src/cryptsetup.c

   1 /*
   2  * cryptsetup - setup cryptographic volumes for dm-crypt
   3  *
   4  * Copyright (C) 2004, Christophe Saout <christophe@saout.de>
   5  * Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
   6  * Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
   7  * Copyright (C) 2009-2013, Milan Broz
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU General Public License
  11  * as published by the Free Software Foundation; either version 2
  12  * of the License, or (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  22  */
  23
  24 #include "cryptsetup.h"
  25
  26 static const char *opt_cipher = NULL;
  27 static const char *opt_hash = NULL;
  28 static int opt_verify_passphrase = 0;
  29
  30 static const char *opt_key_file = NULL;
  31 static int opt_keyfiles_count = 0;
  32 static const char *opt_keyfiles[MAX_KEYFILES];
  33
  34 static const char *opt_master_key_file = NULL;
  35 static const char *opt_header_backup_file = NULL;
  36 static const char *opt_uuid = NULL;
  37 static const char *opt_header_device = NULL;
  38 static const char *opt_type = "luks";
  39 static int opt_key_size = 0;
  40 static long opt_keyfile_size = 0;
  41 static long opt_new_keyfile_size = 0;
  42 static long opt_keyfile_offset = 0;
  43 static long opt_new_keyfile_offset = 0;
  44 static int opt_key_slot = CRYPT_ANY_SLOT;
  45 static uint64_t opt_size = 0;
  46 static uint64_t opt_offset = 0;
  47 static uint64_t opt_skip = 0;
  48 static int opt_skip_valid = 0;
  49 static int opt_readonly = 0;
  50 static int opt_iteration_time = DEFAULT_LUKS1_ITER_TIME;
  51 static int opt_version_mode = 0;
  52 static int opt_timeout = 0;
  53 static int opt_tries = 3;
  54 static int opt_align_payload = 0;
  55 static int opt_random = 0;
  56 static int opt_urandom = 0;
  57 static int opt_dump_master_key = 0;
  58 static int opt_shared = 0;
  59 static int opt_allow_discards = 0;
  60 static int opt_test_passphrase = 0;
  61 static int opt_tcrypt_hidden = 0;
  62 static int opt_tcrypt_system = 0;
  63
  64 static const char **action_argv;
  65 static int action_argc;
  66 static const char *null_action_argv[] = {NULL, NULL};
  67
  68 static int _verify_passphrase(int def)
  69 {
  70         /* Batch mode switch off verify - if not overrided by -y */
  71         if (opt_verify_passphrase)
  72                 def = 1;
  73         else if (opt_batch_mode)
  74                 def = 0;
  75
  76         /* Non-tty input doesn't allow verify */
  77         if (def && !isatty(STDIN_FILENO)) {
  78                 if (opt_verify_passphrase)
  79                         log_err(_("Can't do passphrase verification on non-tty inputs.\n"));
  80                 def = 0;
  81         }
  82
  83         return def;
  84 }
  85
  86 static int action_open_plain(void)
  87 {
  88         struct crypt_device *cd = NULL;
  89         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
  90         struct crypt_params_plain params = {
  91                 .hash = opt_hash ?: DEFAULT_PLAIN_HASH,
  92                 .skip = opt_skip,
  93                 .offset = opt_offset,
  94                 .size = opt_size,
  95         };
  96         char *password = NULL;
  97         size_t passwordLen;
  98         size_t key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS) / 8;
  99         uint32_t activate_flags = 0;
 100         int r;
 101
 102         if (params.hash && !strcmp(params.hash, "plain"))
 103                 params.hash = NULL;
 104
 105         /* FIXME: temporary hack */
 106         if (opt_key_file && strcmp(opt_key_file, "-"))
 107                 params.hash = NULL;
 108
 109         if ((opt_keyfile_offset || opt_keyfile_size) && opt_key_file)
 110                 log_std(_("Ignoring keyfile offset and size options, keyfile read "
 111                          "size is always the same as encryption key size.\n"));
 112
 113         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(PLAIN),
 114                                       cipher, NULL, cipher_mode);
 115         if (r < 0) {
 116                 log_err(_("No known cipher specification pattern detected.\n"));
 117                 goto out;
 118         }
 119
 120         if ((r = crypt_init(&cd, action_argv[0])))
 121                 goto out;
 122
 123         crypt_set_timeout(cd, opt_timeout);
 124         crypt_set_password_retry(cd, opt_tries);
 125
 126         r = crypt_format(cd, CRYPT_PLAIN,
 127                          cipher, cipher_mode,
 128                          NULL, NULL,
 129                          key_size,
 130                          &params);
 131         check_signal(&r);
 132         if (r < 0)
 133                 goto out;
 134
 135         if (opt_readonly)
 136                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 137
 138         if (opt_shared)
 139                 activate_flags |= CRYPT_ACTIVATE_SHARED;
 140
 141         if (opt_allow_discards)
 142                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 143
 144         if (opt_key_file)
 145                 /* With hashing, read the whole keyfile */
 146                 r = crypt_activate_by_keyfile_offset(cd, action_argv[1],
 147                         CRYPT_ANY_SLOT, opt_key_file,
 148                         params.hash ? 0 : key_size, 0,
 149                         activate_flags);
 150         else {
 151                 r = tools_get_key(_("Enter passphrase: "),
 152                                   &password, &passwordLen,
 153                                   opt_keyfile_offset, opt_keyfile_size,
 154                                   NULL, opt_timeout,
 155                                   _verify_passphrase(0), 0,
 156                                   cd);
 157                 if (r < 0)
 158                         goto out;
 159
 160                 r = crypt_activate_by_passphrase(cd, action_argv[1],
 161                         CRYPT_ANY_SLOT, password, passwordLen, activate_flags);
 162         }
 163 out:
 164         crypt_free(cd);
 165         crypt_safe_free(password);
 166
 167         return r;
 168 }
 169
 170 static int action_open_loopaes(void)
 171 {
 172         struct crypt_device *cd = NULL;
 173         struct crypt_params_loopaes params = {
 174                 .hash = opt_hash ?: NULL,
 175                 .offset = opt_offset,
 176                 .skip = opt_skip_valid ? opt_skip : opt_offset,
 177         };
 178         unsigned int key_size = (opt_key_size ?: DEFAULT_LOOPAES_KEYBITS) / 8;
 179         uint32_t activate_flags = 0;
 180         int r;
 181
 182         if (!opt_key_file) {
 183                 log_err(_("Option --key-file is required.\n"));
 184                 return -EINVAL;
 185         }
 186
 187         if (opt_readonly)
 188                 activate_flags |= CRYPT_ACTIVATE_READONLY;
 189
 190         if (opt_allow_discards)
 191                 activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 192
 193         if ((r = crypt_init(&cd, action_argv[0])))
 194                 goto out;
 195
 196         r = crypt_format(cd, CRYPT_LOOPAES, opt_cipher ?: DEFAULT_LOOPAES_CIPHER,
 197                          NULL, NULL, NULL, key_size, &params);
 198         check_signal(&r);
 199         if (r < 0)
 200                 goto out;
 201
 202         r = crypt_activate_by_keyfile_offset(cd, action_argv[1], CRYPT_ANY_SLOT,
 203                                       opt_key_file, opt_keyfile_size,
 204                                       opt_keyfile_size, activate_flags);
 205 out:
 206         crypt_free(cd);
 207
 208         return r;
 209 }
 210
 211 static int action_open_tcrypt(void)
 212 {
 213         struct crypt_device *cd = NULL;
 214         struct crypt_params_tcrypt params = {
 215                 .keyfiles = opt_keyfiles,
 216                 .keyfiles_count = opt_keyfiles_count,
 217                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 218         };
 219         const char *activated_name;
 220         uint32_t flags = 0;
 221         int r;
 222
 223         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 224
 225         if ((r = crypt_init(&cd, action_argv[0])))
 226                 goto out;
 227
 228         /* TCRYPT header is encrypted, get passphrase now */
 229         r = tools_get_key(_("Enter passphrase: "),
 230                           CONST_CAST(char**)&params.passphrase,
 231                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 232                           _verify_passphrase(0), 0, cd);
 233         if (r < 0)
 234                 goto out;
 235
 236         if (opt_tcrypt_hidden)
 237                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 238
