POPT_ARG_NONE, &opt_verbose,               0, N_("Shows more detailed error messages"), NULL },
1352                 { "debug",             '\0', POPT_ARG_NONE, &opt_debug,                 0, N_("Show debug messages"), NULL },
1353                 { "cipher",            'c',  POPT_ARG_STRING, &opt_cipher,              0, N_("The cipher used to encrypt the disk (see /proc/crypto)"), NULL },
1354                 { "hash",              'h',  POPT_ARG_STRING, &opt_hash,                0, N_("The hash used to create the encryption key from the passphrase"), NULL },
1355                 { "verify-passphrase", 'y',  POPT_ARG_NONE, &opt_verify_passphrase,     0, N_("Verifies the passphrase by asking for it twice"), NULL },
1356                 { "key-file",          'd',  POPT_ARG_STRING, &opt_key_file,            5, N_("Read the key from a file."), NULL },
1357                 { "master-key-file",  '\0',  POPT_ARG_STRING, &opt_master_key_file,     0, N_("Read the volume (master) key from file."), NULL },
1358                 { "dump-master-key",  '\0',  POPT_ARG_NONE, &opt_dump_master_key,       0, N_("Dump volume (master) key instead of keyslots info."), NULL },
1359                 { "key-size",          's',  POPT_ARG_INT, &opt_key_size,               0, N_("The size of the encryption key"), N_("BITS") },
1360                 { "keyfile-size",      'l',  POPT_ARG_LONG, &opt_keyfile_size,          0, N_("Limits the read from keyfile"), N_("bytes") },
1361                 { "keyfile-offset",   '\0',  POPT_ARG_LONG, &opt_keyfile_offset,        0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
1362                 { "new-keyfile-size", '\0',  POPT_ARG_LONG, &opt_new_keyfile_size,      0, N_("Limits the read from newly added keyfile"), N_("bytes") },
1363                 { "new-keyfile-offset",'\0', POPT_ARG_LONG, &opt_new_keyfile_offset,    0, N_("Number of bytes to skip in newly added keyfile"), N_("bytes") },
1364                 { "key-slot",          'S',  POPT_ARG_INT, &opt_key_slot,               0, N_("Slot number for new key (default is first free)"), NULL },
1365                 { "size",              'b',  POPT_ARG_STRING, &popt_tmp,                1, N_("The size of the device"), N_("SECTORS") },
1366                 { "offset",            'o',  POPT_ARG_STRING, &popt_tmp,                2, N_("The start offset in the backend device"), N_("SECTORS") },
1367                 { "skip",              'p',  POPT_ARG_STRING, &popt_tmp,                3, N_("How many sectors of the encrypted data to skip at the beginning"), N_("SECTORS") },
1368                 { "readonly",          'r',  POPT_ARG_NONE, &opt_readonly,              0, N_("Create a readonly mapping"), NULL },
1369                 { "iter-time",         'i',  POPT_ARG_INT, &opt_iteration_time,         0, N_("PBKDF2 iteration time for LUKS (in ms)"), N_("msecs") },
1370                 { "batch-mode",        'q',  POPT_ARG_NONE, &opt_batch_mode,            0, N_("Do not ask for confirmation"), NULL },
1371                 { "timeout",           't',  POPT_ARG_INT, &opt_timeout,                0, N_("Timeout for interactive passphrase prompt (in seconds)"), N_("secs") },
1372                 { "tries",             'T',  POPT_ARG_INT, &opt_tries,                  0, N_("How often the input of the passphrase can be retried"), NULL },
1373                 { "align-payload",     '\0', POPT_ARG_INT, &opt_align_payload,          0, N_("Align payload at <n> sector boundaries - for luksFormat"), N_("SECTORS") },
1374                 { "header-backup-file",'\0', POPT_ARG_STRING, &opt_header_backup_file,  0, N_("File with LUKS header and keyslots backup."), NULL },
1375                 { "use-random",        '\0', POPT_ARG_NONE, &opt_random,                0, N_("Use /dev/random for generating volume key."), NULL },
1376                 { "use-urandom",       '\0', POPT_ARG_NONE, &opt_urandom,               0, N_("Use /dev/urandom for generating volume key."), NULL },
1377                 { "shared",            '\0', POPT_ARG_NONE, &opt_shared,                0, N_("Share device with another non-overlapping crypt segment."), NULL },
1378                 { "uuid",              '\0', POPT_ARG_STRING, &opt_uuid,                0, N_("UUID for device to use."), NULL },
1379                 { "allow-discards",    '\0', POPT_ARG_NONE, &opt_allow_discards,        0, N_("Allow discards (aka TRIM) requests for device."), NULL },
1380                 { "header",            '\0', POPT_ARG_STRING, &opt_header_device,       0, N_("Device or file with separated LUKS header."), NULL },
1381                 { "test-passphrase",   '\0', POPT_ARG_NONE, &opt_test_passphrase,       0, N_("Do not activate device, just check passphrase."), NULL },
1382                 { "tcrypt-hidden",     '\0', POPT_ARG_NONE, &opt_tcrypt_hidden,         0, N_("Use hidden header (hidden TCRYPT device)."), NULL },
1383                 { "tcrypt-system",     '\0', POPT_ARG_NONE, &opt_tcrypt_system,         0, N_("Device is system TCRYPT drive (with bootloader)."), NULL },
