src/veritysetup.c

   1 /*
   2  * veritysetup - setup cryptographic volumes for dm-verity
   3  *
   4  * Copyright (C) 2012-2020 Red Hat, Inc. All rights reserved.
   5  * Copyright (C) 2012-2020 Milan Broz
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "cryptsetup.h"
  23
  24 #define PACKAGE_VERITY "veritysetup"
  25
  26 static int use_superblock = 1;
  27
  28 static const char *fec_device = NULL;
  29 static int fec_roots = DEFAULT_VERITY_FEC_ROOTS;
  30 static const char *hash_algorithm = NULL;
  31 static int hash_type = 1;
  32 static int data_block_size = DEFAULT_VERITY_DATA_BLOCK;
  33 static int hash_block_size = DEFAULT_VERITY_HASH_BLOCK;
  34 static uint64_t data_blocks = 0;
  35 static const char *salt_string = NULL;
  36 static uint64_t hash_offset = 0;
  37 static uint64_t fec_offset = 0;
  38 static const char *opt_uuid = NULL;
  39 static int opt_restart_on_corruption = 0;
  40 static int opt_ignore_corruption = 0;
  41 static int opt_ignore_zero_blocks = 0;
  42 static int opt_check_at_most_once = 0;
  43 static const char *opt_root_hash_signature = NULL;
  44
  45 static const char **action_argv;
  46 static int action_argc;
  47
  48 static int _prepare_format(struct crypt_params_verity *params,
  49                            const char *data_device,
  50                            uint32_t flags)
  51 {
  52         char *salt = NULL;
  53         int len;
  54
  55         params->hash_name = hash_algorithm ?: DEFAULT_VERITY_HASH;
  56         params->data_device = data_device;
  57         params->fec_device = fec_device;
  58         params->fec_roots = fec_roots;
  59
  60         if (salt_string && !strcmp(salt_string, "-")) {
  61                 params->salt_size = 0;
  62                 params->salt = NULL;
  63         } else if (salt_string) {
  64                 len = crypt_hex_to_bytes(salt_string, &salt, 0);
  65                 if (len < 0) {
  66                         log_err(_("Invalid salt string specified."));
  67                         return -EINVAL;
  68                 }
  69                 params->salt_size = len;
  70                 params->salt = salt;
  71         } else {
  72                 params->salt_size = DEFAULT_VERITY_SALT_SIZE;
  73                 params->salt = NULL;
  74         }
  75
  76         params->data_block_size = data_block_size;
  77         params->hash_block_size = hash_block_size;
  78         params->data_size = data_blocks;
  79         params->hash_area_offset = hash_offset;
  80         params->fec_area_offset = fec_offset;
  81         params->hash_type = hash_type;
  82         params->flags = flags;
  83
  84         return 0;
  85 }
  86
  87 static int action_format(int arg)
  88 {
  89         struct crypt_device *cd = NULL;
  90         struct crypt_params_verity params = {};
  91         uint32_t flags = CRYPT_VERITY_CREATE_HASH;
  92         int r;
  93
  94         /* Try to create hash image if doesn't exist */
  95         r = open(action_argv[1], O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
  96         if (r < 0 && errno != EEXIST) {
  97                 log_err(_("Cannot create hash image %s for writing."), action_argv[1]);
  98                 return -EINVAL;
  99         } else if (r >= 0) {
 100                 log_dbg("Created hash image %s.", action_argv[1]);
 101                 close(r);
 102         }
 103         /* Try to create FEC image if doesn't exist */
 104         if (fec_device) {
 105                 r = open(fec_device, O_WRONLY | O_EXCL | O_CREAT, S_IRUSR | S_IWUSR);
 106                 if (r < 0 && errno != EEXIST) {
 107                         log_err(_("Cannot create FEC image %s for writing."), fec_device);
 108                         return -EINVAL;
 109                 } else if (r >= 0) {
 110                         log_dbg("Created FEC image %s.", fec_device);
 111                         close(r);
 112                 }
 113         }
 114
 115         if ((r = crypt_init(&cd, action_argv[1])))
 116                 goto out;
 117
 118         if (!use_superblock)
 119                 flags |= CRYPT_VERITY_NO_HEADER;
 120
 121         r = _prepare_format(&params, action_argv[0], flags);
 122         if (r < 0)
 123                 goto out;
 124
 125         r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, opt_uuid, NULL, 0, &params);
 126         if (!r)
 127                 crypt_dump(cd);
 128 out:
 129         crypt_free(cd);
 130         free(CONST_CAST(char*)params.salt);
 131         return r;
 132 }
 133
 134 static int _activate(const char *dm_device,
 135                       const char *data_device,