 239         if (opt_tcrypt_system)
 240                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 241
 242         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 243         check_signal(&r);
 244         if (r < 0)
 245                 goto out;
 246
 247         if (opt_readonly)
 248                 flags |= CRYPT_ACTIVATE_READONLY;
 249
 250         if (activated_name)
 251                 r = crypt_activate_by_volume_key(cd, activated_name, NULL, 0, flags);
 252 out:
 253         if (r == -EPERM)
 254                 log_err(_("No device header detected with this passphrase.\n"));
 255         crypt_free(cd);
 256         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 257         return r;
 258 }
 259
 260 static int tcryptDump_with_volume_key(struct crypt_device *cd)
 261 {
 262         char *vk = NULL;
 263         size_t vk_size;
 264         unsigned i;
 265         int r;
 266
 267         crypt_set_confirm_callback(cd, yesDialog, NULL);
 268         if (!yesDialog(
 269             _("Header dump with volume key is sensitive information\n"
 270               "which allows access to encrypted partition without passphrase.\n"
 271               "This dump should be always stored encrypted on safe place."),
 272               NULL))
 273                 return -EPERM;
 274
 275         vk_size = crypt_get_volume_key_size(cd);
 276         vk = crypt_safe_alloc(vk_size);
 277         if (!vk)
 278                 return -ENOMEM;
 279
 280         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size, NULL, 0);
 281         if (r < 0)
 282                 goto out;
 283
 284         log_std("TCRYPT header information for %s\n", crypt_get_device_name(cd));
 285         log_std("Cipher chain:  \t%s\n", crypt_get_cipher(cd));
 286         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
 287         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
 288         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
 289         log_std("MK dump:\t");
 290
 291         for(i = 0; i < vk_size; i++) {
 292                 if (i && !(i % 16))
 293                         log_std("\n\t\t");
 294                 log_std("%02hhx ", (char)vk[i]);
 295         }
 296         log_std("\n");
 297 out:
 298         crypt_safe_free(vk);
 299         return r;
 300 }
 301
 302 static int action_tcryptDump(void)
 303 {
 304         struct crypt_device *cd = NULL;
 305         struct crypt_params_tcrypt params = {
 306                 .keyfiles = opt_keyfiles,
 307                 .keyfiles_count = opt_keyfiles_count,
 308                 .flags = CRYPT_TCRYPT_LEGACY_MODES,
 309         };
 310         int r;
 311
 312         if ((r = crypt_init(&cd, action_argv[0])))
 313                 goto out;
 314
 315         /* TCRYPT header is encrypted, get passphrase now */
 316         r = tools_get_key(_("Enter passphrase: "),
 317                           CONST_CAST(char**)&params.passphrase,
 318                           &params.passphrase_size, 0, 0, NULL, opt_timeout,
 319                           _verify_passphrase(0), 0, cd);
 320         if (r < 0)
 321                 goto out;
 322
 323         if (opt_tcrypt_hidden)
 324                 params.flags |= CRYPT_TCRYPT_HIDDEN_HEADER;
 325
 326         if (opt_tcrypt_system)
 327                 params.flags |= CRYPT_TCRYPT_SYSTEM_HEADER;
 328
 329         r = crypt_load(cd, CRYPT_TCRYPT, &params);
 330         check_signal(&r);
 331         if (r < 0)
 332                 goto out;
 333
 334         if (opt_dump_master_key)
 335                 r = tcryptDump_with_volume_key(cd);
 336         else
 337                 r = crypt_dump(cd);
 338 out:
 339         if (r == -EPERM)
 340                 log_err(_("No device header detected with this passphrase.\n"));
 341         crypt_free(cd);
 342         crypt_safe_free(CONST_CAST(char*)params.passphrase);
 343         return r;
 344 }
 345
 346 static int action_close(void)
 347 {
 348         struct crypt_device *cd = NULL;
 349         int r;
 350
 351         r = crypt_init_by_name(&cd, action_argv[0]);
 352         if (r == 0)
 353                 r = crypt_deactivate(cd, action_argv[0]);
 354
 355         crypt_free(cd);
 356         return r;
 357 }
 358
 359 static int action_resize(void)
 360 {
 361         struct crypt_device *cd = NULL;
 362         int r;
 363
 364         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 365         if (r == 0)
 366                 r = crypt_resize(cd, action_argv[0], opt_size);
 367
 368         crypt_free(cd);
 369         return r;
 370 }
 371
 372 static int action_status(void)
 373 {
 374         crypt_status_info ci;
 375         struct crypt_active_device cad;
 376         struct crypt_device *cd = NULL;
 377         char *backing_file;
 378         const char *device;
 379         int path = 0, r = 0;
 380
 381         /* perhaps a path, not a dm device name */
 382         if (strchr(action_argv[0], '/'))
 383                 path = 1;
 384
 385         ci = crypt_status(NULL, action_argv[0]);
 386         switch (ci) {
 387         case CRYPT_INVALID:
 388                 r = -EINVAL;
 389                 break;
 390         case CRYPT_INACTIVE:
 391                 if (path)
 392                         log_std("%s is inactive.\n", action_argv[0]);
 393                 else
 394                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 395                 r = -ENODEV;
 396                 break;
 397         case CRYPT_ACTIVE:
 398         case CRYPT_BUSY:
 399                 if (path)
 400                         log_std("%s is active%s.\n", action_argv[0],
 401                                 ci == CRYPT_BUSY ? " and is in use" : "");
 402                 else
 403                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 404                                 ci == CRYPT_BUSY ? " and is in use" : "");
 405
 406                 r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
 407                 if (r < 0 || !crypt_get_type(cd))
 408                         goto out;
 409
 410                 log_std("  type:    %s\n", crypt_get_type(cd));
 411
 412                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 413                 if (r < 0)
 414                         goto out;
 415
 416                 log_std("  cipher:  %s-%s\n", crypt_get_cipher(cd), crypt_get_cipher_mode(cd));
 417                 log_std("  keysize: %d bits\n", crypt_get_volume_key_size(cd) * 8);
 418                 device = crypt_get_device_name(cd);
 419                 log_std("  device:  %s\n", device);
 420                 if (crypt_loop_device(device)) {
 421                         backing_file = crypt_loop_backing_file(device);
 422                         log_std("  loop:    %s\n", backing_file);
 423                         free(backing_file);
 424                 }
 425                 log_std("  offset:  %" PRIu64 " sectors\n", cad.offset);
 426                 log_std("  size:    %" PRIu64 " sectors\n", cad.size);
 427                 if (cad.iv_offset)
 428                         log_std("  skipped: %" PRIu64 " sectors\n", cad.iv_offset);
 429                 log_std("  mode:    %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 430                                            "readonly" : "read/write");
 431                 if (cad.flags & CRYPT_ACTIVATE_ALLOW_DISCARDS)
 432                         log_std("  flags:   discards\n");
 433         }
 434 out:
 435         crypt_free(cd);
 436         if (r == -ENOTSUP)
 437                 r = 0;
 438         return r;
 439 }
 440
 441 static int action_benchmark_kdf(const char *hash)
 442 {
 443         uint64_t kdf_iters;
 444         int r;
 445
 446         r = crypt_benchmark_kdf(NULL, "pbkdf2", hash, "foo", 3, "bar", 3,
 447                                 &kdf_iters);
 448         if (r < 0)
 449                 log_std("PBKDF2-%-9s     N/A\n", hash);
 450         else
 451                 log_std("PBKDF2-%-9s %7" PRIu64 " iterations per second\n",
 452                         hash, kdf_iters);
 453         return r;
 454 }
 455
 456 static int action_benchmark(void)
 457 {
 458         static struct {
 459                 const char *cipher;
 460                 const char *mode;
 461                 size_t key_size;
 462                 size_t iv_size;
 463         } bciphers[] = {
 464                 { "aes",     "cbc", 16, 16 },
 465                 { "serpent", "cbc", 16, 16 },
 466                 { "twofish", "cbc", 16, 16 },
 467                 { "aes",     "cbc", 32, 16 },
 468                 { "serpent", "cbc", 32, 16 },
 469                 { "twofish", "cbc", 32, 16 },
