mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-08 09:20:11 +01:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
66fa12a521 |
41
COPYING
41
COPYING
@@ -1,12 +1,12 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions:
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
@@ -225,7 +225,7 @@ impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
@@ -303,16 +303,17 @@ the "copyright" line and a pointer to where the full notice is found.
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
@@ -335,7 +336,7 @@ necessary. Here is a sample; alter the names:
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
||||
|
||||
-----
|
||||
|
||||
502
COPYING.LGPL
502
COPYING.LGPL
@@ -1,502 +0,0 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Libraries
|
||||
|
||||
If you develop a new library, and you want it to be of the greatest
|
||||
possible use to the public, we recommend making it free software that
|
||||
everyone can redistribute and change. You can do so by permitting
|
||||
redistribution under these terms (or, alternatively, under the terms of the
|
||||
ordinary General Public License).
|
||||
|
||||
To apply these terms, attach the following notices to the library. It is
|
||||
safest to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least the
|
||||
"copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the library's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU Lesser General Public
|
||||
License along with this library; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the library, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the
|
||||
library `Frob' (a library for tweaking knobs) written by James Random Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1990
|
||||
Ty Coon, President of Vice
|
||||
|
||||
That's all there is to it!
|
||||
102
ChangeLog
102
ChangeLog
@@ -1,105 +1,3 @@
|
||||
2012-10-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Added keyslot checker (by Arno Wagner).
|
||||
* Version 1.5.1.
|
||||
|
||||
2012-09-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Add crypt_keyslot_area() API call.
|
||||
|
||||
2012-08-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Optimize seek to keyfile-offset (Issue #135, thx to dreisner).
|
||||
* Fix luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
2012-08-12 Milan Broz <gmazyland@gmail.com>
|
||||
* Allocate loop device late (only when real block device needed).
|
||||
* Rework underlying device/file access functions.
|
||||
* Create hash image if doesn't exist in veritysetup format.
|
||||
* Provide better error message if running as non-root user (device-mapper, loop).
|
||||
|
||||
2012-07-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0.
|
||||
|
||||
2012-06-25 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --device-size option for reencryption tool.
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
2012-06-20 Milan Broz <gmazyland@gmail.com>
|
||||
* Version 1.5.0-rc2.
|
||||
|
||||
2012-06-18 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
2012-06-11 Milan Broz <gmazyland@gmail.com>
|
||||
* Introduce veritysetup for dm-verity target management.
|
||||
* Version 1.5.0-rc1.
|
||||
|
||||
2012-06-10 Milan Broz <gmazyland@gmail.com>
|
||||
* Both data and header device can now be a file.
|
||||
* Loop is automatically allocated in crypt_set_data_device().
|
||||
* Require only up to last keyslot area for header device (ignore data offset).
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
|
||||
2012-05-27 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
* Version 1.4.3.
|
||||
|
||||
2012-05-21 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --enable-fips for linking with fipscheck library.
|
||||
* Initialize binary and library selfcheck if running in FIPS mode.
|
||||
* Use FIPS RNG in FIPS mode for KEY and SALT (only gcrypt backend supported).
|
||||
|
||||
2012-05-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix keyslot removal (wipe keyslot) for device with 4k hw block (1.4.0).
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
2012-05-02 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix loop mapping on readonly file.
|
||||
* Relax --shared test, allow mapping even for overlapping segments.
|
||||
* Support shared flag for LUKS devices (dangerous).
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
|
||||
2012-04-09 Milan Broz <gmazyland@gmail.com>
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment. (1.4.0)
|
||||
* Version 1.4.2.
|
||||
|
||||
2012-03-16 Milan Broz <gmazyland@gmail.com>
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
* Allow to specify --align-payload only for luksFormat.
|
||||
|
||||
2012-03-16 Milan Broz <mbroz@redhat.com>
|
||||
* Unify password verification option.
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
|
||||
2012-02-11 Milan Broz <mbroz@redhat.com>
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
2012-01-12 Milan Broz <mbroz@redhat.com>
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
2011-11-13 Milan Broz <mbroz@redhat.com>
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
|
||||
2011-11-09 Milan Broz <mbroz@redhat.com>
|
||||
* Version 1.4.1.
|
||||
|
||||
2011-11-05 Milan Broz <mbroz@redhat.com>
|
||||
* Merge pycryptsetup (Python libcryptsetup bindings).
|
||||
* Fix stupid typo in set_iteration_time API call.
|
||||
* Fix cryptsetup status output if parameter is device path.
|
||||
|
||||
2011-10-27 Milan Broz <mbroz@redhat.com>
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
* Fix FSF address in license text.
|
||||
|
||||
2011-10-25 Milan Broz <mbroz@redhat.com>
|
||||
* Print informative message in isLuks only in verbose mode.
|
||||
* Version 1.4.0.
|
||||
|
||||
@@ -1,9 +1,8 @@
|
||||
EXTRA_DIST = COPYING.LGPL FAQ docs misc
|
||||
EXTRA_DIST = FAQ docs misc
|
||||
SUBDIRS = \
|
||||
lib \
|
||||
src \
|
||||
man \
|
||||
python \
|
||||
tests \
|
||||
po
|
||||
|
||||
|
||||
2
README
2
README
@@ -23,7 +23,7 @@ DOWNLOAD:
|
||||
SOURCE CODE:
|
||||
|
||||
URL: http://code.google.com/p/cryptsetup/source/browse/
|
||||
Checkout: git clone https://code.google.com/p/cryptsetup/
|
||||
Checkout: svn checkout http://cryptsetup.googlecode.com/svn/trunk/ cryptsetup
|
||||
|
||||
NLS (PO TRANSLATIONS):
|
||||
|
||||
|
||||
5
TODO
5
TODO
@@ -1,7 +1,6 @@
|
||||
Version 1.6.0:
|
||||
Version 1.5.0:
|
||||
- Export wipe device functions
|
||||
- Support K/M suffixes for align payload (new switch?).
|
||||
- FIPS: move changekey to library
|
||||
- FIPS patches (RNG, volume key restrictions, move changekey to library)
|
||||
- online reencryption api?
|
||||
- integrate more metadata formats
|
||||
- TRIM for keyslots
|
||||
|
||||
118
configure.in
118
configure.in
@@ -1,11 +1,9 @@
|
||||
AC_PREREQ([2.67])
|
||||
AC_INIT([cryptsetup],[1.5.1])
|
||||
AC_INIT([cryptsetup],[1.4.0])
|
||||
|
||||
dnl library version from <major>.<minor>.<release>[-<suffix>]
|
||||
LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
|
||||
LIBCRYPTSETUP_VERSION_INFO=8:0:4
|
||||
dnl library file name for FIPS selfcheck
|
||||
LIBCRYPTSETUP_VERSION_FIPS="libcryptsetup.so.4"
|
||||
LIBCRYPTSETUP_VERSION_INFO=4:0:0
|
||||
|
||||
AC_CONFIG_SRCDIR(src/cryptsetup.c)
|
||||
AC_CONFIG_MACRO_DIR([m4])
|
||||
@@ -33,11 +31,11 @@ AC_HEADER_STDC
|
||||
AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h sys/ioctl.h sys/mman.h \
|
||||
ctype.h unistd.h locale.h)
|
||||
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])])
|
||||
AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR('You need the device-mapper library')])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR([You need the uuid library.])])
|
||||
AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR('You need the uuid library')])
|
||||
AC_SUBST(UUID_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
@@ -63,44 +61,11 @@ AC_CHECK_LIB(popt, poptConfigFileToString,,
|
||||
AC_SUBST(POPT_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl FIPS extensions
|
||||
AC_ARG_ENABLE([fips], AS_HELP_STRING([--enable-fips],[enable FIPS mode restrictions]),
|
||||
[with_fips=$enableval],
|
||||
[with_fips=no])
|
||||
|
||||
if test "x$with_fips" = "xyes"; then
|
||||
AC_DEFINE(ENABLE_FIPS, 1, [Enable FIPS mode restrictions])
|
||||
AC_DEFINE_UNQUOTED(LIBCRYPTSETUP_VERSION_FIPS, ["$LIBCRYPTSETUP_VERSION_FIPS"],
|
||||
[library file name for FIPS selfcheck])
|
||||
|
||||
if test "x$enable_static" = "xyes" -o "x$enable_static_cryptsetup" = "xyes" ; then
|
||||
AC_MSG_ERROR([Static build is not compatible with FIPS.])
|
||||
fi
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(fipscheck, FIPSCHECK_verify, ,[AC_MSG_ERROR([You need the fipscheck library.])])
|
||||
AC_SUBST(FIPSCHECK_LIBS, $LIBS)
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
fi
|
||||
|
||||
AC_DEFUN([NO_FIPS], [
|
||||
if test "x$with_fips" = "xyes"; then
|
||||
AC_MSG_ERROR([This option is not compatible with FIPS.])
|
||||
fi
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl Crypto backend functions
|
||||
|
||||
AC_DEFUN([CONFIGURE_GCRYPT], [
|
||||
if test "x$with_fips" = "xyes"; then
|
||||
GCRYPT_REQ_VERSION=1.4.5
|
||||
else
|
||||
GCRYPT_REQ_VERSION=1.1.42
|
||||
fi
|
||||
AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])
|
||||
AM_PATH_LIBGCRYPT(1.1.42,,[AC_MSG_ERROR('You need the gcrypt library')])
|
||||
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
saved_LIBS=$LIBS
|
||||
@@ -115,13 +80,11 @@ AC_DEFUN([CONFIGURE_GCRYPT], [
|
||||
CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS
|
||||
CRYPTO_LIBS=$LIBGCRYPT_LIBS
|
||||
CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS
|
||||
|
||||
AC_DEFINE_UNQUOTED(GCRYPT_REQ_VERSION, ["$GCRYPT_REQ_VERSION"], [Requested gcrypt version])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_OPENSSL], [
|
||||
PKG_CHECK_MODULES([OPENSSL], [openssl >= 0.9.8],,
|
||||
AC_MSG_ERROR([You need openssl library.]))
|
||||
AC_MSG_ERROR('You need openssl library'))
|
||||
CRYPTO_CFLAGS=$OPENSSL_CFLAGS
|
||||
CRYPTO_LIBS=$OPENSSL_LIBS
|
||||
|
||||
@@ -132,50 +95,41 @@ AC_DEFUN([CONFIGURE_OPENSSL], [
|
||||
CRYPTO_STATIC_LIBS=$OPENSSL_LIBS
|
||||
PKG_CONFIG=$saved_PKG_CONFIG
|
||||
fi
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NSS], [
|
||||
if test x$enable_static_cryptsetup = xyes; then
|
||||
AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.])
|
||||
AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.]),
|
||||
fi
|
||||
|
||||
AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).])
|
||||
|
||||
PKG_CHECK_MODULES([NSS], [nss],,
|
||||
AC_MSG_ERROR([You need nss library.]))
|
||||
|
||||
saved_CFLAGS=$CFLAGS
|
||||
CFLAGS="$CFLAGS $NSS_CFLAGS"
|
||||
AC_CHECK_DECLS([NSS_GetVersion], [], [], [#include <nss.h>])
|
||||
CFLAGS=$saved_CFLAGS
|
||||
|
||||
AC_MSG_ERROR('You need nss library'))
|
||||
CRYPTO_CFLAGS=$NSS_CFLAGS
|
||||
CRYPTO_LIBS=$NSS_LIBS
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_KERNEL], [
|
||||
AC_CHECK_HEADERS(linux/if_alg.h,,
|
||||
[AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])])
|
||||
[AC_MSG_ERROR('You need Linux kernel with userspace crypto interface.')])
|
||||
# AC_CHECK_DECLS([AF_ALG],,
|
||||
# [AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])],
|
||||
# [AC_MSG_ERROR('You need Linux kernel with userspace crypto interface.')],
|
||||
# [#include <sys/socket.h>])
|
||||
NO_FIPS([])
|
||||
|
||||
])
|
||||
|
||||
AC_DEFUN([CONFIGURE_NETTLE], [
|
||||
AC_CHECK_HEADERS(nettle/sha.h,,
|
||||
[AC_MSG_ERROR([You need Nettle cryptographic library.])])
|
||||
[AC_MSG_ERROR('You need Nettle cryptographic library.')])
|
||||
|
||||
saved_LIBS=$LIBS
|
||||
AC_CHECK_LIB(nettle, nettle_ripemd160_init,,
|
||||
[AC_MSG_ERROR([You need Nettle library version 2.4 or more recent.])])
|
||||
[AC_MSG_ERROR('You need Nettle library version 2.4 or more recent.')])
|
||||
CRYPTO_LIBS=$LIBS
|
||||
LIBS=$saved_LIBS
|
||||
|
||||
CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
|
||||
NO_FIPS([])
|
||||
])
|
||||
|
||||
dnl ==========================================================================
|
||||
@@ -190,17 +144,7 @@ if test x$enable_static_cryptsetup = xyes; then
|
||||
enable_static=yes
|
||||
fi
|
||||
fi
|
||||
AM_CONDITIONAL(STATIC_TOOLS, test x$enable_static_cryptsetup = xyes)
|
||||
|
||||
AC_ARG_ENABLE(veritysetup,
|
||||
AS_HELP_STRING([--disable-veritysetup],
|
||||
[disable veritysetup support]),[], [enable_veritysetup=yes])
|
||||
AM_CONDITIONAL(VERITYSETUP, test x$enable_veritysetup = xyes)
|
||||
|
||||
AC_ARG_ENABLE([cryptsetup-reencrypt],
|
||||
AS_HELP_STRING([--enable-cryptsetup-reencrypt],
|
||||
[enable cryptsetup-reencrypt tool]))
|
||||
AM_CONDITIONAL(REENCRYPT, test x$enable_cryptsetup_reencrypt = xyes)
|
||||
AM_CONDITIONAL(STATIC_CRYPTSETUP, test x$enable_static_cryptsetup = xyes)
|
||||
|
||||
AC_ARG_ENABLE(selinux,
|
||||
AS_HELP_STRING([--disable-selinux],
|
||||
@@ -222,7 +166,6 @@ LIBS=$saved_LIBS
|
||||
|
||||
LIBS="$LIBS $DEVMAPPER_LIBS"
|
||||
AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([dm_task_retry_remove], [], [], [#include <libdevmapper.h>])
|
||||
AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
|
||||
if test "x$enable_udev" = xyes; then
|
||||
if test "x$have_cookie" = xno; then
|
||||
@@ -293,7 +236,6 @@ AC_SUBST([CRYPTO_STATIC_LIBS])
|
||||
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
|
||||
AC_SUBST([LIBCRYPTSETUP_VERSION_FIPS])
|
||||
|
||||
dnl ==========================================================================
|
||||
AC_ARG_ENABLE([dev-random], AS_HELP_STRING([--enable-dev-random],
|
||||
@@ -318,25 +260,6 @@ AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
|
||||
[CS_DEFINE([$1], [$3], [$2])]
|
||||
)])
|
||||
|
||||
dnl ==========================================================================
|
||||
dnl Python bindings
|
||||
AC_ARG_ENABLE([python], AS_HELP_STRING([--enable-python],[enable Python bindings]),
|
||||
[with_python=$enableval],
|
||||
[with_python=no])
|
||||
|
||||
if test "x$with_python" = "xyes"; then
|
||||
AM_PATH_PYTHON([2.4])
|
||||
|
||||
if ! test -x "$PYTHON-config" ; then
|
||||
AC_MSG_ERROR([Cannot find python development packages to build bindings])
|
||||
fi
|
||||
|
||||
PYTHON_INCLUDES=$($PYTHON-config --includes)
|
||||
AC_SUBST(PYTHON_INCLUDES)
|
||||
fi
|
||||
AM_CONDITIONAL([PYTHON_CRYPTSETUP], [test "x$with_python" = "xyes"])
|
||||
|
||||
dnl ==========================================================================
|
||||
CS_STR_WITH([plain-hash], [password hashing function for plain mode], [ripemd160])
|
||||
CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
|
||||
CS_STR_WITH([plain-mode], [cipher mode for plain mode], [cbc-essiv:sha256])
|
||||
@@ -350,13 +273,8 @@ CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
|
||||
CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes])
|
||||
CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256])
|
||||
|
||||
CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in KiB)], [8192])
|
||||
CS_NUM_WITH([passphrase-size-max],[maximum keyfile size (in characters)], [512])
|
||||
|
||||
CS_STR_WITH([verity-hash], [hash function for verity mode], [sha256])
|
||||
CS_NUM_WITH([verity-data-block], [data block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096])
|
||||
CS_NUM_WITH([verity-salt-size], [salt size for verity mode], [32])
|
||||
CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in kilobytes)], [8192])
|
||||
CS_NUM_WITH([passphrase-size-max],[maximum keyfile size (in kilobytes)], [512])
|
||||
|
||||
dnl ==========================================================================
|
||||
|
||||
@@ -366,11 +284,9 @@ lib/libcryptsetup.pc
|
||||
lib/crypto_backend/Makefile
|
||||
lib/luks1/Makefile
|
||||
lib/loopaes/Makefile
|
||||
lib/verity/Makefile
|
||||
src/Makefile
|
||||
po/Makefile.in
|
||||
man/Makefile
|
||||
tests/Makefile
|
||||
python/Makefile
|
||||
])
|
||||
AC_OUTPUT
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
*
|
||||
* The documentation covers public parts of cryptsetup API. In the following sections you'll find
|
||||
* the examples that describe some features of cryptsetup API.
|
||||
* For more info about libcryptsetup API versions see
|
||||
* <a href="http://upstream-tracker.org/versions/libcryptsetup.html">Upstream Tracker</a>.
|
||||
*
|
||||
* <OL type="A">
|
||||
* <LI>@ref cexamples "Cryptsetup API examples"</LI>
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this file; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this file; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
|
||||
@@ -62,14 +62,14 @@ WARNING: This release removes old deprecated API from libcryptsetup
|
||||
cannot properly work (there is filesystem allocation layer between
|
||||
header and disk).
|
||||
|
||||
* Support --allow-discards option to allow discards/TRIM requests.
|
||||
* Support --enable-discards option to allow discards/TRIM requests.
|
||||
|
||||
Since kernel 3.1, dm-crypt devices optionally (not by default) support
|
||||
block discards (TRIM) commands.
|
||||
block discards (TRIM) comands.
|
||||
If you want to enable this operation, you have to enable it manually
|
||||
on every activation using --allow-discards
|
||||
on every activation using --enable-discards
|
||||
|
||||
cryptsetup luksOpen --allow-discards /dev/sdb test_disk
|
||||
cryptsetup luksOpen --enable-discards /dev/sdb test_disk
|
||||
|
||||
WARNING: There are several security consequences, please read at least
|
||||
http://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html
|
||||
|
||||
@@ -1,25 +0,0 @@
|
||||
Cryptsetup 1.4.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.0
|
||||
|
||||
* Merge experimental Python cryptsetup (pycryptsetup) binding.
|
||||
|
||||
This option is disabled by default, you can enable build of Python binding
|
||||
with --enable--python configure switch.
|
||||
|
||||
Note that binding currently covers only partial libcryptsetup functions,
|
||||
mainly LUKS device handling needed for Anaconda installer.
|
||||
Until now provided separately as python-cryptsetup.
|
||||
Thanks to Martin Sivak for the code.
|
||||
|
||||
See python subdirectory for more info.
|
||||
|
||||
Python binding code is experimental for now, no stable API guarantee.
|
||||
|
||||
* Fix crypt_get_volume_key_size() for plain device.
|
||||
(cryptsetup status reported zero key size for plain crypt devices).
|
||||
|
||||
* Fix typo in set_iteration_time API call (old name remains for compatibility reasons).
|
||||
|
||||
* Fix FSF address in license and add LGPL license text.
|
||||
@@ -1,44 +0,0 @@
|
||||
Cryptsetup 1.4.2 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.1
|
||||
|
||||
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
|
||||
These options can be used to skip start of keyfile or device used as keyfile.
|
||||
|
||||
* Add repair command and crypt_repair() for known LUKS metadata problems repair.
|
||||
|
||||
Some well-known LUKS metadata corruptions are easy to repair, this
|
||||
command should provide a way to fix these problems.
|
||||
|
||||
Always create binary backup of header device before running repair,
|
||||
(only 4kB - visible header) for example by using dd:
|
||||
dd if=/dev/<LUKS header device> of=repair_bck.img bs=1k count=4
|
||||
|
||||
Then you can try to run repair:
|
||||
cryptsetup repair <device>
|
||||
|
||||
Note, not all problems are possible to repair and if keyslot or some header
|
||||
parameters are overwritten, device is lost permanently.
|
||||
|
||||
* Fix header check to support old (cryptsetup 1.0.0) header alignment.
|
||||
(Regression in 1.4.0)
|
||||
|
||||
* Allow to specify --align-payload only for luksFormat.
|
||||
|
||||
* Add --master-key-file option to luksOpen (open using volume key).
|
||||
|
||||
* Support UUID=<LUKS_UUID> format for device specification.
|
||||
You can open device by UUID (only shortcut to /dev/disk/by-uuid/ symlinks).
|
||||
|
||||
* Support password verification with quiet flag if possible. (1.2.0)
|
||||
Password verification can be still possible if input is terminal.
|
||||
|
||||
* Fix retry if entered passphrases (with verify option) do not match.
|
||||
(It should retry if requested, not fail.)
|
||||
|
||||
* Fix use of empty keyfile.
|
||||
|
||||
* Fix error message for luksClose and detached LUKS header.
|
||||
|
||||
* Allow --header for status command to get full info with detached header.
|
||||
@@ -1,62 +0,0 @@
|
||||
Cryptsetup 1.4.3 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.4.2
|
||||
|
||||
* Fix readonly activation if underlying device is readonly (1.4.0).
|
||||
|
||||
* Fix loop mapping on readonly file.
|
||||
|
||||
* Include stddef.h in libdevmapper.h (size_t definition).
|
||||
|
||||
* Fix keyslot removal for device with 4k hw block (1.4.0).
|
||||
(Wipe keyslot failed in this case.)
|
||||
|
||||
* Relax --shared flag to allow mapping even for overlapping segments.
|
||||
|
||||
The --shared flag (and API CRYPT_ACTIVATE_SHARED flag) is now able
|
||||
to map arbitrary overlapping area. From API it is even usable
|
||||
for LUKS devices.
|
||||
It is user responsibility to not cause data corruption though.
|
||||
|
||||
This allows e.g. scubed to work again and also allows some
|
||||
tricky extensions later.
|
||||
|
||||
* Allow empty cipher (cipher_null) for testing.
|
||||
|
||||
You can now use "null" (or directly cipher_null-ecb) in cryptsetup.
|
||||
This means no encryption, useful for performance tests
|
||||
(measure dm-crypt layer overhead).
|
||||
|
||||
* Switch on retry on device remove for libdevmapper.
|
||||
Device-mapper now retry removal if device is busy.
|
||||
|
||||
* Allow "private" activation (skip some udev global rules) flag.
|
||||
Cryptsetup library API now allows to specify CRYPT_ACTIVATE_PRIVATE,
|
||||
which means that some udev rules are not processed.
|
||||
(Used for temporary devices, like internal keyslot mappings where
|
||||
it is not desirable to run any device scans.)
|
||||
|
||||
* This release also includes some Red Hat/Fedora specific extensions
|
||||
related to FIPS140-2 compliance.
|
||||
|
||||
In fact, all these patches are more formal changes and are just subset
|
||||
of building blocks for FIPS certification. See FAQ for more details
|
||||
about FIPS.
|
||||
|
||||
FIPS extensions are enabled by using --enable-fips configure switch.
|
||||
|
||||
In FIPS mode (kernel booted with fips=1 and gcrypt in FIPS mode)
|
||||
|
||||
- it provides library and binary integrity verification using
|
||||
libfipscheck (requires pre-generated checksums)
|
||||
|
||||
- it uses FIPS approved RNG for encryption key and salt generation
|
||||
(note that using /dev/random is not formally FIPS compliant RNG).
|
||||
|
||||
- only gcrypt crypto backend is currently supported in FIPS mode.
|
||||
|
||||
The FIPS RNG requirement for salt comes from NIST SP 800-132 recommendation.
|
||||
(Recommendation for Password-Based Key Derivation. Part 1: Storage Applications.
|
||||
http://csrc.nist.gov/publications/nistpubs/800-132/nist-sp800-132.pdf)
|
||||
LUKS should be aligned to this recommendation otherwise.
|
||||
@@ -1,241 +0,0 @@
|
||||
Cryptsetup 1.5.0 Release Notes
|
||||
==============================
|
||||
|
||||
This release covers mainly inclusion of:
|
||||
|
||||
* Veritysetup tool (and related libcryptsetup extensions for dm-verity).
|
||||
|
||||
* Experimental cryptsetup-reencrypt tool (LUKS offline reencryption).
|
||||
|
||||
Changes since version 1.5.0-rc2
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
* Add --device-size option for reencryption tool.
|
||||
|
||||
* Switch to use unit suffix for --reduce-device-size option.
|
||||
|
||||
* Remove open device debugging feature (no longer needed).
|
||||
|
||||
* Fix library name for FIPS check.
|
||||
|
||||
* Add example of using reencryption inside dracut (see misc/dracut).
|
||||
|
||||
Changes since version 1.5.0-rc1
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce cryptsetup-reencrypt - experimental offline LUKS reencryption tool.
|
||||
|
||||
! cryptsetup-reencrypt tool is EXPERIMENTAL
|
||||
! ALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL
|
||||
|
||||
This tool tries to simplify situation when you need to re-encrypt the whole
|
||||
LUKS device in situ (without need to move data elsewhere).
|
||||
|
||||
This can happen for example when you want to change volume (master) key,
|
||||
encryption algorithm, or other encryption parameter.
|
||||
|
||||
Cryptsetup-reencrypt can even optionally shift data on device
|
||||
(reducing data device size - you need some free space at the end of device).
|
||||
|
||||
In general, cryptsetup-reencrypt can be used to
|
||||
|
||||
- re-generate volume key
|
||||
- change arbitrary encryption parameters
|
||||
- add encryption to not yet encrypted drive
|
||||
|
||||
Side effect of reencryption is that final device will contain
|
||||
only ciphertext (for all sectors) so even if device was not properly
|
||||
wiped by random data, after reencryption you cannot distinguish
|
||||
which sectors are used.
|
||||
(Reecryption is done always for the whole device.)
|
||||
|
||||
There are for sure bugs, please TEST IT IN TEST ENVIRONMENT before
|
||||
use for your data.
|
||||
|
||||
This tool is not resistant to HW and kernel failures - hw crash
|
||||
will cause serious data corruption.
|
||||
|
||||
You can enable compilation of this tool with --enable-cryptsetup-reencrypt
|
||||
configure option (it is switched off by default).
|
||||
(Tool requires libcryptsetup 1.4.3 and later.)
|
||||
|
||||
You have to provide all keyslot passphrases or use --keyslot-option
|
||||
(then all other keyslots will be disabled).
|
||||
|
||||
EXAMPLES (from man page)
|
||||
|
||||
Reencrypt /dev/sdb1 (change volume key)
|
||||
# cryptsetup-reencrypt /dev/sdb1
|
||||
|
||||
Reencrypt and also change cipher and cipher mode
|
||||
# cryptsetup-reencrypt /dev/sdb1 -c aes-xts-plain64
|
||||
|
||||
Note: if you are changing key size, there must be enough space
|
||||
for keyslots in header or you have to use --reduce-device size and
|
||||
reduce fs in advance.
|
||||
|
||||
Add LUKS encryption to not yet encrypted device
|
||||
First, be sure you have space added to disk.
|
||||
Or, alternatively, shrink filesystem in advance.
|
||||
|
||||
Here we need 4096 512-bytes sectors (enough for 2x128 bit key).
|
||||
|
||||
# fdisk -u /dev/sdb # move sdb1 partition end + 4096 sectors
|
||||
|
||||
# cryptsetup-reencrypt /dev/sdb1 --new --reduce-device-size 4096
|
||||
|
||||
There are some options which can improve performance (depends on system),
|
||||
namely --use-directio (use direct IO for all operations) can be faster
|
||||
on some systems. See man page.
|
||||
|
||||
Progress and estimated time is printed during reencryption.
|
||||
|
||||
You can suspend reencryption (using ctrl+c or term signal).
|
||||
To continue reencryption you have to provide only
|
||||
the device parameter (offset is stored in temporary log file).
|
||||
|
||||
Please note LUKS device is marked invalid during reencryption and
|
||||
you have to retain tool temporary files until reencryption finishes.
|
||||
|
||||
Temporary files are LUKS-<uuid>.[log|org|new]
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Fix luks-header-from-active script (do not use LUKS header on-disk, add UUID).
|
||||
|
||||
* Add --test-passphrase option for luksOpen (check passphrase only).
|
||||
|
||||
* Fix parsing of hexadecimal string (salt or root hash) in veritysetup.
|
||||
|
||||
Changes since version 1.4.3
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
Introduce veritysetup tool for dm-verity target management.
|
||||
|
||||
The dm-verity device-mapper target was added to Linux kernel 3.4 and
|
||||
provides transparent integrity checking of block devices using a cryptographic
|
||||
digest provided by the kernel crypto API. This target is read-only.
|
||||
|
||||
It is meant to be setup as part of a verified boot path (it was originally
|
||||
developed by Chrome OS authors as part of verified boot infrastructure).
|
||||
|
||||
For deeper description please see http://code.google.com/p/cryptsetup/wiki/DMVerity
|
||||
and kernel dm-verity documentation.
|
||||
|
||||
The libcryptsetup library was extended to support manipulation
|
||||
with dm-verity kernel module and new veritysetup CLI tool is added.
|
||||
|
||||
There are no additional library requirements (it uses the same crypto
|
||||
backend as cryptsetup).
|
||||
|
||||
If you want compile cryptsetup without veritysetup tool,
|
||||
use --disable-veritysetup configure option.
|
||||
For other configuration option see configure --help and veritysetup --help
|
||||
(e.g. default parameters).
|
||||
|
||||
Supported libcryptsetup functions new CRYPT_VERITY type:
|
||||
crypt_init
|
||||
crypt_init_by_name
|
||||
crypt_set_data device
|
||||
crypt_get_type
|
||||
crypt_format
|
||||
crypt_load
|
||||
crypt_get_active_device
|
||||
crypt_activate_by_volume_key (volume key == root hash here)
|
||||
crypt_dump
|
||||
and new introduced function
|
||||
crypt_get_verity_info
|
||||
|
||||
Please see comments in libcryptsetup.h and veritysetup.c as an code example
|
||||
how to use CRYPT_VERITY API.
|
||||
|
||||
The veritysetup tool supports these operations:
|
||||
|
||||
veritysetup format <data_device> <hash_device>
|
||||
Formats <hash_device> (calculates all hash areas according to <data_device>).
|
||||
This is initial command to prepare device <hash_device> for later verification.
|
||||
|
||||
veritysetup create <name> <data_device> <hash_device> <root_hash>
|
||||
Creates (activates) a dm-verity mapping with <name> backed by device <data_device>
|
||||
and using <hash_device> for in-kernel verification.