1384                 { "type",               'M', POPT_ARG_STRING, &opt_type,                0, N_("Type of device metadata: luks, plain, loopaes, tcrypt."), NULL },
1385                 { "force-password",    '\0', POPT_ARG_NONE, &opt_force_password,        0, N_("Disable password quality check (if enabled)."), NULL },
1386                 POPT_TABLEEND
1387         };
1388         poptContext popt_context;
1389         struct action_type *action;
1390         const char *aname;
1391         int r;
1392
1393         crypt_set_log_callback(NULL, tool_log, NULL);
1394
1395         setlocale(LC_ALL, "");
1396         bindtextdomain(PACKAGE, LOCALEDIR);
1397         textdomain(PACKAGE);
1398
1399         crypt_fips_self_check(NULL);
1400
1401         popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
1402         poptSetOtherOptionHelp(popt_context,
1403                                _("[OPTION...] <action> <action-specific>"));
1404
1405         while((r = poptGetNextOpt(popt_context)) > 0) {
1406                 unsigned long long ull_value;
1407                 char *endp;
1408
1409                 if (r == 5) {
1410                         if (opt_keyfiles_count < MAX_KEYFILES)
1411                                 opt_keyfiles[opt_keyfiles_count++] = poptGetOptArg(popt_context);
1412                         continue;
1413                 }
1414
1415                 errno = 0;
1416                 ull_value = strtoull(popt_tmp, &endp, 0);
1417                 if (*endp || !*popt_tmp ||
1418                     (errno == ERANGE && ull_value == ULLONG_MAX) ||
1419                     (errno != 0 && ull_value == 0))
1420                         r = POPT_ERROR_BADNUMBER;
1421
1422                 switch(r) {
1423                         case 1:
1424                                 opt_size = ull_value;
1425                                 break;
1426                         case 2:
1427                                 opt_offset = ull_value;
1428                                 break;
1429                         case 3:
1430                                 opt_skip = ull_value;
1431                                 opt_skip_valid = 1;
1432                                 break;
1433                 }
1434
1435                 if (r < 0)
1436                         break;
1437         }
1438
1439         if (r < -1)
1440                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
1441                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
1442         if (opt_version_mode) {
1443                 log_std("%s %s\n", PACKAGE_NAME, PACKAGE_VERSION);
1444                 poptFreeContext(popt_context);
1445                 exit(EXIT_SUCCESS);
1446         }
1447
1448         if (!(aname = poptGetArg(popt_context)))
1449                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
1450                       poptGetInvocationName(popt_context));
1451
1452         action_argc = 0;
1453         action_argv = poptGetArgs(popt_context);
1454         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
1455         if(!action_argv)
1456                 action_argv = null_action_argv;
1457
1458         /* Count args, somewhat unnice, change? */
1459         while(action_argv[action_argc] != NULL)
1460                 action_argc++;
1461
1462         /* Handle aliases */
1463         if (!strcmp(aname, "create")) {
1464                 /* create command had historically switched arguments */
1465                 if (action_argv[0] && action_argv[1]) {
1466                         const char *tmp = action_argv[0];
1467                         action_argv[0] = action_argv[1];
1468                         action_argv[1] = tmp;
1469                 }
1470                 aname = "open";
1471                 opt_type = "plain";
1472         } else if (!strcmp(aname, "plainOpen")) {
1473                 aname = "open";
1474                 opt_type = "plain";
1475         } else if (!strcmp(aname, "luksOpen")) {
1476                 aname = "open";
1477                 opt_type = "luks";
1478         } else if (!strcmp(aname, "loopaesOpen")) {
1479                 aname = "open";
1480                 opt_type = "loopaes";
1481         } else if (!strcmp(aname, "tcryptOpen")) {
1482                 aname = "open";
1483                 opt_type = "tcrypt";
1484         } else if (!strcmp(aname, "remove") ||
1485                    !strcmp(aname, "plainClose") ||
1486                    !strcmp(aname, "luksClose") ||
1487                    !strcmp(aname, "loopaesClose") ||
1488                    !strcmp(aname, "tcryptClose")) {
1489                 aname = "close";
1490         }
1491
1492         for(action = action_types; action->type; action++)
1493                 if (strcmp(action->type, aname) == 0)
1494                         break;
1495
1496         if (!action->type)
1497                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
1498                       poptGetInvocationName(popt_context));
1499
1500         if(action_argc < action->required_action_argc)
1501                 help_args(action, popt_context);
1502
1503         /* FIXME: rewrite this from scratch */
1504