 470                 { "aes",     "xts", 32, 16 },
 471                 { "serpent", "xts", 32, 16 },
 472                 { "twofish", "xts", 32, 16 },
 473                 { "aes",     "xts", 64, 16 },
 474                 { "serpent", "xts", 64, 16 },
 475                 { "twofish", "xts", 64, 16 },
 476                 {  NULL, NULL, 0, 0 }
 477         };
 478         static const char *bkdfs[] = {
 479                 "sha1", "sha256", "sha512", "ripemd160", "whirlpool", NULL
 480         };
 481         char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 482         double enc_mbr = 0, dec_mbr = 0;
 483         int key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS);
 484         int iv_size = 16, skipped = 0;
 485         int buffer_size = 1024 * 1024;
 486         char *c;
 487         int i, r;
 488
 489         log_std(_("# Tests are approximate using memory only (no storage IO).\n"));
 490         if (opt_hash) {
 491                 r = action_benchmark_kdf(opt_hash);
 492         } else if (opt_cipher) {
 493                 r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mode);
 494                 if (r < 0) {
 495                         log_err(_("No known cipher specification pattern detected.\n"));
 496                         return r;
 497                 }
 498                 if ((c  = strchr(cipher_mode, '-')))
 499                         *c = '\0';
 500
 501                 /* FIXME: not really clever :) */
 502                 if (strstr(cipher, "des") ||
 503                     strstr(cipher, "blowfish") ||
 504                     strstr(cipher, "cast5"))
 505                         iv_size = 8;
 506
 507                 r = crypt_benchmark(NULL, cipher, cipher_mode,
 508                                     key_size / 8, iv_size, buffer_size,
 509                                     &enc_mbr, &dec_mbr);
 510                 if (!r) {
 511                         log_std(N_("#  Algorithm | Key |  Encryption |  Decryption\n"));
 512                         log_std("%8s-%s  %4db  %6.1f MiB/s  %6.1f MiB/s\n",
 513                                 cipher, cipher_mode, key_size, enc_mbr, dec_mbr);
 514                 } else if (r == -ENOENT)
 515                         log_err(_("Cipher %s is not available.\n"), opt_cipher);
 516         } else {
 517                 for (i = 0; bkdfs[i]; i++) {
 518                         r = action_benchmark_kdf(bkdfs[i]);
 519                         check_signal(&r);
 520                         if (r == -EINTR)
 521                                 break;
 522                 }
 523                 for (i = 0; bciphers[i].cipher; i++) {
 524                         r = crypt_benchmark(NULL, bciphers[i].cipher, bciphers[i].mode,
 525                                             bciphers[i].key_size, bciphers[i].iv_size,
 526                                             buffer_size, &enc_mbr, &dec_mbr);
 527                         check_signal(&r);
 528                         if (r == -ENOTSUP || r == -EINTR)
 529                                 break;
 530                         if (r == -ENOENT)
 531                                 skipped++;
 532                         if (i == 0)
 533                                 log_std(N_("#  Algorithm | Key |  Encryption |  Decryption\n"));
 534
 535                         snprintf(cipher, MAX_CIPHER_LEN, "%s-%s",
 536                                  bciphers[i].cipher, bciphers[i].mode);
 537                         if (!r)
 538                                 log_std("%12s  %4db  %6.1f MiB/s  %6.1f MiB/s\n",
 539                                         cipher, bciphers[i].key_size*8, enc_mbr, dec_mbr);
 540                         else
 541                                 log_std("%12s  %4db %13s %13s\n", cipher,
 542                                         bciphers[i].key_size*8, _("N/A"), _("N/A"));
 543                 }
 544                 if (skipped && skipped == i)
 545                         r = -ENOTSUP;
 546         }
 547
 548         if (r == -ENOTSUP) {
 549                 log_err(_("Required kernel crypto interface not available.\n"));
 550 #ifdef ENABLE_AF_ALG
 551                 log_err( _("Ensure you have algif_skcipher kernel module loaded.\n"));
 552 #endif
 553         }
 554         return r;
 555 }
 556
 557 static int _read_mk(const char *file, char **key, int keysize)
 558 {
 559         int fd;
 560
 561         *key = crypt_safe_alloc(keysize);
 562         if (!*key)
 563                 return -ENOMEM;
 564
 565         fd = open(file, O_RDONLY);
 566         if (fd == -1) {
 567                 log_err(_("Cannot read keyfile %s.\n"), file);
 568                 goto fail;
 569         }
 570         if ((read(fd, *key, keysize) != keysize)) {
 571                 log_err(_("Cannot read %d bytes from keyfile %s.\n"), keysize, file);
 572                 close(fd);
 573                 goto fail;
 574         }
 575         close(fd);
 576         return 0;
 577 fail:
 578         crypt_safe_free(*key);
 579         *key = NULL;
 580         return -EINVAL;
 581 }
 582
 583 static int action_luksRepair(void)
 584 {
 585         struct crypt_device *cd = NULL;
 586         int r;
 587
 588         if ((r = crypt_init(&cd, action_argv[0])))
 589                 goto out;
 590
 591         /* Currently only LUKS1 allows repair */
 592         crypt_set_log_callback(cd, quiet_log, NULL);
 593         r = crypt_load(cd, CRYPT_LUKS1, NULL);
 594         crypt_set_log_callback(cd, tool_log, NULL);
 595         if (r == 0) {
 596                 log_verbose(_("No known problems detected for LUKS header.\n"));
 597                 goto out;
 598         }
 599
 600         r = yesDialog(_("Really try to repair LUKS device header?"),
 601                        NULL) ? 0 : -EINVAL;
 602         if (r == 0)
 603                 r = crypt_repair(cd, CRYPT_LUKS1, NULL);
 604 out:
 605         crypt_free(cd);
 606         return r;
 607 }
 608
 609 static int action_luksFormat(void)
 610 {
 611         int r = -EINVAL, keysize;
 612         const char *header_device;
 613         char *msg = NULL, *key = NULL, cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 614         char *password = NULL;
 615         size_t passwordLen;
 616         struct crypt_device *cd = NULL;
 617         struct crypt_params_luks1 params = {
 618                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 619                 .data_alignment = opt_align_payload,
 620                 .data_device = opt_header_device ? action_argv[0] : NULL,
 621         };
 622
 623         header_device = opt_header_device ?: action_argv[0];
 624
 625         if(asprintf(&msg, _("This will overwrite data on %s irrevocably."),
 626                     header_device) == -1) {
 627                 log_err(_("memory allocation error in action_luksFormat"));
 628                 r = -ENOMEM;
 629                 goto out;
 630         }
 631         r = yesDialog(msg, NULL) ? 0 : -EINVAL;
 632         free(msg);
 633         if (r < 0)
 634                 goto out;
 635
 636         r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 637                                       cipher, NULL, cipher_mode);
 638         if (r < 0) {
 639                 log_err(_("No known cipher specification pattern detected.\n"));
 640                 goto out;
 641         }
 642
 643         if ((r = crypt_init(&cd, header_device))) {
 644                 if (opt_header_device)
 645                         log_err(_("Cannot use %s as on-disk header.\n"), header_device);
 646                 goto out;
 647         }
 648
 649         keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
 650
 651         crypt_set_timeout(cd, opt_timeout);
 652         if (opt_iteration_time)
 653                 crypt_set_iteration_time(cd, opt_iteration_time);
 654
 655         if (opt_random)
 656                 crypt_set_rng_type(cd, CRYPT_RNG_RANDOM);
 657         else if (opt_urandom)
 658                 crypt_set_rng_type(cd, CRYPT_RNG_URANDOM);
 659
 660         r = tools_get_key(_("Enter passphrase: "), &password, &passwordLen,
 661                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 662                           opt_timeout, _verify_passphrase(1), 1, cd);
 663         if (r < 0)
 664                 goto out;
 665
 666         if (opt_master_key_file) {
 667                 r = _read_mk(opt_master_key_file, &key, keysize);
 668                 if (r < 0)
 669                         goto out;
 670         }
 671
 672         r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode,
 673                          opt_uuid, key, keysize, &params);