|
||||
|
||||
veritysetup verify <data_device> <hash_device> <root_hash>
|
||||
Verifies data in userspace (no kernel device is activated).
|
||||
|
||||
veritysetup remove <name>
|
||||
Removes activated device from kernel (similar to dmsetup remove).
|
||||
|
||||
veritysetup status <name>
|
||||
Reports status for the active kernel dm-verity device.
|
||||
|
||||
veritysetup dump <hash_device>
|
||||
Reports parameters of verity device from on-disk stored superblock.
|
||||
|
||||
For more info see veritysetup --help and veritysetup man page.
|
||||
|
||||
Other changes
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
* Both data and header device can now be a file and
|
||||
loop device is automatically allocated.
|
||||
|
||||
* Require only up to last keyslot area for header device, previously
|
||||
backup (and activation) required device/file of size up to data start
|
||||
offset (data payload).
|
||||
|
||||
* Fix header backup and restore to work on files with large data offset.
|
||||
Backup and restore now works even if backup file is smaller than data offset.
|
||||
|
||||
Appendix: Examples of veritysetup use
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Format device using default parameters, info and final root hash is printed:
|
||||
# veritysetup format /dev/sdb /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
Root hash: 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
|
||||
Activation of device in-kernel:
|
||||
# veritysetup create vr /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Note - if device is corrupted, kernel mapping is created but will report failure:
|
||||
Verity device detected corruption after activation.
|
||||
|
||||
Userspace verification:
|
||||
# veritysetup verify /dev/sdb /dev/sdc 7aefa4506f7af497ac491a27f862cf8005ea782a5d97f6426945a6896ab557a1
|
||||
Verification failed at position 8192.
|
||||
Verification of data area failed.
|
||||
|
||||
Active device status report:
|
||||
# veritysetup status vr
|
||||
/dev/mapper/vr is active.
|
||||
type: VERITY
|
||||
status: verified
|
||||
hash type: 1
|
||||
data block: 4096
|
||||
hash block: 4096
|
||||
hash name: sha256
|
||||
salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
data device: /dev/sdb
|
||||
size: 417792 sectors
|
||||
mode: readonly
|
||||
hash device: /dev/sdc
|
||||
hash offset: 8 sectors
|
||||
|
||||
Dump of on-disk superblock information:
|
||||
# veritysetup dump /dev/sdc
|
||||
VERITY header information for /dev/sdc
|
||||
UUID: fad30431-0c59-4fa6-9b57-732a90501f75
|
||||
Hash type: 1
|
||||
Data blocks: 52224
|
||||
Data block size: 4096
|
||||
Hash block size: 4096
|
||||
Hash algorithm: sha256
|
||||
Salt: 5cc52759af76a092e0c21829cd0ef6938f69831bf86926525106f92a7e9e3aa9
|
||||
|
||||
Remove mapping:
|
||||
# veritysetup remove vr
|
||||
@@ -1,32 +0,0 @@
|
||||
Cryptsetup 1.5.1 Release Notes
|
||||
==============================
|
||||
|
||||
Changes since version 1.5.0
|
||||
|
||||
* The libcryptsetup library now tries to initialize device-mapper backend and
|
||||
loop devices only if they are really needed (lazy initializations).
|
||||
This allows some operations to be run by a non-root user.
|
||||
|
||||
(Unfortunately LUKS header keyslot operations still require temporary dm-crypt
|
||||
device and device-mapper subsystem is available only to superuser.)
|
||||
|
||||
Also clear error messages are provided if running as non-root user and
|
||||
operation requires privileged user.
|
||||
|
||||
* Veritysetup can be now used by a normal user for creating hash image to file
|
||||
and also it can create hash image if doesn't exist.
|
||||
(Previously it required pre-allocated space.)
|
||||
|
||||
* Added crypt_keyslot_area() API call which allows external tools
|
||||
to get exact keyslot offsets and analyse content.
|
||||
|
||||
An example of a tool that searches the keyslot area of a LUKS container
|
||||
for positions where entropy is low and hence there is a high probability
|
||||
of damage is in misc/kesylot_checker.
|
||||
(Thanks to Arno Wagner for the code.)
|
||||
|
||||
* Optimized seek to keyfile-offset if key offset is large.
|
||||
|
||||
* Fixed luksHeaderBackup for very old v1.0 unaligned LUKS headers.
|
||||
|
||||
* Various fixes for problems found by a several static analysis tools.
|
||||
@@ -1,4 +1,4 @@
|
||||
SUBDIRS = crypto_backend luks1 loopaes verity
|
||||
SUBDIRS = crypto_backend luks1 loopaes
|
||||
|
||||
moduledir = $(libdir)/cryptsetup
|
||||
|
||||
@@ -10,7 +10,6 @@ INCLUDES = \
|
||||
-I$(top_srcdir)/lib/crypto_backend \
|
||||
-I$(top_srcdir)/lib/luks1 \
|
||||
-I$(top_srcdir)/lib/loopaes \
|
||||
-I$(top_srcdir)/lib/verity \
|
||||
-DDATADIR=\""$(datadir)"\" \
|
||||
-DLIBDIR=\""$(libdir)"\" \
|
||||
-DPREFIX=\""$(prefix)"\" \
|
||||
@@ -25,8 +24,7 @@ lib_LTLIBRARIES = libcryptsetup.la
|
||||
common_ldadd = \
|
||||
crypto_backend/libcrypto_backend.la \
|
||||
luks1/libluks1.la \
|
||||
loopaes/libloopaes.la \
|
||||
verity/libverity.la
|
||||
loopaes/libloopaes.la
|
||||
|
||||
libcryptsetup_la_DEPENDENCIES = $(common_ldadd) libcryptsetup.sym
|
||||
|
||||
@@ -40,26 +38,22 @@ libcryptsetup_la_LIBADD = \
|
||||
@UUID_LIBS@ \
|
||||
@DEVMAPPER_LIBS@ \
|
||||
@CRYPTO_LIBS@ \
|
||||
@FIPSCHECK_LIBS@ \
|
||||
$(common_ldadd)
|
||||
|
||||
|
||||
libcryptsetup_la_SOURCES = \
|
||||
setup.c \
|
||||
internal.h \
|
||||
bitops.h \
|
||||
nls.h \
|
||||
libcryptsetup.h \
|
||||
utils.c \
|
||||
utils_crypt.c \
|
||||
utils_crypt.h \
|
||||
utils_debug.c \
|
||||
utils_loop.c \
|
||||
utils_loop.h \
|
||||
utils_devpath.c \
|
||||
utils_wipe.c \
|
||||
utils_fips.c \
|
||||
utils_fips.h \
|
||||
utils_device.c \
|
||||
libdevmapper.c \
|
||||
utils_dm.h \
|
||||
volumekey.c \
|
||||
|
||||
83
lib/bitops.h
83
lib/bitops.h
@@ -1,83 +0,0 @@
|
||||
#ifndef BITOPS_H
|
||||
#define BITOPS_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
/*
|
||||
* Bit map related macros. Usually provided by libc.
|
||||
*/
|
||||
#include <sys/param.h>
|
||||
|
||||
#ifndef NBBY
|
||||
# define NBBY CHAR_BIT
|
||||
#endif
|
||||
|
||||
#ifndef setbit
|
||||
# define setbit(a,i) ((a)[(i)/NBBY] |= 1<<((i)%NBBY))
|
||||
# define clrbit(a,i) ((a)[(i)/NBBY] &= ~(1<<((i)%NBBY)))
|
||||
# define isset(a,i) ((a)[(i)/NBBY] & (1<<((i)%NBBY)))
|
||||
# define isclr(a,i) (((a)[(i)/NBBY] & (1<<((i)%NBBY))) == 0)
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Byte swab macros (based on linux/byteorder/swab.h)
|
||||
*/
|
||||
#define swab16(x) \
|
||||
((uint16_t)( \
|
||||
(((uint16_t)(x) & (uint16_t)0x00ffU) << 8) | \
|
||||
(((uint16_t)(x) & (uint16_t)0xff00U) >> 8) ))
|
||||
|
||||
#define swab32(x) \
|
||||
((uint32_t)( \
|
||||
(((uint32_t)(x) & (uint32_t)0x000000ffUL) << 24) | \
|
||||
(((uint32_t)(x) & (uint32_t)0x0000ff00UL) << 8) | \
|
||||
(((uint32_t)(x) & (uint32_t)0x00ff0000UL) >> 8) | \
|
||||
(((uint32_t)(x) & (uint32_t)0xff000000UL) >> 24) ))
|
||||
|
||||
#define swab64(x) \
|
||||
((uint64_t)( \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x00000000000000ffULL) << 56) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x000000000000ff00ULL) << 40) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x0000000000ff0000ULL) << 24) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x00000000ff000000ULL) << 8) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x000000ff00000000ULL) >> 8) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x0000ff0000000000ULL) >> 24) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0x00ff000000000000ULL) >> 40) | \
|
||||
(uint64_t)(((uint64_t)(x) & (uint64_t)0xff00000000000000ULL) >> 56) ))
|
||||
|
||||
|
||||
#ifdef WORDS_BIGENDIAN
|
||||
|
||||
#define cpu_to_le16(x) swab16(x)
|
||||
#define cpu_to_le32(x) swab32(x)
|
||||
#define cpu_to_le64(x) swab64(x)
|
||||
#define cpu_to_be16(x) ((uint16_t)(x))
|
||||
#define cpu_to_be32(x) ((uint32_t)(x))
|
||||
#define cpu_to_be64(x) ((uint64_t)(x))
|
||||
|
||||
#define le16_to_cpu(x) swab16(x)
|
||||
#define le32_to_cpu(x) swab32(x)
|
||||
#define le64_to_cpu(x) swab64(x)
|
||||
#define be16_to_cpu(x) ((uint16_t)(x))
|
||||
#define be32_to_cpu(x) ((uint32_t)(x))
|
||||
#define be64_to_cpu(x) ((uint64_t)(x))
|
||||
|
||||
#else /* !WORDS_BIGENDIAN */
|
||||
|
||||
#define cpu_to_le16(x) ((uint16_t)(x))
|
||||
#define cpu_to_le32(x) ((uint32_t)(x))
|
||||
#define cpu_to_le64(x) ((uint64_t)(x))
|
||||
#define cpu_to_be16(x) swab16(x)
|
||||
#define cpu_to_be32(x) swab32(x)
|
||||
#define cpu_to_be64(x) swab64(x)
|
||||
|
||||
#define le16_to_cpu(x) ((uint16_t)(x))
|
||||
#define le32_to_cpu(x) ((uint32_t)(x))
|
||||
#define le64_to_cpu(x) ((uint64_t)(x))
|
||||
#define be16_to_cpu(x) swab16(x)
|
||||
#define be32_to_cpu(x) swab32(x)
|
||||
#define be64_to_cpu(x) swab64(x)
|
||||
|
||||
#endif /* WORDS_BIGENDIAN */
|
||||
|
||||
#endif /* BITOPS_H */
|
||||
@@ -15,15 +15,15 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
#include "internal.h"
|
||||
#include "crypto_backend.h"
|
||||
|
||||
static int hash(const char *hash_name, size_t key_size, char *key,
|
||||
size_t passphrase_size, const char *passphrase)
|
||||
|
||||
@@ -1,28 +1,9 @@
|
||||
/*
|
||||
* crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#ifndef _CRYPTO_BACKEND_H
|
||||
#define _CRYPTO_BACKEND_H
|
||||
|
||||
#include <stdint.h>
|
||||
#include "config.h"
|
||||
#include "libcryptsetup.h"
|
||||
#include "internal.h"
|
||||
|
||||
struct crypt_device;
|
||||
struct crypt_hash;
|
||||
struct crypt_hmac;
|
||||
|
||||
@@ -31,7 +12,6 @@ int crypt_backend_init(struct crypt_device *ctx);
|
||||
#define CRYPT_BACKEND_KERNEL (1 << 0) /* Crypto uses kernel part, for benchmark */
|
||||
|
||||
uint32_t crypt_backend_flags(void);
|
||||
const char *crypt_backend_version(void);
|
||||
|
||||
/* HASH */
|
||||
int crypt_hash_size(const char *name);
|
||||
@@ -48,8 +28,4 @@ int crypt_hmac_write(struct crypt_hmac *ctx, const char *buffer, size_t length);
|
||||
int crypt_hmac_final(struct crypt_hmac *ctx, char *buffer, size_t length);
|
||||
int crypt_hmac_destroy(struct crypt_hmac *ctx);
|
||||
|
||||
/* RNG (if fips paramater set, must provide FIPS compliance) */
|
||||
enum { CRYPT_RND_NORMAL = 0, CRYPT_RND_KEY = 1, CRYPT_RND_SALT = 2 };
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips);
|
||||
|
||||
#endif /* _CRYPTO_BACKEND_H */
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* GCRYPT crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,19 +14,18 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <errno.h>
|
||||
#include <assert.h>
|
||||
#include <gcrypt.h>
|
||||
#include "crypto_backend.h"
|
||||
|
||||
#define GCRYPT_REQ_VERSION "1.1.42"
|
||||
|
||||
static int crypto_backend_initialised = 0;
|
||||
static int crypto_backend_secmem = 1;
|
||||
static char version[64];
|
||||
|
||||
struct crypt_hash {
|
||||
gcry_md_hd_t hd;
|
||||
@@ -40,11 +39,12 @@ struct crypt_hmac {
|
||||
int hash_len;
|
||||
};
|
||||
|
||||
int crypt_backend_init(struct crypt_device *ctx)
|
||||
int crypt_backend_init(struct crypt_device *ctx __attribute__((unused)))
|
||||
{
|
||||
if (crypto_backend_initialised)
|
||||
return 0;
|
||||
|
||||
log_dbg("Initialising gcrypt crypto backend.");
|
||||
if (!gcry_control (GCRYCTL_INITIALIZATION_FINISHED_P)) {
|
||||
if (!gcry_check_version (GCRYPT_REQ_VERSION)) {
|
||||
return -ENOSYS;
|
||||
@@ -57,8 +57,8 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
* and it locks its memory space anyway.
|
||||
*/
|
||||
#if 0
|
||||
log_dbg("Initializing crypto backend (secure memory disabled).");
|
||||
gcry_control (GCRYCTL_DISABLE_SECMEM);
|
||||
crypto_backend_secmem = 0;
|
||||
#else
|
||||
|
||||
gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
|
||||
@@ -68,18 +68,10 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
}
|
||||
|
||||
snprintf(version, 64, "gcrypt %s%s",
|
||||
gcry_check_version(NULL),
|
||||
crypto_backend_secmem ? "" : ", secmem disabled");
|
||||
crypto_backend_initialised = 1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
const char *crypt_backend_version(void)
|
||||
{
|
||||
return crypto_backend_initialised ? version : "";
|
||||
}
|
||||
|
||||
uint32_t crypt_backend_flags(void)
|
||||
{
|
||||
return 0;
|
||||
@@ -235,19 +227,3 @@ int crypt_hmac_destroy(struct crypt_hmac *ctx)
|
||||
free(ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* RNG */
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
|
||||
{
|
||||
switch(quality) {
|
||||
case CRYPT_RND_NORMAL:
|
||||
gcry_randomize(buffer, length, GCRY_STRONG_RANDOM);
|
||||
break;
|
||||
case CRYPT_RND_SALT:
|
||||
case CRYPT_RND_KEY:
|
||||
default:
|
||||
gcry_randomize(buffer, length, GCRY_VERY_STRONG_RANDOM);
|
||||
break;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Linux kernel userspace API crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
@@ -36,7 +36,6 @@
|
||||
#endif
|
||||
|
||||
static int crypto_backend_initialised = 0;
|
||||
static char version[64];
|
||||
|
||||
struct hash_alg {
|
||||
const char *name;
|
||||
@@ -94,6 +93,7 @@ bad:
|
||||
int crypt_backend_init(struct crypt_device *ctx)
|
||||
{
|
||||
struct utsname uts;
|
||||
|
||||
struct sockaddr_alg sa = {
|
||||
.salg_family = AF_ALG,
|
||||
.salg_type = "hash",
|
||||
@@ -104,8 +104,11 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
if (crypto_backend_initialised)
|
||||
return 0;
|
||||
|
||||
log_dbg("Initialising kernel crypto API backend.");
|
||||
|
||||
if (uname(&uts) == -1 || strcmp(uts.sysname, "Linux"))
|
||||
return -EINVAL;
|
||||
log_dbg("Kernel version %s %s.", uts.sysname, uts.release);
|
||||
|
||||
if (_socket_init(&sa, &tfmfd, &opfd) < 0)
|
||||
return -EINVAL;
|
||||
@@ -113,9 +116,6 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
close(tfmfd);
|
||||
close(opfd);
|
||||
|
||||
snprintf(version, sizeof(version), "%s %s kernel cryptoAPI",
|
||||
uts.sysname, uts.release);
|
||||
|
||||
crypto_backend_initialised = 1;
|
||||
return 0;
|
||||
}
|
||||
@@ -125,11 +125,6 @@ uint32_t crypt_backend_flags(void)
|
||||
return CRYPT_BACKEND_KERNEL;
|
||||
}
|
||||
|
||||
const char *crypt_backend_version(void)
|
||||
{
|
||||
return crypto_backend_initialised ? version : "";
|
||||
}
|
||||
|
||||
static struct hash_alg *_get_alg(const char *name)
|
||||
{
|
||||
int i = 0;
|
||||
@@ -296,9 +291,3 @@ int crypt_hmac_destroy(struct crypt_hmac *ctx)
|
||||
free(ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* RNG - N/A */
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
|
||||
{
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* Nettle crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2011-2012 Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2011 Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
@@ -24,8 +24,6 @@
|
||||
#include <nettle/hmac.h>
|
||||
#include "crypto_backend.h"
|
||||
|
||||
static char *version = "Nettle";
|
||||
|
||||
typedef void (*init_func) (void *);
|
||||
typedef void (*update_func) (void *, unsigned, const uint8_t *);
|
||||
typedef void (*digest_func) (void *, unsigned, uint8_t *);
|
||||
@@ -137,14 +135,10 @@ static struct hash_alg *_get_alg(const char *name)
|
||||
|
||||
int crypt_backend_init(struct crypt_device *ctx)
|
||||
{
|
||||
log_dbg("Initialising Nettle crypto backend.");
|
||||
return 0;
|
||||
}
|
||||
|
||||
const char *crypt_backend_version(void)
|
||||
{
|
||||
return version;
|
||||
}
|
||||
|
||||
/* HASH */
|
||||
int crypt_hash_size(const char *name)
|
||||
{
|
||||
@@ -268,9 +262,3 @@ int crypt_hmac_destroy(struct crypt_hmac *ctx)
|
||||
free(ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* RNG - N/A */
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
|
||||
{
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* NSS crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
@@ -23,10 +23,7 @@
|
||||
#include <pk11pub.h>
|
||||
#include "crypto_backend.h"
|
||||
|
||||
#define CONST_CAST(x) (x)(uintptr_t)
|
||||
|
||||
static int crypto_backend_initialised = 0;
|
||||
static char version[64];
|
||||
|
||||
struct hash_alg {
|
||||
const char *name;
|
||||
@@ -73,14 +70,10 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
if (crypto_backend_initialised)
|
||||
return 0;
|
||||
|
||||
log_dbg("Initialising NSS crypto backend.");
|
||||
if (NSS_NoDB_Init(".") != SECSuccess)
|
||||
return -EINVAL;
|
||||
|
||||
#if HAVE_DECL_NSS_GETVERSION
|
||||
snprintf(version, 64, "NSS %s", NSS_GetVersion());
|
||||
#else
|
||||
snprintf(version, 64, "NSS");
|
||||
#endif
|
||||
crypto_backend_initialised = 1;
|
||||
return 0;
|
||||
}
|
||||
@@ -90,11 +83,6 @@ uint32_t crypt_backend_flags(void)
|
||||
return 0;
|
||||
}
|
||||
|
||||
const char *crypt_backend_version(void)
|
||||
{
|
||||
return crypto_backend_initialised ? version : "";
|
||||
}
|
||||
|
||||
/* HASH */
|
||||
int crypt_hash_size(const char *name)
|
||||
{
|
||||
@@ -286,15 +274,3 @@ int crypt_hmac_destroy(struct crypt_hmac *ctx)
|
||||
free(ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* RNG */
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
|
||||
{
|
||||
if (fips)
|
||||
return -EINVAL;
|
||||
|
||||
if (PK11_GenerateRandom((unsigned char *)buffer, length) != SECSuccess)
|
||||
return -EINVAL;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* OPENSSL crypto backend implementation
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*
|
||||
* In addition, as a special exception, the copyright holders give
|
||||
* permission to link the code of portions of this program with the
|
||||
@@ -30,7 +30,6 @@
|
||||
#include <errno.h>
|
||||
#include <openssl/evp.h>
|
||||
#include <openssl/hmac.h>
|
||||
#include <openssl/rand.h>
|
||||
#include "crypto_backend.h"
|
||||
|
||||
static int crypto_backend_initialised = 0;
|
||||
@@ -53,6 +52,7 @@ int crypt_backend_init(struct crypt_device *ctx)
|
||||
return 0;
|
||||
|
||||
OpenSSL_add_all_digests();
|
||||
log_dbg("OpenSSL crypto backend initialized.");
|
||||
|
||||
crypto_backend_initialised = 1;
|
||||
return 0;
|
||||
@@ -63,11 +63,6 @@ uint32_t crypt_backend_flags(void)
|
||||
return 0;
|
||||
}
|
||||
|
||||
const char *crypt_backend_version(void)
|
||||
{
|
||||
return SSLeay_version(SSLEAY_VERSION);
|
||||
}
|
||||
|
||||
/* HASH */
|
||||
int crypt_hash_size(const char *name)
|
||||
{
|
||||
@@ -218,15 +213,3 @@ int crypt_hmac_destroy(struct crypt_hmac *ctx)
|
||||
free(ctx);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* RNG */
|
||||
int crypt_backend_rng(char *buffer, size_t length, int quality, int fips)
|
||||
{
|
||||
if (fips)
|
||||
return -EINVAL;
|
||||
|
||||
if (RAND_bytes((unsigned char *)buffer, length) != 1)
|
||||
return -EINVAL;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,24 +1,3 @@
|
||||
/*
|
||||
* libcryptsetup - cryptsetup library internal
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef INTERNAL_H
|
||||
#define INTERNAL_H
|
||||
|
||||
@@ -32,14 +11,9 @@
|
||||
#include <inttypes.h>
|
||||
|
||||
#include "nls.h"
|
||||
#include "bitops.h"
|
||||
#include "utils_crypt.h"
|
||||
#include "utils_loop.h"
|
||||
#include "utils_dm.h"
|
||||
#include "utils_fips.h"
|
||||
#include "crypto_backend.h"
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
|
||||
/* to silent gcc -Wcast-qual for const cast */
|
||||
#define CONST_CAST(x) (x)(uintptr_t)
|
||||
@@ -63,44 +37,27 @@ struct volume_key *crypt_alloc_volume_key(unsigned keylength, const char *key);
|
||||
struct volume_key *crypt_generate_volume_key(struct crypt_device *cd, unsigned keylength);
|
||||
void crypt_free_volume_key(struct volume_key *vk);
|
||||
|
||||
/* Device backend */
|
||||
struct device;
|
||||
int device_alloc(struct device **device, const char *path);
|
||||
void device_free(struct device *device);
|
||||
const char *device_path(const struct device *device);
|
||||
const char *device_block_path(const struct device *device);
|
||||
void device_topology_alignment(struct device *device,
|
||||
unsigned long *required_alignment, /* bytes */
|
||||
unsigned long *alignment_offset, /* bytes */
|
||||
unsigned long default_alignment);
|
||||
int device_block_size(struct device *device);
|
||||
int device_read_ahead(struct device *device, uint32_t *read_ahead);
|
||||
int device_size(struct device *device, uint64_t *size);
|
||||
|
||||
enum devcheck { DEV_OK = 0, DEV_EXCL = 1, DEV_SHARED = 2 };
|
||||
int device_block_adjust(struct crypt_device *cd,
|
||||
struct device *device,
|
||||
enum devcheck device_check,
|
||||
uint64_t device_offset,
|
||||
uint64_t *size,
|
||||
uint32_t *flags);
|
||||
size_t size_round_up(size_t size, unsigned int block);
|
||||
|
||||
/* Receive backend devices from context helpers */
|
||||
struct device *crypt_metadata_device(struct crypt_device *cd);
|
||||
struct device *crypt_data_device(struct crypt_device *cd);
|
||||
|
||||
int crypt_confirm(struct crypt_device *cd, const char *msg);
|
||||
|
||||
char *crypt_lookup_dev(const char *dev_id);
|
||||
int crypt_sysfs_check_crypt_segment(const char *device, uint64_t offset, uint64_t size);
|
||||
int crypt_sysfs_get_rotational(int major, int minor, int *rotational);
|
||||
|
||||
ssize_t write_blockwise(int fd, int bsize, void *buf, size_t count);
|
||||
ssize_t read_blockwise(int fd, int bsize, void *_buf, size_t count);
|
||||
ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t offset);
|
||||
|
||||
unsigned crypt_getpagesize(void);
|
||||
int sector_size_for_device(const char *device);
|
||||
int device_read_ahead(const char *dev, uint32_t *read_ahead);
|
||||
ssize_t write_blockwise(int fd, void *buf, size_t count);
|
||||
ssize_t read_blockwise(int fd, void *_buf, size_t count);
|
||||
ssize_t write_lseek_blockwise(int fd, char *buf, size_t count, off_t offset);
|
||||
int device_ready(struct crypt_device *cd, const char *device, int mode);
|
||||
int device_size(const char *device, uint64_t *size);
|
||||
|
||||
enum devcheck { DEV_OK = 0, DEV_EXCL = 1, DEV_SHARED = 2 };
|
||||
int device_check_and_adjust(struct crypt_device *cd,
|
||||
const char *device,
|
||||
enum devcheck device_check,
|
||||
uint64_t *size,
|
||||
uint64_t *offset,
|
||||
uint32_t *flags);
|
||||
|
||||
void logger(struct crypt_device *cd, int class, const char *file, int line, const char *format, ...);
|
||||
#define log_dbg(x...) logger(NULL, CRYPT_LOG_DEBUG, __FILE__, __LINE__, x)
|
||||
@@ -109,10 +66,17 @@ void logger(struct crypt_device *cd, int class, const char *file, int line, cons
|
||||
#define log_err(c, x...) logger(c, CRYPT_LOG_ERROR, __FILE__, __LINE__, x)
|
||||
|
||||
int crypt_get_debug_level(void);
|
||||
void debug_processes_using_device(const char *name);
|
||||
|
||||
int crypt_memlock_inc(struct crypt_device *ctx);
|
||||
int crypt_memlock_dec(struct crypt_device *ctx);
|
||||
|
||||
void get_topology_alignment(const char *device,
|
||||
unsigned long *required_alignment, /* bytes */
|
||||
unsigned long *alignment_offset, /* bytes */
|
||||
unsigned long default_alignment);
|
||||
|
||||
enum { CRYPT_RND_NORMAL = 0, CRYPT_RND_KEY = 1 };
|
||||
int crypt_random_init(struct crypt_device *ctx);
|
||||
int crypt_random_get(struct crypt_device *ctx, char *buf, size_t len, int quality);
|
||||
void crypt_random_exit(void);
|
||||
@@ -141,7 +105,7 @@ typedef enum {
|
||||
* random algorithm */
|
||||
} crypt_wipe_type;
|
||||
|
||||
int crypt_wipe(struct device *device,
|
||||
int crypt_wipe(const char *device,
|
||||
uint64_t offset,
|
||||
uint64_t sectors,
|
||||
crypt_wipe_type type,
|
||||
|
||||
@@ -1,24 +1,3 @@
|
||||
/*
|
||||
* libcryptsetup - cryptsetup library
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file libcryptsetup.h
|
||||
* @brief Public cryptsetup API
|
||||
@@ -33,7 +12,6 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
|
||||
struct crypt_device; /* crypt device handle */
|
||||
@@ -212,8 +190,6 @@ void crypt_set_password_retry(struct crypt_device *cd, int tries);
|
||||
* @param cd crypt device handle
|
||||
* @param iteration_time_ms the time in ms
|
||||
*/
|
||||
void crypt_set_iteration_time(struct crypt_device *cd, uint64_t iteration_time_ms);
|
||||
/* Don't ask :-) */
|
||||
void crypt_set_iterarion_time(struct crypt_device *cd, uint64_t iteration_time_ms);
|
||||
|
||||
/**
|
||||
@@ -226,13 +202,14 @@ void crypt_set_iterarion_time(struct crypt_device *cd, uint64_t iteration_time_m
|
||||
void crypt_set_password_verify(struct crypt_device *cd, int password_verify);
|
||||
|
||||
/**
|
||||
* Set data device
|
||||
* For LUKS it is encrypted data device when LUKS header is separated.
|
||||
* For VERITY it is data device when hash device is separated.
|
||||
* Set data device (encrypted payload area device) if LUKS header is separated
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param device path to device
|
||||
*
|
||||
* @pre context is of LUKS type
|
||||
* @pre unlike @ref crypt_init, in this function param @e device
|
||||
* has to be block device (at least 512B large)
|
||||
*/
|
||||
int crypt_set_data_device(struct crypt_device *cd, const char *device);
|
||||
|
||||
@@ -294,14 +271,12 @@ int crypt_memory_lock(struct crypt_device *cd, int lock);
|
||||
* @{
|
||||
*/
|
||||
|
||||
/** plain crypt device, no on-disk header */
|
||||
/** regular crypt device, no on-disk header */
|
||||
#define CRYPT_PLAIN "PLAIN"
|
||||
/** LUKS version 1 header on-disk */
|
||||
#define CRYPT_LUKS1 "LUKS1"
|
||||
/** loop-AES compatibility mode */
|
||||
#define CRYPT_LOOPAES "LOOPAES"
|
||||
/** dm-verity mode */
|
||||
#define CRYPT_VERITY "VERITY"
|
||||
|
||||
/**
|
||||
* Get device type
|
||||
@@ -352,34 +327,6 @@ struct crypt_params_loopaes {
|
||||
uint64_t skip; /**< IV offset / initialization sector */
|
||||
};
|
||||
|
||||
/**
|
||||
*
|
||||
* Structure used as parameter for dm-verity device type
|
||||
*
|
||||
* @see crypt_format, crypt_load
|
||||
*
|
||||
*/
|
||||
/** No on-disk header (only hashes) */
|
||||
#define CRYPT_VERITY_NO_HEADER (1 << 0)
|
||||
/** Verity hash in userspace before activation */
|
||||
#define CRYPT_VERITY_CHECK_HASH (1 << 1)
|
||||
/** Create hash - format hash device */
|
||||
#define CRYPT_VERITY_CREATE_HASH (1 << 2)
|
||||
|
||||
struct crypt_params_verity {
|
||||
const char *hash_name; /**< hash function */
|
||||
const char *data_device; /**< data_device (CRYPT_VERITY_CREATE_HASH) */
|
||||
const char *hash_device; /**< hash_device (output only) */
|
||||
const char *salt; /**< salt */
|
||||
uint32_t salt_size; /**< salt size (in bytes) */
|
||||
uint32_t hash_type; /**< in-kernel hashing type */
|
||||
uint32_t data_block_size; /**< data block size (in bytes) */
|
||||
uint32_t hash_block_size; /**< hash block size (in bytes) */
|
||||
uint64_t data_size; /**< data area size (in data blocks) */
|
||||
uint64_t hash_area_offset; /**< hash/header offset (in bytes) */
|
||||
uint32_t flags; /**< CRYPT_VERITY* flags */
|
||||
};
|
||||
|
||||
/** @} */
|
||||
|
||||
/**
|
||||
@@ -398,10 +345,8 @@ struct crypt_params_verity {
|
||||
*
|
||||
* @returns @e 0 on success or negative errno value otherwise.