 136                       const char *hash_device,
 137                       const char *root_hash,
 138                       uint32_t flags)
 139 {
 140         struct crypt_device *cd = NULL;
 141         struct crypt_params_verity params = {};
 142         uint32_t activate_flags = CRYPT_ACTIVATE_READONLY;
 143         char *root_hash_bytes = NULL;
 144         ssize_t hash_size;
 145         struct stat st;
 146         char *signature = NULL;
 147         int signature_size = 0, r;
 148
 149         if ((r = crypt_init_data_device(&cd, hash_device, data_device)))
 150                 goto out;
 151
 152         if (opt_ignore_corruption)
 153                 activate_flags |= CRYPT_ACTIVATE_IGNORE_CORRUPTION;
 154         if (opt_restart_on_corruption)
 155                 activate_flags |= CRYPT_ACTIVATE_RESTART_ON_CORRUPTION;
 156         if (opt_ignore_zero_blocks)
 157                 activate_flags |= CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS;
 158         if (opt_check_at_most_once)
 159                 activate_flags |= CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE;
 160
 161         if (use_superblock) {
 162                 params.flags = flags;
 163                 params.hash_area_offset = hash_offset;
 164                 params.fec_area_offset = fec_offset;
 165                 params.fec_device = fec_device;
 166                 params.fec_roots = fec_roots;
 167                 r = crypt_load(cd, CRYPT_VERITY, &params);
 168         } else {
 169                 r = _prepare_format(&params, data_device, flags | CRYPT_VERITY_NO_HEADER);
 170                 if (r < 0)
 171                         goto out;
 172                 r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, &params);
 173         }
 174         if (r < 0)
 175                 goto out;
 176
 177         hash_size = crypt_get_volume_key_size(cd);
 178         if (crypt_hex_to_bytes(root_hash, &root_hash_bytes, 0) != hash_size) {
 179                 log_err(_("Invalid root hash string specified."));
 180                 r = -EINVAL;
 181                 goto out;
 182         }
 183
 184         if (opt_root_hash_signature) {
 185                 // FIXME: check max file size
 186                 if (stat(opt_root_hash_signature, &st) || !S_ISREG(st.st_mode) || !st.st_size) {
 187                         log_err(_("Invalid signature file %s."), opt_root_hash_signature);
 188                         r = -EINVAL;
 189                         goto out;
 190                 }
 191                 signature_size = st.st_size;
 192                 r = tools_read_mk(opt_root_hash_signature, &signature, signature_size);
 193                 if (r < 0) {
 194                         log_err(_("Cannot read signature file %s."), opt_root_hash_signature);
 195                         goto out;
 196                 }
 197         }
 198         r = crypt_activate_by_signed_key(cd, dm_device,
 199                                          root_hash_bytes,
 200                                          hash_size,
 201                                          signature, signature_size,
 202                                          activate_flags);
 203 out:
 204         crypt_safe_free(signature);
 205         crypt_free(cd);
 206         free(root_hash_bytes);
 207         free(CONST_CAST(char*)params.salt);
 208         return r;
 209 }
 210
 211 static int action_open(int arg)
 212 {
 213         return _activate(action_argv[1],
 214                          action_argv[0],
 215                          action_argv[2],
 216                          action_argv[3],
 217                          opt_root_hash_signature ? CRYPT_VERITY_ROOT_HASH_SIGNATURE : 0);
 218 }
 219
 220 static int action_verify(int arg)
 221 {
 222         return _activate(NULL,
 223                          action_argv[0],
 224                          action_argv[1],
 225                          action_argv[2],
 226                          CRYPT_VERITY_CHECK_HASH);
 227 }
 228
 229 static int action_close(int arg)
 230 {
 231         struct crypt_device *cd = NULL;
 232         int r;
 233
 234         r = crypt_init_by_name(&cd, action_argv[0]);
 235         if (r == 0)
 236                 r = crypt_deactivate(cd, action_argv[0]);
 237
 238         crypt_free(cd);
 239         return r;
 240 }
 241
 242 static int action_status(int arg)
 243 {
 244         crypt_status_info ci;
 245         struct crypt_active_device cad;
 246         struct crypt_params_verity vp = {};
 247         struct crypt_device *cd = NULL;
 248         struct stat st;