 674         check_signal(&r);
 675         if (r < 0)
 676                 goto out;
 677
 678         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 679                                             key, keysize,
 680                                             password, passwordLen);
 681 out:
 682         crypt_free(cd);
 683         crypt_safe_free(key);
 684         crypt_safe_free(password);
 685
 686         return r;
 687 }
 688
 689 static int action_open_luks(void)
 690 {
 691         struct crypt_device *cd = NULL;
 692         const char *data_device, *header_device, *activated_name;
 693         char *key = NULL;
 694         uint32_t flags = 0;
 695         int r, keysize;
 696
 697         if (opt_header_device) {
 698                 header_device = uuid_or_device(opt_header_device);
 699                 data_device = action_argv[0];
 700         } else {
 701                 header_device = uuid_or_device(action_argv[0]);
 702                 data_device = NULL;
 703         }
 704
 705         activated_name = opt_test_passphrase ? NULL : action_argv[1];
 706
 707         if ((r = crypt_init(&cd, header_device)))
 708                 goto out;
 709
 710         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 711                 goto out;
 712
 713         if (data_device &&
 714             (r = crypt_set_data_device(cd, data_device)))
 715                 goto out;
 716
 717         if (!data_device && (crypt_get_data_offset(cd) < 8)) {
 718                 log_err(_("Reduced data offset is allowed only for detached LUKS header.\n"));
 719                 r = -EINVAL;
 720                 goto out;
 721         }
 722
 723         crypt_set_timeout(cd, opt_timeout);
 724         crypt_set_password_retry(cd, opt_tries);
 725         crypt_set_password_verify(cd, _verify_passphrase(0));
 726
 727         if (opt_iteration_time)
 728                 crypt_set_iteration_time(cd, opt_iteration_time);
 729
 730         if (opt_readonly)
 731                 flags |= CRYPT_ACTIVATE_READONLY;
 732
 733         if (opt_allow_discards)
 734                 flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
 735
 736         if (opt_master_key_file) {
 737                 keysize = crypt_get_volume_key_size(cd);
 738                 r = _read_mk(opt_master_key_file, &key, keysize);
 739                 if (r < 0)
 740                         goto out;
 741                 r = crypt_activate_by_volume_key(cd, activated_name,
 742                                                  key, keysize, flags);
 743         } else if (opt_key_file) {
 744                 crypt_set_password_retry(cd, 1);
 745                 r = crypt_activate_by_keyfile_offset(cd, activated_name,
 746                         opt_key_slot, opt_key_file, opt_keyfile_size,
 747                         opt_keyfile_offset, flags);
 748         } else
 749                 r = crypt_activate_by_passphrase(cd, activated_name,
 750                         opt_key_slot, NULL, 0, flags);
 751 out:
 752         crypt_safe_free(key);
 753         crypt_free(cd);
 754         return r;
 755 }
 756
 757 static int verify_keyslot(struct crypt_device *cd, int key_slot,
 758                           char *msg_last, char *msg_pass,
 759                           const char *key_file, int keyfile_offset,
 760                           int keyfile_size)
 761 {
 762         crypt_keyslot_info ki;
 763         char *password = NULL;
 764         size_t passwordLen;
 765         int i, r;
 766
 767         ki = crypt_keyslot_status(cd, key_slot);
 768         if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !yesDialog(msg_last, NULL))
 769                 return -EPERM;
 770
 771         r = tools_get_key(msg_pass, &password, &passwordLen,
 772                           keyfile_offset, keyfile_size, key_file, opt_timeout,
 773                           _verify_passphrase(0), 0, cd);
 774         if(r < 0)
 775                 goto out;
 776
 777         if (ki == CRYPT_SLOT_ACTIVE_LAST) {
 778                 /* check the last keyslot */
 779                 r = crypt_activate_by_passphrase(cd, NULL, key_slot,
 780                                                  password, passwordLen, 0);
 781         } else {
 782                 /* try all other keyslots */
 783                 for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1); i++) {
 784                         if (i == key_slot)
 785                                 continue;
 786                         ki = crypt_keyslot_status(cd, key_slot);
 787                         if (ki == CRYPT_SLOT_ACTIVE)
 788                         r = crypt_activate_by_passphrase(cd, NULL, i,
 789                                                          password, passwordLen, 0);
 790                         if (r == i)
 791                                 break;
 792                 }
 793         }
 794
 795         if (r == -EPERM)
 796                 log_err(_("No key available with this passphrase.\n"));
 797 out:
 798         crypt_safe_free(password);
 799         return r;
 800 }
 801
 802 static int action_luksKillSlot(void)
 803 {
 804         struct crypt_device *cd = NULL;
 805         int r;
 806
 807         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 808                 goto out;
 809
 810         crypt_set_confirm_callback(cd, yesDialog, NULL);
 811         crypt_set_timeout(cd, opt_timeout);
 812
 813         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 814                 goto out;
 815
 816         switch (crypt_keyslot_status(cd, opt_key_slot)) {
 817         case CRYPT_SLOT_ACTIVE_LAST:
 818         case CRYPT_SLOT_ACTIVE:
 819                 log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 820                 break;
 821         case CRYPT_SLOT_INACTIVE:
 822                 log_err(_("Key %d not active. Can't wipe.\n"), opt_key_slot);
 823         case CRYPT_SLOT_INVALID:
 824                 r = -EINVAL;
 825                 goto out;
 826         }
 827
 828         if (!opt_batch_mode) {
 829                 r = verify_keyslot(cd, opt_key_slot,
 830                         _("This is the last keyslot. Device will become unusable after purging this key."),
 831                         _("Enter any remaining passphrase: "),
 832                         opt_key_file, opt_keyfile_offset, opt_keyfile_size);
 833                 if (r < 0)
 834                         goto out;
 835         }
 836
 837         r = crypt_keyslot_destroy(cd, opt_key_slot);
 838 out:
 839         crypt_free(cd);
 840         return r;
 841 }
 842
 843 static int action_luksRemoveKey(void)
 844 {
 845         struct crypt_device *cd = NULL;
 846         char *password = NULL;
 847         size_t passwordLen;
 848         int r;
 849
 850         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 851                 goto out;
 852
 853         crypt_set_confirm_callback(cd, yesDialog, NULL);
 854         crypt_set_timeout(cd, opt_timeout);
 855
 856         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 857                 goto out;
 858
 859         r = tools_get_key(_("Enter passphrase to be deleted: "),
 860                       &password, &passwordLen,
 861                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 862                       opt_timeout,
 863                       _verify_passphrase(0), 0,
 864                       cd);
 865         if(r < 0)
 866                 goto out;
 867
 868         r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 869                                          password, passwordLen, 0);
 870         check_signal(&r);
 871         if (r < 0)
 872                 goto out;
 873
 874         opt_key_slot = r;
 875         log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
 876
 877         if (crypt_keyslot_status(cd, opt_key_slot) == CRYPT_SLOT_ACTIVE_LAST &&
 878             !yesDialog(_("This is the last keyslot. "
 879                           "Device will become unusable after purging this key."),
 880                         NULL)) {
 881                 r = -EPERM;
 882                 goto out;
 883         }
 884
 885         r = crypt_keyslot_destroy(cd, opt_key_slot);
 886 out:
 887         crypt_safe_free(password);
 888         crypt_free(cd);
 889         return r;
 890 }
 891
 892 static int action_luksAddKey(void)
 893 {
 894         int r = -EINVAL, keysize = 0;
 895         char *key = NULL;
 896         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 897         char *password = NULL, *password_new = NULL;
 898         size_t password_size = 0, password_new_size = 0;
 899         struct crypt_device *cd = NULL;
 900