|
||||
*
|
||||
* @note Note that crypt_format does not enable any keyslot (in case of work with LUKS device),
|
||||
* but it stores volume key internally and subsequent crypt_keyslot_add_* calls can be used.
|
||||
* @note For VERITY @link crypt_type @endlink, only uuid parameter is used, others paramaters
|
||||
* are ignored and verity specific attributes are set through mandatory params option.
|
||||
* @note Note that crypt_format does not enable any keyslot (in case of work with LUKS device), but it stores volume key internally
|
||||
* and subsequent crypt_keyslot_add_* calls can be used.
|
||||
*/
|
||||
int crypt_format(struct crypt_device *cd,
|
||||
const char *type,
|
||||
@@ -429,7 +374,7 @@ int crypt_set_uuid(struct crypt_device *cd,
|
||||
* Load crypt device parameters from on-disk header
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param requested_type @link crypt_type @endlink or @e NULL for all known
|
||||
* @param requested_type - use @e NULL for all known
|
||||
* @param params crypt type specific parameters (see @link crypt_type @endlink)
|
||||
*
|
||||
* @returns 0 on success or negative errno value otherwise.
|
||||
@@ -437,27 +382,13 @@ int crypt_set_uuid(struct crypt_device *cd,
|
||||
* @post In case LUKS header is read successfully but payload device is too small
|
||||
* error is returned and device type in context is set to @e NULL
|
||||
*
|
||||
* @note Note that in current version load works only for LUKS and VERITY device type.
|
||||
* @note Note that in current version load works only for LUKS device type
|
||||
*
|
||||
*/
|
||||
int crypt_load(struct crypt_device *cd,
|
||||
const char *requested_type,
|
||||
void *params);
|
||||
|
||||
/**
|
||||
* Try to repair crypt device on-disk header if invalid
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param requested_type @link crypt_type @endlink or @e NULL for all known
|
||||
* @param params crypt type specific parameters (see @link crypt_type @endlink)
|
||||
*
|
||||
* @returns 0 on success or negative errno value otherwise.
|
||||
*
|
||||
*/
|
||||
int crypt_repair(struct crypt_device *cd,
|
||||
const char *requested_type,
|
||||
void *params);
|
||||
|
||||
/**
|
||||
* Resize crypt device
|
||||
*
|
||||
@@ -500,10 +431,10 @@ int crypt_suspend(struct crypt_device *cd,
|
||||
* @note Only LUKS device type is supported
|
||||
*/
|
||||
int crypt_resume_by_passphrase(struct crypt_device *cd,
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *passphrase,
|
||||
size_t passphrase_size);
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *passphrase,
|
||||
size_t passphrase_size);
|
||||
|
||||
/**
|
||||
* Resumes crypt device using key file.
|
||||
@@ -513,24 +444,14 @@ int crypt_resume_by_passphrase(struct crypt_device *cd,
|
||||
* @param keyslot requested keyslot or CRYPT_ANY_SLOT
|
||||
* @param keyfile key file used to unlock volume key, @e NULL for passphrase query
|
||||
* @param keyfile_size number of bytes to read from keyfile, 0 is unlimited
|
||||
* @param keyfile_offset number of bytes to skip at start of keyfile
|
||||
*
|
||||
* @return unlocked key slot number or negative errno otherwise.
|
||||
*/
|
||||
int crypt_resume_by_keyfile_offset(struct crypt_device *cd,
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
size_t keyfile_size,
|
||||
size_t keyfile_offset);
|
||||
/**
|
||||
* Backward compatible crypt_resume_by_keyfile_offset() (without offset).
|
||||
*/
|
||||
int crypt_resume_by_keyfile(struct crypt_device *cd,
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
size_t keyfile_size);
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
size_t keyfile_size);
|
||||
|
||||
/**
|
||||
* Releases crypt device context and used memory.
|
||||
@@ -570,6 +491,16 @@ int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
|
||||
const char *new_passphrase,
|
||||
size_t new_passphrase_size);
|
||||
|
||||
/**
|
||||
* Get number of keyslots supported for device type.
|
||||
*
|
||||
* @param type crypt device type
|
||||
*
|
||||
* @return slot count or negative errno otherwise if device
|
||||
* doesn't not support keyslots.
|
||||
*/
|
||||
int crypt_keyslot_max(const char *type);
|
||||
|
||||
/**
|
||||
* Add key slot using provided key file path
|
||||
*
|
||||
@@ -579,27 +510,14 @@ int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
|
||||
* @param keyslot requested keyslot or @e CRYPT_ANY_SLOT
|
||||
* @param keyfile key file used to unlock volume key, @e NULL for passphrase query
|
||||
* @param keyfile_size number of bytes to read from keyfile, @e 0 is unlimited
|
||||
* @param keyfile_offset number of bytes to skip at start of keyfile
|
||||
* @param new_keyfile keyfile for new keyslot, @e NULL for passphrase query
|
||||
* @param new_keyfile_size number of bytes to read from @e new_keyfile, @e 0 is unlimited
|
||||
* @param new_keyfile_offset number of bytes to skip at start of new_keyfile
|
||||
*
|
||||
* @return allocated key slot number or negative errno otherwise.
|
||||
*
|
||||
* @note Note that @e keyfile can be "-" for STDIN
|
||||
*
|
||||
*/
|
||||
int crypt_keyslot_add_by_keyfile_offset(struct crypt_device *cd,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
size_t keyfile_size,
|
||||
size_t keyfile_offset,
|
||||
const char *new_keyfile,
|
||||
size_t new_keyfile_size,
|
||||
size_t new_keyfile_offset);
|
||||
/**
|
||||
* Backward compatible crypt_keyslot_add_by_keyfile_offset() (without offset).
|
||||
*/
|
||||
int crypt_keyslot_add_by_keyfile(struct crypt_device *cd,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
@@ -658,14 +576,10 @@ int crypt_keyslot_destroy(struct crypt_device *cd, int keyslot);
|
||||
#define CRYPT_ACTIVATE_READONLY (1 << 0)
|
||||
/** only reported for device without uuid */
|
||||
#define CRYPT_ACTIVATE_NO_UUID (1 << 1)
|
||||
/** activate even if cannot grant exclusive access (DANGEROUS) */
|
||||
/** activate more non-overlapping mapping to the same device */
|
||||
#define CRYPT_ACTIVATE_SHARED (1 << 2)
|
||||
/** enable discards aka TRIM */
|
||||
#define CRYPT_ACTIVATE_ALLOW_DISCARDS (1 << 3)
|
||||
/** skip global udev rules in activation ("private device"), input only */
|
||||
#define CRYPT_ACTIVATE_PRIVATE (1 << 4)
|
||||
/** corruption detected (verity), output only */
|
||||
#define CRYPT_ACTIVATE_CORRUPTED (1 << 5)
|
||||
|
||||
/**
|
||||
* Active device runtime attributes
|
||||
@@ -720,21 +634,10 @@ int crypt_activate_by_passphrase(struct crypt_device *cd,
|
||||
* @param keyslot requested keyslot to check or CRYPT_ANY_SLOT
|
||||
* @param keyfile key file used to unlock volume key
|
||||
* @param keyfile_size number of bytes to read from keyfile, 0 is unlimited
|
||||
* @param keyfile_offset number of bytes to skip at start of keyfile
|
||||
* @param flags activation flags
|
||||
*
|
||||
* @return unlocked key slot number or negative errno otherwise.
|
||||
*/
|
||||
int crypt_activate_by_keyfile_offset(struct crypt_device *cd,
|
||||
const char *name,
|
||||
int keyslot,
|
||||
const char *keyfile,
|
||||
size_t keyfile_size,
|
||||
size_t keyfile_offset,
|
||||
uint32_t flags);
|
||||
/**
|
||||
* Backward compatible crypt_activate_by_keyfile_offset() (without offset).
|
||||
*/
|
||||
int crypt_activate_by_keyfile(struct crypt_device *cd,
|
||||
const char *name,
|
||||
int keyslot,
|
||||
@@ -757,9 +660,6 @@ int crypt_activate_by_keyfile(struct crypt_device *cd,
|
||||
* @note If @e NULL is used for volume_key, device has to be initialized
|
||||
* by previous operation (like @ref crypt_format
|
||||
* or @ref crypt_init_by_name)
|
||||
* @note For VERITY the volume key means root hash required for activation.
|
||||
* Because kernel dm-verity is always read only, you have to provide
|
||||
* CRYPT_ACTIVATE_READONLY flag always.
|
||||
*/
|
||||
int crypt_activate_by_volume_key(struct crypt_device *cd,
|
||||
const char *name,
|
||||
@@ -813,8 +713,9 @@ int crypt_volume_key_verify(struct crypt_device *cd,
|
||||
const char *volume_key,
|
||||
size_t volume_key_size);
|
||||
|
||||
/**
|
||||
* @defgroup devstat "Crypt and Verity device status"
|
||||
|
||||
/*
|
||||
* @defgroup devstat "dmcrypt device status"
|
||||
* @addtogroup devstat
|
||||
* @{
|
||||
*/
|
||||
@@ -841,7 +742,7 @@ typedef enum {
|
||||
crypt_status_info crypt_status(struct crypt_device *cd, const char *name);
|
||||
|
||||
/**
|
||||
* Dump text-formatted information about crypt or verity device to log output
|
||||
* Dump text-formatted information about crypt device to log output
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
*
|
||||
@@ -919,19 +820,6 @@ uint64_t crypt_get_iv_offset(struct crypt_device *cd);
|
||||
*/
|
||||
int crypt_get_volume_key_size(struct crypt_device *cd);
|
||||
|
||||
/**
|
||||
* Get device parameters for VERITY device
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param vp verity device info
|
||||
*
|
||||
* @e 0 on success or negative errno value otherwise.
|
||||
*
|
||||
*/
|
||||
int crypt_get_verity_info(struct crypt_device *cd,
|
||||
struct crypt_params_verity *vp);
|
||||
/** @} */
|
||||
|
||||
/**
|
||||
* @addtogroup keyslot
|
||||
* @{
|
||||
@@ -962,37 +850,11 @@ typedef enum {
|
||||
crypt_keyslot_info crypt_keyslot_status(struct crypt_device *cd, int keyslot);
|
||||
/** @} */
|
||||
|
||||
/**
|
||||
* Get number of keyslots supported for device type.
|
||||
*
|
||||
* @param type crypt device type
|
||||
*
|
||||
* @return slot count or negative errno otherwise if device
|
||||
* doesn't not support keyslots.
|
||||
*/
|
||||
int crypt_keyslot_max(const char *type);
|
||||
|
||||
/**
|
||||
* Get keyslot area pointers (relative to metadata device)
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param keyslot keyslot number
|
||||
* @param offset offset on metadata device (in bytes)
|
||||
* @param length length of keyslot area (in bytes)
|
||||
*
|
||||
* @return @e 0 on success or negative errno value otherwise.
|
||||
*
|
||||
*/
|
||||
int crypt_keyslot_area(struct crypt_device *cd,
|
||||
int keyslot,
|
||||
uint64_t *offset,
|
||||
uint64_t *length);
|
||||
|
||||
/**
|
||||
* Backup header and keyslots to file
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param requested_type @link crypt_type @endlink or @e NULL for all known
|
||||
* @param requested_type type of header to backup
|
||||
* @param backup_file file to backup header to
|
||||
*
|
||||
* @return @e 0 on success or negative errno value otherwise.
|
||||
@@ -1007,7 +869,7 @@ int crypt_header_backup(struct crypt_device *cd,
|
||||
*
|
||||
*
|
||||
* @param cd crypt device handle
|
||||
* @param requested_type @link crypt_type @endlink or @e NULL for all known
|
||||
* @param requested_type type of header to restore
|
||||
* @param backup_file file to restore header from
|
||||
*
|
||||
* @return @e 0 on success or negative errno value otherwise.
|
||||
|
||||
@@ -9,7 +9,6 @@ CRYPTSETUP_1.0 {
|
||||
crypt_set_timeout;
|
||||
crypt_set_password_retry;
|
||||
crypt_set_iterarion_time;
|
||||
crypt_set_iteration_time;
|
||||
crypt_set_password_verify;
|
||||
crypt_set_uuid;
|
||||
crypt_set_data_device;
|
||||
@@ -17,22 +16,18 @@ CRYPTSETUP_1.0 {
|
||||
crypt_memory_lock;
|
||||
crypt_format;
|
||||
crypt_load;
|
||||
crypt_repair;
|
||||
crypt_resize;
|
||||
crypt_suspend;
|
||||
crypt_resume_by_passphrase;
|
||||
crypt_resume_by_keyfile;
|
||||
crypt_resume_by_keyfile_offset;
|
||||
crypt_free;
|
||||
|
||||
crypt_keyslot_add_by_passphrase;
|
||||
crypt_keyslot_add_by_keyfile;
|
||||
crypt_keyslot_add_by_keyfile_offset;
|
||||
crypt_keyslot_add_by_volume_key;
|
||||
crypt_keyslot_destroy;
|
||||
crypt_activate_by_passphrase;
|
||||
crypt_activate_by_keyfile;
|
||||
crypt_activate_by_keyfile_offset;
|
||||
crypt_activate_by_volume_key;
|
||||
crypt_deactivate;
|
||||
crypt_volume_key_get;
|
||||
@@ -46,7 +41,6 @@ CRYPTSETUP_1.0 {
|
||||
crypt_get_iv_offset;
|
||||
crypt_get_volume_key_size;
|
||||
crypt_get_device_name;
|
||||
crypt_get_verity_info;
|
||||
|
||||
crypt_get_type;
|
||||
crypt_get_active_device;
|
||||
@@ -55,7 +49,6 @@ CRYPTSETUP_1.0 {
|
||||
crypt_get_rng_type;
|
||||
|
||||
crypt_keyslot_max;
|
||||
crypt_keyslot_area;
|
||||
crypt_keyslot_status;
|
||||
crypt_last_error;
|
||||
crypt_get_error;
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* loop-AES compatible volume handling
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <errno.h>
|
||||
@@ -22,9 +22,8 @@
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
#include "crypto_backend.h"
|
||||
#include "loopaes.h"
|
||||
#include "internal.h"
|
||||
|
||||
static const char *get_hash(unsigned int key_size)
|
||||
{
|
||||
@@ -192,21 +191,18 @@ int LOOPAES_activate(struct crypt_device *cd,
|
||||
uint32_t req_flags;
|
||||
int r;
|
||||
struct crypt_dm_active_device dmd = {
|
||||
.target = DM_CRYPT,
|
||||
.device = crypt_get_device_name(cd),
|
||||
.cipher = NULL,
|
||||
.uuid = crypt_get_uuid(cd),
|
||||
.vk = vk,
|
||||
.offset = crypt_get_data_offset(cd),
|
||||
.iv_offset = crypt_get_iv_offset(cd),
|
||||
.size = 0,
|
||||
.flags = flags,
|
||||
.data_device = crypt_data_device(cd),
|
||||
.u.crypt = {
|
||||
.cipher = NULL,
|
||||
.vk = vk,
|
||||
.offset = crypt_get_data_offset(cd),
|
||||
.iv_offset = crypt_get_iv_offset(cd),
|
||||
}
|
||||
.flags = flags
|
||||
};
|
||||
|
||||
r = device_block_adjust(cd, dmd.data_device, DEV_EXCL,
|
||||
dmd.u.crypt.offset, &dmd.size, &dmd.flags);
|
||||
|
||||
r = device_check_and_adjust(cd, dmd.device, DEV_EXCL, &dmd.size, &dmd.offset, &flags);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
@@ -220,11 +216,10 @@ int LOOPAES_activate(struct crypt_device *cd,
|
||||
if (r < 0)
|
||||
return -ENOMEM;
|
||||
|
||||
dmd.u.crypt.cipher = cipher;
|
||||
log_dbg("Trying to activate loop-AES device %s using cipher %s.",
|
||||
name, dmd.u.crypt.cipher);
|
||||
dmd.cipher = cipher;
|
||||
log_dbg("Trying to activate loop-AES device %s using cipher %s.", name, dmd.cipher);
|
||||
|
||||
r = dm_create_device(cd, name, CRYPT_LOOPAES, &dmd, 0);
|
||||
r = dm_create_device(name, CRYPT_LOOPAES, &dmd, 0);
|
||||
|
||||
if (!r && !(dm_flags() & req_flags)) {
|
||||
log_err(cd, _("Kernel doesn't support loop-AES compatible mapping.\n"));
|
||||
|
||||
@@ -1,22 +1,3 @@
|
||||
/*
|
||||
* loop-AES compatible volume handling
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _LOOPAES_H
|
||||
#define _LOOPAES_H
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* AFsplitter - Anti forensic information splitter
|
||||
*
|
||||
* Copyright (C) 2004, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* AFsplitter diffuses information over a large stripe of data,
|
||||
* therefor supporting secure data destruction.
|
||||
@@ -18,7 +18,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
*/
|
||||
|
||||
#include <stddef.h>
|
||||
@@ -26,6 +26,7 @@
|
||||
#include <string.h>
|
||||
#include <netinet/in.h>
|
||||
#include <errno.h>
|
||||
#include "crypto_backend.h"
|
||||
#include "internal.h"
|
||||
#include "af.h"
|
||||
|
||||
@@ -66,14 +67,9 @@ out:
|
||||
|
||||
static int diffuse(char *src, char *dst, size_t size, const char *hash_name)
|
||||
{
|
||||
int hash_size = crypt_hash_size(hash_name);
|
||||
unsigned int digest_size;
|
||||
unsigned int digest_size = crypt_hash_size(hash_name);
|
||||
unsigned int i, blocks, padding;
|
||||
|
||||
if (hash_size <= 0)
|
||||
return 1;
|
||||
digest_size = hash_size;
|
||||
|
||||
blocks = size / digest_size;
|
||||
padding = size % digest_size;
|
||||
|
||||
@@ -146,17 +142,3 @@ out:
|
||||
free(bufblock);
|
||||
return r;
|
||||
}
|
||||
|
||||
/* Size of final split data including sector alignment */
|
||||
size_t AF_split_sectors(size_t blocksize, unsigned int blocknumbers)
|
||||
{
|
||||
size_t af_size;
|
||||
|
||||
/* data material * stripes */
|
||||
af_size = blocksize * blocknumbers;
|
||||
|
||||
/* round up to sector */
|
||||
af_size = (af_size + (SECTOR_SIZE - 1)) / SECTOR_SIZE;
|
||||
|
||||
return af_size;
|
||||
}
|
||||
|
||||
@@ -1,28 +1,11 @@
|
||||
/*
|
||||
* AFsplitter - Anti forensic information splitter
|
||||
*
|
||||
* Copyright (C) 2004, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* AFsplitter diffuses information over a large stripe of data,
|
||||
* therefor supporting secure data destruction.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Library General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#ifndef INCLUDED_CRYPTSETUP_LUKS_AF_H
|
||||
#define INCLUDED_CRYPTSETUP_LUKS_AF_H
|
||||
|
||||
/*
|
||||
* AFsplitter - Anti forensic information splitter
|
||||
* Copyright 2004, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
*/
|
||||
|
||||
/*
|
||||
* AF_split operates on src and produces information split data in
|
||||
* dst. src is assumed to be of the length blocksize. The data stripe
|
||||
@@ -38,6 +21,5 @@
|
||||
|
||||
int AF_split(char *src, char *dst, size_t blocksize, unsigned int blocknumbers, const char *hash);
|
||||
int AF_merge(char *src, char *dst, size_t blocksize, unsigned int blocknumbers, const char *hash);
|
||||
size_t AF_split_sectors(size_t blocksize, unsigned int blocknumbers);
|
||||
|
||||
#endif
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* LUKS - Linux Unified Key Setup
|
||||
*
|
||||
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -15,12 +14,19 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <ctype.h>
|
||||
#include <inttypes.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <sys/mman.h>
|
||||
#include <sys/utsname.h>
|
||||
#include <fcntl.h>
|
||||
#include <unistd.h>
|
||||
#include <errno.h>
|
||||
@@ -29,46 +35,51 @@
|
||||
#include "luks.h"
|
||||
#include "internal.h"
|
||||
|
||||
#define div_round_up(a,b) ({ \
|
||||
typeof(a) __a = (a); \
|
||||
typeof(b) __b = (b); \
|
||||
(__a - 1) / __b + 1; \
|
||||
})
|
||||
|
||||
static inline int round_up_modulo(int x, int m) {
|
||||
return div_round_up(x, m) * m;
|
||||
}
|
||||
|
||||
static const char *cleaner_name=NULL;
|
||||
static uint64_t cleaner_size = 0;
|
||||
static int devfd=-1;
|
||||
|
||||
static int setup_mapping(const char *cipher, const char *name,
|
||||
unsigned int bsize, struct volume_key *vk,
|
||||
const char *device,
|
||||
struct volume_key *vk,
|
||||
unsigned int sector, size_t srcLength,
|
||||
int mode, struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
int device_sector_size = sector_size_for_device(device);
|
||||
struct crypt_dm_active_device dmd = {
|
||||
.target = DM_CRYPT,
|
||||
.device = device,
|
||||
.cipher = cipher,
|
||||
.uuid = NULL,
|
||||
.size = size_round_up(srcLength, bsize) / SECTOR_SIZE,
|
||||
.flags = CRYPT_ACTIVATE_PRIVATE,
|
||||
.data_device = device,
|
||||
.u.crypt = {
|
||||
.cipher = cipher,
|
||||
.vk = vk,
|
||||
.offset = sector,
|
||||
.iv_offset = 0,
|
||||
}
|
||||
.vk = vk,
|
||||
.offset = sector,
|
||||
.iv_offset = 0,
|
||||
.size = 0,
|
||||
.flags = (mode == O_RDONLY) ? CRYPT_ACTIVATE_READONLY : 0
|
||||
};
|
||||
int r;
|
||||
|
||||
if (mode == O_RDONLY)
|
||||
dmd.flags |= CRYPT_ACTIVATE_READONLY;
|
||||
|
||||
r = device_block_adjust(ctx, dmd.data_device, DEV_OK,
|
||||
dmd.u.crypt.offset, &dmd.size, &dmd.flags);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
if (mode != O_RDONLY && dmd.flags & CRYPT_ACTIVATE_READONLY) {
|
||||
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
|
||||
device_path(device));
|
||||
return -EACCES;
|
||||
/*
|
||||
* we need to round this to nearest multiple of the underlying
|
||||
* device's sector size, otherwise the mapping will be refused.