 249         char *backing_file, *root_hash;
 250         size_t root_hash_size;
 251         unsigned i, path = 0;
 252         int r = 0;
 253
 254         /* perhaps a path, not a dm device name */
 255         if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
 256                 path = 1;
 257
 258         ci = crypt_status(NULL, action_argv[0]);
 259         switch (ci) {
 260         case CRYPT_INVALID:
 261                 r = -EINVAL;
 262                 break;
 263         case CRYPT_INACTIVE:
 264                 if (path)
 265                         log_std("%s is inactive.\n", action_argv[0]);
 266                 else
 267                         log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
 268                 r = -ENODEV;
 269                 break;
 270         case CRYPT_ACTIVE:
 271         case CRYPT_BUSY:
 272                 if (path)
 273                         log_std("%s is active%s.\n", action_argv[0],
 274                                 ci == CRYPT_BUSY ? " and is in use" : "");
 275                 else
 276                         log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
 277                                 ci == CRYPT_BUSY ? " and is in use" : "");
 278
 279                 r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL);
 280                 if (r < 0)
 281                         goto out;
 282
 283                 log_std("  type:        %s\n", crypt_get_type(cd) ?: "n/a");
 284
 285                 r = crypt_get_active_device(cd, action_argv[0], &cad);
 286                 if (r < 0)
 287                         goto out;
 288
 289                 /* Print only VERITY type devices */
 290                 r = crypt_get_verity_info(cd, &vp);
 291                 if (r < 0)
 292                         goto out;
 293
 294                 log_std("  status:      %s%s\n",
 295                         cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified",
 296                         vp.flags & CRYPT_VERITY_ROOT_HASH_SIGNATURE ? " (with signature)" : "");
 297
 298                 log_std("  hash type:   %u\n", vp.hash_type);
 299                 log_std("  data block:  %u\n", vp.data_block_size);
 300                 log_std("  hash block:  %u\n", vp.hash_block_size);
 301                 log_std("  hash name:   %s\n", vp.hash_name);
 302                 log_std("  salt:        ");
 303                 if (vp.salt_size)
 304                         for(i = 0; i < vp.salt_size; i++)
 305                                 log_std("%02hhx", (const char)vp.salt[i]);
 306                 else
 307                         log_std("-");
 308                 log_std("\n");
 309
 310                 log_std("  data device: %s\n", vp.data_device);
 311                 if ((backing_file = crypt_loop_backing_file(vp.data_device))) {
 312                         log_std("  data loop:   %s\n", backing_file);
 313                         free(backing_file);
 314                 }
 315                 log_std("  size:        %" PRIu64 " sectors\n", cad.size);
 316                 log_std("  mode:        %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
 317                                            "readonly" : "read/write");
 318
 319                 log_std("  hash device: %s\n", vp.hash_device);
 320                 if ((backing_file = crypt_loop_backing_file(vp.hash_device))) {
 321                         log_std("  hash loop:   %s\n", backing_file);
 322                         free(backing_file);
 323                 }
 324                 log_std("  hash offset: %" PRIu64 " sectors\n",
 325                         vp.hash_area_offset * vp.hash_block_size / 512);
 326
 327                 if (vp.fec_device) {
 328                         log_std("  FEC device:  %s\n", vp.fec_device);
 329                         if ((backing_file = crypt_loop_backing_file(vp.fec_device))) {
 330                                 log_std("  FEC loop:    %s\n", backing_file);
 331                                 free(backing_file);
 332                         }
 333                         log_std("  FEC offset:  %" PRIu64 " sectors\n",
 334                                 vp.fec_area_offset * vp.hash_block_size / 512);
 335                         log_std("  FEC roots:   %u\n", vp.fec_roots);
 336                 }
 337
 338                 root_hash_size = crypt_get_volume_key_size(cd);
 339                 if (root_hash_size > 0 && (root_hash = malloc(root_hash_size))) {
 340                         r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, root_hash, &root_hash_size, NULL, 0);