 901         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 902                 goto out;
 903
 904         crypt_set_confirm_callback(cd, yesDialog, NULL);
 905
 906         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 907                 goto out;
 908
 909         keysize = crypt_get_volume_key_size(cd);
 910         /* FIXME: lib cannot properly set verification for new/old passphrase */
 911         crypt_set_password_verify(cd, _verify_passphrase(0));
 912         crypt_set_timeout(cd, opt_timeout);
 913         if (opt_iteration_time)
 914                 crypt_set_iteration_time(cd, opt_iteration_time);
 915
 916         if (opt_master_key_file) {
 917                 r = _read_mk(opt_master_key_file, &key, keysize);
 918                 if (r < 0)
 919                         goto out;
 920                 //FIXME: process keyfile arg
 921                 r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
 922                                                     key, keysize, NULL, 0);
 923         } else if (opt_key_file || opt_new_key_file) {
 924                 r = crypt_keyslot_add_by_keyfile_offset(cd, opt_key_slot,
 925                         opt_key_file, opt_keyfile_size, opt_keyfile_offset,
 926                         opt_new_key_file, opt_new_keyfile_size, opt_new_keyfile_offset);
 927         } else {
 928                 r = tools_get_key(_("Enter any existing passphrase: "),
 929                               &password, &password_size, 0, 0, NULL,
 930                               opt_timeout, _verify_passphrase(0), 0, cd);
 931
 932                 if (r < 0)
 933                         goto out;
 934
 935                 /* Check password before asking for new one */
 936                 r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT,
 937                                                  password, password_size, 0);
 938                 check_signal(&r);
 939                 if (r < 0)
 940                         goto out;
 941
 942                 r = tools_get_key(_("Enter new passphrase for key slot: "),
 943                                   &password_new, &password_new_size, 0, 0, NULL,
 944                                   opt_timeout, _verify_passphrase(0), 1, cd);
 945                 if (r < 0)
 946                         goto out;
 947
 948                 r = crypt_keyslot_add_by_passphrase(cd, opt_key_slot,
 949                                                     password, password_size,
 950                                                     password_new, password_new_size);
 951         }
 952 out:
 953         crypt_safe_free(password);
 954         crypt_safe_free(password_new);
 955         crypt_safe_free(key);
 956         crypt_free(cd);
 957         return r;
 958 }
 959
 960 static int action_luksChangeKey(void)
 961 {
 962         const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
 963         struct crypt_device *cd = NULL;
 964         char *password = NULL, *password_new = NULL;
 965         size_t password_size = 0, password_new_size = 0;
 966         int r;
 967
 968         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
 969                 goto out;
 970
 971         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 972                 goto out;
 973
 974         if (opt_iteration_time)
 975                 crypt_set_iteration_time(cd, opt_iteration_time);
 976
 977         r = tools_get_key(_("Enter passphrase to be changed: "),
 978                       &password, &password_size,
 979                       opt_keyfile_offset, opt_keyfile_size, opt_key_file,
 980                       opt_timeout, _verify_passphrase(0), 0, cd);
 981         if (r < 0)
 982                 goto out;
 983
 984         /* Check password before asking for new one */
 985         r = crypt_activate_by_passphrase(cd, NULL, opt_key_slot,
 986                                          password, password_size, 0);
 987         check_signal(&r);
 988         if (r < 0)
 989                 goto out;
 990
 991         r = tools_get_key(_("Enter new passphrase: "),
 992                           &password_new, &password_new_size,
 993                           opt_new_keyfile_offset, opt_new_keyfile_size,
 994                           opt_new_key_file,
 995                           opt_timeout, _verify_passphrase(0), 1, cd);
 996         if (r < 0)
 997                 goto out;
 998
 999         r = crypt_keyslot_change_by_passphrase(cd, opt_key_slot, opt_key_slot,
1000                 password, password_size, password_new, password_new_size);
1001 out:
1002         crypt_safe_free(password);
1003         crypt_safe_free(password_new);
1004         crypt_free(cd);
1005         return r;
1006 }
1007
1008 static int action_isLuks(void)
1009 {
1010         struct crypt_device *cd = NULL;
1011         int r;
1012
1013         /* FIXME: argc > max should be checked for other operations as well */
1014         if (action_argc > 1) {
1015                 log_err(_("Only one device argument for isLuks operation is supported.\n"));
1016                 return -ENODEV;
1017         }
1018
1019         if ((r = crypt_init(&cd, action_argv[0])))
1020                 goto out;
1021
1022         crypt_set_log_callback(cd, quiet_log, NULL);
1023         r = crypt_load(cd, CRYPT_LUKS1, NULL);
1024 out:
1025         crypt_free(cd);
1026         return r;
1027 }
1028
1029 static int action_luksUUID(void)
1030 {
1031         struct crypt_device *cd = NULL;
1032         const char *existing_uuid = NULL;
1033         int r;
1034
1035         if ((r = crypt_init(&cd, action_argv[0])))
1036                 goto out;
1037
1038         crypt_set_confirm_callback(cd, yesDialog, NULL);
1039
1040         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1041                 goto out;
1042
1043         if (opt_uuid)
1044                 r = crypt_set_uuid(cd, opt_uuid);
1045         else {
1046                 existing_uuid = crypt_get_uuid(cd);
1047                 log_std("%s\n", existing_uuid ?: "");
1048                 r = existing_uuid ? 0 : 1;
1049         }
1050 out:
1051         crypt_free(cd);
1052         return r;
1053 }
1054
1055 static int luksDump_with_volume_key(struct crypt_device *cd)
1056 {
1057         char *vk = NULL, *password = NULL;
1058         size_t passwordLen = 0;
1059         size_t vk_size;
1060         unsigned i;
1061         int r;
1062
1063         crypt_set_confirm_callback(cd, yesDialog, NULL);
1064         if (!yesDialog(
1065             _("Header dump with volume key is sensitive information\n"
1066               "which allows access to encrypted partition without passphrase.\n"
1067               "This dump should be always stored encrypted on safe place."),
1068               NULL))
1069                 return -EPERM;
1070
1071         vk_size = crypt_get_volume_key_size(cd);
1072         vk = crypt_safe_alloc(vk_size);
1073         if (!vk)
1074                 return -ENOMEM;
1075
1076         r = tools_get_key(_("Enter passphrase: "), &password, &passwordLen,
1077                           opt_keyfile_offset, opt_keyfile_size, opt_key_file,
1078                           opt_timeout, 0, 0, cd);
1079         if (r < 0)
1080                 goto out;
1081
1082         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size,
1083                                  password, passwordLen);
1084         check_signal(&r);
1085         if (r < 0)
1086                 goto out;
1087
1088         log_std("LUKS header information for %s\n", crypt_get_device_name(cd));
1089         log_std("Cipher name:   \t%s\n", crypt_get_cipher(cd));
1090         log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
1091         log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
1092         log_std("UUID:          \t%s\n", crypt_get_uuid(cd));
1093         log_std("MK bits:       \t%d\n", (int)vk_size * 8);
1094         log_std("MK dump:\t");
1095
1096         for(i = 0; i < vk_size; i++) {
1097                 if (i && !(i % 16))
1098                         log_std("\n\t\t");
1099                 log_std("%02hhx ", (char)vk[i]);
1100         }
1101         log_std("\n");
1102
1103 out:
1104         crypt_safe_free(password);
1105         crypt_safe_free(vk);
1106         return r;
1107 }
1108
1109 static int action_luksDump(void)
1110 {
1111         struct crypt_device *cd = NULL;
1112         int r;
1113
1114         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1115                 goto out;
1116
1117         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
1118                 goto out;
1119
1120         if (opt_dump_master_key)
1121                 r = luksDump_with_volume_key(cd);
1122         else