|
||||
*/
|
||||
if(device_sector_size < 0) {
|
||||
log_err(ctx, _("Unable to obtain sector size for %s"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
dmd.size = round_up_modulo(srcLength,device_sector_size)/SECTOR_SIZE;
|
||||
cleaner_size = dmd.size;
|
||||
return dm_create_device(ctx, name, "TEMP", &dmd, 0);
|
||||
|
||||
return dm_create_device(name, "TEMP", &dmd, 0);
|
||||
}
|
||||
|
||||
static void sigint_handler(int sig __attribute__((unused)))
|
||||
@@ -77,7 +88,7 @@ static void sigint_handler(int sig __attribute__((unused)))
|
||||
close(devfd);
|
||||
devfd = -1;
|
||||
if(cleaner_name)
|
||||
dm_remove_device(NULL, cleaner_name, 1, cleaner_size);
|
||||
dm_remove_device(cleaner_name, 1, cleaner_size);
|
||||
|
||||
signal(SIGINT, SIG_DFL);
|
||||
kill(getpid(), SIGINT);
|
||||
@@ -98,8 +109,9 @@ static const char *_error_hint(char *cipherMode, size_t keyLength)
|
||||
static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
struct luks_phdr *hdr,
|
||||
struct volume_key *vk,
|
||||
const char *device,
|
||||
unsigned int sector,
|
||||
ssize_t (*func)(int, int, void *, size_t),
|
||||
ssize_t (*func)(int, void *, size_t),
|
||||
int mode,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
@@ -108,14 +120,10 @@ static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
char *dmCipherSpec = NULL;
|
||||
const char *dmDir = dm_get_dir();
|
||||
int r = -1;
|
||||
int bsize = device_block_size(crypt_metadata_device(ctx));
|
||||
|
||||
if (bsize <= 0)
|
||||
return -EINVAL;
|
||||
|
||||
if(dmDir == NULL) {
|
||||
log_err(ctx, _("Failed to obtain device mapper directory."));
|
||||
return -EINVAL;
|
||||
return -1;
|
||||
}
|
||||
if(asprintf(&name,"temporary-cryptsetup-%d",getpid()) == -1 ||
|
||||
asprintf(&fullpath,"%s/%s",dmDir,name) == -1 ||
|
||||
@@ -127,12 +135,12 @@ static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
signal(SIGINT, sigint_handler);
|
||||
cleaner_name = name;
|
||||
|
||||
r = setup_mapping(dmCipherSpec, name, bsize, vk, sector, srcLength, mode, ctx);
|
||||
r = setup_mapping(dmCipherSpec, name, device,
|
||||
vk, sector, srcLength, mode, ctx);
|
||||
if(r < 0) {
|
||||
if (r != -EACCES && r != -ENOTSUP)
|
||||
log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
|
||||
log_err(ctx, _("Failed to setup dm-crypt key mapping for device %s.\n"
|
||||
"Check that kernel supports %s cipher (check syslog for more info).\n%s"),
|
||||
device_path(crypt_metadata_device(ctx)), dmCipherSpec,
|
||||
device, dmCipherSpec,
|
||||
_error_hint(hdr->cipherMode, vk->keylength * 8));
|
||||
r = -EIO;
|
||||
goto out1;
|
||||
@@ -145,7 +153,7 @@ static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
goto out2;
|
||||
}
|
||||
|
||||
r = func(devfd, bsize, src, srcLength);
|
||||
r = func(devfd,src,srcLength);
|
||||
if(r < 0) {
|
||||
log_err(ctx, _("Failed to access temporary keystore device.\n"));
|
||||
r = -EIO;
|
||||
@@ -157,7 +165,7 @@ static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
close(devfd);
|
||||
devfd = -1;
|
||||
out2:
|
||||
dm_remove_device(ctx, cleaner_name, 1, cleaner_size);
|
||||
dm_remove_device(cleaner_name, 1, cleaner_size);
|
||||
out1:
|
||||
signal(SIGINT, SIG_DFL);
|
||||
cleaner_name = NULL;
|
||||
@@ -171,19 +179,21 @@ static int LUKS_endec_template(char *src, size_t srcLength,
|
||||
int LUKS_encrypt_to_storage(char *src, size_t srcLength,
|
||||
struct luks_phdr *hdr,
|
||||
struct volume_key *vk,
|
||||
const char *device,
|
||||
unsigned int sector,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
return LUKS_endec_template(src, srcLength, hdr, vk, sector,
|
||||
write_blockwise, O_RDWR, ctx);
|
||||
return LUKS_endec_template(src,srcLength,hdr,vk, device,
|
||||
sector, write_blockwise, O_RDWR, ctx);
|
||||
}
|
||||
|
||||
int LUKS_decrypt_from_storage(char *dst, size_t dstLength,
|
||||
struct luks_phdr *hdr,
|
||||
struct volume_key *vk,
|
||||
const char *device,
|
||||
unsigned int sector,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
return LUKS_endec_template(dst, dstLength, hdr, vk, sector,
|
||||
read_blockwise, O_RDONLY, ctx);
|
||||
return LUKS_endec_template(dst,dstLength,hdr,vk, device,
|
||||
sector, read_blockwise, O_RDONLY, ctx);
|
||||
}
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
* LUKS - Linux Unified Key Setup
|
||||
*
|
||||
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -15,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <sys/types.h>
|
||||
@@ -36,61 +35,49 @@
|
||||
#include "pbkdf.h"
|
||||
#include "internal.h"
|
||||
|
||||
/* Get size of struct luks_phdr with all keyslots material space */
|
||||
static size_t LUKS_device_sectors(size_t keyLen)
|
||||
#define div_round_up(a,b) ({ \
|
||||
typeof(a) __a = (a); \
|
||||
typeof(b) __b = (b); \
|
||||
(__a - 1) / __b + 1; \
|
||||
})
|
||||
|
||||
static inline int round_up_modulo(int x, int m) {
|
||||
return div_round_up(x, m) * m;
|
||||
}
|
||||
|
||||
/* Get size of struct luks_phrd with all keyslots material space */
|
||||
static uint64_t LUKS_device_sectors(size_t keyLen, unsigned int stripes)
|
||||
{
|
||||
size_t keyslot_sectors, sector;
|
||||
uint64_t keyslot_sectors, sector;
|
||||
int i;
|
||||
|
||||
keyslot_sectors = AF_split_sectors(keyLen, LUKS_STRIPES);
|
||||
sector = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE;
|
||||
keyslot_sectors = div_round_up(keyLen * stripes, SECTOR_SIZE);
|
||||
sector = round_up_modulo(LUKS_PHDR_SIZE, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
|
||||
|
||||
for (i = 0; i < LUKS_NUMKEYS; i++) {
|
||||
sector = size_round_up(sector, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
|
||||
sector = round_up_modulo(sector, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
|
||||
sector += keyslot_sectors;
|
||||
}
|
||||
|
||||
return sector;
|
||||
}
|
||||
|
||||
int LUKS_keyslot_area(struct luks_phdr *hdr,
|
||||
int keyslot,
|
||||
uint64_t *offset,
|
||||
uint64_t *length)
|
||||
static int LUKS_check_device_size(const char *device,
|
||||
uint64_t min_sectors,
|
||||
size_t keyLength)
|
||||
{
|
||||
if(keyslot >= LUKS_NUMKEYS || keyslot < 0)
|
||||
return -EINVAL;
|
||||
uint64_t dev_size, req_sectors;
|
||||
|
||||
*offset = hdr->keyblock[keyslot].keyMaterialOffset * SECTOR_SIZE;
|
||||
*length = AF_split_sectors(hdr->keyBytes, LUKS_STRIPES) * SECTOR_SIZE;
|
||||
req_sectors = LUKS_device_sectors(keyLength, LUKS_STRIPES);
|
||||
if (min_sectors > req_sectors)
|
||||
req_sectors = min_sectors;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int LUKS_check_device_size(struct crypt_device *ctx, size_t keyLength)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
uint64_t dev_sectors, hdr_sectors;
|
||||
|
||||
if (!keyLength)
|
||||
return -EINVAL;
|
||||
|
||||
if(device_size(device, &dev_sectors)) {
|
||||
log_dbg("Cannot get device size for device %s.", device_path(device));
|
||||
if(device_size(device, &dev_size)) {
|
||||
log_dbg("Cannot get device size for device %s.", device);
|
||||
return -EIO;
|
||||
}
|
||||
|
||||
dev_sectors >>= SECTOR_SHIFT;
|
||||
hdr_sectors = LUKS_device_sectors(keyLength);
|
||||
log_dbg("Key length %u, device size %" PRIu64 " sectors, header size %"
|
||||
PRIu64 " sectors.",keyLength, dev_sectors, hdr_sectors);
|
||||
|
||||
if (hdr_sectors > dev_sectors) {
|
||||
log_err(ctx, _("Device %s is too small.\n"), device_path(device));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
return 0;
|
||||
return (req_sectors > (dev_size >> SECTOR_SHIFT));
|
||||
}
|
||||
|
||||
/* Check keyslot to prevent access outside of header and keyslot area */
|
||||
@@ -99,7 +86,7 @@ static int LUKS_check_keyslot_size(const struct luks_phdr *phdr, unsigned int ke
|
||||
uint32_t secs_per_stripes;
|
||||
|
||||
/* First sectors is the header itself */
|
||||
if (phdr->keyblock[keyIndex].keyMaterialOffset * SECTOR_SIZE < sizeof(*phdr)) {
|
||||
if (phdr->keyblock[keyIndex].keyMaterialOffset * SECTOR_SIZE < LUKS_ALIGN_KEYSLOTS) {
|
||||
log_dbg("Invalid offset %u in keyslot %u.",
|
||||
phdr->keyblock[keyIndex].keyMaterialOffset, keyIndex);
|
||||
return 1;
|
||||
@@ -116,7 +103,7 @@ static int LUKS_check_keyslot_size(const struct luks_phdr *phdr, unsigned int ke
|
||||
return 1;
|
||||
}
|
||||
|
||||
secs_per_stripes = AF_split_sectors(phdr->keyBytes, phdr->keyblock[keyIndex].stripes);
|
||||
secs_per_stripes = div_round_up(phdr->keyBytes * phdr->keyblock[keyIndex].stripes, SECTOR_SIZE);
|
||||
|
||||
if (phdr->payloadOffset < (phdr->keyblock[keyIndex].keyMaterialOffset + secs_per_stripes)) {
|
||||
log_dbg("Invalid keyslot size %u (offset %u, stripes %u) in "
|
||||
@@ -148,10 +135,10 @@ static const char *dbg_slot_state(crypt_keyslot_info ki)
|
||||
|
||||
int LUKS_hdr_backup(
|
||||
const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
int r = 0, devfd = -1;
|
||||
ssize_t buffer_size;
|
||||
char *buffer = NULL;
|
||||
@@ -162,11 +149,11 @@ int LUKS_hdr_backup(
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
r = LUKS_read_phdr(hdr, 1, 0, ctx);
|
||||
r = LUKS_read_phdr(device, hdr, 1, ctx);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
buffer_size = LUKS_device_sectors(hdr->keyBytes) << SECTOR_SHIFT;
|
||||
buffer_size = hdr->payloadOffset << SECTOR_SHIFT;
|
||||
buffer = crypt_safe_alloc(buffer_size);
|
||||
if (!buffer || buffer_size < LUKS_ALIGN_KEYSLOTS) {
|
||||
r = -ENOMEM;
|
||||
@@ -176,22 +163,21 @@ int LUKS_hdr_backup(
|
||||
log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes).",
|
||||
sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS);
|
||||
|
||||
devfd = open(device_path(device), O_RDONLY | O_DIRECT | O_SYNC);
|
||||
devfd = open(device, O_RDONLY | O_DIRECT | O_SYNC);
|
||||
if(devfd == -1) {
|
||||
log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device_path(device));
|
||||
log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
|
||||
r = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if(read_blockwise(devfd, device_block_size(device), buffer, buffer_size) < buffer_size) {
|
||||
if(read_blockwise(devfd, buffer, buffer_size) < buffer_size) {
|
||||
r = -EIO;
|
||||
goto out;
|
||||
}
|
||||
close(devfd);
|
||||
|
||||
/* Wipe unused area, so backup cannot contain old signatures */
|
||||
if (hdr->keyblock[0].keyMaterialOffset * SECTOR_SIZE == LUKS_ALIGN_KEYSLOTS)
|
||||
memset(buffer + sizeof(*hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(*hdr));
|
||||
memset(buffer + sizeof(*hdr), 0, LUKS_ALIGN_KEYSLOTS - sizeof(*hdr));
|
||||
|
||||
devfd = creat(backup_file, S_IRUSR);
|
||||
if(devfd == -1) {
|
||||
@@ -215,12 +201,12 @@ out:
|
||||
|
||||
int LUKS_hdr_restore(
|
||||
const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
int r = 0, devfd = -1, diff_uuid = 0;
|
||||
ssize_t buffer_size = 0;
|
||||
ssize_t buffer_size;
|
||||
char *buffer = NULL, msg[200];
|
||||
struct stat st;
|
||||
struct luks_phdr hdr_file;
|
||||
@@ -230,9 +216,8 @@ int LUKS_hdr_restore(
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
r = LUKS_read_phdr_backup(backup_file, &hdr_file, 0, ctx);
|
||||
if (!r)
|
||||
buffer_size = LUKS_device_sectors(hdr_file.keyBytes) << SECTOR_SHIFT;
|
||||
r = LUKS_read_phdr_backup(backup_file, device, &hdr_file, 0, ctx);
|
||||
buffer_size = hdr_file.payloadOffset << SECTOR_SHIFT;
|
||||
|
||||
if (r || buffer_size < LUKS_ALIGN_KEYSLOTS) {
|
||||
log_err(ctx, _("Backup file doesn't contain valid LUKS header.\n"));
|
||||
@@ -260,9 +245,9 @@ int LUKS_hdr_restore(
|
||||
}
|
||||
close(devfd);
|
||||
|
||||
r = LUKS_read_phdr(hdr, 0, 0, ctx);
|
||||
r = LUKS_read_phdr(device, hdr, 0, ctx);
|
||||
if (r == 0) {
|
||||
log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device_path(device));
|
||||
log_dbg("Device %s already contains LUKS header, checking UUID and offset.", device);
|
||||
if(hdr->payloadOffset != hdr_file.payloadOffset ||
|
||||
hdr->keyBytes != hdr_file.keyBytes) {
|
||||
log_err(ctx, _("Data offset or key size differs on device and backup, restore failed.\n"));
|
||||
@@ -273,7 +258,7 @@ int LUKS_hdr_restore(
|
||||
diff_uuid = 1;
|
||||
}
|
||||
|
||||
if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device_path(device),
|
||||
if (snprintf(msg, sizeof(msg), _("Device %s %s%s"), device,
|
||||
r ? _("does not contain LUKS header. Replacing header can destroy data on that device.") :
|
||||
_("already contains LUKS header. Replacing header will destroy existing keyslots."),
|
||||
diff_uuid ? _("\nWARNING: real device header has different UUID than backup!") : "") < 0) {
|
||||
@@ -287,27 +272,23 @@ int LUKS_hdr_restore(
|
||||
}
|
||||
|
||||
log_dbg("Storing backup of header (%u bytes) and keyslot area (%u bytes) to device %s.",
|
||||
sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device_path(device));
|
||||
sizeof(*hdr), buffer_size - LUKS_ALIGN_KEYSLOTS, device);
|
||||
|
||||
devfd = open(device_path(device), O_WRONLY | O_DIRECT | O_SYNC);
|
||||
devfd = open(device, O_WRONLY | O_DIRECT | O_SYNC);
|
||||
if(devfd == -1) {
|
||||
if (errno == EACCES)
|
||||
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
|
||||
device_path(device));
|
||||
else
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device);
|
||||
r = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (write_blockwise(devfd, device_block_size(device), buffer, buffer_size) < buffer_size) {
|
||||
if(write_blockwise(devfd, buffer, buffer_size) < buffer_size) {
|
||||
r = -EIO;
|
||||
goto out;
|
||||
}
|
||||
close(devfd);
|
||||
|
||||
/* Be sure to reload new data */
|
||||
r = LUKS_read_phdr(hdr, 1, 0, ctx);
|
||||
r = LUKS_read_phdr(device, hdr, 1, ctx);
|
||||
out:
|
||||
if (devfd != -1)
|
||||
close(devfd);
|
||||
@@ -315,96 +296,9 @@ out:
|
||||
return r;
|
||||
}
|
||||
|
||||
/* This routine should do some just basic recovery for known problems. */
|
||||
static int _keyslot_repair(struct luks_phdr *phdr, struct crypt_device *ctx)
|
||||
{
|
||||
struct luks_phdr temp_phdr;
|
||||
const unsigned char *sector = (const unsigned char*)phdr;
|
||||
struct volume_key *vk;
|
||||
uint64_t PBKDF2_per_sec = 1;
|
||||
int i, bad, r, need_write = 0;
|
||||
|
||||
if (phdr->keyBytes != 16 && phdr->keyBytes != 32) {
|
||||
log_err(ctx, _("Non standard key size, manual repair required.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
/* cryptsetup 1.0 did not align to 4k, cannot repair this one */
|
||||
if (phdr->keyblock[0].keyMaterialOffset < (LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE)) {
|
||||
log_err(ctx, _("Non standard keyslots alignment, manual repair required.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
vk = crypt_alloc_volume_key(phdr->keyBytes, NULL);
|
||||
|
||||
log_verbose(ctx, _("Repairing keyslots.\n"));
|
||||
|
||||
log_dbg("Generating second header with the same parameters for check.");
|
||||
/* cipherName, cipherMode, hashSpec, uuid are already null terminated */
|
||||
/* payloadOffset - cannot check */
|
||||
r = LUKS_generate_phdr(&temp_phdr, vk, phdr->cipherName, phdr->cipherMode,
|
||||
phdr->hashSpec,phdr->uuid, LUKS_STRIPES,
|
||||
phdr->payloadOffset, 0,
|
||||
1, &PBKDF2_per_sec,
|
||||
1, ctx);
|
||||
if (r < 0) {
|
||||
log_err(ctx, _("Repair failed."));
|
||||
goto out;
|
||||
}
|
||||
|
||||
for(i = 0; i < LUKS_NUMKEYS; ++i) {
|
||||
if (phdr->keyblock[i].active == LUKS_KEY_ENABLED) {
|
||||
log_dbg("Skipping repair for active keyslot %i.", i);
|
||||
continue;
|
||||
}
|
||||
|
||||
bad = 0;
|
||||
if (phdr->keyblock[i].keyMaterialOffset != temp_phdr.keyblock[i].keyMaterialOffset) {
|
||||
log_err(ctx, _("Keyslot %i: offset repaired (%u -> %u).\n"), i,
|
||||
(unsigned)phdr->keyblock[i].keyMaterialOffset,
|
||||
(unsigned)temp_phdr.keyblock[i].keyMaterialOffset);
|
||||
phdr->keyblock[i].keyMaterialOffset = temp_phdr.keyblock[i].keyMaterialOffset;
|
||||
bad = 1;
|
||||
}
|
||||
|
||||
if (phdr->keyblock[i].stripes != temp_phdr.keyblock[i].stripes) {
|
||||
log_err(ctx, _("Keyslot %i: stripes repaired (%u -> %u).\n"), i,
|
||||
(unsigned)phdr->keyblock[i].stripes,
|
||||
(unsigned)temp_phdr.keyblock[i].stripes);
|
||||
phdr->keyblock[i].stripes = temp_phdr.keyblock[i].stripes;
|
||||
bad = 1;
|
||||
}
|
||||
|
||||
/* Known case - MSDOS partition table signature */
|
||||
if (i == 6 && sector[0x1fe] == 0x55 && sector[0x1ff] == 0xaa) {
|
||||
log_err(ctx, _("Keyslot %i: bogus partition signature.\n"), i);
|
||||
bad = 1;
|
||||
}
|
||||
|
||||
if(bad) {
|
||||
log_err(ctx, _("Keyslot %i: salt wiped.\n"), i);
|
||||
phdr->keyblock[i].active = LUKS_KEY_DISABLED;
|
||||
memset(&phdr->keyblock[i].passwordSalt, 0x00, LUKS_SALTSIZE);
|
||||
phdr->keyblock[i].passwordIterations = 0;
|
||||
}
|
||||
|
||||
if (bad)
|
||||
need_write = 1;
|
||||
}
|
||||
|
||||
if (need_write) {
|
||||
log_verbose(ctx, _("Writing LUKS header to disk.\n"));
|
||||
r = LUKS_write_phdr(phdr, ctx);
|
||||
}
|
||||
out:
|
||||
crypt_free_volume_key(vk);
|
||||
memset(&temp_phdr, 0, sizeof(temp_phdr));
|
||||
return r;
|
||||
}
|
||||
|
||||
static int _check_and_convert_hdr(const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
int require_luks_device,
|
||||
int repair,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
int r = 0;
|
||||
@@ -415,44 +309,34 @@ static int _check_and_convert_hdr(const char *device,
|
||||
log_dbg("LUKS header not detected.");
|
||||
if (require_luks_device)
|
||||
log_err(ctx, _("Device %s is not a valid LUKS device.\n"), device);
|
||||
return -EINVAL;
|
||||
r = -EINVAL;
|
||||
} else if((hdr->version = ntohs(hdr->version)) != 1) { /* Convert every uint16/32_t item from network byte order */
|
||||
log_err(ctx, _("Unsupported LUKS version %d.\n"), hdr->version);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
hdr->hashSpec[LUKS_HASHSPEC_L - 1] = '\0';
|
||||
if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
|
||||
r = -EINVAL;
|
||||
} else if (PBKDF2_HMAC_ready(hdr->hashSpec) < 0) {
|
||||
log_err(ctx, _("Requested LUKS hash %s is not supported.\n"), hdr->hashSpec);
|
||||
return -EINVAL;
|
||||
}
|
||||
r = -EINVAL;
|
||||
} else {
|
||||
hdr->payloadOffset = ntohl(hdr->payloadOffset);
|
||||
hdr->keyBytes = ntohl(hdr->keyBytes);
|
||||
hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
|
||||
|
||||
/* Header detected */
|
||||
hdr->payloadOffset = ntohl(hdr->payloadOffset);
|
||||
hdr->keyBytes = ntohl(hdr->keyBytes);
|
||||
hdr->mkDigestIterations = ntohl(hdr->mkDigestIterations);
|
||||
|
||||
for(i = 0; i < LUKS_NUMKEYS; ++i) {
|
||||
hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
|
||||
hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
|
||||
hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
|
||||
hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
|
||||
if (LUKS_check_keyslot_size(hdr, i)) {
|
||||
log_err(ctx, _("LUKS keyslot %u is invalid.\n"), i);
|
||||
r = -EINVAL;
|
||||
for(i = 0; i < LUKS_NUMKEYS; ++i) {
|
||||
hdr->keyblock[i].active = ntohl(hdr->keyblock[i].active);
|
||||
hdr->keyblock[i].passwordIterations = ntohl(hdr->keyblock[i].passwordIterations);
|
||||
hdr->keyblock[i].keyMaterialOffset = ntohl(hdr->keyblock[i].keyMaterialOffset);
|
||||
hdr->keyblock[i].stripes = ntohl(hdr->keyblock[i].stripes);
|
||||
if (LUKS_check_keyslot_size(hdr, i)) {
|
||||
log_err(ctx, _("LUKS keyslot %u is invalid.\n"), i);
|
||||
// FIXME: allow header recovery
|
||||
r = -EINVAL;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* Avoid unterminated strings */
|
||||
hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0';
|
||||
hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0';
|
||||
hdr->uuid[UUID_STRING_L - 1] = '\0';
|
||||
|
||||
if (repair) {
|
||||
if (r == -EINVAL)
|
||||
r = _keyslot_repair(hdr, ctx);
|
||||
else
|
||||
log_verbose(ctx, _("No known problems detected for LUKS header.\n"));
|
||||
/* Avoid unterminated strings */
|
||||
hdr->cipherName[LUKS_CIPHERNAME_L - 1] = '\0';
|
||||
hdr->cipherMode[LUKS_CIPHERMODE_L - 1] = '\0';
|
||||
hdr->uuid[UUID_STRING_L - 1] = '\0';
|
||||
}
|
||||
|
||||
return r;
|
||||
@@ -473,6 +357,7 @@ static void LUKS_fix_header_compatible(struct luks_phdr *header)
|
||||
}
|
||||
|
||||
int LUKS_read_phdr_backup(const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
int require_luks_device,
|
||||
struct crypt_device *ctx)
|
||||
@@ -485,7 +370,7 @@ int LUKS_read_phdr_backup(const char *backup_file,
|
||||
|
||||
devfd = open(backup_file, O_RDONLY);
|
||||
if(-1 == devfd) {
|
||||
log_err(ctx, _("Cannot open file %s.\n"), backup_file);
|
||||
log_err(ctx, _("Cannot open file %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@@ -493,58 +378,43 @@ int LUKS_read_phdr_backup(const char *backup_file,
|
||||
r = -EIO;
|
||||
else {
|
||||
LUKS_fix_header_compatible(hdr);
|
||||
r = _check_and_convert_hdr(backup_file, hdr,
|
||||
require_luks_device, 0, ctx);
|
||||
r = _check_and_convert_hdr(backup_file, hdr, require_luks_device, ctx);
|
||||
}
|
||||
|
||||
close(devfd);
|
||||
return r;
|
||||
}
|
||||
|
||||
int LUKS_read_phdr(struct luks_phdr *hdr,
|
||||
int LUKS_read_phdr(const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
int require_luks_device,
|
||||
int repair,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
ssize_t hdr_size = sizeof(struct luks_phdr);
|
||||
int devfd = 0, r = 0;
|
||||
|
||||
/* LUKS header starts at offset 0, first keyslot on LUKS_ALIGN_KEYSLOTS */
|
||||
assert(sizeof(struct luks_phdr) <= LUKS_ALIGN_KEYSLOTS);
|
||||
|
||||
/* Stripes count cannot be changed without additional code fixes yet */
|
||||
assert(LUKS_STRIPES == 4000);
|
||||
|
||||
if (repair && !require_luks_device)
|
||||
return -EINVAL;
|
||||
|
||||
log_dbg("Reading LUKS header of size %d from device %s",
|
||||
hdr_size, device_path(device));
|
||||
hdr_size, device);
|
||||
|
||||
devfd = open(device_path(device), O_RDONLY | O_DIRECT | O_SYNC);
|
||||
if (devfd == -1) {
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
|
||||
devfd = open(device,O_RDONLY | O_DIRECT | O_SYNC);
|
||||
if(-1 == devfd) {
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (read_blockwise(devfd, device_block_size(device), hdr, hdr_size) < hdr_size)
|
||||
if (read_blockwise(devfd, hdr, hdr_size) < hdr_size)
|
||||
r = -EIO;
|
||||
else
|
||||
r = _check_and_convert_hdr(device_path(device), hdr, require_luks_device,
|
||||
repair, ctx);
|
||||
|
||||
if (!r)
|
||||
r = LUKS_check_device_size(ctx, hdr->keyBytes);
|
||||
r = _check_and_convert_hdr(device, hdr, require_luks_device, ctx);
|
||||
|
||||
close(devfd);
|
||||
return r;
|
||||
}
|
||||
|
||||
int LUKS_write_phdr(struct luks_phdr *hdr,
|
||||
int LUKS_write_phdr(const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
ssize_t hdr_size = sizeof(struct luks_phdr);
|
||||
int devfd = 0;
|
||||
unsigned int i;
|
||||
@@ -552,19 +422,16 @@ int LUKS_write_phdr(struct luks_phdr *hdr,
|
||||
int r;
|
||||
|
||||
log_dbg("Updating LUKS header of size %d on device %s",
|
||||
sizeof(struct luks_phdr), device_path(device));
|
||||
sizeof(struct luks_phdr), device);
|
||||
|
||||
r = LUKS_check_device_size(ctx, hdr->keyBytes);
|
||||
if (r)
|
||||
return r;
|
||||
if (LUKS_check_device_size(device, hdr->payloadOffset, hdr->keyBytes)) {
|
||||
log_err(ctx, _("Device %s is too small.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
devfd = open(device_path(device), O_RDWR | O_DIRECT | O_SYNC);
|
||||
devfd = open(device,O_RDWR | O_DIRECT | O_SYNC);
|
||||
if(-1 == devfd) {
|
||||
if (errno == EACCES)
|
||||
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
|
||||
device_path(device));
|
||||
else
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device_path(device));
|
||||
log_err(ctx, _("Cannot open device %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
@@ -583,17 +450,16 @@ int LUKS_write_phdr(struct luks_phdr *hdr,
|
||||
convHdr.keyblock[i].stripes = htonl(hdr->keyblock[i].stripes);
|
||||
}
|
||||
|
||||
r = write_blockwise(devfd, device_block_size(device), &convHdr, hdr_size) < hdr_size ? -EIO : 0;
|
||||
r = write_blockwise(devfd, &convHdr, hdr_size) < hdr_size ? -EIO : 0;
|
||||
if (r)
|
||||
log_err(ctx, _("Error during update of LUKS header on device %s.\n"), device_path(device));
|
||||
log_err(ctx, _("Error during update of LUKS header on device %s.\n"), device);
|
||||
close(devfd);
|
||||
|
||||
/* Re-read header from disk to be sure that in-memory and on-disk data are the same. */
|
||||
if (!r) {
|
||||
r = LUKS_read_phdr(hdr, 1, 0, ctx);
|
||||
r = LUKS_read_phdr(device, hdr, 1, ctx);
|
||||
if (r)
|
||||
log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"),
|
||||
device_path(device));
|
||||
log_err(ctx, _("Error re-reading LUKS header after update on device %s.\n"), device);
|
||||
}
|
||||
|
||||
return r;
|
||||
@@ -622,17 +488,18 @@ int LUKS_generate_phdr(struct luks_phdr *header,
|
||||
unsigned int alignOffset,
|
||||
uint32_t iteration_time_ms,
|
||||
uint64_t *PBKDF2_per_sec,
|
||||
int detached_metadata_device,
|
||||
const char *metadata_device,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
unsigned int i=0;
|
||||
size_t blocksPerStripeSet, currentSector;
|
||||
unsigned int blocksPerStripeSet = div_round_up(vk->keylength*stripes,SECTOR_SIZE);
|
||||
int r;
|
||||
uuid_t partitionUuid;
|
||||
int currentSector;
|
||||
char luksMagic[] = LUKS_MAGIC;
|
||||
|
||||
/* For separate metadata device allow zero alignment */
|
||||
if (alignPayload == 0 && !detached_metadata_device)
|
||||
if (alignPayload == 0 && !metadata_device)
|
||||
alignPayload = DEFAULT_DISK_ALIGNMENT / SECTOR_SIZE;
|
||||
|
||||
if (PBKDF2_HMAC_ready(hashSpec) < 0) {
|
||||
@@ -664,7 +531,7 @@ int LUKS_generate_phdr(struct luks_phdr *header,
|
||||
header->version, header->hashSpec ,header->cipherName, header->cipherMode,
|
||||
header->keyBytes);
|
||||
|
||||
r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_SALT);
|
||||
r = crypt_random_get(ctx, header->mkDigestSalt, LUKS_SALTSIZE, CRYPT_RND_NORMAL);
|
||||
if(r < 0) {
|
||||
log_err(ctx, _("Cannot create LUKS header: reading random salt failed.\n"));
|
||||
return r;
|
||||
@@ -688,22 +555,21 @@ int LUKS_generate_phdr(struct luks_phdr *header,
|
||||
return r;
|
||||
}
|
||||
|
||||
currentSector = LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE;
|
||||
blocksPerStripeSet = AF_split_sectors(vk->keylength, stripes);
|
||||
currentSector = round_up_modulo(LUKS_PHDR_SIZE, LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
|
||||
for(i = 0; i < LUKS_NUMKEYS; ++i) {
|
||||
header->keyblock[i].active = LUKS_KEY_DISABLED;
|
||||
header->keyblock[i].keyMaterialOffset = currentSector;
|
||||
header->keyblock[i].stripes = stripes;
|
||||
currentSector = size_round_up(currentSector + blocksPerStripeSet,
|
||||
currentSector = round_up_modulo(currentSector + blocksPerStripeSet,
|
||||
LUKS_ALIGN_KEYSLOTS / SECTOR_SIZE);
|
||||
}
|
||||
|
||||
if (detached_metadata_device) {
|
||||
if (metadata_device) {
|
||||
/* for separate metadata device use alignPayload directly */
|
||||
header->payloadOffset = alignPayload;
|
||||
} else {
|
||||
/* alignOffset - offset from natural device alignment provided by topology info */
|
||||
currentSector = size_round_up(currentSector, alignPayload);
|
||||
currentSector = round_up_modulo(currentSector, alignPayload);
|
||||
header->payloadOffset = currentSector + alignOffset;
|
||||
}
|
||||
|
||||
@@ -716,6 +582,7 @@ int LUKS_generate_phdr(struct luks_phdr *header,
|
||||
}
|
||||
|
||||
int LUKS_hdr_uuid_set(
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