 341                         if (!r) {
 342                                 log_std("  root hash:   ");
 343                                 for (i = 0; i < root_hash_size; i++)
 344                                         log_std("%02hhx", (const char)root_hash[i]);
 345                                 log_std("\n");
 346                         }
 347                         free(root_hash);
 348                 }
 349
 350                 if (cad.flags & (CRYPT_ACTIVATE_IGNORE_CORRUPTION|
 351                                  CRYPT_ACTIVATE_RESTART_ON_CORRUPTION|
 352                                  CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS|
 353                                  CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE))
 354                         log_std("  flags:       %s%s%s%s\n",
 355                                 (cad.flags & CRYPT_ACTIVATE_IGNORE_CORRUPTION) ? "ignore_corruption " : "",
 356                                 (cad.flags & CRYPT_ACTIVATE_RESTART_ON_CORRUPTION) ? "restart_on_corruption " : "",
 357                                 (cad.flags & CRYPT_ACTIVATE_IGNORE_ZERO_BLOCKS) ? "ignore_zero_blocks " : "",
 358                                 (cad.flags & CRYPT_ACTIVATE_CHECK_AT_MOST_ONCE) ? "check_at_most_once" : "");
 359         }
 360 out:
 361         crypt_free(cd);
 362         if (r == -ENOTSUP)
 363                 r = 0;
 364         return r;
 365 }
 366
 367 static int action_dump(int arg)
 368 {
 369         struct crypt_device *cd = NULL;
 370         struct crypt_params_verity params = {};
 371         int r;
 372
 373         if ((r = crypt_init(&cd, action_argv[0])))
 374                 return r;
 375
 376         params.hash_area_offset = hash_offset;
 377         params.fec_area_offset = fec_offset;
 378         r = crypt_load(cd, CRYPT_VERITY, &params);
 379         if (!r)
 380                 crypt_dump(cd);
 381         crypt_free(cd);
 382         return r;
 383 }
 384
 385 static struct action_type {
 386         const char *type;
 387         int (*handler)(int);
 388         int required_action_argc;
 389         const char *arg_desc;
 390         const char *desc;
 391 } action_types[] = {
 392         { "format",     action_format, 2, N_("<data_device> <hash_device>"),N_("format device") },
 393         { "verify",     action_verify, 3, N_("<data_device> <hash_device> <root_hash>"),N_("verify device") },
 394         { "open",       action_open,   4, N_("<data_device> <name> <hash_device> <root_hash>"),N_("open device as <name>") },
 395         { "close",      action_close,  1, N_("<name>"),N_("close device (remove mapping)") },
 396         { "status",     action_status, 1, N_("<name>"),N_("show active device status") },
 397         { "dump",       action_dump,   1, N_("<hash_device>"),N_("show on-disk information") },
 398         { NULL, NULL, 0, NULL, NULL }
 399 };
 400
 401 static void help(poptContext popt_context,
 402                  enum poptCallbackReason reason __attribute__((unused)),
 403                  struct poptOption *key,
 404                  const char *arg __attribute__((unused)),
 405                  void *data __attribute__((unused)))
 406 {
 407         struct action_type *action;
 408
 409         if (key->shortName == '?') {
 410                 log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
 411                 poptPrintHelp(popt_context, stdout, 0);
 412                 log_std(_("\n"
 413                          "<action> is one of:\n"));
 414                 for(action = action_types; action->type; action++)
 415                         log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
 416                 log_std(_("\n"
 417                          "<name> is the device to create under %s\n"
 418                          "<data_device> is the data device\n"
 419                          "<hash_device> is the device containing verification data\n"
 420                          "<root_hash> hash of the root node on <hash_device>\n"),
 421                         crypt_get_dir());
 422
 423                 log_std(_("\nDefault compiled-in dm-verity parameters:\n"
 424                          "\tHash: %s, Data block (bytes): %u, "
 425                          "Hash block (bytes): %u, Salt size: %u, Hash format: %u\n"),
 426                         DEFAULT_VERITY_HASH, DEFAULT_VERITY_DATA_BLOCK,
 427                         DEFAULT_VERITY_HASH_BLOCK, DEFAULT_VERITY_SALT_SIZE,
 428                         1);
 429                 poptFreeContext(popt_context);
 430                 exit(EXIT_SUCCESS);