1505         if (opt_shared && (strcmp(aname, "open") || strcmp(opt_type, "plain")) )
1506                 usage(popt_context, EXIT_FAILURE,
1507                       _("Option --shared is allowed only for open of plain device.\n"),
1508                       poptGetInvocationName(popt_context));
1509
1510         if (opt_allow_discards && strcmp(aname, "open"))
1511                 usage(popt_context, EXIT_FAILURE,
1512                       _("Option --allow-discards is allowed only for open operation.\n"),
1513                       poptGetInvocationName(popt_context));
1514
1515         if (opt_key_size &&
1516            strcmp(aname, "luksFormat") &&
1517            strcmp(aname, "open") &&
1518            strcmp(aname, "benchmark"))
1519                 usage(popt_context, EXIT_FAILURE,
1520                       _("Option --key-size is allowed only for luksFormat, open and benchmark.\n"
1521                         "To limit read from keyfile use --keyfile-size=(bytes)."),
1522                       poptGetInvocationName(popt_context));
1523
1524         if (opt_test_passphrase && (strcmp(aname, "open") ||
1525             (strcmp(opt_type, "luks") && strcmp(opt_type, "tcrypt"))))
1526                 usage(popt_context, EXIT_FAILURE,
1527                       _("Option --test-passphrase is allowed only for open of LUKS and TCRYPT devices.\n"),
1528                       poptGetInvocationName(popt_context));
1529
1530         if (opt_key_size % 8)
1531                 usage(popt_context, EXIT_FAILURE,
1532                       _("Key size must be a multiple of 8 bits"),
1533                       poptGetInvocationName(popt_context));
1534
1535         if (!strcmp(aname, "luksKillSlot") && action_argc > 1)
1536                 opt_key_slot = atoi(action_argv[1]);
1537         if (opt_key_slot != CRYPT_ANY_SLOT &&
1538             (opt_key_slot < 0 || opt_key_slot >= crypt_keyslot_max(CRYPT_LUKS1)))
1539                 usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."),
1540                       poptGetInvocationName(popt_context));
1541
1542         if ((!strcmp(aname, "luksRemoveKey") ||
1543              !strcmp(aname, "luksFormat")) &&
1544              action_argc > 1) {
1545                 if (opt_key_file)
1546                         log_err(_("Option --key-file takes precedence over specified key file argument.\n"));
1547                 else
1548                         opt_key_file = action_argv[1];
1549         }
1550
1551         if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0 ||
1552             opt_keyfile_offset < 0 || opt_new_keyfile_offset < 0)
1553                 usage(popt_context, EXIT_FAILURE,
1554                       _("Negative number for option not permitted."),
1555                       poptGetInvocationName(popt_context));
1556
1557         if (opt_random && opt_urandom)
1558                 usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
1559                       poptGetInvocationName(popt_context));
1560
1561         if ((opt_random || opt_urandom) && strcmp(aname, "luksFormat"))
1562                 usage(popt_context, EXIT_FAILURE, _("Option --use-[u]random is allowed only for luksFormat."),
1563                       poptGetInvocationName(popt_context));
1564
1565         if (opt_uuid && strcmp(aname, "luksFormat") && strcmp(aname, "luksUUID"))
1566                 usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed only for luksFormat and luksUUID."),
1567                       poptGetInvocationName(popt_context));
1568
1569         if (opt_align_payload && strcmp(aname, "luksFormat"))
1570                 usage(popt_context, EXIT_FAILURE, _("Option --align-payload is allowed only for luksFormat."),
1571                       poptGetInvocationName(popt_context));
1572
1573         if (opt_skip && (strcmp(aname, "open") ||
1574             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1575                 usage(popt_context, EXIT_FAILURE,
1576                 _("Option --skip is supported only for open of plain and loopaes devices.\n"),
1577                 poptGetInvocationName(popt_context));
1578
1579         if (opt_offset && (strcmp(aname, "open") ||
1580             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1581                 usage(popt_context, EXIT_FAILURE,
1582                 _("Option --offset is supported only for open of plain and loopaes devices.\n"),
1583                 poptGetInvocationName(popt_context));
1584
1585         if ((opt_tcrypt_hidden || opt_tcrypt_system) && strcmp(aname, "tcryptDump") &&
1586             (strcmp(aname, "open") || strcmp(opt_type, "tcrypt")))
1587                 usage(popt_context, EXIT_FAILURE,
1588                 _("Option --tcrypt-hidden or --tcrypt-system is supported only for TCRYPT device.\n"),
1589                 poptGetInvocationName(popt_context));
1590
1591         if (opt_debug) {
1592                 opt_verbose = 1;
1593                 crypt_set_debug_level(-1);
1594                 dbg_version_and_cmd(argc, argv);
1595         }
1596
1597         r = run_action(action);
1598         poptFreeContext(popt_context);
1599         return r;
1600 }