const char *uuid,
|
||||
struct crypt_device *ctx)
|
||||
@@ -731,10 +598,10 @@ int LUKS_hdr_uuid_set(
|
||||
|
||||
uuid_unparse(partitionUuid, hdr->uuid);
|
||||
|
||||
return LUKS_write_phdr(hdr, ctx);
|
||||
return LUKS_write_phdr(device, hdr, ctx);
|
||||
}
|
||||
|
||||
int LUKS_set_key(unsigned int keyIndex,
|
||||
int LUKS_set_key(const char *device, unsigned int keyIndex,
|
||||
const char *password, size_t passwordLen,
|
||||
struct luks_phdr *hdr, struct volume_key *vk,
|
||||
uint32_t iteration_time_ms,
|
||||
@@ -743,7 +610,7 @@ int LUKS_set_key(unsigned int keyIndex,
|
||||
{
|
||||
struct volume_key *derived_key;
|
||||
char *AfKey = NULL;
|
||||
size_t AFEKSize;
|
||||
unsigned int AFEKSize;
|
||||
uint64_t PBKDF2_temp;
|
||||
int r;
|
||||
|
||||
@@ -752,8 +619,7 @@ int LUKS_set_key(unsigned int keyIndex,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* LUKS keyslot has always at least 4000 stripes accoding to specification */
|
||||
if(hdr->keyblock[keyIndex].stripes < 4000) {
|
||||
if(hdr->keyblock[keyIndex].stripes < LUKS_STRIPES) {
|
||||
log_err(ctx, _("Key slot %d material includes too few stripes. Header manipulation?\n"),
|
||||
keyIndex);
|
||||
return -EINVAL;
|
||||
@@ -782,9 +648,9 @@ int LUKS_set_key(unsigned int keyIndex,
|
||||
return -ENOMEM;
|
||||
|
||||
r = crypt_random_get(ctx, hdr->keyblock[keyIndex].passwordSalt,
|
||||
LUKS_SALTSIZE, CRYPT_RND_SALT);
|
||||
LUKS_SALTSIZE, CRYPT_RND_NORMAL);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
return r;
|
||||
|
||||
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
|
||||
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
|
||||
@@ -797,7 +663,7 @@ int LUKS_set_key(unsigned int keyIndex,
|
||||
* AF splitting, the masterkey stored in vk->key is split to AfKey
|
||||
*/
|
||||
assert(vk->keylength == hdr->keyBytes);
|
||||
AFEKSize = AF_split_sectors(vk->keylength, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE;
|
||||
AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
|
||||
AfKey = crypt_safe_alloc(AFEKSize);
|
||||
if (!AfKey) {
|
||||
r = -ENOMEM;
|
||||
@@ -810,24 +676,27 @@ int LUKS_set_key(unsigned int keyIndex,
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
log_dbg("Updating key slot %d [0x%04x] area.", keyIndex,
|
||||
hdr->keyblock[keyIndex].keyMaterialOffset << 9);
|
||||
log_dbg("Updating key slot %d [0x%04x] area on device %s.", keyIndex,
|
||||
hdr->keyblock[keyIndex].keyMaterialOffset << 9, device);
|
||||
/* Encryption via dm */
|
||||
r = LUKS_encrypt_to_storage(AfKey,
|
||||
AFEKSize,
|
||||
hdr,
|
||||
derived_key,
|
||||
device,
|
||||
hdr->keyblock[keyIndex].keyMaterialOffset,
|
||||
ctx);
|
||||
if (r < 0)
|
||||
if (r < 0) {
|
||||
log_err(ctx, _("Failed to write to key storage.\n"));
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* Mark the key as active in phdr */
|
||||
r = LUKS_keyslot_set(hdr, (int)keyIndex, 1);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
r = LUKS_write_phdr(hdr, ctx);
|
||||
r = LUKS_write_phdr(device, hdr, ctx);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -857,7 +726,8 @@ int LUKS_verify_volume_key(const struct luks_phdr *hdr,
|
||||
}
|
||||
|
||||
/* Try to open a particular key slot */
|
||||
static int LUKS_open_key(unsigned int keyIndex,
|
||||
static int LUKS_open_key(const char *device,
|
||||
unsigned int keyIndex,
|
||||
const char *password,
|
||||
size_t passwordLen,
|
||||
struct luks_phdr *hdr,
|
||||
@@ -881,12 +751,10 @@ static int LUKS_open_key(unsigned int keyIndex,
|
||||
return -ENOMEM;
|
||||
|
||||
assert(vk->keylength == hdr->keyBytes);
|
||||
AFEKSize = AF_split_sectors(vk->keylength, hdr->keyblock[keyIndex].stripes) * SECTOR_SIZE;
|
||||
AFEKSize = hdr->keyblock[keyIndex].stripes*vk->keylength;
|
||||
AfKey = crypt_safe_alloc(AFEKSize);
|
||||
if (!AfKey) {
|
||||
r = -ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
if (!AfKey)
|
||||
return -ENOMEM;
|
||||
|
||||
r = PBKDF2_HMAC(hdr->hashSpec, password,passwordLen,
|
||||
hdr->keyblock[keyIndex].passwordSalt,LUKS_SALTSIZE,
|
||||
@@ -900,10 +768,13 @@ static int LUKS_open_key(unsigned int keyIndex,
|
||||
AFEKSize,
|
||||
hdr,
|
||||
derived_key,
|
||||
device,
|
||||
hdr->keyblock[keyIndex].keyMaterialOffset,
|
||||
ctx);
|
||||
if (r < 0)
|
||||
if (r < 0) {
|
||||
log_err(ctx, _("Failed to read from key storage.\n"));
|
||||
goto out;
|
||||
}
|
||||
|
||||
r = AF_merge(AfKey,vk->key,vk->keylength,hdr->keyblock[keyIndex].stripes,hdr->hashSpec);
|
||||
if (r < 0)
|
||||
@@ -918,7 +789,8 @@ out:
|
||||
return r;
|
||||
}
|
||||
|
||||
int LUKS_open_key_with_hdr(int keyIndex,
|
||||
int LUKS_open_key_with_hdr(const char *device,
|
||||
int keyIndex,
|
||||
const char *password,
|
||||
size_t passwordLen,
|
||||
struct luks_phdr *hdr,
|
||||
@@ -931,12 +803,12 @@ int LUKS_open_key_with_hdr(int keyIndex,
|
||||
*vk = crypt_alloc_volume_key(hdr->keyBytes, NULL);
|
||||
|
||||
if (keyIndex >= 0) {
|
||||
r = LUKS_open_key(keyIndex, password, passwordLen, hdr, *vk, ctx);
|
||||
r = LUKS_open_key(device, keyIndex, password, passwordLen, hdr, *vk, ctx);
|
||||
return (r < 0) ? r : keyIndex;
|
||||
}
|
||||
|
||||
for(i = 0; i < LUKS_NUMKEYS; i++) {
|
||||
r = LUKS_open_key(i, password, passwordLen, hdr, *vk, ctx);
|
||||
r = LUKS_open_key(device, i, password, passwordLen, hdr, *vk, ctx);
|
||||
if(r == 0)
|
||||
return i;
|
||||
|
||||
@@ -950,15 +822,15 @@ int LUKS_open_key_with_hdr(int keyIndex,
|
||||
return -EPERM;
|
||||
}
|
||||
|
||||
int LUKS_del_key(unsigned int keyIndex,
|
||||
int LUKS_del_key(const char *device,
|
||||
unsigned int keyIndex,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx)
|
||||
{
|
||||
struct device *device = crypt_metadata_device(ctx);
|
||||
unsigned int startOffset, endOffset;
|
||||
unsigned int startOffset, endOffset, stripesLen;
|
||||
int r;
|
||||
|
||||
r = LUKS_read_phdr(hdr, 1, 0, ctx);
|
||||
r = LUKS_read_phdr(device, hdr, 1, ctx);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
@@ -971,19 +843,14 @@ int LUKS_del_key(unsigned int keyIndex,
|
||||
|
||||
/* secure deletion of key material */
|
||||
startOffset = hdr->keyblock[keyIndex].keyMaterialOffset;
|
||||
endOffset = startOffset + AF_split_sectors(hdr->keyBytes, hdr->keyblock[keyIndex].stripes);
|
||||
stripesLen = hdr->keyBytes * hdr->keyblock[keyIndex].stripes;
|
||||
endOffset = startOffset + div_round_up(stripesLen, SECTOR_SIZE);
|
||||
|
||||
r = crypt_wipe(device, startOffset * SECTOR_SIZE,
|
||||
(endOffset - startOffset) * SECTOR_SIZE,
|
||||
CRYPT_WIPE_DISK, 0);
|
||||
if (r) {
|
||||
if (r == -EACCES) {
|
||||
log_err(ctx, _("Cannot write to device %s, permission denied.\n"),
|
||||
device_path(device));
|
||||
r = -EINVAL;
|
||||
} else
|
||||
log_err(ctx, _("Cannot wipe device %s.\n"),
|
||||
device_path(device));
|
||||
log_err(ctx, _("Cannot wipe device %s.\n"), device);
|
||||
return r;
|
||||
}
|
||||
|
||||
@@ -991,7 +858,7 @@ int LUKS_del_key(unsigned int keyIndex,
|
||||
memset(&hdr->keyblock[keyIndex].passwordSalt, 0, LUKS_SALTSIZE);
|
||||
hdr->keyblock[keyIndex].passwordIterations = 0;
|
||||
|
||||
r = LUKS_write_phdr(hdr, ctx);
|
||||
r = LUKS_write_phdr(device, hdr, ctx);
|
||||
|
||||
return r;
|
||||
}
|
||||
@@ -1060,28 +927,19 @@ int LUKS1_activate(struct crypt_device *cd,
|
||||
{
|
||||
int r;
|
||||
char *dm_cipher = NULL;
|
||||
enum devcheck device_check;
|
||||
struct crypt_dm_active_device dmd = {
|
||||
.target = DM_CRYPT,
|
||||
.device = crypt_get_device_name(cd),
|
||||
.cipher = NULL,
|
||||
.uuid = crypt_get_uuid(cd),
|
||||
.flags = flags,
|
||||
.vk = vk,
|
||||
.offset = crypt_get_data_offset(cd),
|
||||
.iv_offset = 0,
|
||||
.size = 0,
|
||||
.data_device = crypt_data_device(cd),
|
||||
.u.crypt = {
|
||||
.cipher = NULL,
|
||||
.vk = vk,
|
||||
.offset = crypt_get_data_offset(cd),
|
||||
.iv_offset = 0,
|
||||
}
|
||||
.flags = flags
|
||||
};
|
||||
|
||||
if (dmd.flags & CRYPT_ACTIVATE_SHARED)
|
||||
device_check = DEV_SHARED;
|
||||
else
|
||||
device_check = DEV_EXCL;
|
||||
|
||||
r = device_block_adjust(cd, dmd.data_device, device_check,
|
||||
dmd.u.crypt.offset, &dmd.size, &dmd.flags);
|
||||
r = device_check_and_adjust(cd, dmd.device, DEV_EXCL,
|
||||
&dmd.size, &dmd.offset, &flags);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
@@ -1089,8 +947,8 @@ int LUKS1_activate(struct crypt_device *cd,
|
||||
if (r < 0)
|
||||
return -ENOMEM;
|
||||
|
||||
dmd.u.crypt.cipher = dm_cipher;
|
||||
r = dm_create_device(cd, name, CRYPT_LUKS1, &dmd, 0);
|
||||
dmd.cipher = dm_cipher;
|
||||
r = dm_create_device(name, CRYPT_LUKS1, &dmd, 0);
|
||||
|
||||
free(dm_cipher);
|
||||
return r;
|
||||
|
||||
@@ -1,23 +1,3 @@
|
||||
/*
|
||||
* LUKS - Linux Unified Key Setup
|
||||
*
|
||||
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef INCLUDED_CRYPTSETUP_LUKS_LUKS_H
|
||||
#define INCLUDED_CRYPTSETUP_LUKS_LUKS_H
|
||||
|
||||
@@ -51,6 +31,8 @@
|
||||
#define LUKS_MAGIC {'L','U','K','S', 0xba, 0xbe};
|
||||
#define LUKS_MAGIC_L 6
|
||||
|
||||
#define LUKS_PHDR_SIZE (sizeof(struct luks_phdr)/SECTOR_SIZE+1)
|
||||
|
||||
/* Actually we need only 37, but we don't want struct autoaligning to kick in */
|
||||
#define UUID_STRING_L 40
|
||||
|
||||
@@ -61,7 +43,6 @@
|
||||
converted */
|
||||
|
||||
struct volume_key;
|
||||
struct device_backend;
|
||||
|
||||
struct luks_phdr {
|
||||
char magic[LUKS_MAGIC_L];
|
||||
@@ -107,41 +88,47 @@ int LUKS_generate_phdr(
|
||||
unsigned int alignOffset,
|
||||
uint32_t iteration_time_ms,
|
||||
uint64_t *PBKDF2_per_sec,
|
||||
int detached_metadata_device,
|
||||
const char *metadata_device,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_read_phdr(
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
int require_luks_device,
|
||||
int repair,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_read_phdr_backup(
|
||||
const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
int require_luks_device,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_hdr_uuid_set(
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
const char *uuid,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_hdr_backup(
|
||||
const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_hdr_restore(
|
||||
const char *backup_file,
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_write_phdr(
|
||||
const char *device,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_set_key(
|
||||
const char *device,
|
||||
unsigned int keyIndex,
|
||||
const char *password,
|
||||
size_t passwordLen,
|
||||
@@ -152,6 +139,7 @@ int LUKS_set_key(
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_open_key_with_hdr(
|
||||
const char *device,
|
||||
int keyIndex,
|
||||
const char *password,
|
||||
size_t passwordLen,
|
||||
@@ -160,6 +148,7 @@ int LUKS_open_key_with_hdr(
|
||||
struct crypt_device *ctx);
|
||||
|
||||
int LUKS_del_key(
|
||||
const char *device,
|
||||
unsigned int keyIndex,
|
||||
struct luks_phdr *hdr,
|
||||
struct crypt_device *ctx);
|
||||
@@ -168,15 +157,12 @@ crypt_keyslot_info LUKS_keyslot_info(struct luks_phdr *hdr, int keyslot);
|
||||
int LUKS_keyslot_find_empty(struct luks_phdr *hdr);
|
||||
int LUKS_keyslot_active_count(struct luks_phdr *hdr);
|
||||
int LUKS_keyslot_set(struct luks_phdr *hdr, int keyslot, int enable);
|
||||
int LUKS_keyslot_area(struct luks_phdr *hdr,
|
||||
int keyslot,
|
||||
uint64_t *offset,
|
||||
uint64_t *length);
|
||||
|
||||
int LUKS_encrypt_to_storage(
|
||||
char *src, size_t srcLength,
|
||||
struct luks_phdr *hdr,
|
||||
struct volume_key *vk,
|
||||
const char *device,
|
||||
unsigned int sector,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
@@ -184,6 +170,7 @@ int LUKS_decrypt_from_storage(
|
||||
char *dst, size_t dstLength,
|
||||
struct luks_phdr *hdr,
|
||||
struct volume_key *vk,
|
||||
const char *device,
|
||||
unsigned int sector,
|
||||
struct crypt_device *ctx);
|
||||
|
||||
|
||||
@@ -1,11 +1,10 @@
|
||||
/*
|
||||
* Implementation of Password-Based Cryptography as per PKCS#5
|
||||
/* Implementation of Password-Based Cryptography as per PKCS#5
|
||||
* Copyright (C) 2002,2003 Simon Josefsson
|
||||
* Copyright (C) 2004 Free Software Foundation
|
||||
*
|
||||
* LUKS code
|
||||
* Copyright (C) 2004, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This file is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
@@ -19,7 +18,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this file; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*
|
||||
*/
|
||||
|
||||
|
||||
@@ -1,28 +1,3 @@
|
||||
/*
|
||||
* Implementation of Password-Based Cryptography as per PKCS#5
|
||||
* Copyright (C) 2002,2003 Simon Josefsson
|
||||
* Copyright (C) 2004 Free Software Foundation
|
||||
*
|
||||
* LUKS code
|
||||
* Copyright (C) 2004, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This file is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 2.1 of the License, or (at your option) any later version.
|
||||
*
|
||||
* This file is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this file; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
*/
|
||||
|
||||
#ifndef INCLUDED_CRYPTSETUP_LUKS_PBKDF_H
|
||||
#define INCLUDED_CRYPTSETUP_LUKS_PBKDF_H
|
||||
|
||||
|
||||
@@ -31,4 +31,4 @@
|
||||
( (Count) == 1 ? (Singular) : (Plural) )
|
||||
#endif
|
||||
|
||||
#endif /* CRYPTSETUP_NLS_H */
|
||||
#endif /* CRYPTSETUP_H */
|
||||
|
||||
14
lib/random.c
14
lib/random.c
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* cryptsetup kernel RNG access functions
|
||||
*
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
@@ -176,17 +176,7 @@ int crypt_random_get(struct crypt_device *ctx, char *buf, size_t len, int qualit
|
||||
case CRYPT_RND_NORMAL:
|
||||
status = _get_urandom(ctx, buf, len);
|
||||
break;
|
||||
case CRYPT_RND_SALT:
|
||||
if (crypt_fips_mode())
|
||||
status = crypt_backend_rng(buf, len, quality, 1);
|
||||
else
|
||||
status = _get_urandom(ctx, buf, len);
|
||||
break;
|
||||
case CRYPT_RND_KEY:
|
||||
if (crypt_fips_mode()) {
|
||||
status = crypt_backend_rng(buf, len, quality, 1);
|
||||
break;
|
||||
}
|
||||
rng_type = ctx ? crypt_get_rng_type(ctx) :
|
||||
crypt_random_default_key_rng();
|
||||
switch (rng_type) {
|
||||
|
||||
992
lib/setup.c
992
lib/setup.c
File diff suppressed because it is too large
Load Diff
317
lib/utils.c
317
lib/utils.c
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -16,23 +16,28 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <stddef.h>
|
||||
#include <stdarg.h>
|
||||
#include <errno.h>
|
||||
#include <linux/fs.h>
|
||||
#include <sys/types.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <fcntl.h>
|
||||
#include <sys/mman.h>
|
||||
#include <sys/resource.h>
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
#include "internal.h"
|
||||
|
||||
unsigned crypt_getpagesize(void)
|
||||
{
|
||||
return (unsigned)sysconf(_SC_PAGESIZE);
|
||||
}
|
||||
|
||||
static int get_alignment(int fd)
|
||||
{
|
||||
int alignment = DEFAULT_MEM_ALIGNMENT;
|
||||
@@ -64,15 +69,52 @@ static void *aligned_malloc(void **base, int size, int alignment)
|
||||
#endif
|
||||
}
|
||||
|
||||
ssize_t write_blockwise(int fd, int bsize, void *orig_buf, size_t count)
|
||||
int device_read_ahead(const char *dev, uint32_t *read_ahead)
|
||||
{
|
||||
int fd, r = 0;
|
||||
long read_ahead_long;
|
||||
|
||||
if ((fd = open(dev, O_RDONLY)) < 0)
|
||||
return 0;
|
||||
|
||||
r = ioctl(fd, BLKRAGET, &read_ahead_long) ? 0 : 1;
|
||||
close(fd);
|
||||
|
||||
if (r)
|
||||
*read_ahead = (uint32_t) read_ahead_long;
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
static int sector_size(int fd)
|
||||
{
|
||||
int bsize;
|
||||
if (ioctl(fd,BLKSSZGET, &bsize) < 0)
|
||||
return -EINVAL;
|
||||
else
|
||||
return bsize;
|
||||
}
|
||||
|
||||
int sector_size_for_device(const char *device)
|
||||
{
|
||||
int fd = open(device, O_RDONLY);
|
||||
int r;
|
||||
if(fd < 0)
|
||||
return -EINVAL;
|
||||
r = sector_size(fd);
|
||||
close(fd);
|
||||
return r;
|
||||
}
|
||||
|
||||
ssize_t write_blockwise(int fd, void *orig_buf, size_t count)
|
||||
{
|
||||
void *hangover_buf, *hangover_buf_base = NULL;
|
||||
void *buf, *buf_base = NULL;
|
||||
int r, hangover, solid, alignment;
|
||||
int r, hangover, solid, bsize, alignment;
|
||||
ssize_t ret = -1;
|
||||
|
||||
if (fd == -1 || !orig_buf || bsize <= 0)
|
||||
return -1;
|
||||
if ((bsize = sector_size(fd)) < 0)
|
||||
return bsize;
|
||||
|
||||
hangover = count % bsize;
|
||||
solid = count - hangover;
|
||||
@@ -116,14 +158,14 @@ out:
|
||||
return ret;
|
||||
}
|
||||
|
||||
ssize_t read_blockwise(int fd, int bsize, void *orig_buf, size_t count) {
|
||||
ssize_t read_blockwise(int fd, void *orig_buf, size_t count) {
|
||||
void *hangover_buf, *hangover_buf_base = NULL;
|
||||
void *buf, *buf_base = NULL;
|
||||
int r, hangover, solid, alignment;
|
||||
int r, hangover, solid, bsize, alignment;
|
||||
ssize_t ret = -1;
|
||||
|
||||
if (fd == -1 || !orig_buf || bsize <= 0)
|
||||
return -1;
|
||||
if ((bsize = sector_size(fd)) < 0)
|
||||
return bsize;
|
||||
|
||||
hangover = count % bsize;
|
||||
solid = count - hangover;
|
||||
@@ -166,15 +208,15 @@ out:
|
||||
* is implicitly included in the read/write offset, which can not be set to non-aligned
|
||||
* boundaries. Hence, we combine llseek with write.
|
||||
*/
|
||||
ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t offset) {
|
||||
ssize_t write_lseek_blockwise(int fd, char *buf, size_t count, off_t offset) {
|
||||
char *frontPadBuf;
|
||||
void *frontPadBuf_base = NULL;
|
||||
int r, frontHang;
|
||||
int r, bsize, frontHang;
|
||||
size_t innerCount = 0;
|
||||
ssize_t ret = -1;
|
||||
|
||||
if (fd == -1 || !buf || bsize <= 0)
|
||||
return -1;
|
||||
if ((bsize = sector_size(fd)) < 0)
|
||||
return bsize;
|
||||
|
||||
frontHang = offset % bsize;
|
||||
|
||||
@@ -208,7 +250,7 @@ ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t
|
||||
count -= innerCount;
|
||||
}
|
||||
|
||||
ret = count ? write_blockwise(fd, bsize, buf, count) : 0;
|
||||
ret = count ? write_blockwise(fd, buf, count) : 0;
|
||||
if (ret >= 0)
|
||||
ret += innerCount;
|
||||
out:
|
||||
@@ -217,6 +259,182 @@ out:
|
||||
return ret;
|
||||
}
|
||||
|
||||
int device_ready(struct crypt_device *cd, const char *device, int mode)
|
||||
{
|
||||
int devfd, r = 0;
|
||||
ssize_t s;
|
||||
struct stat st;
|
||||
char buf[512];
|
||||
|
||||
if(stat(device, &st) < 0) {
|
||||
log_err(cd, _("Device %s doesn't exist or access denied.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!S_ISBLK(st.st_mode))
|
||||
return -ENOTBLK;
|
||||
|
||||
log_dbg("Trying to open and read device %s.", device);
|
||||
devfd = open(device, mode | O_DIRECT | O_SYNC);
|
||||
if(devfd < 0) {
|
||||
log_err(cd, _("Cannot open device %s for %s%s access.\n"), device,
|
||||
(mode & O_EXCL) ? _("exclusive ") : "",
|
||||
(mode & O_RDWR) ? _("writable") : _("read-only"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
/* Try to read first sector */
|
||||
s = read_blockwise(devfd, buf, sizeof(buf));
|
||||
if (s < 0 || s != sizeof(buf)) {
|
||||
log_verbose(cd, _("Cannot read device %s.\n"), device);
|
||||
r = -EIO;
|
||||
}
|
||||
|
||||
memset(buf, 0, sizeof(buf));
|
||||
close(devfd);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
int device_size(const char *device, uint64_t *size)
|
||||
{
|
||||
int devfd, r = 0;
|
||||
|
||||
devfd = open(device, O_RDONLY);
|
||||
if(devfd == -1)
|
||||
return -EINVAL;
|
||||
|
||||
if (ioctl(devfd, BLKGETSIZE64, size) < 0)
|
||||
r = -EINVAL;
|
||||
|
||||
close(devfd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int get_device_infos(const char *device, enum devcheck device_check,
|
||||
int *readonly, uint64_t *size)
|
||||
{
|
||||
struct stat st;
|
||||
unsigned long size_small;
|
||||
int fd, r = -1;
|
||||
int flags = 0;
|
||||
|
||||
*readonly = 0;
|
||||
*size = 0;
|
||||
|
||||
if (stat(device, &st) < 0)
|
||||
return -EINVAL;
|
||||
|
||||
/* never wipe header on mounted device */
|
||||
if (device_check == DEV_EXCL && S_ISBLK(st.st_mode))
|
||||
flags |= O_EXCL;
|
||||
|
||||
/* Try to open read-write to check whether it is a read-only device */
|
||||
fd = open(device, O_RDWR | flags);
|
||||
if (fd == -1 && errno == EROFS) {
|
||||
*readonly = 1;
|
||||
fd = open(device, O_RDONLY | flags);
|
||||
}
|
||||
|
||||
if (fd == -1 && device_check == DEV_EXCL && errno == EBUSY)
|
||||
return -EBUSY;
|
||||
|
||||
if (fd == -1)
|
||||
return -EINVAL;
|
||||
|
||||
/* If the device can be opened read-write, i.e. readonly is still 0, then
|
||||
* check whether BKROGET says that it is read-only. E.g. read-only loop
|
||||
* devices may be openend read-write but are read-only according to BLKROGET
|
||||
*/
|
||||
if (*readonly == 0 && (r = ioctl(fd, BLKROGET, readonly)) < 0)
|
||||
goto out;
|
||||
|
||||
if (ioctl(fd, BLKGETSIZE64, size) >= 0) {
|
||||
*size >>= SECTOR_SHIFT;
|
||||
r = 0;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (ioctl(fd, BLKGETSIZE, &size_small) >= 0) {
|
||||
*size = (uint64_t)size_small;
|
||||
r = 0;
|
||||
goto out;
|
||||
}
|
||||
|
||||
r = -EINVAL;
|
||||
out:
|
||||
close(fd);
|
||||
return r;
|
||||
}
|
||||
|
||||
int device_check_and_adjust(struct crypt_device *cd,
|
||||
const char *device,
|
||||
enum devcheck device_check,
|
||||
uint64_t *size,
|
||||
uint64_t *offset,
|
||||
uint32_t *flags)
|
||||
{
|
||||
int r, real_readonly;
|
||||
uint64_t real_size;
|
||||
|
||||
if (!device)
|
||||
return -ENOTBLK;
|
||||
|
||||
r = get_device_infos(device, device_check, &real_readonly, &real_size);
|
||||
if (r < 0) {
|
||||
if (r == -EBUSY)
|
||||
log_err(cd, _("Cannot use device %s which is in use "
|
||||
"(already mapped or mounted).\n"),
|
||||
device);
|
||||
else
|
||||
log_err(cd, _("Cannot get info about device %s.\n"),
|
||||
device);
|
||||
return r;
|
||||
}
|
||||
|
||||
if (*offset >= real_size) {
|
||||
log_err(cd, _("Requested offset is beyond real size of device %s.\n"),
|
||||
device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!*size) {
|
||||
*size = real_size;
|
||||
if (!*size) {
|
||||
log_err(cd, _("Device %s has zero size.\n"), device);
|
||||
return -ENOTBLK;
|
||||
}
|
||||
*size -= *offset;
|
||||
}
|
||||
|
||||
/* in case of size is set by parameter */
|
||||
if ((real_size - *offset) < *size) {
|
||||
log_dbg("Device %s: offset = %" PRIu64 " requested size = %" PRIu64
|
||||
", backing device size = %" PRIu64,
|
||||
device, *offset, *size, real_size);
|
||||
log_err(cd, _("Device %s is too small.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (device_check == DEV_SHARED) {
|
||||
log_dbg("Checking crypt segments for device %s.", device);
|
||||
r = crypt_sysfs_check_crypt_segment(device, *offset, *size);
|
||||
if (r < 0) {
|
||||
log_err(cd, _("Cannot use device %s (crypt segments "
|
||||
"overlaps or in use by another device).\n"),
|
||||
device);
|
||||
return r;
|
||||
}
|
||||
}
|
||||
|
||||
if (real_readonly)
|
||||
*flags |= CRYPT_ACTIVATE_READONLY;
|
||||
|
||||
log_dbg("Calculated device size is %" PRIu64 " sectors (%s), offset %" PRIu64 ".",
|
||||
*size, real_readonly ? "RO" : "RW", *offset);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* MEMLOCK */
|
||||
#define DEFAULT_PROCESS_PRIORITY -18
|
||||
|
||||
@@ -229,7 +447,7 @@ int crypt_memlock_inc(struct crypt_device *ctx)
|
||||
if (!_memlock_count++) {
|
||||
log_dbg("Locking memory.");
|
||||
if (mlockall(MCL_CURRENT | MCL_FUTURE) == -1) {
|
||||
log_dbg("Cannot lock memory with mlockall.");
|
||||
log_err(ctx, _("WARNING!!! Possibly insecure memory. Are you root?\n"));
|
||||
_memlock_count--;
|
||||
return 0;
|
||||
}
|
||||
@@ -255,3 +473,60 @@ int crypt_memlock_dec(struct crypt_device *ctx)
|
||||
}
|
||||
return _memlock_count ? 1 : 0;
|
||||
}
|
||||
|
||||
/* DEVICE TOPOLOGY */
|
||||
|
||||
/* block device topology ioctls, introduced in 2.6.32 */
|
||||
#ifndef BLKIOMIN
|
||||
#define BLKIOMIN _IO(0x12,120)
|
||||
#define BLKIOOPT _IO(0x12,121)
|
||||
#define BLKALIGNOFF _IO(0x12,122)
|
||||
#endif
|
||||
|
||||
void get_topology_alignment(const char *device,
|
||||
unsigned long *required_alignment, /* bytes */
|
||||
unsigned long *alignment_offset, /* bytes */
|
||||
unsigned long default_alignment)
|
||||
{
|
||||
int dev_alignment_offset = 0;
|
||||
unsigned int min_io_size = 0, opt_io_size = 0;
|
||||
unsigned long temp_alignment = 0;
|
||||
int fd;
|
||||
|
||||
*required_alignment = default_alignment;
|
||||
*alignment_offset = 0;
|
||||
|
||||
fd = open(device, O_RDONLY);
|
||||
if (fd == -1)
|
||||
return;
|
||||
|
||||
/* minimum io size */
|
||||
if (ioctl(fd, BLKIOMIN, &min_io_size) == -1) {
|
||||
log_dbg("Topology info for %s not supported, using default offset %lu bytes.",
|
||||
device, default_alignment);
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* optimal io size */
|
||||
if (ioctl(fd, BLKIOOPT, &opt_io_size) == -1)
|
||||
opt_io_size = min_io_size;
|
||||
|
||||
/* alignment offset, bogus -1 means misaligned/unknown */
|
||||
if (ioctl(fd, BLKALIGNOFF, &dev_alignment_offset) == -1 || dev_alignment_offset < 0)
|
||||
dev_alignment_offset = 0;
|
||||
*alignment_offset = (unsigned long)dev_alignment_offset;
|
||||
|
||||
temp_alignment = (unsigned long)min_io_size;
|
||||
|
||||
if (temp_alignment < (unsigned long)opt_io_size)
|
||||
temp_alignment = (unsigned long)opt_io_size;
|
||||
|
||||
/* If calculated alignment is multiple of default, keep default */
|
||||
if (temp_alignment && (default_alignment % temp_alignment))
|
||||
*required_alignment = temp_alignment;
|
||||
|
||||
log_dbg("Topology: IO (%u/%u), offset = %lu; Required alignment is %lu bytes.",
|
||||
min_io_size, opt_io_size, *alignment_offset, *required_alignment);
|
||||
out:
|
||||
(void)close(fd);
|
||||
}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
/*
|
||||
* utils_crypt - cipher utilities for cryptsetup
|
||||
* util_crypt - cipher utilities for cryptsetup
|
||||
*
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -15,7 +15,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
@@ -23,8 +23,6 @@
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
#include <ctype.h>
|
||||
#include <limits.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <unistd.h>
|
||||
@@ -60,15 +58,6 @@ int crypt_parse_name_and_mode(const char *s, char *cipher, int *key_nums,
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Short version for "empty" cipher */
|
||||
if (!strcmp(s, "null")) {
|
||||
strncpy(cipher, "cipher_null", MAX_CIPHER_LEN);
|
||||
strncpy(cipher_mode, "ecb", 9);
|
||||
if (key_nums)
|
||||
*key_nums = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (sscanf(s, "%" MAX_CIPHER_LEN_STR "[^-]", cipher) == 1) {
|
||||
strncpy(cipher_mode, "cbc-plain", 10);
|
||||
if (key_nums)
|
||||
@@ -92,9 +81,7 @@ void *crypt_safe_alloc(size_t size)
|
||||
return NULL;
|
||||
|
||||
alloc->size = size;
|
||||
memset(&alloc->data, 0, size);
|
||||
|
||||
/* coverity[leaked_storage] */
|
||||
return &alloc->data;
|
||||
}
|
||||
|
||||
@@ -263,49 +250,6 @@ out_err:
|
||||
return r;
|
||||
}
|
||||
|
||||
/*
|
||||
* A simple call to lseek(3) might not be possible for some inputs (e.g.
|
||||
* reading from a pipe), so this function instead reads of up to BUFSIZ bytes
|
||||
* at a time until the specified number of bytes. It returns -1 on read error
|
||||
* or when it reaches EOF before the requested number of bytes have been
|
||||
* discarded.