1123                 r = crypt_dump(cd);
1124 out:
1125         crypt_free(cd);
1126         return r;
1127 }
1128
1129 static int action_luksSuspend(void)
1130 {
1131         struct crypt_device *cd = NULL;
1132         int r;
1133
1134         r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
1135         if (!r)
1136                 r = crypt_suspend(cd, action_argv[0]);
1137
1138         crypt_free(cd);
1139         return r;
1140 }
1141
1142 static int action_luksResume(void)
1143 {
1144         struct crypt_device *cd = NULL;
1145         int r;
1146
1147         if ((r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device)))
1148                 goto out;
1149
1150         crypt_set_timeout(cd, opt_timeout);
1151         crypt_set_password_retry(cd, opt_tries);
1152         crypt_set_password_verify(cd, _verify_passphrase(0));
1153
1154         if (opt_key_file)
1155                 r = crypt_resume_by_keyfile_offset(cd, action_argv[0], CRYPT_ANY_SLOT,
1156                         opt_key_file, opt_keyfile_size, opt_keyfile_offset);
1157         else
1158                 r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
1159                                                NULL, 0);
1160 out:
1161         crypt_free(cd);
1162         return r;
1163 }
1164
1165 static int action_luksBackup(void)
1166 {
1167         struct crypt_device *cd = NULL;
1168         int r;
1169
1170         if (!opt_header_backup_file) {
1171                 log_err(_("Option --header-backup-file is required.\n"));
1172                 return -EINVAL;
1173         }
1174
1175         if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
1176                 goto out;
1177
1178         crypt_set_confirm_callback(cd, yesDialog, NULL);
1179
1180         r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
1181 out:
1182         crypt_free(cd);
1183         return r;
1184 }
1185
1186 static int action_luksRestore(void)
1187 {
1188         struct crypt_device *cd = NULL;
1189         int r = 0;
1190
1191         if (!opt_header_backup_file) {
1192                 log_err(_("Option --header-backup-file is required.\n"));
1193                 return -EINVAL;
1194         }
1195
1196         if ((r = crypt_init(&cd, action_argv[0])))
1197                 goto out;
1198
1199         crypt_set_confirm_callback(cd, yesDialog, NULL);
1200         r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
1201 out:
1202         crypt_free(cd);
1203         return r;
1204 }
1205
1206 static int action_open(void)
1207 {
1208         if (!opt_type)
1209                 return -EINVAL;
1210
1211         if (!strcmp(opt_type, "luks") || !strcmp(opt_type, "luks1")) {
1212                 if (action_argc < 2 && !opt_test_passphrase)
1213                         goto args;
1214                 return action_open_luks();
1215         } else if (!strcmp(opt_type, "plain")) {
1216                 if (action_argc < 2)
1217                         goto args;
1218                 return action_open_plain();
1219         } else if (!strcmp(opt_type, "loopaes")) {
1220                 if (action_argc < 2)
1221                         goto args;
1222                 return action_open_loopaes();
1223         } else if (!strcmp(opt_type, "tcrypt")) {
1224                 if (action_argc < 2 && !opt_test_passphrase)
1225                         goto args;
1226                 return action_open_tcrypt();
1227         }
1228
1229         log_err(_("Unrecognized metadata device type %s.\n"), opt_type);
1230         return -EINVAL;
1231 args:
1232         log_err(_("Command requires device and mapped name as arguments.\n"));
1233         return -EINVAL;
1234 }
1235
1236 static struct action_type {
1237         const char *type;
1238         int (*handler)(void);
1239         int required_action_argc;
1240         int required_memlock;
1241         const char *arg_desc;
1242         const char *desc;
1243 } action_types[] = {
1244         { "open",         action_open,         1, 1, N_("<device> [--type <type>] [<name>]"),N_("open device as mapping <name>") },
1245         { "close",        action_close,        1, 1, N_("<name>"), N_("close device (remove mapping)") },
1246         { "resize",       action_resize,       1, 1, N_("<name>"), N_("resize active device") },
1247         { "status",       action_status,       1, 0, N_("<name>"), N_("show device status") },
1248         { "benchmark",    action_benchmark,    0, 0, N_("<name>"), N_("benchmark cipher") },
1249         { "repair",       action_luksRepair,   1, 1, N_("<device>"), N_("try to repair on-disk metadata") },
1250         { "luksFormat",   action_luksFormat,   1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
1251         { "luksAddKey",   action_luksAddKey,   1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
1252         { "luksRemoveKey",action_luksRemoveKey,1, 1, N_("<device> [<key file>]"), N_("removes supplied key or key file from LUKS device") },
1253         { "luksChangeKey",action_luksChangeKey,1, 1, N_("<device> [<key file>]"), N_("changes supplied key or key file of LUKS device") },
1254         { "luksKillSlot", action_luksKillSlot, 2, 1, N_("<device> <key slot>"), N_("wipes key with number <key slot> from LUKS device") },
1255         { "luksUUID",     action_luksUUID,     1, 0, N_("<device>"), N_("print UUID of LUKS device") },
1256         { "isLuks",       action_isLuks,       1, 0, N_("<device>"), N_("tests <device> for LUKS partition header") },
1257         { "luksDump",     action_luksDump,     1, 1, N_("<device>"), N_("dump LUKS partition information") },
1258         { "tcryptDump",   action_tcryptDump,   1, 1, N_("<device>"), N_("dump TCRYPT device information") },
1259         { "luksSuspend",  action_luksSuspend,  1, 1, N_("<device>"), N_("Suspend LUKS device and wipe key (all IOs are frozen).") },
1260         { "luksResume",   action_luksResume,   1, 1, N_("<device>"), N_("Resume suspended LUKS device.") },
1261         { "luksHeaderBackup", action_luksBackup,1,1, N_("<device>"), N_("Backup LUKS device header and keyslots") },
1262         { "luksHeaderRestore",action_luksRestore,1,1,N_("<device>"), N_("Restore LUKS device header and keyslots") },
1263         {}
1264 };
1265
1266 static void help(poptContext popt_context,
1267                  enum poptCallbackReason reason __attribute__((unused)),
1268                  struct poptOption *key,
1269                  const char *arg __attribute__((unused)),
1270                  void *data __attribute__((unused)))
1271 {
1272         if (key->shortName == '?') {
1273                 struct action_type *action;
1274
1275                 log_std("%s\n",PACKAGE_STRING);
1276
1277                 poptPrintHelp(popt_context, stdout, 0);
1278
1279                 log_std(_("\n"
1280                          "<action> is one of:\n"));
1281
1282                 for(action = action_types; action->type; action++)
1283                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
1284
1285                 log_std(_("\n"
1286                           "You can also use old <action> syntax aliases:\n"
1287                           "\topen: create (plainOpen), luksOpen, loopaesOpen, tcryptOpen\n"
1288                           "\tclose: remove (plainClose), luksClose, loopaesClose, tcryptClose\n"));
1289                 log_std(_("\n"
1290                          "<name> is the device to create under %s\n"
1291                          "<device> is the encrypted device\n"
1292                          "<key slot> is the LUKS key slot number to modify\n"
1293                          "<key file> optional key file for the new key for luksAddKey action\n"),
1294                         crypt_get_dir());
1295
1296                 log_std(_("\nDefault compiled-in key and passphrase parameters:\n"
1297                          "\tMaximum keyfile size: %dkB, "
1298                          "Maximum interactive passphrase length %d (characters)\n"
1299                          "Default PBKDF2 iteration time for LUKS: %d (ms)\n"),
1300                          DEFAULT_KEYFILE_SIZE_MAXKB, DEFAULT_PASSPHRASE_SIZE_MAX,
1301                          DEFAULT_LUKS1_ITER_TIME);
1302
1303                 log_std(_("\nDefault compiled-in device cipher parameters:\n"
1304                          "\tloop-AES: %s, Key %d bits\n"
1305                          "\tplain: %s, Key: %d bits, Password hashing: %s\n"
1306                          "\tLUKS1: %s, Key: %d bits, LUKS header hashing: %s, RNG: %s\n"),
1307                          DEFAULT_LOOPAES_CIPHER, DEFAULT_LOOPAES_KEYBITS,
1308                          DEFAULT_CIPHER(PLAIN), DEFAULT_PLAIN_KEYBITS, DEFAULT_PLAIN_HASH,