 431         } else if (key->shortName == 'V') {
 432                 log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
 433                 poptFreeContext(popt_context);
 434                 exit(EXIT_SUCCESS);
 435         } else
 436                 usage(popt_context, EXIT_SUCCESS, NULL, NULL);
 437 }
 438
 439 static int run_action(struct action_type *action)
 440 {
 441         int r;
 442
 443         log_dbg("Running command %s.", action->type);
 444
 445         r = action->handler(0);
 446
 447         show_status(r);
 448         return translate_errno(r);
 449 }
 450
 451 int main(int argc, const char **argv)
 452 {
 453         static char *popt_tmp;
 454         static const char *null_action_argv[] = {NULL};
 455         static struct poptOption popt_help_options[] = {
 456                 { NULL,    '\0', POPT_ARG_CALLBACK, help, 0, NULL,                         NULL },
 457                 { "help",  '?',  POPT_ARG_NONE,     NULL, 0, N_("Show this help message"), NULL },
 458                 { "usage", '\0', POPT_ARG_NONE,     NULL, 0, N_("Display brief usage"),    NULL },
 459                 { "version",'V', POPT_ARG_NONE,     NULL, 0, N_("Print package version"),  NULL },
 460                 POPT_TABLEEND
 461         };
 462         static struct poptOption popt_options[] = {
 463                 { NULL,              '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
 464                 { "verbose",         'v',  POPT_ARG_NONE, &opt_verbose,      0, N_("Shows more detailed error messages"), NULL },
 465                 { "debug",           '\0', POPT_ARG_NONE, &opt_debug,        0, N_("Show debug messages"), NULL },
 466                 { "no-superblock",   0,    POPT_ARG_VAL,  &use_superblock,   0, N_("Do not use verity superblock"), NULL },
 467                 { "format",          0,    POPT_ARG_INT,  &hash_type,        0, N_("Format type (1 - normal, 0 - original Chrome OS)"), N_("number") },
 468                 { "data-block-size", 0,    POPT_ARG_INT,  &data_block_size,  0, N_("Block size on the data device"), N_("bytes") },
 469                 { "hash-block-size", 0,    POPT_ARG_INT,  &hash_block_size,  0, N_("Block size on the hash device"), N_("bytes") },
 470                 { "fec-roots",       0,    POPT_ARG_INT,  &fec_roots,        0, N_("FEC parity bytes"), N_("bytes") },
 471                 { "data-blocks",     0,    POPT_ARG_STRING, &popt_tmp,       1, N_("The number of blocks in the data file"), N_("blocks") },
 472                 { "fec-device",      0,    POPT_ARG_STRING, &fec_device,     0, N_("Path to device with error correction data"), N_("path") },
 473                 { "hash-offset",     0,    POPT_ARG_STRING, &popt_tmp,       2, N_("Starting offset on the hash device"), N_("bytes") },
 474                 { "fec-offset",      0,    POPT_ARG_STRING, &popt_tmp,       3, N_("Starting offset on the FEC device"), N_("bytes") },
 475                 { "hash",            'h',  POPT_ARG_STRING, &hash_algorithm, 0, N_("Hash algorithm"), N_("string") },
 476                 { "salt",            's',  POPT_ARG_STRING, &salt_string,    0, N_("Salt"), N_("hex string") },
 477                 { "uuid",            '\0', POPT_ARG_STRING, &opt_uuid,       0, N_("UUID for device to use"), NULL },
 478                 { "root-hash-signature",'\0', POPT_ARG_STRING, &opt_root_hash_signature,  0, N_("Path to root hash signature file"), NULL },
 479                 { "restart-on-corruption", 0,POPT_ARG_NONE,&opt_restart_on_corruption, 0, N_("Restart kernel if corruption is detected"), NULL },
 480                 { "ignore-corruption", 0,  POPT_ARG_NONE, &opt_ignore_corruption,  0, N_("Ignore corruption, log it only"), NULL },
 481                 { "ignore-zero-blocks", 0, POPT_ARG_NONE, &opt_ignore_zero_blocks, 0, N_("Do not verify zeroed blocks"), NULL },
 482                 { "check-at-most-once", 0, POPT_ARG_NONE, &opt_check_at_most_once, 0, N_("Verify data block only the first time it is read"), NULL },
 483                 POPT_TABLEEND
 484         };
 485
 486         poptContext popt_context;
 487         struct action_type *action;
 488         const char *aname;
 489         int r;
 490
 491         crypt_set_log_callback(NULL, tool_log, NULL);
 492
 493         setlocale(LC_ALL, "");
 494         bindtextdomain(PACKAGE, LOCALEDIR);
 495         textdomain(PACKAGE);
 496
 497         popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
 498         poptSetOtherOptionHelp(popt_context,
 499                                _("[OPTION...] <action> <action-specific>"));
 500