|
||||
*/
|
||||
static int keyfile_seek(int fd, size_t bytes)
|
||||
{
|
||||
char tmp[BUFSIZ];
|
||||
size_t next_read;
|
||||
ssize_t bytes_r;
|
||||
off_t r;
|
||||
|
||||
r = lseek(fd, bytes, SEEK_CUR);
|
||||
if (r > 0)
|
||||
return 0;
|
||||
if (r < 0 && errno != ESPIPE)
|
||||
return -1;
|
||||
|
||||
while (bytes > 0) {
|
||||
/* figure out how much to read */
|
||||
next_read = bytes > sizeof(tmp) ? sizeof(tmp) : bytes;
|
||||
|
||||
bytes_r = read(fd, tmp, next_read);
|
||||
if (bytes_r < 0) {
|
||||
if (errno == EINTR)
|
||||
continue;
|
||||
|
||||
/* read error */
|
||||
return -1;
|
||||
}
|
||||
|
||||
if (bytes_r == 0)
|
||||
/* EOF */
|
||||
break;
|
||||
|
||||
bytes -= bytes_r;
|
||||
}
|
||||
|
||||
return bytes == 0 ? 0 : -1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Note: --key-file=- is interpreted as a read from a binary file (stdin)
|
||||
* key_size_max == 0 means detect maximum according to input type (tty/file)
|
||||
@@ -313,14 +257,14 @@ static int keyfile_seek(int fd, size_t bytes)
|
||||
*/
|
||||
int crypt_get_key(const char *prompt,
|
||||
char **key, size_t *key_size,
|
||||
size_t keyfile_offset, size_t keyfile_size_max,
|
||||
const char *key_file, int timeout, int verify,
|
||||
size_t keyfile_size_max, const char *key_file,
|
||||
int timeout, int verify,
|
||||
struct crypt_device *cd)
|
||||
{
|
||||
int fd, regular_file, read_stdin, char_read, unlimited_read = 0;
|
||||
int r = -EINVAL;
|
||||
char *pass = NULL;
|
||||
size_t buflen, i, file_read_size;
|
||||
size_t buflen, i;
|
||||
struct stat st;
|
||||
|
||||
*key = NULL;
|
||||
@@ -329,13 +273,8 @@ int crypt_get_key(const char *prompt,
|
||||
/* Passphrase read from stdin? */
|
||||
read_stdin = (!key_file || !strcmp(key_file, "-")) ? 1 : 0;
|
||||
|
||||
if (read_stdin && isatty(STDIN_FILENO)) {
|
||||
if (keyfile_offset) {
|
||||
log_err(cd, _("Cannot use offset with terminal input.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
if(read_stdin && isatty(STDIN_FILENO))
|
||||
return crypt_get_key_tty(prompt, key, key_size, timeout, verify, cd);
|
||||
}
|
||||
|
||||
if (read_stdin)
|
||||
log_dbg("STDIN descriptor passphrase entry requested.");
|
||||
@@ -364,19 +303,11 @@ int crypt_get_key(const char *prompt,
|
||||
}
|
||||
if(S_ISREG(st.st_mode)) {
|
||||
regular_file = 1;
|
||||
file_read_size = (size_t)st.st_size;
|
||||
|
||||
if (keyfile_offset > file_read_size) {
|
||||
log_err(cd, _("Cannot seek to requested keyfile offset.\n"));
|
||||
goto out_err;
|
||||
}
|
||||
file_read_size -= keyfile_offset;
|
||||
|
||||
/* known keyfile size, alloc it in one step */
|
||||
if (file_read_size >= keyfile_size_max)
|
||||
if ((size_t)st.st_size >= keyfile_size_max)
|
||||
buflen = keyfile_size_max;
|
||||
else if (file_read_size)
|
||||
buflen = file_read_size;
|
||||
else
|
||||
buflen = st.st_size;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -386,12 +317,6 @@ int crypt_get_key(const char *prompt,
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
/* Discard keyfile_offset bytes on input */
|
||||
if (keyfile_offset && keyfile_seek(fd, keyfile_offset) < 0) {
|
||||
log_err(cd, _("Cannot seek to requested keyfile offset.\n"));
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
for(i = 0; i < keyfile_size_max; i++) {
|
||||
if(i == buflen) {
|
||||
buflen += 4096;
|
||||
@@ -423,7 +348,7 @@ int crypt_get_key(const char *prompt,
|
||||
|
||||
/* Fail if we exceeded internal default (no specified size) */
|
||||
if (unlimited_read && i == keyfile_size_max) {
|
||||
log_err(cd, _("Maximum keyfile size exceeded.\n"));
|
||||
log_err(cd, _("Maximum keyfile size exceeeded.\n"));
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
@@ -432,6 +357,12 @@ int crypt_get_key(const char *prompt,
|
||||
goto out_err;
|
||||
}
|
||||
|
||||
/* Well, for historical reasons reading empty keyfile is not fail. */
|
||||
if(!i) {
|
||||
crypt_safe_free(pass);
|
||||
pass = NULL;
|
||||
}
|
||||
|
||||
*key = pass;
|
||||
*key_size = i;
|
||||
r = 0;
|
||||
@@ -443,94 +374,3 @@ out_err:
|
||||
crypt_safe_free(pass);
|
||||
return r;
|
||||
}
|
||||
|
||||
ssize_t crypt_hex_to_bytes(const char *hex, char **result, int safe_alloc)
|
||||
{
|
||||
char buf[3] = "xx\0", *endp, *bytes;
|
||||
size_t i, len;
|
||||
|
||||
len = strlen(hex);
|
||||
if (len % 2)
|
||||
return -EINVAL;
|
||||
len /= 2;
|
||||
|
||||
bytes = safe_alloc ? crypt_safe_alloc(len) : malloc(len);
|
||||
if (!bytes)
|
||||
return -ENOMEM;
|
||||
|
||||
for (i = 0; i < len; i++) {
|
||||
memcpy(buf, &hex[i * 2], 2);
|
||||
bytes[i] = strtoul(buf, &endp, 16);
|
||||
if (endp != &buf[2]) {
|
||||
safe_alloc ? crypt_safe_free(bytes) : free(bytes);
|
||||
return -EINVAL;
|
||||
}
|
||||
}
|
||||
*result = bytes;
|
||||
return i;
|
||||
}
|
||||
|
||||
/*
|
||||
* Device size string parsing, suffixes:
|
||||
* s|S - 512 bytes sectors
|
||||
* k |K |m |M |g |G |t |T - 1024 base
|
||||
* kiB|KiB|miB|MiB|giB|GiB|tiB|TiB - 1024 base
|
||||
* kb |KB |mM |MB |gB |GB |tB |TB - 1000 base
|
||||
*/
|
||||
int crypt_string_to_size(struct crypt_device *cd, const char *s, uint64_t *size)
|
||||
{
|
||||
char *endp = NULL;
|
||||
size_t len;
|
||||
uint64_t mult_base, mult, tmp;
|
||||
|
||||
*size = strtoull(s, &endp, 10);
|
||||
if (!isdigit(s[0]) ||
|
||||
(errno == ERANGE && *size == ULLONG_MAX) ||
|
||||
(errno != 0 && *size == 0))
|
||||
return -EINVAL;
|
||||
|
||||
if (!endp || !*endp)
|
||||
return 0;
|
||||
|
||||
len = strlen(endp);
|
||||
/* Allow "B" and "iB" suffixes */
|
||||
if (len > 3 ||
|
||||
(len == 3 && (endp[1] != 'i' || endp[2] != 'B')) ||
|
||||
(len == 2 && endp[1] != 'B'))
|
||||
return -EINVAL;
|
||||
|
||||
if (len == 1 || len == 3)
|
||||
mult_base = 1024;
|
||||
else
|
||||
mult_base = 1000;
|
||||
|
||||
mult = 1;
|
||||
switch (endp[0]) {
|
||||
case 's':
|
||||
case 'S': mult = 512;
|
||||
break;
|
||||
case 't':
|
||||
case 'T': mult *= mult_base;
|
||||
/* Fall through */
|
||||
case 'g':
|
||||
case 'G': mult *= mult_base;
|
||||
/* Fall through */
|
||||
case 'm':
|
||||
case 'M': mult *= mult_base;
|
||||
/* Fall through */
|
||||
case 'k':
|
||||
case 'K': mult *= mult_base;
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
tmp = *size * mult;
|
||||
if ((tmp / *size) != mult) {
|
||||
log_dbg("Device size overflow.");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
*size = tmp;
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -1,23 +1,3 @@
|
||||
/*
|
||||
* utils_crypt - cipher utilities for cryptsetup
|
||||
*
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _UTILS_CRYPT_H
|
||||
#define _UTILS_CRYPT_H
|
||||
|
||||
@@ -34,7 +14,7 @@ int crypt_parse_name_and_mode(const char *s, char *cipher,
|
||||
|
||||
int crypt_get_key(const char *prompt,
|
||||
char **key, size_t *key_size,
|
||||
size_t keyfile_offset, size_t keyfile_size_max,
|
||||
size_t keyfile_size_max,
|
||||
const char *key_file,
|
||||
int timeout, int verify,
|
||||
struct crypt_device *cd);
|
||||
@@ -43,7 +23,4 @@ void *crypt_safe_alloc(size_t size);
|
||||
void crypt_safe_free(void *data);
|
||||
void *crypt_safe_realloc(void *data, size_t size);
|
||||
|
||||
ssize_t crypt_hex_to_bytes(const char *hex, char **result, int safe_alloc);
|
||||
int crypt_string_to_size(struct crypt_device *cd, const char *s, uint64_t *size);
|
||||
|
||||
#endif /* _UTILS_CRYPT_H */
|
||||
|
||||
146
lib/utils_debug.c
Normal file
146
lib/utils_debug.c
Normal file
@@ -0,0 +1,146 @@
|
||||
/*
|
||||
* Temporary debug code to find processes locking internal cryptsetup devices.
|
||||
* This code is intended to run only in debug mode.
|
||||
*
|
||||
* inspired by psmisc/fuser proc scanning code
|
||||
*
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <dirent.h>
|
||||
#include <fcntl.h>
|
||||
#include <unistd.h>
|
||||
#include <string.h>
|
||||
#include "libcryptsetup.h"
|
||||
#include "internal.h"
|
||||
|
||||
#define MAX_PATHNAME 1024
|
||||
#define MAX_SHORTNAME 64
|
||||
|
||||
static int numeric_name(const char *name)
|
||||
{
|
||||
return (name[0] < '0' || name[0] > '9') ? 0 : 1;
|
||||
}
|
||||
|
||||
static int check_pid(const pid_t pid, const char *dev_name, const char *short_dev_name)
|
||||
{
|
||||
char dirpath[MAX_SHORTNAME], fdpath[MAX_SHORTNAME], linkpath[MAX_PATHNAME];
|
||||
DIR *dirp;
|
||||
struct dirent *direntry;
|
||||
ssize_t len;
|
||||
int r = 0;
|
||||
|
||||
snprintf(dirpath, sizeof(dirpath), "/proc/%d/fd", pid);
|
||||
|
||||
if (!(dirp = opendir(dirpath)))
|
||||
return r;
|
||||
|
||||
while ((direntry = readdir(dirp))) {
|
||||
if (!numeric_name(direntry->d_name))
|
||||
continue;
|
||||
|
||||
snprintf(fdpath, sizeof(fdpath), "/proc/%d/fd/%s", pid, direntry->d_name);
|
||||
|
||||
if ((len = readlink(fdpath, linkpath, MAX_PATHNAME-1)) < 0)
|
||||
break;
|
||||
linkpath[len] = '\0';
|
||||
|
||||
if (!strcmp(dev_name, linkpath)) {
|
||||
r = 1;
|
||||
break;
|
||||
}
|
||||
|
||||
if (!strcmp(short_dev_name, linkpath)) {
|
||||
r = 2;
|
||||
break;
|
||||
}
|
||||
}
|
||||
closedir(dirp);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int read_proc_info(const pid_t pid, pid_t *ppid, char *name, int max_size)
|
||||
{
|
||||
char path[MAX_SHORTNAME], info[max_size], c;
|
||||
int fd, xpid, r = 0;
|
||||
|
||||
snprintf(path, sizeof(path), "/proc/%u/stat", pid);
|
||||
if ((fd = open(path, O_RDONLY)) < 0)
|
||||
return 0;
|
||||
|
||||
if (read(fd, info, max_size) > 0 &&
|
||||
sscanf(info, "%d %s %c %d", &xpid, name, &c, ppid) == 4)
|
||||
r = 1;
|
||||
|
||||
if (!r) {
|
||||
*ppid = 0;
|
||||
name[0] = '\0';
|
||||
}
|
||||
close(fd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static void report_proc(const pid_t pid, const char *dev_name)
|
||||
{
|
||||
char name[MAX_PATHNAME], name2[MAX_PATHNAME];
|
||||
pid_t ppid, ppid2;
|
||||
|
||||
if (read_proc_info(pid, &ppid, name, MAX_PATHNAME) &&
|
||||
read_proc_info(ppid, &ppid2, name2, MAX_PATHNAME))
|
||||
log_dbg("WARNING: Process PID %u %s [PPID %u %s] spying on internal device %s.",
|
||||
pid, name, ppid, name2, dev_name);
|
||||
}
|
||||
|
||||
void debug_processes_using_device(const char *dm_name)
|
||||
{
|
||||
char short_dev_name[MAX_SHORTNAME], dev_name[MAX_PATHNAME];
|
||||
DIR *proc_dir;
|
||||
struct dirent *proc_dentry;
|
||||
struct stat st;
|
||||
pid_t pid;
|
||||
|
||||
if (crypt_get_debug_level() != CRYPT_LOG_DEBUG)
|
||||
return;
|
||||
|
||||
snprintf(dev_name, sizeof(dev_name), "/dev/mapper/%s", dm_name);
|
||||
if (stat(dev_name, &st) || !S_ISBLK(st.st_mode))
|
||||
return;
|
||||
snprintf(short_dev_name, sizeof(short_dev_name), "/dev/dm-%u", minor(st.st_rdev));
|
||||
|
||||
if (!(proc_dir = opendir("/proc")))
|
||||
return;
|
||||
|
||||
while ((proc_dentry = readdir(proc_dir))) {
|
||||
if (!numeric_name(proc_dentry->d_name))
|
||||
continue;
|
||||
|
||||
pid = atoi(proc_dentry->d_name);
|
||||
switch(check_pid(pid, dev_name, short_dev_name)) {
|
||||
case 1: report_proc(pid, dev_name);
|
||||
break;
|
||||
case 2: report_proc(pid, short_dev_name);
|
||||
default:
|
||||
break;
|
||||
}
|
||||
}
|
||||
closedir(proc_dir);
|
||||
}
|
||||
@@ -1,429 +0,0 @@
|
||||
/*
|
||||
* device backend utilities
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <fcntl.h>
|
||||
#include <errno.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <sys/ioctl.h>
|
||||
#include <linux/fs.h>
|
||||
#include <unistd.h>
|
||||
#include "internal.h"
|
||||
|
||||
struct device {
|
||||
char *path;
|
||||
|
||||
char *file_path;
|
||||
int loop_fd;
|
||||
|
||||
int init_done:1;
|
||||
};
|
||||
|
||||
static int device_ready(const char *device)
|
||||
{
|
||||
int devfd, r = 0;
|
||||
struct stat st;
|
||||
|
||||
if(stat(device, &st) < 0) {
|
||||
log_err(NULL, _("Device %s doesn't exist or access denied.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!S_ISBLK(st.st_mode))
|
||||
return S_ISREG(st.st_mode) ? -ENOTBLK : -EINVAL;
|
||||
|
||||
log_dbg("Trying to open and read device %s.", device);
|
||||
devfd = open(device, O_RDONLY | O_DIRECT | O_SYNC);
|
||||
if(devfd < 0) {
|
||||
log_err(NULL, _("Cannot open device %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
close(devfd);
|
||||
return r;
|
||||
}
|
||||
|
||||
int device_alloc(struct device **device, const char *path)
|
||||
{
|
||||
struct device *dev;
|
||||
int r;
|
||||
|
||||
if (!path) {
|
||||
*device = NULL;
|
||||
return 0;
|
||||
}
|
||||
|
||||
dev = malloc(sizeof(struct device));
|
||||
if (!dev)
|
||||
return -ENOMEM;
|
||||
|
||||
memset(dev, 0, sizeof(struct device));
|
||||
dev->loop_fd = -1;
|
||||
|
||||
r = device_ready(path);
|
||||
if (!r) {
|
||||
dev->init_done = 1;
|
||||
} else if (r == -ENOTBLK) {
|
||||
/* alloc loop later */
|
||||
} else if (r < 0) {
|
||||
free(dev);
|
||||
return -ENOTBLK;
|
||||
}
|
||||
|
||||
dev->path = strdup(path);
|
||||
if (!dev->path) {
|
||||
free(dev);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
*device = dev;
|
||||
return 0;
|
||||
}
|
||||
|
||||
void device_free(struct device *device)
|
||||
{
|
||||
if (!device)
|
||||
return;
|
||||
|
||||
if (device->loop_fd != -1) {
|
||||
log_dbg("Closed loop %s (%s).", device->path, device->file_path);
|
||||
close(device->loop_fd);
|
||||
}
|
||||
|
||||
free(device->file_path);
|
||||
free(device->path);
|
||||
free(device);
|
||||
}
|
||||
|
||||
/* Get block device path */
|
||||
const char *device_block_path(const struct device *device)
|
||||
{
|
||||
if (!device || !device->init_done)
|
||||
return NULL;
|
||||
|
||||
return device->path;
|
||||
}
|
||||
|
||||
/* Get path to device / file */
|
||||
const char *device_path(const struct device *device)
|
||||
{
|
||||
if (!device)
|
||||
return NULL;
|
||||
|
||||
if (device->file_path)
|
||||
return device->file_path;
|
||||
|
||||
return device->path;
|
||||
}
|
||||
|
||||
/* block device topology ioctls, introduced in 2.6.32 */
|
||||
#ifndef BLKIOMIN
|
||||
#define BLKIOMIN _IO(0x12,120)
|
||||
#define BLKIOOPT _IO(0x12,121)
|
||||
#define BLKALIGNOFF _IO(0x12,122)
|
||||
#endif
|
||||
|
||||
void device_topology_alignment(struct device *device,
|
||||
unsigned long *required_alignment, /* bytes */
|
||||
unsigned long *alignment_offset, /* bytes */
|
||||
unsigned long default_alignment)
|
||||
{
|
||||
int dev_alignment_offset = 0;
|
||||
unsigned int min_io_size = 0, opt_io_size = 0;
|
||||
unsigned long temp_alignment = 0;
|
||||
int fd;
|
||||
|
||||
*required_alignment = default_alignment;
|
||||
*alignment_offset = 0;
|
||||
|
||||
if (!device || !device->path) //FIXME
|
||||
return;
|
||||
|
||||
fd = open(device->path, O_RDONLY);
|
||||
if (fd == -1)
|
||||
return;
|
||||
|
||||
/* minimum io size */
|
||||
if (ioctl(fd, BLKIOMIN, &min_io_size) == -1) {
|
||||
log_dbg("Topology info for %s not supported, using default offset %lu bytes.",
|
||||
device->path, default_alignment);
|
||||
goto out;
|
||||
}
|
||||
|
||||
/* optimal io size */
|
||||
if (ioctl(fd, BLKIOOPT, &opt_io_size) == -1)
|
||||
opt_io_size = min_io_size;
|
||||
|
||||
/* alignment offset, bogus -1 means misaligned/unknown */
|
||||
if (ioctl(fd, BLKALIGNOFF, &dev_alignment_offset) == -1 || dev_alignment_offset < 0)
|
||||
dev_alignment_offset = 0;
|
||||
*alignment_offset = (unsigned long)dev_alignment_offset;
|
||||
|
||||
temp_alignment = (unsigned long)min_io_size;
|
||||
|
||||
if (temp_alignment < (unsigned long)opt_io_size)
|
||||
temp_alignment = (unsigned long)opt_io_size;
|
||||
|
||||
/* If calculated alignment is multiple of default, keep default */
|
||||
if (temp_alignment && (default_alignment % temp_alignment))
|
||||
*required_alignment = temp_alignment;
|
||||
|
||||
log_dbg("Topology: IO (%u/%u), offset = %lu; Required alignment is %lu bytes.",
|
||||
min_io_size, opt_io_size, *alignment_offset, *required_alignment);
|
||||
out:
|
||||
(void)close(fd);
|
||||
}
|
||||
|
||||
int device_block_size(struct device *device)
|
||||
{
|
||||
struct stat st;
|
||||
int fd, bsize = 0, r = -EINVAL;
|
||||
|
||||
if (!device)
|
||||
return 0;
|
||||
|
||||
fd = open(device->path, O_RDONLY);
|
||||
if(fd < 0)
|
||||
return -EINVAL;
|
||||
|
||||
if (fstat(fd, &st) < 0)
|
||||
goto out;
|
||||
|
||||
if (S_ISREG(st.st_mode)) {
|
||||
r = (int)crypt_getpagesize();
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (ioctl(fd, BLKSSZGET, &bsize) >= 0)
|
||||
r = bsize;
|
||||
out:
|
||||
close(fd);
|
||||
return r;
|
||||
}
|
||||
|
||||
int device_read_ahead(struct device *device, uint32_t *read_ahead)
|
||||
{
|
||||
int fd, r = 0;
|
||||
long read_ahead_long;
|
||||
|
||||
if (!device)
|
||||
return 0;
|
||||
|
||||
if ((fd = open(device->path, O_RDONLY)) < 0)
|
||||
return 0;
|
||||
|
||||
r = ioctl(fd, BLKRAGET, &read_ahead_long) ? 0 : 1;
|
||||
close(fd);
|
||||
|
||||
if (r)
|
||||
*read_ahead = (uint32_t) read_ahead_long;
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
/* Get data size in bytes */
|
||||
int device_size(struct device *device, uint64_t *size)
|
||||
{
|
||||
struct stat st;
|
||||
int devfd, r = -EINVAL;
|
||||
|
||||
devfd = open(device->path, O_RDONLY);
|
||||
if(devfd == -1)
|
||||
return -EINVAL;
|
||||
|
||||
if (fstat(devfd, &st) < 0)
|
||||
goto out;
|
||||
|
||||
if (S_ISREG(st.st_mode)) {
|
||||
*size = (uint64_t)st.st_size;
|
||||
r = 0;
|
||||
} else if (ioctl(devfd, BLKGETSIZE64, size) >= 0)
|
||||
r = 0;
|
||||
out:
|
||||
close(devfd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int device_info(struct device *device,
|
||||
enum devcheck device_check,
|
||||
int *readonly, uint64_t *size)
|
||||
{
|
||||
struct stat st;
|
||||
int fd, r = -EINVAL, flags = 0;
|
||||
|
||||
*readonly = 0;
|
||||
*size = 0;
|
||||
|
||||
if (stat(device->path, &st) < 0)
|
||||
return -EINVAL;
|
||||
|
||||
/* never wipe header on mounted device */
|
||||
if (device_check == DEV_EXCL && S_ISBLK(st.st_mode))
|
||||
flags |= O_EXCL;
|
||||
|
||||
/* Try to open read-write to check whether it is a read-only device */
|
||||
fd = open(device->path, O_RDWR | flags);
|
||||
if (fd == -1 && errno == EROFS) {
|
||||
*readonly = 1;
|
||||
fd = open(device->path, O_RDONLY | flags);
|
||||
}
|
||||
|
||||
if (fd == -1 && device_check == DEV_EXCL && errno == EBUSY)
|
||||
return -EBUSY;
|
||||
|
||||
if (fd == -1)
|
||||
return -EINVAL;
|
||||
|
||||
if (S_ISREG(st.st_mode)) {
|
||||
//FIXME: add readonly check
|
||||
*size = (uint64_t)st.st_size;
|
||||
*size >>= SECTOR_SHIFT;
|
||||
} else {
|
||||
/* If the device can be opened read-write, i.e. readonly is still 0, then
|
||||
* check whether BKROGET says that it is read-only. E.g. read-only loop
|
||||
* devices may be openend read-write but are read-only according to BLKROGET
|
||||
*/
|
||||
if (*readonly == 0 && (r = ioctl(fd, BLKROGET, readonly)) < 0)
|
||||
goto out;
|
||||
|
||||
if (ioctl(fd, BLKGETSIZE64, size) >= 0) {
|
||||
*size >>= SECTOR_SHIFT;
|
||||
r = 0;
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
r = -EINVAL;
|
||||
out:
|
||||
close(fd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int device_internal_prepare(struct crypt_device *cd, struct device *device)
|
||||
{
|
||||
char *loop_device;
|
||||
int r, loop_fd, readonly = 0;
|
||||
|
||||
if (device->init_done)
|
||||
return 0;
|
||||
|
||||
log_dbg("Allocating a free loop device.");
|
||||
loop_device = crypt_loop_get_device();
|
||||
if (!loop_device) {
|
||||
if (getuid() || geteuid())
|
||||
log_err(cd, _("Cannot use a loopback device, "
|
||||
"running as non-root user.\n"));
|
||||
else
|
||||
log_err(cd, _("Cannot find a free loopback device.\n"));
|
||||
return -ENOTSUP;
|
||||
}
|
||||
|
||||
/* Keep the loop open, dettached on last close. */
|
||||
loop_fd = crypt_loop_attach(loop_device, device->path, 0, 1, &readonly);
|
||||
if (loop_fd == -1) {
|
||||
log_err(cd, _("Attaching loopback device failed "
|
||||
"(loop device with autoclear flag is required).\n"));
|
||||
free(loop_device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
r = device_ready(loop_device);
|
||||
if (r < 0) {
|
||||
free(loop_device);
|
||||
return r;
|
||||
}
|
||||
|
||||
device->loop_fd = loop_fd;
|
||||
device->file_path = device->path;
|
||||
device->path = loop_device;
|
||||
device->init_done = 1;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
int device_block_adjust(struct crypt_device *cd,
|
||||
struct device *device,
|
||||
enum devcheck device_check,
|
||||
uint64_t device_offset,
|
||||
uint64_t *size,
|
||||
uint32_t *flags)
|
||||
{
|
||||
int r, real_readonly;
|
||||
uint64_t real_size;
|
||||
|
||||
if (!device)
|
||||
return -ENOTBLK;
|
||||
|
||||
r = device_internal_prepare(cd, device);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
r = device_info(device, device_check, &real_readonly, &real_size);
|
||||
if (r < 0) {
|
||||
if (r == -EBUSY)
|
||||
log_err(cd, _("Cannot use device %s which is in use "
|
||||
"(already mapped or mounted).\n"),
|
||||
device->path);
|
||||
else
|
||||
log_err(cd, _("Cannot get info about device %s.\n"),
|
||||
device->path);
|
||||
return r;
|
||||
}
|
||||
|
||||
if (device_offset >= real_size) {
|
||||
log_err(cd, _("Requested offset is beyond real size of device %s.\n"),
|
||||
device->path);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (size && !*size) {
|
||||
*size = real_size;
|
||||
if (!*size) {
|
||||
log_err(cd, _("Device %s has zero size.\n"), device->path);
|
||||
return -ENOTBLK;
|
||||
}
|
||||
*size -= device_offset;
|
||||
}
|
||||
|
||||
/* in case of size is set by parameter */
|
||||
if (size && ((real_size - device_offset) < *size)) {
|
||||
log_dbg("Device %s: offset = %" PRIu64 " requested size = %" PRIu64
|
||||
", backing device size = %" PRIu64,
|
||||
device->path, device_offset, *size, real_size);
|
||||
log_err(cd, _("Device %s is too small.\n"), device->path);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (flags && real_readonly)
|
||||
*flags |= CRYPT_ACTIVATE_READONLY;
|
||||
|
||||
if (size)
|
||||
log_dbg("Calculated device size is %" PRIu64" sectors (%s), offset %" PRIu64 ".",
|
||||
*size, real_readonly ? "RO" : "RW", device_offset);
|
||||
return 0;
|
||||
}
|
||||
|
||||
size_t size_round_up(size_t size, unsigned int block)
|
||||
{
|
||||
size_t s = (size + (block - 1)) / block;
|
||||
return s * block;
|
||||
}
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -16,7 +16,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
@@ -30,12 +30,8 @@
|
||||
#include <sys/types.h>
|
||||
#include "utils_dm.h"
|
||||
|
||||
/* These are DM helpers used only by this file */
|
||||
int dm_is_dm_device(int major, int minor);
|
||||
int dm_is_dm_kernel_name(const char *name);
|
||||
char *dm_device_path(const char *prefix, int major, int minor);
|
||||
|
||||
char *crypt_lookup_dev(const char *dev_id);
|
||||
int crypt_sysfs_check_crypt_segment(const char *device, uint64_t offset, uint64_t size);
|
||||
int crypt_sysfs_get_rotational(int major, int minor, int *rotational);
|
||||
|
||||
static char *__lookup_dev(char *path, dev_t dev, int dir_level, const int max_level)
|
||||
@@ -139,7 +135,7 @@ char *crypt_lookup_dev(const char *dev_id)
|
||||
if (snprintf(path, sizeof(path), "/sys/dev/block/%s", dev_id) < 0)
|
||||
return NULL;
|
||||
|
||||
len = readlink(path, link, sizeof(link) - 1);
|
||||
len = readlink(path, link, sizeof(link));
|
||||
if (len < 0) {
|
||||
/* Without /sys use old scan */
|
||||
if (stat("/sys/dev/block", &st) < 0)
|
||||
@@ -172,6 +168,82 @@ char *crypt_lookup_dev(const char *dev_id)
|
||||
return devpath;
|
||||
}
|
||||
|
||||
static int crypt_sysfs_get_major_minor(const char *kname, int *major, int *minor)
|
||||
{
|
||||
char path[PATH_MAX], tmp[64] = {0};
|
||||
int fd, r = 0;
|
||||
|
||||
if (snprintf(path, sizeof(path), "/sys/block/%s/dev", kname) < 0)
|
||||
return 0;
|
||||
|
||||
if ((fd = open(path, O_RDONLY)) < 0)
|
||||
return 0;
|
||||
r = read(fd, tmp, sizeof(tmp));
|
||||
close(fd);
|
||||
|
||||
if (r <= 0)
|
||||
return 0;
|
||||
|
||||
tmp[63] = '\0';
|
||||
if (sscanf(tmp, "%d:%d", major, minor) != 2)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int crypt_sysfs_get_holders_dir(const char *device, char *path, int size)
|
||||
{
|
||||
struct stat st;
|
||||
|
||||
if (stat(device, &st) < 0 || !S_ISBLK(st.st_mode))
|
||||
return 0;
|
||||
|
||||
if (snprintf(path, size, "/sys/dev/block/%d:%d/holders",
|
||||
major(st.st_rdev), minor(st.st_rdev)) < 0)
|
||||
return 0;
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
int crypt_sysfs_check_crypt_segment(const char *device, uint64_t offset, uint64_t size)
|
||||
{
|
||||
DIR *dir;
|
||||
struct dirent *d;
|
||||
char path[PATH_MAX], *dmname;
|
||||
int major, minor, r = 0;
|
||||
|
||||
if (!crypt_sysfs_get_holders_dir(device, path, sizeof(path)))
|
||||
return -EINVAL;
|
||||
|
||||
if (!(dir = opendir(path)))
|
||||
return -EINVAL;
|
||||
|
||||
while (!r && (d = readdir(dir))) {
|
||||
if (!strcmp(d->d_name, ".") || !strcmp(d->d_name, ".."))