1309                          DEFAULT_CIPHER(LUKS1), DEFAULT_LUKS1_KEYBITS, DEFAULT_LUKS1_HASH,
1310                          DEFAULT_RNG);
1311                 exit(EXIT_SUCCESS);
1312         } else
1313                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
1314 }
1315
1316 static void help_args(struct action_type *action, poptContext popt_context)
1317 {
1318         char buf[128];
1319
1320         snprintf(buf, sizeof(buf), _("%s: requires %s as arguments"), action->type, action->arg_desc);
1321         usage(popt_context, EXIT_FAILURE, buf, poptGetInvocationName(popt_context));
1322 }
1323
1324 static int run_action(struct action_type *action)
1325 {
1326         int r;
1327
1328         log_dbg("Running command %s.", action->type);
1329
1330         if (action->required_memlock)
1331                 crypt_memory_lock(NULL, 1);
1332
1333         set_int_handler(0);
1334         r = action->handler();
1335
1336         if (action->required_memlock)
1337                 crypt_memory_lock(NULL, 0);
1338
1339         /* Some functions returns keyslot # */
1340         if (r > 0)
1341                 r = 0;
1342         check_signal(&r);
1343
1344         show_status(r);
1345         return translate_errno(r);
1346 }
1347
1348 int main(int argc, const char **argv)
1349 {
1350         static char *popt_tmp;
1351         static struct poptOption popt_help_options[] = {
1352                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
1353                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
1354                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
1355                 POPT_TABLEEND
1356         };
1357         static struct poptOption popt_options[] = {
1358                 { NULL,                '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
1359                 { "version",           '\0', POPT_ARG_NONE, &opt_version_mode,          0, N_("Print package version"), NULL },
1360                 { "verbose",           'v',  POPT_ARG_NONE, &opt_verbose,               0, N_("Shows more detailed error messages"), NULL },
1361                 { "debug",             '\0', POPT_ARG_NONE, &opt_debug,                 0, N_("Show debug messages"), NULL },
1362                 { "cipher",            'c',  POPT_ARG_STRING, &opt_cipher,              0, N_("The cipher used to encrypt the disk (see /proc/crypto)"), NULL },
1363                 { "hash",              'h',  POPT_ARG_STRING, &opt_hash,                0, N_("The hash used to create the encryption key from the passphrase"), NULL },
1364                 { "verify-passphrase", 'y',  POPT_ARG_NONE, &opt_verify_passphrase,     0, N_("Verifies the passphrase by asking for it twice"), NULL },
1365                 { "key-file",          'd',  POPT_ARG_STRING, &opt_key_file,            5, N_("Read the key from a file."), NULL },
1366                 { "master-key-file",  '\0',  POPT_ARG_STRING, &opt_master_key_file,     0, N_("Read the volume (master) key from file."), NULL },
1367                 { "dump-master-key",  '\0',  POPT_ARG_NONE, &opt_dump_master_key,       0, N_("Dump volume (master) key instead of keyslots info."), NULL },
1368                 { "key-size",          's',  POPT_ARG_INT, &opt_key_size,               0, N_("The size of the encryption key"), N_("BITS") },
1369                 { "keyfile-size",      'l',  POPT_ARG_LONG, &opt_keyfile_size,          0, N_("Limits the read from keyfile"), N_("bytes") },
1370                 { "keyfile-offset",   '\0',  POPT_ARG_LONG, &opt_keyfile_offset,        0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
1371                 { "new-keyfile-size", '\0',  POPT_ARG_LONG, &opt_new_keyfile_size,      0, N_("Limits the read from newly added keyfile"), N_("bytes") },
1372                 { "new-keyfile-offset",'\0', POPT_ARG_LONG, &opt_new_keyfile_offset,    0, N_("Number of bytes to skip in newly added keyfile"), N_("bytes") },
1373                 { "key-slot",          'S',  POPT_ARG_INT, &opt_key_slot,               0, N_("Slot number for new key (default is first free)"), NULL },
1374                 { "size",              'b',  POPT_ARG_STRING, &popt_tmp,                1, N_("The size of the device"), N_("SECTORS") },
1375                 { "offset",            'o',  POPT_ARG_STRING, &popt_tmp,                2, N_("The start offset in the backend device"), N_("SECTORS") },
1376                 { "skip",              'p',  POPT_ARG_STRING, &popt_tmp,                3, N_("How many sectors of the encrypted data to skip at the beginning"), N_("SECTORS") },
1377                 { "readonly",          'r',  POPT_ARG_NONE, &opt_readonly,              0, N_("Create a readonly mapping"), NULL },
1378                 { "iter-time",         'i',  POPT_ARG_INT, &opt_iteration_time,         0, N_("PBKDF2 iteration time for LUKS (in ms)"), N_("msecs") },
1379                 { "batch-mode",        'q',  POPT_ARG_NONE, &opt_batch_mode,            0, N_("Do not ask for confirmation"), NULL },
1380                 { "timeout",           't',  POPT_ARG_INT, &opt_timeout,                0, N_("Timeout for interactive passphrase prompt (in seconds)"), N_("secs") },
1381                 { "tries",             'T',  POPT_ARG_INT, &opt_tries,                  0, N_("How often the input of the passphrase can be retried"), NULL },
1382                 { "align-payload",     '\0', POPT_ARG_INT, &opt_align_payload,          0, N_("Align payload at <n> sector boundaries - for luksFormat"), N_("SECTORS") },
1383                 { "header-backup-file",'\0', POPT_ARG_STRING, &opt_header_backup_file,  0, N_("File with LUKS header and keyslots backup."), NULL },
1384                 { "use-random",        '\0', POPT_ARG_NONE, &opt_random,                0, N_("Use /dev/random for generating volume key."), NULL },
1385                 { "use-urandom",       '\0', POPT_ARG_NONE, &opt_urandom,               0, N_("Use /dev/urandom for generating volume key."), NULL },
1386                 { "shared",            '\0', POPT_ARG_NONE, &opt_shared,                0, N_("Share device with another non-overlapping crypt segment."), NULL },
1387                 { "uuid",              '\0', POPT_ARG_STRING, &opt_uuid,                0, N_("UUID for device to use."), NULL },
1388                 { "allow-discards",    '\0', POPT_ARG_NONE, &opt_allow_discards,        0, N_("Allow discards (aka TRIM) requests for device."), NULL },
1389                 { "header",            '\0', POPT_ARG_STRING, &opt_header_device,       0, N_("Device or file with separated LUKS header."), NULL },
1390                 { "test-passphrase",   '\0', POPT_ARG_NONE, &opt_test_passphrase,       0, N_("Do not activate device, just check passphrase."), NULL },
1391                 { "tcrypt-hidden",     '\0', POPT_ARG_NONE, &opt_tcrypt_hidden,         0, N_("Use hidden header (hidden TCRYPT device)."), NULL },
1392                 { "tcrypt-system",     '\0', POPT_ARG_NONE, &opt_tcrypt_system,         0, N_("Device is system TCRYPT drive (with bootloader)."), NULL },
1393                 { "type",               'M', POPT_ARG_STRING, &opt_type,                0, N_("Type of device metadata: luks, plain, loopaes, tcrypt."), NULL },
1394                 { "force-password",    '\0', POPT_ARG_NONE, &opt_force_password,        0, N_("Disable password quality check (if enabled)."), NULL },
1395                 POPT_TABLEEND
1396         };
1397         poptContext popt_context;
1398         struct action_type *action;
1399         const char *aname;
1400         int r;
1401
1402         crypt_set_log_callback(NULL, tool_log, NULL);
1403
1404         setlocale(LC_ALL, "");
1405         bindtextdomain(PACKAGE, LOCALEDIR);
1406         textdomain(PACKAGE);
1407
1408         crypt_fips_self_check(NULL);
1409
1410         popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
1411         poptSetOtherOptionHelp(popt_context,
1412                                _("[OPTION...] <action> <action-specific>"));
1413
1414         while((r = poptGetNextOpt(popt_context)) > 0) {
1415                 unsigned long long ull_value;
1416                 char *endp;
1417
1418                 if (r == 5) {
1419                         if (opt_keyfiles_count < MAX_KEYFILES)
1420                                 opt_keyfiles[opt_keyfiles_count++] = poptGetOptArg(popt_context);
1421                         continue;
1422                 }
1423
1424                 errno = 0;
1425                 ull_value = strtoull(popt_tmp, &endp, 0);
1426                 if (*endp || !*popt_tmp ||
1427                     (errno == ERANGE && ull_value == ULLONG_MAX) ||
1428                     (errno != 0 && ull_value == 0))
