Add master key dump option for tcryptDump.

diff --git a/src/cryptsetup.c b/src/cryptsetup.c
index bf215b2..779c1b4 100644 (file)
--- a/src/cryptsetup.c
+++ b/src/cryptsetup.c
@@ -246,6 +246,48 @@ out:
        return r;
 }
 
        return r;
 }
 

+static int tcryptDump_with_volume_key(struct crypt_device *cd)
+{
+       char *vk = NULL;
+       size_t vk_size;
+       unsigned i;
+       int r;
+
+       crypt_set_confirm_callback(cd, yesDialog, NULL);
+       if (!yesDialog(
+           _("Header dump with volume key is sensitive information\n"
+             "which allows access to encrypted partition without passphrase.\n"
+             "This dump should be always stored encrypted on safe place."),
+             NULL))
+               return -EPERM;
+
+       vk_size = crypt_get_volume_key_size(cd);
+       vk = crypt_safe_alloc(vk_size);
+       if (!vk)
+               return -ENOMEM;
+
+       r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, vk, &vk_size, NULL, 0);
+       if (r < 0)
+               goto out;
+
+       log_std("TCRYPT header information for %s\n", crypt_get_device_name(cd));
+       log_std("Cipher chain:  \t%s\n", crypt_get_cipher(cd));
+       log_std("Cipher mode:   \t%s\n", crypt_get_cipher_mode(cd));
+       log_std("Payload offset:\t%d\n", (int)crypt_get_data_offset(cd));
+       log_std("MK bits:       \t%d\n", (int)vk_size * 8);
+       log_std("MK dump:\t");
+
+       for(i = 0; i < vk_size; i++) {
+               if (i && !(i % 16))
+                       log_std("\n\t\t");
+               log_std("%02hhx ", (char)vk[i]);
+       }
+       log_std("\n");
+out:
+       crypt_safe_free(vk);
+       return r;
+}
+

 static int action_tcryptDump(void)
 {
        struct crypt_device *cd = NULL;
 static int action_tcryptDump(void)
 {
        struct crypt_device *cd = NULL;


@@ -274,7 +316,10 @@ static int action_tcryptDump(void)
        if (r < 0)
                goto out;
 
        if (r < 0)
                goto out;
 

-       r = crypt_dump(cd);
+       if (opt_dump_master_key)
+               r = tcryptDump_with_volume_key(cd);
+       else
+               r = crypt_dump(cd);

 out:
        crypt_free(cd);
        crypt_safe_free(CONST_CAST(char*)params.passphrase);
 out:
        crypt_free(cd);
        crypt_safe_free(CONST_CAST(char*)params.passphrase);


@@ -991,7 +1036,7 @@ static int luksDump_with_volume_key(struct crypt_device *cd)
 
        crypt_set_confirm_callback(cd, yesDialog, NULL);
        if (!yesDialog(
 
        crypt_set_confirm_callback(cd, yesDialog, NULL);
        if (!yesDialog(

-           _("LUKS header dump with volume key is sensitive information\n"
+           _("Header dump with volume key is sensitive information\n"

              "which allows access to encrypted partition without passphrase.\n"
              "This dump should be always stored encrypted on safe place."),
              NULL))
              "which allows access to encrypted partition without passphrase.\n"
              "This dump should be always stored encrypted on safe place."),
              NULL))