|
||||
continue;
|
||||
|
||||
if (!dm_is_dm_kernel_name(d->d_name)) {
|
||||
r = -EBUSY;
|
||||
break;
|
||||
}
|
||||
|
||||
if (!crypt_sysfs_get_major_minor(d->d_name, &major, &minor)) {
|
||||
r = -EINVAL;
|
||||
break;
|
||||
}
|
||||
|
||||
if (!(dmname = dm_device_path(NULL, major, minor))) {
|
||||
r = -EINVAL;
|
||||
break;
|
||||
}
|
||||
r = dm_check_segment(dmname, offset, size);
|
||||
free(dmname);
|
||||
}
|
||||
closedir(dir);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
int crypt_sysfs_get_rotational(int major, int minor, int *rotational)
|
||||
{
|
||||
char path[PATH_MAX], tmp[64] = {0};
|
||||
|
||||
107
lib/utils_dm.h
107
lib/utils_dm.h
@@ -1,24 +1,3 @@
|
||||
/*
|
||||
* libdevmapper - device-mapper backend for cryptsetup
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _UTILS_DM_H
|
||||
#define _UTILS_DM_H
|
||||
|
||||
@@ -27,8 +6,6 @@
|
||||
|
||||
struct crypt_device;
|
||||
struct volume_key;
|
||||
struct crypt_params_verity;
|
||||
struct device;
|
||||
|
||||
/* Device mapper backend - kernel support flags */
|
||||
#define DM_KEY_WIPE_SUPPORTED (1 << 0) /* key wipe message */
|
||||
@@ -36,66 +13,48 @@ struct device;
|
||||
#define DM_SECURE_SUPPORTED (1 << 2) /* wipe (secure) buffer flag */
|
||||
#define DM_PLAIN64_SUPPORTED (1 << 3) /* plain64 IV */
|
||||
#define DM_DISCARDS_SUPPORTED (1 << 4) /* discards/TRIM option is supported */
|
||||
#define DM_VERITY_SUPPORTED (1 << 5) /* dm-verity target supported */
|
||||
uint32_t dm_flags(void);
|
||||
|
||||
#define DM_ACTIVE_DEVICE (1 << 0)
|
||||
#define DM_ACTIVE_UUID (1 << 1)
|
||||
|
||||
#define DM_ACTIVE_CRYPT_CIPHER (1 << 2)
|
||||
#define DM_ACTIVE_CRYPT_KEYSIZE (1 << 3)
|
||||
#define DM_ACTIVE_CRYPT_KEY (1 << 4)
|
||||
|
||||
#define DM_ACTIVE_VERITY_ROOT_HASH (1 << 5)
|
||||
#define DM_ACTIVE_VERITY_HASH_DEVICE (1 << 6)
|
||||
#define DM_ACTIVE_VERITY_PARAMS (1 << 7)
|
||||
#define DM_ACTIVE_CIPHER (1 << 1)
|
||||
#define DM_ACTIVE_UUID (1 << 2)
|
||||
#define DM_ACTIVE_KEYSIZE (1 << 3)
|
||||
#define DM_ACTIVE_KEY (1 << 4)
|
||||
|
||||
struct crypt_dm_active_device {
|
||||
enum { DM_CRYPT = 0, DM_VERITY } target;
|
||||
const char *device;
|
||||
const char *cipher;
|
||||
const char *uuid;
|
||||
|
||||
/* Active key for device */
|
||||
struct volume_key *vk;
|
||||
|
||||
/* struct crypt_active_device */
|
||||
uint64_t offset; /* offset in sectors */
|
||||
uint64_t iv_offset; /* IV initilisation sector */
|
||||
uint64_t size; /* active device size */
|
||||
uint32_t flags; /* activation flags */
|
||||
const char *uuid;
|
||||
struct device *data_device;
|
||||
union {
|
||||
struct {
|
||||
const char *cipher;
|
||||
|
||||
/* Active key for device */
|
||||
struct volume_key *vk;
|
||||
|
||||
/* struct crypt_active_device */
|
||||
uint64_t offset; /* offset in sectors */
|
||||
uint64_t iv_offset; /* IV initilisation sector */
|
||||
} crypt;
|
||||
struct {
|
||||
struct device *hash_device;
|
||||
|
||||
const char *root_hash;
|
||||
uint32_t root_hash_size;
|
||||
|
||||
uint64_t hash_offset; /* hash offset in blocks (not header) */
|
||||
struct crypt_params_verity *vp;
|
||||
} verity;
|
||||
} u;
|
||||
};
|
||||
|
||||
void dm_backend_init(void);
|
||||
void dm_backend_exit(void);
|
||||
|
||||
int dm_remove_device(struct crypt_device *cd, const char *name,
|
||||
int force, uint64_t size);
|
||||
int dm_status_device(struct crypt_device *cd, const char *name);
|
||||
int dm_status_suspended(struct crypt_device *cd, const char *name);
|
||||
int dm_status_verity_ok(struct crypt_device *cd, const char *name);
|
||||
int dm_query_device(struct crypt_device *cd, const char *name,
|
||||
uint32_t get_flags, struct crypt_dm_active_device *dmd);
|
||||
int dm_create_device(struct crypt_device *cd, const char *name,
|
||||
const char *type, struct crypt_dm_active_device *dmd,
|
||||
int reload);
|
||||
int dm_suspend_and_wipe_key(struct crypt_device *cd, const char *name);
|
||||
int dm_resume_and_reinstate_key(struct crypt_device *cd, const char *name,
|
||||
size_t key_size, const char *key);
|
||||
|
||||
const char *dm_get_dir(void);
|
||||
int dm_init(struct crypt_device *context, int check_kernel);
|
||||
void dm_exit(void);
|
||||
int dm_remove_device(const char *name, int force, uint64_t size);
|
||||
int dm_status_device(const char *name);
|
||||
int dm_status_suspended(const char *name);
|
||||
int dm_query_device(const char *name, uint32_t get_flags,
|
||||
struct crypt_dm_active_device *dmd);
|
||||
int dm_create_device(const char *name,
|
||||
const char *type,
|
||||
struct crypt_dm_active_device *dmd,
|
||||
int reload);
|
||||
int dm_suspend_and_wipe_key(const char *name);
|
||||
int dm_resume_and_reinstate_key(const char *name,
|
||||
size_t key_size,
|
||||
const char *key);
|
||||
char *dm_device_path(const char *prefix, int major, int minor);
|
||||
int dm_is_dm_device(int major, int minor);
|
||||
int dm_is_dm_kernel_name(const char *name);
|
||||
int dm_check_segment(const char *name, uint64_t offset, uint64_t size);
|
||||
|
||||
#endif /* _UTILS_DM_H */
|
||||
|
||||
@@ -1,62 +0,0 @@
|
||||
/*
|
||||
* FIPS mode utilities
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include "libcryptsetup.h"
|
||||
#include "nls.h"
|
||||
#include "utils_fips.h"
|
||||
#include "config.h"
|
||||
|
||||
#if !ENABLE_FIPS
|
||||
int crypt_fips_mode(void) { return 0; }
|
||||
void crypt_fips_libcryptsetup_check(struct crypt_device *cd) {}
|
||||
void crypt_fips_self_check(struct crypt_device *cd) {}
|
||||
#else
|
||||
#include <fipscheck.h>
|
||||
|
||||
int crypt_fips_mode(void)
|
||||
{
|
||||
return FIPSCHECK_kernel_fips_mode();
|
||||
}
|
||||
|
||||
static void crypt_fips_verify(struct crypt_device *cd,
|
||||
const char *name, const char *function)
|
||||
{
|
||||
if (!crypt_fips_mode())
|
||||
return;
|
||||
|
||||
if (!FIPSCHECK_verify(name, function)) {
|
||||
crypt_log(cd, CRYPT_LOG_ERROR, _("FIPS checksum verification failed.\n"));
|
||||
_exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
crypt_log(cd, CRYPT_LOG_VERBOSE, _("Running in FIPS mode.\n"));
|
||||
}
|
||||
|
||||
void crypt_fips_libcryptsetup_check(struct crypt_device *cd)
|
||||
{
|
||||
crypt_fips_verify(cd, LIBCRYPTSETUP_VERSION_FIPS, "crypt_init");
|
||||
}
|
||||
|
||||
void crypt_fips_self_check(struct crypt_device *cd)
|
||||
{
|
||||
crypt_fips_verify(cd, NULL, NULL);
|
||||
}
|
||||
#endif /* ENABLE_FIPS */
|
||||
@@ -1,29 +0,0 @@
|
||||
/*
|
||||
* FIPS mode utilities
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _UTILS_FIPS_H
|
||||
#define _UTILS_FIPS_H
|
||||
|
||||
struct crypt_device;
|
||||
|
||||
int crypt_fips_mode(void);
|
||||
void crypt_fips_libcryptsetup_check(struct crypt_device *cd);
|
||||
void crypt_fips_self_check(struct crypt_device *cd);
|
||||
|
||||
#endif /* _UTILS_FIPS_H */
|
||||
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* loopback block device utilities
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
@@ -99,7 +99,7 @@ int crypt_loop_attach(const char *loop, const char *file, int offset,
|
||||
int loop_fd = -1, file_fd = -1, r = 1;
|
||||
|
||||
file_fd = open(file, (*readonly ? O_RDONLY : O_RDWR) | O_EXCL);
|
||||
if (file_fd < 0 && (errno == EROFS || errno == EACCES) && !*readonly) {
|
||||
if (file_fd < 0 && errno == EROFS && !*readonly) {
|
||||
*readonly = 1;
|
||||
file_fd = open(file, O_RDONLY | O_EXCL);
|
||||
}
|
||||
|
||||
@@ -1,22 +1,3 @@
|
||||
/*
|
||||
* loopback block device utilities
|
||||
*
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _UTILS_LOOP_H
|
||||
#define _UTILS_LOOP_H
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
* utils_wipe - wipe a device
|
||||
*
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2011-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -15,7 +15,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@@ -34,20 +34,10 @@
|
||||
|
||||
#define MAXIMUM_WIPE_BYTES 1024 * 1024 * 32 /* 32 MiB */
|
||||
|
||||
static ssize_t _crypt_wipe_zero(int fd, int bsize, char *buffer,
|
||||
uint64_t offset, uint64_t size)
|
||||
static ssize_t _crypt_wipe_zero(int fd, char *buffer, uint64_t offset, uint64_t size)
|
||||
{
|
||||
memset(buffer, 0, size);
|
||||
return write_lseek_blockwise(fd, bsize, buffer, size, offset);
|
||||
}
|
||||
|
||||
static ssize_t _crypt_wipe_random(int fd, int bsize, char *buffer,
|
||||
uint64_t offset, uint64_t size)
|
||||
{
|
||||
if (crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL) < 0)
|
||||
return -EINVAL;
|
||||
|
||||
return write_lseek_blockwise(fd, bsize, buffer, size, offset);
|
||||
return write_lseek_blockwise(fd, buffer, size, offset);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -76,45 +66,38 @@ static void wipeSpecial(char *buffer, size_t buffer_size, unsigned int turn)
|
||||
}
|
||||
}
|
||||
|
||||
static ssize_t _crypt_wipe_disk(int fd, int bsize, char *buffer,
|
||||
uint64_t offset, uint64_t size)
|
||||
static ssize_t _crypt_wipe_disk(int fd, char *buffer, uint64_t offset, uint64_t size)
|
||||
{
|
||||
int r;
|
||||
unsigned int i;
|
||||
ssize_t written;
|
||||
|
||||
for(i = 0; i < 39; ++i) {
|
||||
if (i < 5) {
|
||||
r = crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL);
|
||||
} else if(i >= 5 && i < 32) {
|
||||
wipeSpecial(buffer, size, i - 5);
|
||||
r = 0;
|
||||
} else if(i >= 32 && i < 38) {
|
||||
r = crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL);
|
||||
} else if(i >= 38 && i < 39) {
|
||||
memset(buffer, 0xFF, size);
|
||||
r = 0;
|
||||
}
|
||||
if (r < 0)
|
||||
return r;
|
||||
if (i < 5) crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL);
|
||||
else if(i >= 5 && i < 32) wipeSpecial(buffer, size, i - 5);
|
||||
else if(i >= 32 && i < 38) crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL);
|
||||
else if(i >= 38 && i < 39) memset(buffer, 0xFF, size);
|
||||
|
||||
written = write_lseek_blockwise(fd, bsize, buffer, size, offset);
|
||||
written = write_lseek_blockwise(fd, buffer, size, offset);
|
||||
if (written < 0 || written != (ssize_t)size)
|
||||
return written;
|
||||
}
|
||||
|
||||
/* Rewrite it finally with random */
|
||||
return _crypt_wipe_random(fd, bsize, buffer, offset, size);
|
||||
return written;
|
||||
}
|
||||
|
||||
static ssize_t _crypt_wipe_ssd(int fd, int bsize, char *buffer,
|
||||
uint64_t offset, uint64_t size)
|
||||
static ssize_t _crypt_wipe_random(int fd, char *buffer, uint64_t offset, uint64_t size)
|
||||
{
|
||||
crypt_random_get(NULL, buffer, size, CRYPT_RND_NORMAL);
|
||||
return write_lseek_blockwise(fd, buffer, size, offset);
|
||||
}
|
||||
|
||||
static ssize_t _crypt_wipe_ssd(int fd, char *buffer, uint64_t offset, uint64_t size)
|
||||
{
|
||||
// FIXME: for now just rewrite it by random
|
||||
return _crypt_wipe_random(fd, bsize, buffer, offset, size);
|
||||
return _crypt_wipe_random(fd, buffer, offset, size);
|
||||
}
|
||||
|
||||
int crypt_wipe(struct device *device,
|
||||
int crypt_wipe(const char *device,
|
||||
uint64_t offset,
|
||||
uint64_t size,
|
||||
crypt_wipe_type type,
|
||||
@@ -122,22 +105,21 @@ int crypt_wipe(struct device *device,
|
||||
{
|
||||
struct stat st;
|
||||
char *buffer;
|
||||
int devfd, flags, rotational, bsize;
|
||||
int devfd, flags, rotational;
|
||||
ssize_t written;
|
||||
|
||||
if (!size || size % SECTOR_SIZE || (size > MAXIMUM_WIPE_BYTES)) {
|
||||
log_dbg("Unsuported wipe size for device %s: %ld.",
|
||||
device_path(device), (unsigned long)size);
|
||||
device, (unsigned long)size);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (stat(device_path(device), &st) < 0) {
|
||||
log_dbg("Device %s not found.", device_path(device));
|
||||
if (stat(device, &st) < 0) {
|
||||
log_dbg("Device %s not found.", device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (type == CRYPT_WIPE_DISK && S_ISBLK(st.st_mode)) {
|
||||
rotational = 0;
|
||||
if (type == CRYPT_WIPE_DISK) {
|
||||
if (!crypt_sysfs_get_rotational(major(st.st_rdev),
|
||||
minor(st.st_rdev),
|
||||
&rotational))
|
||||
@@ -147,40 +129,34 @@ int crypt_wipe(struct device *device,
|
||||
type = CRYPT_WIPE_SSD;
|
||||
}
|
||||
|
||||
bsize = device_block_size(device);
|
||||
if (bsize <= 0)
|
||||
return -EINVAL;
|
||||
|
||||
buffer = malloc(size);
|
||||
if (!buffer)
|
||||
return -ENOMEM;
|
||||
|
||||
flags = O_RDWR | O_DIRECT | O_SYNC;
|
||||
flags = O_WRONLY | O_DIRECT | O_SYNC;
|
||||
|
||||
/* use O_EXCL only for block devices */
|
||||
if (exclusive && S_ISBLK(st.st_mode))
|
||||
flags |= O_EXCL;
|
||||
|
||||
devfd = open(device_path(device), flags);
|
||||
devfd = open(device, flags);
|
||||
if (devfd == -1) {
|
||||
free(buffer);
|
||||
return errno ? -errno : -EINVAL;
|
||||
return errno == EBUSY ? -EBUSY : -EINVAL;
|
||||
}
|
||||
|
||||
// FIXME: use fixed block size and loop here
|
||||
switch (type) {
|
||||
case CRYPT_WIPE_ZERO:
|
||||
written = _crypt_wipe_zero(devfd, bsize, buffer, offset, size);
|
||||
written = _crypt_wipe_zero(devfd, buffer, offset, size);
|
||||
break;
|
||||
case CRYPT_WIPE_DISK:
|
||||
written = _crypt_wipe_disk(devfd, bsize, buffer, offset, size);
|
||||
break;
|
||||
written = _crypt_wipe_disk(devfd, buffer, offset, size);
|
||||
case CRYPT_WIPE_SSD:
|
||||
written = _crypt_wipe_ssd(devfd, bsize, buffer, offset, size);
|
||||
written = _crypt_wipe_ssd(devfd, buffer, offset, size);
|
||||
break;
|
||||
case CRYPT_WIPE_RANDOM:
|
||||
written = _crypt_wipe_random(devfd, bsize, buffer, offset, size);
|
||||
break;
|
||||
written = _crypt_wipe_random(devfd, buffer, offset, size);
|
||||
default:
|
||||
log_dbg("Unsuported wipe type requested: (%d)", type);
|
||||
written = -1;
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
moduledir = $(libdir)/cryptsetup
|
||||
|
||||
noinst_LTLIBRARIES = libverity.la
|
||||
|
||||
libverity_la_CFLAGS = -Wall @CRYPTO_CFLAGS@
|
||||
|
||||
libverity_la_SOURCES = \
|
||||
verity_hash.c \
|
||||
verity.c \
|
||||
verity.h
|
||||
|
||||
INCLUDES = -D_GNU_SOURCE \
|
||||
-D_LARGEFILE64_SOURCE \
|
||||
-D_FILE_OFFSET_BITS=64 \
|
||||
-I$(top_srcdir)/lib \
|
||||
-I$(top_srcdir)/lib/crypto_backend
|
||||
@@ -1,283 +0,0 @@
|
||||
/*
|
||||
* dm-verity volume handling
|
||||
*
|
||||
* Copyright (C) 2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h>
|
||||
#include <netinet/in.h>
|
||||
#include <uuid/uuid.h>
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
#include "verity.h"
|
||||
#include "internal.h"
|
||||
|
||||
#define VERITY_SIGNATURE "verity\0\0"
|
||||
|
||||
/* http://code.google.com/p/cryptsetup/wiki/DMVerity#Verity_superblock_format */
|
||||
struct verity_sb {
|
||||
uint8_t signature[8]; /* "verity\0\0" */
|
||||
uint32_t version; /* superblock version */
|
||||
uint32_t hash_type; /* 0 - Chrome OS, 1 - normal */
|
||||
uint8_t uuid[16]; /* UUID of hash device */
|
||||
uint8_t algorithm[32];/* hash algorithm name */
|
||||
uint32_t data_block_size; /* data block in bytes */
|
||||
uint32_t hash_block_size; /* hash block in bytes */
|
||||
uint64_t data_blocks; /* number of data blocks */
|
||||
uint16_t salt_size; /* salt size */
|
||||
uint8_t _pad1[6];
|
||||
uint8_t salt[256]; /* salt */
|
||||
uint8_t _pad2[168];
|
||||
} __attribute__((packed));
|
||||
|
||||
/* Read verity superblock from disk */
|
||||
int VERITY_read_sb(struct crypt_device *cd,
|
||||
uint64_t sb_offset,
|
||||
char **uuid_string,
|
||||
struct crypt_params_verity *params)
|
||||
{
|
||||
const char *device = device_path(crypt_metadata_device(cd));
|
||||
int bsize = device_block_size(crypt_metadata_device(cd));
|
||||
struct verity_sb sb = {};
|
||||
ssize_t hdr_size = sizeof(struct verity_sb);
|
||||
int devfd = 0, sb_version;
|
||||
|
||||
log_dbg("Reading VERITY header of size %u on device %s, offset %" PRIu64 ".",
|
||||
sizeof(struct verity_sb), device, sb_offset);
|
||||
|
||||
if (params->flags & CRYPT_VERITY_NO_HEADER) {
|
||||
log_err(cd, _("Verity device doesn't use on-disk header.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (sb_offset % 512) {
|
||||
log_err(cd, _("Unsupported VERITY hash offset.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
devfd = open(device ,O_RDONLY | O_DIRECT);
|
||||
if(devfd == -1) {
|
||||
log_err(cd, _("Cannot open device %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if(lseek(devfd, sb_offset, SEEK_SET) < 0 ||
|
||||
read_blockwise(devfd, bsize, &sb, hdr_size) < hdr_size) {
|
||||
close(devfd);
|
||||
return -EIO;
|
||||
}
|
||||
close(devfd);
|
||||
|
||||
if (memcmp(sb.signature, VERITY_SIGNATURE, sizeof(sb.signature))) {
|
||||
log_err(cd, _("Device %s is not a valid VERITY device.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
sb_version = le32_to_cpu(sb.version);
|
||||
if (sb_version != 1) {
|
||||
log_err(cd, _("Unsupported VERITY version %d.\n"), sb_version);
|
||||
return -EINVAL;
|
||||
}
|
||||
params->hash_type = le32_to_cpu(sb.hash_type);
|
||||
if (params->hash_type > VERITY_MAX_HASH_TYPE) {
|
||||
log_err(cd, _("Unsupported VERITY hash type %d.\n"), params->hash_type);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
params->data_block_size = le32_to_cpu(sb.data_block_size);
|
||||
params->hash_block_size = le32_to_cpu(sb.hash_block_size);
|
||||
if (VERITY_BLOCK_SIZE_OK(params->data_block_size) ||
|
||||
VERITY_BLOCK_SIZE_OK(params->hash_block_size)) {
|
||||
log_err(cd, _("Unsupported VERITY block size.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
params->data_size = le64_to_cpu(sb.data_blocks);
|
||||
|
||||
params->hash_name = strndup((const char*)sb.algorithm, sizeof(sb.algorithm));
|
||||
if (!params->hash_name)
|
||||
return -ENOMEM;
|
||||
if (crypt_hash_size(params->hash_name) <= 0) {
|
||||
log_err(cd, _("Hash algorithm %s not supported.\n"),
|
||||
params->hash_name);
|
||||
free(CONST_CAST(char*)params->hash_name);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
params->salt_size = le16_to_cpu(sb.salt_size);
|
||||
if (params->salt_size > sizeof(sb.salt)) {
|
||||
log_err(cd, _("VERITY header corrupted.\n"));
|
||||
free(CONST_CAST(char*)params->hash_name);
|
||||
return -EINVAL;
|
||||
}
|
||||
params->salt = malloc(params->salt_size);
|
||||
if (!params->salt) {
|
||||
free(CONST_CAST(char*)params->hash_name);
|
||||
return -ENOMEM;
|
||||
}
|
||||
memcpy(CONST_CAST(char*)params->salt, sb.salt, params->salt_size);
|
||||
|
||||
if ((*uuid_string = malloc(40)))
|
||||
uuid_unparse(sb.uuid, *uuid_string);
|
||||
|
||||
params->hash_area_offset = sb_offset;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Write verity superblock to disk */
|
||||
int VERITY_write_sb(struct crypt_device *cd,
|
||||
uint64_t sb_offset,
|
||||
const char *uuid_string,
|
||||
struct crypt_params_verity *params)
|
||||
{
|
||||
const char *device = device_path(crypt_metadata_device(cd));
|
||||
int bsize = device_block_size(crypt_metadata_device(cd));
|
||||
struct verity_sb sb = {};
|
||||
ssize_t hdr_size = sizeof(struct verity_sb);
|
||||
uuid_t uuid;
|
||||
int r, devfd = 0;
|
||||
|
||||
log_dbg("Updating VERITY header of size %u on device %s, offset %" PRIu64 ".",
|
||||
sizeof(struct verity_sb), device, sb_offset);
|
||||
|
||||
if (!uuid_string || uuid_parse(uuid_string, uuid) == -1) {
|
||||
log_err(cd, _("Wrong VERITY UUID format provided.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (params->flags & CRYPT_VERITY_NO_HEADER) {
|
||||
log_err(cd, _("Verity device doesn't use on-disk header.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
devfd = open(device, O_RDWR | O_DIRECT);
|
||||
if(devfd == -1) {
|
||||
log_err(cd, _("Cannot open device %s.\n"), device);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
memcpy(&sb.signature, VERITY_SIGNATURE, sizeof(sb.signature));
|
||||
sb.version = cpu_to_le32(1);
|
||||
sb.hash_type = cpu_to_le32(params->hash_type);
|
||||
sb.data_block_size = cpu_to_le32(params->data_block_size);
|
||||
sb.hash_block_size = cpu_to_le32(params->hash_block_size);
|
||||
sb.salt_size = cpu_to_le16(params->salt_size);
|
||||
sb.data_blocks = cpu_to_le64(params->data_size);
|
||||
strncpy((char *)sb.algorithm, params->hash_name, sizeof(sb.algorithm));
|
||||
memcpy(sb.salt, params->salt, params->salt_size);
|
||||
memcpy(sb.uuid, uuid, sizeof(sb.uuid));
|
||||
|
||||
r = write_lseek_blockwise(devfd, bsize, (char*)&sb, hdr_size, sb_offset) < hdr_size ? -EIO : 0;
|
||||
if (r)
|
||||
log_err(cd, _("Error during update of verity header on device %s.\n"), device);
|
||||
close(devfd);
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
/* Calculate hash offset in hash blocks */
|
||||
uint64_t VERITY_hash_offset_block(struct crypt_params_verity *params)
|
||||
{
|
||||
uint64_t hash_offset = params->hash_area_offset;
|
||||
|
||||
if (params->flags & CRYPT_VERITY_NO_HEADER)
|
||||
return hash_offset / params->hash_block_size;
|
||||
|
||||
hash_offset += sizeof(struct verity_sb);
|
||||
hash_offset += params->hash_block_size - 1;
|
||||
|
||||
return hash_offset / params->hash_block_size;
|
||||
}
|
||||
|
||||
int VERITY_UUID_generate(struct crypt_device *cd, char **uuid_string)
|
||||
{
|
||||
uuid_t uuid;
|
||||
|
||||
if (!(*uuid_string = malloc(40)))
|
||||
return -ENOMEM;
|
||||
uuid_generate(uuid);
|
||||
uuid_unparse(uuid, *uuid_string);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Activate verity device in kernel device-mapper */
|
||||
int VERITY_activate(struct crypt_device *cd,
|
||||
const char *name,
|
||||
const char *root_hash,
|
||||
size_t root_hash_size,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
uint32_t activation_flags)
|
||||
{
|
||||
struct crypt_dm_active_device dmd;
|
||||
int r;
|
||||
|
||||
log_dbg("Trying to activate VERITY device %s using hash %s.",
|
||||
name ?: "[none]", verity_hdr->hash_name);
|
||||
|
||||
if (verity_hdr->flags & CRYPT_VERITY_CHECK_HASH) {
|
||||
log_dbg("Verification of data in userspace required.");
|
||||
r = VERITY_verify(cd, verity_hdr,
|
||||
root_hash, root_hash_size);
|
||||
if (r < 0)
|
||||
return r;
|
||||
}
|
||||
|
||||
if (!name)
|
||||
return 0;
|
||||
|
||||
dmd.target = DM_VERITY;
|
||||
dmd.data_device = crypt_data_device(cd);
|
||||
dmd.u.verity.hash_device = crypt_metadata_device(cd);
|
||||
dmd.u.verity.root_hash = root_hash;
|
||||
dmd.u.verity.root_hash_size = root_hash_size;
|
||||
dmd.u.verity.hash_offset = VERITY_hash_offset_block(verity_hdr),
|
||||
dmd.flags = activation_flags;
|
||||
dmd.size = verity_hdr->data_size * verity_hdr->data_block_size / 512;
|
||||
dmd.uuid = crypt_get_uuid(cd);
|
||||
dmd.u.verity.vp = verity_hdr;
|
||||
|
||||
r = device_block_adjust(cd, dmd.u.verity.hash_device, DEV_OK,
|
||||
0, NULL, NULL);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
r = device_block_adjust(cd, dmd.data_device, DEV_EXCL,
|
||||
0, &dmd.size, &dmd.flags);
|
||||
if (r)
|
||||
return r;
|
||||
|
||||
r = dm_create_device(cd, name, CRYPT_VERITY, &dmd, 0);
|
||||
if (!r && !(dm_flags() & DM_VERITY_SUPPORTED)) {
|
||||
log_err(cd, _("Kernel doesn't support dm-verity mapping.\n"));
|
||||
return -ENOTSUP;
|
||||
}
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
r = dm_status_verity_ok(cd, name);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
if (!r)
|
||||
log_err(cd, _("Verity device detected corruption after activation.\n"));
|
||||
return 0;
|
||||
}
|
||||
@@ -1,64 +0,0 @@
|
||||
/*
|
||||
* dm-verity volume handling
|
||||
*
|
||||
* Copyright (C) 2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef _VERITY_H
|
||||
#define _VERITY_H
|
||||
|
||||
#include <unistd.h>
|
||||
#include "config.h"
|
||||
|
||||
#define VERITY_MAX_HASH_TYPE 1
|
||||
#define VERITY_BLOCK_SIZE_OK(x) ((x) % 512 || (x) < 512 || \
|
||||
(x) > (512 * 1024) || (x) & ((x)-1))
|
||||
|
||||
struct crypt_device;
|
||||
struct crypt_params_verity;
|
||||
|
||||
int VERITY_read_sb(struct crypt_device *cd,
|
||||
uint64_t sb_offset,
|
||||
char **uuid,
|
||||
struct crypt_params_verity *params);
|
||||
|
||||
int VERITY_write_sb(struct crypt_device *cd,
|
||||
uint64_t sb_offset,
|
||||
const char *uuid_string,
|
||||
struct crypt_params_verity *params);
|
||||
|
||||
int VERITY_activate(struct crypt_device *cd,
|
||||
const char *name,
|
||||
const char *root_hash,
|
||||
size_t root_hash_size,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
uint32_t activation_flags);
|
||||
|
||||
int VERITY_verify(struct crypt_device *cd,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
const char *root_hash,
|
||||
size_t root_hash_size);
|
||||
|
||||
int VERITY_create(struct crypt_device *cd,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
char *root_hash,
|
||||
size_t root_hash_size);
|
||||
|
||||
uint64_t VERITY_hash_offset_block(struct crypt_params_verity *params);
|
||||
|
||||
int VERITY_UUID_generate(struct crypt_device *cd, char **uuid_string);
|
||||
|
||||
#endif
|
||||
@@ -1,431 +0,0 @@
|
||||
/*
|
||||
* dm-verity volume handling
|
||||
*
|
||||
* Copyright (C) 2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "verity.h"
|
||||
#include "internal.h"
|
||||
|
||||
#define VERITY_MAX_LEVELS 63
|
||||
|
||||
static unsigned get_bits_up(size_t u)
|
||||
{
|
||||
unsigned i = 0;
|
||||
while ((1U << i) < u)
|
||||
i++;
|
||||
return i;
|
||||
}
|
||||
|
||||
static unsigned get_bits_down(size_t u)
|
||||
{
|
||||
unsigned i = 0;
|
||||
while ((u >> i) > 1U)
|
||||
i++;
|
||||
return i;
|
||||
}
|
||||
|
||||
static int verify_zero(struct crypt_device *cd, FILE *wr, size_t bytes)
|
||||
{
|
||||
char block[bytes];
|
||||
size_t i;
|
||||
|
||||
if (fread(block, bytes, 1, wr) != 1) {
|
||||
log_dbg("EIO while reading spare area.");
|
||||
return -EIO;
|
||||
}
|
||||
for (i = 0; i < bytes; i++)
|
||||
if (block[i]) {
|
||||
log_err(cd, _("Spare area is not zeroed at position %" PRIu64 ".\n"),
|
||||
ftello(wr) - bytes);
|
||||
return -EPERM;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int verify_hash_block(const char *hash_name, int version,
|
||||
char *hash, size_t hash_size,
|
||||
const char *data, size_t data_size,
|
||||
const char *salt, size_t salt_size)
|
||||
{
|
||||
struct crypt_hash *ctx = NULL;
|
||||
int r;
|
||||
|
||||
if (crypt_hash_init(&ctx, hash_name))
|
||||
return -EINVAL;
|
||||
|
||||
if (version == 1 && (r = crypt_hash_write(ctx, salt, salt_size)))
|
||||
goto out;
|
||||
|
||||
if ((r = crypt_hash_write(ctx, data, data_size)))
|
||||
goto out;
|
||||
|
||||
if (version == 0 && (r = crypt_hash_write(ctx, salt, salt_size)))
|
||||
goto out;
|
||||
|
||||
r = crypt_hash_final(ctx, hash, hash_size);