1429                         r = POPT_ERROR_BADNUMBER;
1430
1431                 switch(r) {
1432                         case 1:
1433                                 opt_size = ull_value;
1434                                 break;
1435                         case 2:
1436                                 opt_offset = ull_value;
1437                                 break;
1438                         case 3:
1439                                 opt_skip = ull_value;
1440                                 opt_skip_valid = 1;
1441                                 break;
1442                 }
1443
1444                 if (r < 0)
1445                         break;
1446         }
1447
1448         if (r < -1)
1449                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
1450                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
1451         if (opt_version_mode) {
1452                 log_std("%s %s\n", PACKAGE_NAME, PACKAGE_VERSION);
1453                 poptFreeContext(popt_context);
1454                 exit(EXIT_SUCCESS);
1455         }
1456
1457         if (!(aname = poptGetArg(popt_context)))
1458                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
1459                       poptGetInvocationName(popt_context));
1460
1461         action_argc = 0;
1462         action_argv = poptGetArgs(popt_context);
1463         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
1464         if(!action_argv)
1465                 action_argv = null_action_argv;
1466
1467         /* Count args, somewhat unnice, change? */
1468         while(action_argv[action_argc] != NULL)
1469                 action_argc++;
1470
1471         /* Handle aliases */
1472         if (!strcmp(aname, "create")) {
1473                 /* create command had historically switched arguments */
1474                 if (action_argv[0] && action_argv[1]) {
1475                         const char *tmp = action_argv[0];
1476                         action_argv[0] = action_argv[1];
1477                         action_argv[1] = tmp;
1478                 }
1479                 aname = "open";
1480                 opt_type = "plain";
1481         } else if (!strcmp(aname, "plainOpen")) {
1482                 aname = "open";
1483                 opt_type = "plain";
1484         } else if (!strcmp(aname, "luksOpen")) {
1485                 aname = "open";
1486                 opt_type = "luks";
1487         } else if (!strcmp(aname, "loopaesOpen")) {
1488                 aname = "open";
1489                 opt_type = "loopaes";
1490         } else if (!strcmp(aname, "tcryptOpen")) {
1491                 aname = "open";
1492                 opt_type = "tcrypt";
1493         } else if (!strcmp(aname, "remove") ||
1494                    !strcmp(aname, "plainClose") ||
1495                    !strcmp(aname, "luksClose") ||
1496                    !strcmp(aname, "loopaesClose") ||
1497                    !strcmp(aname, "tcryptClose")) {
1498                 aname = "close";
1499         }
1500
1501         for(action = action_types; action->type; action++)
1502                 if (strcmp(action->type, aname) == 0)
1503                         break;
1504
1505         if (!action->type)
1506                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
1507                       poptGetInvocationName(popt_context));
1508
1509         if (action_argc < action->required_action_argc)
1510                 help_args(action, popt_context);
1511
1512         /* FIXME: rewrite this from scratch */
1513
1514         if (opt_shared && (strcmp(aname, "open") || strcmp(opt_type, "plain")) )
1515                 usage(popt_context, EXIT_FAILURE,
1516                       _("Option --shared is allowed only for open of plain device.\n"),
1517                       poptGetInvocationName(popt_context));
1518
1519         if (opt_allow_discards && strcmp(aname, "open"))
1520                 usage(popt_context, EXIT_FAILURE,
1521                       _("Option --allow-discards is allowed only for open operation.\n"),
1522                       poptGetInvocationName(popt_context));
1523
1524         if (opt_key_size &&
1525            strcmp(aname, "luksFormat") &&
1526            strcmp(aname, "open") &&
1527            strcmp(aname, "benchmark"))
1528                 usage(popt_context, EXIT_FAILURE,
1529                       _("Option --key-size is allowed only for luksFormat, open and benchmark.\n"
1530                         "To limit read from keyfile use --keyfile-size=(bytes)."),
1531                       poptGetInvocationName(popt_context));
1532
1533         if (opt_test_passphrase && (strcmp(aname, "open") ||
1534             (strcmp(opt_type, "luks") && strcmp(opt_type, "tcrypt"))))
1535                 usage(popt_context, EXIT_FAILURE,
1536                       _("Option --test-passphrase is allowed only for open of LUKS and TCRYPT devices.\n"),
1537                       poptGetInvocationName(popt_context));
1538
1539         if (opt_key_size % 8)
1540                 usage(popt_context, EXIT_FAILURE,
1541                       _("Key size must be a multiple of 8 bits"),
1542                       poptGetInvocationName(popt_context));
1543
1544         if (!strcmp(aname, "luksKillSlot") && action_argc > 1)
1545                 opt_key_slot = atoi(action_argv[1]);
1546         if (opt_key_slot != CRYPT_ANY_SLOT &&
1547             (opt_key_slot < 0 || opt_key_slot >= crypt_keyslot_max(CRYPT_LUKS1)))
1548                 usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."),
1549                       poptGetInvocationName(popt_context));
1550
1551         if ((!strcmp(aname, "luksRemoveKey") ||
1552              !strcmp(aname, "luksFormat")) &&
1553              action_argc > 1) {
1554                 if (opt_key_file)
1555                         log_err(_("Option --key-file takes precedence over specified key file argument.\n"));
1556                 else
1557                         opt_key_file = action_argv[1];
1558         }
1559
1560         if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0 ||
1561             opt_keyfile_offset < 0 || opt_new_keyfile_offset < 0)
1562                 usage(popt_context, EXIT_FAILURE,
1563                       _("Negative number for option not permitted."),
1564                       poptGetInvocationName(popt_context));
1565
1566         if (opt_random && opt_urandom)
1567                 usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
1568                       poptGetInvocationName(popt_context));
1569
1570         if ((opt_random || opt_urandom) && strcmp(aname, "luksFormat"))
1571                 usage(popt_context, EXIT_FAILURE, _("Option --use-[u]random is allowed only for luksFormat."),
1572                       poptGetInvocationName(popt_context));
1573
1574         if (opt_uuid && strcmp(aname, "luksFormat") && strcmp(aname, "luksUUID"))
1575                 usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed only for luksFormat and luksUUID."),
1576                       poptGetInvocationName(popt_context));
1577
1578         if (opt_align_payload && strcmp(aname, "luksFormat"))
1579                 usage(popt_context, EXIT_FAILURE, _("Option --align-payload is allowed only for luksFormat."),
1580                       poptGetInvocationName(popt_context));
1581
1582         if (opt_skip && (strcmp(aname, "open") ||
1583             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1584                 usage(popt_context, EXIT_FAILURE,
1585                 _("Option --skip is supported only for open of plain and loopaes devices.\n"),
1586                 poptGetInvocationName(popt_context));
1587
1588         if (opt_offset && (strcmp(aname, "open") ||
1589             (strcmp(opt_type, "plain") && strcmp(opt_type, "loopaes"))))
1590                 usage(popt_context, EXIT_FAILURE,
1591                 _("Option --offset is supported only for open of plain and loopaes devices.\n"),
1592                 poptGetInvocationName(popt_context));
1593
1594         if ((opt_tcrypt_hidden || opt_tcrypt_system) && strcmp(aname, "tcryptDump") &&
1595             (strcmp(aname, "open") || strcmp(opt_type, "tcrypt")))
1596                 usage(popt_context, EXIT_FAILURE,
1597                 _("Option --tcrypt-hidden or --tcrypt-system is supported only for TCRYPT device.\n"),
1598                 poptGetInvocationName(popt_context));
1599
1600         if (opt_debug) {
1601                 opt_verbose = 1;
1602                 crypt_set_debug_level(-1);
1603                 dbg_version_and_cmd(argc, argv);
1604         }
1605
1606         r = run_action(action);
1607         poptFreeContext(popt_context);
1608         return r;
1609 }