 501         while((r = poptGetNextOpt(popt_context)) > 0) {
 502                 unsigned long long ull_value;
 503                 char *endp;
 504
 505                 errno = 0;
 506                 ull_value = strtoull(popt_tmp, &endp, 10);
 507                 if (*endp || !*popt_tmp || !isdigit(*popt_tmp) ||
 508                     (errno == ERANGE && ull_value == ULLONG_MAX) ||
 509                     (errno != 0 && ull_value == 0))
 510                         r = POPT_ERROR_BADNUMBER;
 511
 512                 switch(r) {
 513                         case 1:
 514                                 data_blocks = ull_value;
 515                                 break;
 516                         case 2:
 517                                 hash_offset = ull_value;
 518                                 break;
 519                         case 3:
 520                                 fec_offset = ull_value;
 521                                 break;
 522                 }
 523
 524                 if (r < 0)
 525                         break;
 526         }
 527
 528         if (r < -1)
 529                 usage(popt_context, EXIT_FAILURE, poptStrerror(r),
 530                       poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
 531
 532         if (!(aname = poptGetArg(popt_context)))
 533                 usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
 534                       poptGetInvocationName(popt_context));
 535
 536         action_argc = 0;
 537         action_argv = poptGetArgs(popt_context);
 538         /* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
 539         if(!action_argv)
 540                 action_argv = null_action_argv;
 541
 542         /* Count args, somewhat unnice, change? */
 543         while(action_argv[action_argc] != NULL)
 544                 action_argc++;
 545
 546         /* Handle aliases */
 547         if (!strcmp(aname, "create") && action_argc > 1) {
 548                 /* create command had historically switched arguments */
 549                 if (action_argv[0] && action_argv[1]) {
 550                         const char *tmp = action_argv[0];
 551                         action_argv[0] = action_argv[1];
 552                         action_argv[1] = tmp;
 553                 }
 554                 aname = "open";
 555         } else if (!strcmp(aname, "remove")) {
 556                 aname = "close";
 557         }
 558
 559         for (action = action_types; action->type; action++)
 560                 if (strcmp(action->type, aname) == 0)
 561                         break;
 562
 563         if (!action->type)
 564                 usage(popt_context, EXIT_FAILURE, _("Unknown action."),
 565                       poptGetInvocationName(popt_context));
 566
 567         if (action_argc < action->required_action_argc) {
 568                 char buf[128];
 569                 snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc);
 570                 usage(popt_context, EXIT_FAILURE, buf,
 571                       poptGetInvocationName(popt_context));
 572         }
 573
 574         if (data_block_size < 0 || hash_block_size < 0 || hash_type < 0) {
 575                 usage(popt_context, EXIT_FAILURE,
 576                       _("Negative number for option not permitted."),
 577                       poptGetInvocationName(popt_context));
 578         }
 579
 580         if ((opt_ignore_corruption || opt_restart_on_corruption || opt_ignore_zero_blocks) && strcmp(aname, "open"))
 581                 usage(popt_context, EXIT_FAILURE,
 582                 _("Option --ignore-corruption, --restart-on-corruption or --ignore-zero-blocks is allowed only for open operation."),
 583                 poptGetInvocationName(popt_context));
 584
 585         if (opt_root_hash_signature && strcmp(aname, "open"))
 586                 usage(popt_context, EXIT_FAILURE,
 587                 _("Option --root-hash-signature can be used only for open operation."),
 588                 poptGetInvocationName(popt_context));
 589
 590         if (opt_ignore_corruption && opt_restart_on_corruption)
 591                 usage(popt_context, EXIT_FAILURE,
 592                 _("Option --ignore-corruption and --restart-on-corruption cannot be used together."),
 593                 poptGetInvocationName(popt_context));
 594
 595         if (opt_debug) {
 596                 opt_verbose = 1;
 597                 crypt_set_debug_level(-1);
 598                 dbg_version_and_cmd(argc, argv);
 599         }
 600
 601         r = run_action(action);
 602         poptFreeContext(popt_context);
 603         return r;
 604 }