|
||||
out:
|
||||
crypt_hash_destroy(ctx);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int mult_overflow(off_t *u, off_t b, size_t size)
|
||||
{
|
||||
*u = (uint64_t)b * size;
|
||||
if ((off_t)(*u / size) != b || (off_t)*u < 0)
|
||||
return 1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int create_or_verify(struct crypt_device *cd, FILE *rd, FILE *wr,
|
||||
off_t data_block, size_t data_block_size,
|
||||
off_t hash_block, size_t hash_block_size,
|
||||
off_t blocks, int version,
|
||||
const char *hash_name, int verify,
|
||||
char *calculated_digest, size_t digest_size,
|
||||
const char *salt, size_t salt_size)
|
||||
{
|
||||
char left_block[hash_block_size];
|
||||
char data_buffer[data_block_size];
|
||||
char read_digest[digest_size];
|
||||
size_t hash_per_block = 1 << get_bits_down(hash_block_size / digest_size);
|
||||
size_t digest_size_full = 1 << get_bits_up(digest_size);
|
||||
off_t blocks_to_write = (blocks + hash_per_block - 1) / hash_per_block;
|
||||
off_t seek_rd, seek_wr;
|
||||
size_t left_bytes;
|
||||
unsigned i;
|
||||
int r;
|
||||
|
||||
if (mult_overflow(&seek_rd, data_block, data_block_size) ||
|
||||
mult_overflow(&seek_wr, hash_block, hash_block_size)) {
|
||||
log_err(cd, _("Device offset overflow.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (fseeko(rd, seek_rd, SEEK_SET)) {
|
||||
log_dbg("Cannot seek to requested position in data device.");
|
||||
return -EIO;
|
||||
}
|
||||
|
||||
if (wr && fseeko(wr, seek_wr, SEEK_SET)) {
|
||||
log_dbg("Cannot seek to requested position in hash device.");
|
||||
return -EIO;
|
||||
}
|
||||
|
||||
memset(left_block, 0, hash_block_size);
|
||||
while (blocks_to_write--) {
|
||||
left_bytes = hash_block_size;
|
||||
for (i = 0; i < hash_per_block; i++) {
|
||||
if (!blocks)
|
||||
break;
|
||||
blocks--;
|
||||
if (fread(data_buffer, data_block_size, 1, rd) != 1) {
|
||||
log_dbg("Cannot read data device block.");
|
||||
return -EIO;
|
||||
}
|
||||
|
||||
if (verify_hash_block(hash_name, version,
|
||||
calculated_digest, digest_size,
|
||||
data_buffer, data_block_size,
|
||||
salt, salt_size))
|
||||
return -EINVAL;
|
||||
|
||||
if (!wr)
|
||||
break;
|
||||
if (verify) {
|
||||
if (fread(read_digest, digest_size, 1, wr) != 1) {
|
||||
log_dbg("Cannot read digest form hash device.");
|
||||
return -EIO;
|
||||
}
|
||||
if (memcmp(read_digest, calculated_digest, digest_size)) {
|
||||
log_err(cd, _("Verification failed at position %" PRIu64 ".\n"),
|
||||
ftello(rd) - data_block_size);
|
||||
return -EPERM;
|
||||
}
|
||||
} else {
|
||||
if (fwrite(calculated_digest, digest_size, 1, wr) != 1) {
|
||||
log_dbg("Cannot write digest to hash device.");
|
||||
return -EIO;
|
||||
}
|
||||
}
|
||||
if (version == 0) {
|
||||
left_bytes -= digest_size;
|
||||
} else {
|
||||
if (digest_size_full - digest_size) {
|
||||
if (verify) {
|
||||
r = verify_zero(cd, wr, digest_size_full - digest_size);
|
||||
if (r)
|
||||
return r;
|
||||
} else if (fwrite(left_block, digest_size_full - digest_size, 1, wr) != 1) {
|
||||
log_dbg("Cannot write spare area to hash device.");
|
||||
return -EIO;
|
||||
}
|
||||
}
|
||||
left_bytes -= digest_size_full;
|
||||
}
|
||||
}
|
||||
if (wr && left_bytes) {
|
||||
if (verify) {
|
||||
r = verify_zero(cd , wr, left_bytes);
|
||||
if (r)
|
||||
return r;
|
||||
} else if (fwrite(left_block, left_bytes, 1, wr) != 1) {
|
||||
log_dbg("Cannot write remaining spare area to hash device.");
|
||||
return -EIO;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int VERITY_create_or_verify_hash(struct crypt_device *cd,
|
||||
int verify,
|
||||
int version,
|
||||
const char *hash_name,
|
||||
struct device *hash_device,
|
||||
struct device *data_device,
|
||||
size_t hash_block_size,
|
||||
size_t data_block_size,
|
||||
off_t data_blocks,
|
||||
off_t hash_position,
|
||||
char *root_hash,
|
||||
size_t digest_size,
|
||||
const char *salt,
|
||||
size_t salt_size)
|
||||
{
|
||||
char calculated_digest[digest_size];
|
||||
FILE *data_file = NULL;
|
||||
FILE *hash_file = NULL, *hash_file_2;
|
||||
off_t hash_level_block[VERITY_MAX_LEVELS];
|
||||
off_t hash_level_size[VERITY_MAX_LEVELS];
|
||||
off_t data_file_blocks, s;
|
||||
size_t hash_per_block, hash_per_block_bits;
|
||||
off_t data_device_size = 0, hash_device_size = 0;
|
||||
uint64_t dev_size;
|
||||
int levels, i, r;
|
||||
|
||||
log_dbg("Hash %s %s, data device %s, data blocks %" PRIu64
|
||||
", hash_device %s, offset %" PRIu64 ".",
|
||||
verify ? "verification" : "creation", hash_name,
|
||||
device_path(data_device), data_blocks,
|
||||
device_path(hash_device), hash_position);
|
||||
|
||||
if (data_blocks < 0 || hash_position < 0) {
|
||||
log_err(cd, _("Invalid size parameters for verity device.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (!data_blocks) {
|
||||
r = device_size(data_device, &dev_size);
|
||||
if (r < 0)
|
||||
return r;
|
||||
|
||||
data_file_blocks = dev_size / data_block_size;
|
||||
} else
|
||||
data_file_blocks = data_blocks;
|
||||
|
||||
if (mult_overflow(&data_device_size, data_blocks, data_block_size)) {
|
||||
log_err(cd, _("Device offset overflow.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
hash_per_block_bits = get_bits_down(hash_block_size / digest_size);
|
||||
hash_per_block = 1 << hash_per_block_bits;
|
||||
if (!hash_per_block_bits)
|
||||
return -EINVAL;
|
||||
|
||||
levels = 0;
|
||||
if (data_file_blocks) {
|
||||
while (hash_per_block_bits * levels < 64 &&
|
||||
(data_file_blocks - 1) >> (hash_per_block_bits * levels))
|
||||
levels++;
|
||||
}
|
||||
log_dbg("Using %d hash levels.", levels);
|
||||
|
||||
if (levels > VERITY_MAX_LEVELS) {
|
||||
log_err(cd, _("Too many tree levels for verity volume.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
for (i = levels - 1; i >= 0; i--) {
|
||||
hash_level_block[i] = hash_position;
|
||||
// verity position of block data_file_blocks at level i
|
||||
s = data_file_blocks >> (i * hash_per_block_bits);
|
||||
s = (s + hash_per_block - 1) / hash_per_block;
|
||||
hash_level_size[i] = s;
|
||||
if ((hash_position + s) < hash_position ||
|
||||
(hash_position + s) < 0) {
|
||||
log_err(cd, _("Device offset overflow.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
hash_position += s;
|
||||
}
|
||||
|
||||
if (mult_overflow(&hash_device_size, hash_position, hash_block_size)) {
|
||||
log_err(cd, _("Device offset overflow.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
log_dbg("Data device size required: %" PRIu64 " bytes.",
|
||||
data_device_size);
|
||||
data_file = fopen(device_path(data_device), "r");
|
||||
if (!data_file) {
|
||||
log_err(cd, _("Cannot open device %s.\n"),
|
||||
device_path(data_device)
|
||||
);
|
||||
r = -EIO;
|
||||
goto out;
|
||||
}
|
||||
|
||||
log_dbg("Hash device size required: %" PRIu64 " bytes.",
|
||||
hash_device_size);
|
||||
hash_file = fopen(device_path(hash_device), verify ? "r" : "r+");
|
||||
if (!hash_file) {
|
||||
log_err(cd, _("Cannot open device %s.\n"),
|
||||
device_path(hash_device));
|
||||
r = -EIO;
|
||||
goto out;
|
||||
}
|
||||
|
||||
memset(calculated_digest, 0, digest_size);
|
||||
|
||||
for (i = 0; i < levels; i++) {
|
||||
if (!i) {
|
||||
r = create_or_verify(cd, data_file, hash_file,
|
||||
0, data_block_size,
|
||||
hash_level_block[i], hash_block_size,
|
||||
data_file_blocks, version, hash_name, verify,
|
||||
calculated_digest, digest_size, salt, salt_size);
|
||||
if (r)
|
||||
goto out;
|
||||
} else {
|
||||
hash_file_2 = fopen(device_path(hash_device), "r");
|
||||
if (!hash_file_2) {
|
||||
log_err(cd, _("Cannot open device %s.\n"),
|
||||
device_path(hash_device));
|
||||
r = -EIO;
|
||||
goto out;
|
||||
}
|
||||
r = create_or_verify(cd, hash_file_2, hash_file,
|
||||
hash_level_block[i - 1], hash_block_size,
|
||||
hash_level_block[i], hash_block_size,
|
||||
hash_level_size[i - 1], version, hash_name, verify,
|
||||
calculated_digest, digest_size, salt, salt_size);
|
||||
fclose(hash_file_2);
|
||||
if (r)
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
if (levels)
|
||||
r = create_or_verify(cd, hash_file, NULL,
|
||||
hash_level_block[levels - 1], hash_block_size,
|
||||
0, hash_block_size,
|
||||
1, version, hash_name, verify,
|
||||
calculated_digest, digest_size, salt, salt_size);
|
||||
else
|
||||
r = create_or_verify(cd, data_file, NULL,
|
||||
0, data_block_size,
|
||||
0, hash_block_size,
|
||||
data_file_blocks, version, hash_name, verify,
|
||||
calculated_digest, digest_size, salt, salt_size);
|
||||
out:
|
||||
if (verify) {
|
||||
if (r)
|
||||
log_err(cd, _("Verification of data area failed.\n"));
|
||||
else {
|
||||
log_dbg("Verification of data area succeeded.");
|
||||
r = memcmp(root_hash, calculated_digest, digest_size) ? -EPERM : 0;
|
||||
if (r)
|
||||
log_err(cd, _("Verification of root hash failed.\n"));
|
||||
else
|
||||
log_dbg("Verification of root hash succeeded.");
|
||||
}
|
||||
} else {
|
||||
if (r == -EIO)
|
||||
log_err(cd, _("Input/output error while creating hash area.\n"));
|
||||
else if (r)
|
||||
log_err(cd, _("Creation of hash area failed.\n"));
|
||||
else {
|
||||
fsync(fileno(hash_file));
|
||||
memcpy(root_hash, calculated_digest, digest_size);
|
||||
}
|
||||
}
|
||||
|
||||
if (data_file)
|
||||
fclose(data_file);
|
||||
if (hash_file)
|
||||
fclose(hash_file);
|
||||
return r;
|
||||
}
|
||||
|
||||
/* Verify verity device using userspace crypto backend */
|
||||
int VERITY_verify(struct crypt_device *cd,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
const char *root_hash,
|
||||
size_t root_hash_size)
|
||||
{
|
||||
return VERITY_create_or_verify_hash(cd, 1,
|
||||
verity_hdr->hash_type,
|
||||
verity_hdr->hash_name,
|
||||
crypt_metadata_device(cd),
|
||||
crypt_data_device(cd),
|
||||
verity_hdr->hash_block_size,
|
||||
verity_hdr->data_block_size,
|
||||
verity_hdr->data_size,
|
||||
VERITY_hash_offset_block(verity_hdr),
|
||||
CONST_CAST(char*)root_hash,
|
||||
root_hash_size,
|
||||
verity_hdr->salt,
|
||||
verity_hdr->salt_size);
|
||||
}
|
||||
|
||||
/* Create verity hash */
|
||||
int VERITY_create(struct crypt_device *cd,
|
||||
struct crypt_params_verity *verity_hdr,
|
||||
char *root_hash,
|
||||
size_t root_hash_size)
|
||||
{
|
||||
unsigned pgsize = crypt_getpagesize();
|
||||
|
||||
if (verity_hdr->salt_size > 256)
|
||||
return -EINVAL;
|
||||
|
||||
if (verity_hdr->data_block_size > pgsize)
|
||||
log_err(cd, _("WARNING: Kernel cannot activate device if data "
|
||||
"block size exceeds page size (%u).\n"), pgsize);
|
||||
|
||||
return VERITY_create_or_verify_hash(cd, 0,
|
||||
verity_hdr->hash_type,
|
||||
verity_hdr->hash_name,
|
||||
crypt_metadata_device(cd),
|
||||
crypt_data_device(cd),
|
||||
verity_hdr->hash_block_size,
|
||||
verity_hdr->data_block_size,
|
||||
verity_hdr->data_size,
|
||||
VERITY_hash_offset_block(verity_hdr),
|
||||
root_hash,
|
||||
root_hash_size,
|
||||
verity_hdr->salt,
|
||||
verity_hdr->salt_size);
|
||||
}
|
||||
@@ -2,7 +2,7 @@
|
||||
* cryptsetup volume key implementation
|
||||
*
|
||||
* Copyright (C) 2004-2006, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2010-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2010-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -15,7 +15,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
|
||||
@@ -1,11 +1,3 @@
|
||||
man8_MANS = cryptsetup.8
|
||||
|
||||
if VERITYSETUP
|
||||
man8_MANS += veritysetup.8
|
||||
endif
|
||||
|
||||
if REENCRYPT
|
||||
man8_MANS += cryptsetup-reencrypt.8
|
||||
endif
|
||||
|
||||
EXTRA_DIST = cryptsetup.8 veritysetup.8 cryptsetup-reencrypt.8
|
||||
EXTRA_DIST = cryptsetup.8
|
||||
@@ -1,210 +0,0 @@
|
||||
.TH CRYPTSETUP-REENCRYPT "8" "June 2012" "cryptsetup-reencrypt" "Maintenance Commands"
|
||||
.SH NAME
|
||||
cryptsetup-reencrypt - tool for offline LUKS device re-encryption
|
||||
.SH SYNOPSIS
|
||||
.B cryptsetup-reencrypt <options> <device>
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
Cryptsetup-reencrypt can be used to change reencryption parameters
|
||||
which otherwise require full on-disk data change (re-encryption).
|
||||
|
||||
You can regenerate \fBvolume key\fR (the real key used in on-disk encryption
|
||||
unclocked by passphrase), \fBcipher\fR, \fBcipher mode\fR.
|
||||
|
||||
Cryptsetup-reencrypt reencrypts data on LUKS device in-place. During
|
||||
reencryption process the LUKS device is marked unavailable.
|
||||
|
||||
\fIWARNING\fR: The cryptsetup-reencrypt program is not resistant to hardware
|
||||
or kernel failures during reencryption (you can lose you data in this case).
|
||||
|
||||
\fIALWAYS BE SURE YOU HAVE RELIABLE BACKUP BEFORE USING THIS TOOL.\fR
|
||||
.br
|
||||
\fITHIS TOOL IS EXPERIMENTAL.\fR
|
||||
|
||||
The reencryption can be temporarily suspended (by TERM signal or by
|
||||
using ctrl+c) but you need to retain temporary files named LUKS-<uuid>.[log|org|new].
|
||||
LUKS device is unavailable until reencryption is finished though.
|
||||
|
||||
Current working directory must by writable and temporary
|
||||
files created during reencryption must be present.
|
||||
|
||||
For more info about LUKS see cryptsetup(8).
|
||||
.PP
|
||||
.SH OPTIONS
|
||||
.TP
|
||||
To start (or continue) re-encryption for <device> use:
|
||||
.PP
|
||||
\fIcryptsetup-reencrypt\fR <device>
|
||||
|
||||
\fB<options>\fR can be [\-\-block-size, \-\-cipher, \-\-hash, \-\-iter-time,
|
||||
\-\-use-random | \-\-use-urandom, \-\-key-file, \-\-key-slot, \-\-keyfile-offset,
|
||||
\-\-keyfile-size, \-\-tries, \-\-use-directio, \-\-use-fsync, \-\-write-log]
|
||||
|
||||
For detailed description of encryption and key file options see \fIcryptsetup(8)\fR
|
||||
man page.
|
||||
.TP
|
||||
.B "\-\-verbose, \-v"
|
||||
Print more information on command execution.
|
||||
.TP
|
||||
.B "\-\-debug"
|
||||
Run in debug mode with full diagnostic logs. Debug output
|
||||
lines are always prefixed by '#'.
|
||||
.TP
|
||||
.B "\-\-cipher, \-c" \fI<cipher-spec>\fR
|
||||
Set the cipher specification string.
|
||||
.TP
|
||||
.B "\-\-key-size, \-s \fI<bits>\fR"
|
||||
Set key size in bits. The argument has to be a multiple of 8.
|
||||
|
||||
The possible key-sizes are limited by the cipher and mode used.
|
||||
|
||||
If you are increasing key size, there must be enough space in the LUKS header
|
||||
for enlarged keyslots (data offset must be large enough) or reencryption
|
||||
cannot be performed.
|
||||
|
||||
If there is not enough space for keyslots with new key size,
|
||||
you can destructively shrink device with \-\-reduce-device-size option.
|
||||
.TP
|
||||
.B "\-\-hash, \-h \fI<hash-spec>\fR"
|
||||
Specifies the hash used in the LUKS key setup scheme and volume key digest.
|
||||
.TP
|
||||
.B "\-\-iter-time, \-i \fI<milliseconds>\fR"
|
||||
The number of milliseconds to spend with PBKDF2 passphrase processing for the
|
||||
new LUKS header.
|
||||
.TP
|
||||
.B "\-\-use-random"
|
||||
.TP
|
||||
.B "\-\-use-urandom"
|
||||
Define which kernel random number generator will be used to create the volume key.
|
||||
.TP
|
||||
.B "\-\-key-file, \-d \fIname\fR"
|
||||
Read the passphrase from file.
|
||||
|
||||
WARNING: \-\-key-file option can be used only if there only one active keyslot,
|
||||
or alternatively, also if \-\-key-slot option is specified (then all other keyslots
|
||||
will be disabled in new LUKS device).
|
||||
|
||||
If this option is not used, cryptsetup-reencrypt will ask for all active keyslot
|
||||
passphrases.
|
||||
.TP
|
||||
.B "\-\-key-slot, \-S <0-7>"
|
||||
Specify which key slot is used.
|
||||
|
||||
WARNING: All other keyslots will be disabled if this option is used.
|
||||
.TP
|
||||
.B "\-\-keyfile-offset \fIvalue\fR"
|
||||
Skip \fIvalue\fR bytes at the beginning of the key file.
|
||||
.TP
|
||||
.B "\-\-keyfile-size, \-l"
|
||||
Read a maximum of \fIvalue\fR bytes from the key file.
|
||||
Default is to read the whole file up to the compiled-in
|
||||
maximum.
|
||||
.TP
|
||||
.B "\-\-tries, \-T"
|
||||
Number of retries for invalid passphrase entry.
|
||||
.TP
|
||||
.B "\-\-block-size, \-B \fIvalue\fR"
|
||||
Use re-encryption block size of <value> in MiB.
|
||||
|
||||
Values can be between 1 and 64 MiB.
|
||||
.TP
|
||||
.B "\-\-device-size \fIsize[units]\fR"
|
||||
Instead of real device size, use specified value.
|
||||
|
||||
It means that only specified area (from the start of the device
|
||||
to the specified size) will be reencrypted.
|
||||
|
||||
WARNING: This is destructive operation.
|
||||
|
||||
If no unit suffix is specified, the size is in bytes.
|
||||
|
||||
Unit suffix can be S for 512 byte sectors, K/M/G/T (or KiB,MiB,GiB,TiB)
|
||||
for units with 1024 base or KB/MB/GB/TB for 1000 base (SI scale).
|
||||
|
||||
WARNING: This is destructive operation.
|
||||
.TP
|
||||
.B "\-\-reduce-device-size \fIsize[units]\fR"
|
||||
Enlarge data offset to specified value by shrinking device size.
|
||||
|
||||
This means that last sectors on the original device will be lost,
|
||||
ciphertext data will be effectively shifted by specified
|
||||
number of sectors.
|
||||
|
||||
It can be usefull if you e.g. added some space to underlying
|
||||
partition (so last sectors contains no data).
|
||||
|
||||
For units suffix see \-\-device-size parameter description.
|
||||
|
||||
WARNING: This is destructive operation and cannot be reverted.
|
||||
Use with extreme care - shrinked filesystems are usually unrecoverable.
|
||||
|
||||
You cannot shrink device more than by 64 MiB (131072 sectors).
|
||||
.TP
|
||||
.B "\-\-new, N"
|
||||
Create new header (encrypt not yet encrypted device).
|
||||
|
||||
This option must be used together with \-\-reduce-device-size.
|
||||
|
||||
WARNING: This is destructive operation and cannot be reverted.
|
||||
|
||||
.TP
|
||||
.B "\-\-use-directio"
|
||||
Use direct-io (O_DIRECT) for all read/write data operations.
|
||||
|
||||
Usefull if direct-io operations perform better than normal buffered
|
||||
operations (e.g. in virtual environments).
|
||||
.TP
|
||||
.B "\-\-use-fsync"
|
||||
Use fsync call after every written block.
|
||||
.TP
|
||||
.B "\-\-write-log"
|
||||
Update log file after every block write. This can slow down reencryption
|
||||
but will minimize data loss in the case of system crash.
|
||||
.TP
|
||||
.B "\-\-batch-mode, \-q"
|
||||
Suppresses all warnings and reencryption progress output.
|
||||
.TP
|
||||
.B "\-\-version"
|
||||
Show the program version.
|
||||
.SH RETURN CODES
|
||||
Cryptsetup-reencrypt returns 0 on success and a non-zero value on error.
|
||||
|
||||
Error codes are: 1 wrong parameters, 2 no permission,
|
||||
3 out of memory, 4 wrong device specified, 5 device already exists
|
||||
or device is busy.
|
||||
.SH EXAMPLES
|
||||
.TP
|
||||
Reencrypt /dev/sdb1 (change volume key)
|
||||
cryptsetup-reencrypt /dev/sdb1
|
||||
.TP
|
||||
Reencrypt and also change cipher and cipher mode
|
||||
cryptsetup-reencrypt /dev/sdb1 -c aes-xts-plain64
|
||||
.TP
|
||||
Add LUKS encryption to not yet encrypted device
|
||||
|
||||
First, be sure you have space added to disk.
|
||||
Or alternatively shrink filesystem in advance.
|
||||
.br
|
||||
Here we need 4096 512-bytes sectors (enough for 2x128 bit key).
|
||||
|
||||
fdisk -u /dev/sdb # move sdb1 partition end + 4096 sectors
|
||||
|
||||
cryptsetup-reencrypt /dev/sdb1 --new --reduce-device-size 4096
|
||||
|
||||
.SH REPORTING BUGS
|
||||
Report bugs, including ones in the documentation, on
|
||||
the cryptsetup mailing list at <dm-crypt@saout.de>
|
||||
or in the 'Issues' section on LUKS website.
|
||||
Please attach the output of the failed command with the
|
||||
\-\-debug option added.
|
||||
.SH AUTHORS
|
||||
Cryptsetup-reencrypt was written by Milan Broz <gmazyland@gmail.com>.
|
||||
.SH COPYRIGHT
|
||||
Copyright \(co 2012 Milan Broz
|
||||
.br
|
||||
Copyright \(co 2012 Red Hat, Inc.
|
||||
|
||||
This is free software; see the source for copying conditions. There is NO
|
||||
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
.SH SEE ALSO
|
||||
The project website at \fBhttp://code.google.com/p/cryptsetup/\fR
|
||||
909
man/cryptsetup.8
909
man/cryptsetup.8
File diff suppressed because it is too large
Load Diff
@@ -1,141 +0,0 @@
|
||||
.TH VERITYSETUP "8" "June 2012" "veritysetup" "Maintenance Commands"
|
||||
.SH NAME
|
||||
veritysetup - manage dm-verity (block level verification) volumes
|
||||
.SH SYNOPSIS
|
||||
.B veritysetup <options> <action> <action args>
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
Veritysetup is used to configure dm-verity managed device-mapper mappings.
|
||||
|
||||
Device-mapper verity target provides read-only transparent integrity
|
||||
checking of block devices using kernel crypto API.
|
||||
|
||||
The dm-verity devices are always read-only.
|
||||
|
||||
Veritysetup supports these operations:
|
||||
.PP
|
||||
\fIformat\fR <data_device> <hash_device>
|
||||
.IP
|
||||
Calculates and permanently stores hash verification data for data_device.
|
||||
Hash area can be located on the same device after data if specified
|
||||
by \-\-hash\-offset option.
|
||||
|
||||
Note you need to provide root hash string for device verification
|
||||
or activation. Root hash must be trusted.
|
||||
|
||||
The data or hash device argument can be block device or file image.
|
||||
If hash device path doesn't exist, it will be created as file.
|
||||
|
||||
\fB<options>\fR can be [\-\-hash, \-\-no-superblock, \-\-format,
|
||||
\-\-data-block-size, \-\-hash-block-size, \-\-data-blocks, \-\-hash-offset,
|
||||
\-\-salt, \-\-uuid]
|
||||
.PP
|
||||
\fIcreate\fR <name> <data_device> <hash_device> <root_hash>
|
||||
.IP
|
||||
Creates a mapping with <name> backed by device <data_device> and using
|
||||
<hash_device> for in-kernel verification.
|
||||
|
||||
The <root_hash> is a hexadecimal string.
|
||||
|
||||
\fB<options>\fR can be [\-\-hash-offset, \-\-no-superblock]
|
||||
|
||||
If option \-\-no-superblock is used, you have to use as the same options
|
||||
as in initial format operation.
|
||||
.PP
|
||||
\fIverify\fR <data_device> <hash_device> <root_hash>
|
||||
.IP
|
||||
Verifies data on data_device with use of hash blocks stored on hash_device.
|
||||
|
||||
This command performs userspace verification, no kernel device is created.
|
||||
|
||||
The <root_hash> is a hexadecimal string.
|
||||
|
||||
\fB<options>\fR can be [\-\-hash-offset, \-\-no-superblock]
|
||||
|
||||
If option \-\-no-superblock is used, you have to use as the same options
|
||||
as in initial format operation.
|
||||
.PP
|
||||
\fIremove\fR <name>
|
||||
.IP
|
||||
Removes existing mapping <name>.
|
||||
.PP
|
||||
\fIstatus\fR <name>
|
||||
.IP
|
||||
Reports status for the active verity mapping <name>.
|
||||
.PP
|
||||
\fIdump\fR <hash_device>
|
||||
.IP
|
||||
Reports parameters of verity device from on-disk stored superblock.
|
||||
|
||||
\fB<options>\fR can be [\-\-no-superblock]
|
||||
.SH OPTIONS
|
||||
.TP
|
||||
.B "\-\-verbose, \-v"
|
||||
Print more information on command execution.
|
||||
.TP
|
||||
.B "\-\-debug"
|
||||
Run in debug mode with full diagnostic logs. Debug output
|
||||
lines are always prefixed by '#'.
|
||||
.TP
|
||||
.B "\-\-no-superblock"
|
||||
Create or use dm-verity without permanent on-disk superblock.
|
||||
.TP
|
||||
.B "\-\-format=number"
|
||||
Specifies the hash version type.
|
||||
Format type 0 is original Chrome OS verion. Format type 1 is current version.
|
||||
.TP
|
||||
.B "\-\-data-block-size=bytes"
|
||||
Used block size for the data device.
|
||||
(Note kernel supports only page-size as maximum here.)
|
||||
.TP
|
||||
.B "\-\-hash-block-size=bytes"
|
||||
Used block size for the hash device.
|
||||
(Note kernel supports only page-size as maximum here.)
|
||||
.TP
|
||||
.B "\-\-data-blocks=blocks"
|
||||
Size of data device used in verification.
|
||||
If not specified, the whole device is used.
|
||||
.TP
|
||||
.B "\-\-hash-offset=bytes"
|
||||
Offset of hash area/superblock on hash_device.
|
||||
Value must be aligned to disk sector offset.
|
||||
.TP
|
||||
.B "\-\-salt=hex string"
|
||||
Salt used for format or verification.
|
||||
Format is a hexadecimal string.
|
||||
.TP
|
||||
.B "\-\-uuid=UUID"
|
||||
Use the provided UUID for format command instead of generating new one.
|
||||
|
||||
The UUID must be provided in standard UUID format,
|
||||
e.g. 12345678-1234-1234-1234-123456789abc.
|
||||
.TP
|
||||
.B "\-\-version"
|
||||
Show the program version.
|
||||
.SH RETURN CODES
|
||||
Veritysetup returns 0 on success and a non-zero value on error.
|
||||
|
||||
Error codes are: 1 wrong parameters, 2 no permission,
|
||||
3 out of memory, 4 wrong device specified, 5 device already exists
|
||||
or device is busy.
|
||||
.SH REPORTING BUGS
|
||||
Report bugs, including ones in the documentation, on
|
||||
the cryptsetup mailing list at <dm-crypt@saout.de>
|
||||
or in the 'Issues' section on LUKS website.
|
||||
Please attach the output of the failed command with the
|
||||
\-\-debug option added.
|
||||
.SH AUTHORS
|
||||
The first implementation of veritysetup was written by Chrome OS authors.
|
||||
|
||||
This version is based on verification code written by Mikulas Patocka <mpatocka@redhat.com>
|
||||
and rewritten for libcryptsetup by Milan Broz <gmazyland@gmail.com>.
|
||||
.SH COPYRIGHT
|
||||
Copyright \(co 2012 Red Hat, Inc.
|
||||
|
||||
This is free software; see the source for copying conditions. There is NO
|
||||
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
.SH SEE ALSO
|
||||
The project website at \fBhttp://code.google.com/p/cryptsetup/\fR
|
||||
|
||||
The verity on-disk format specification available at
|
||||
\fBhttp://code.google.com/p/cryptsetup/wiki/DMVerity\fR
|
||||
@@ -1,17 +0,0 @@
|
||||
TARGET=luks_dict
|
||||
CFLAGS=-O2 -g -Wall -D_GNU_SOURCE
|
||||
LDLIBS=-lcryptsetup
|
||||
CC=gcc
|
||||
|
||||
SOURCES=$(wildcard *.c)
|
||||
OBJECTS=$(SOURCES:.c=.o)
|
||||
|
||||
all: $(TARGET)
|
||||
|
||||
$(TARGET): $(OBJECTS)
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
clean:
|
||||
rm -f *.o *~ core $(TARGET)
|
||||
|
||||
.PHONY: clean
|
||||
@@ -1,17 +0,0 @@
|
||||
Simple example how to use libcryptsetup
|
||||
for password search.
|
||||
|
||||
Run: luks_dict <device|image> <dictionary> [cpus]
|
||||
|
||||
<device|image> is LUKS device or image
|
||||
<dictionary> is list of passphrases to try
|
||||
(note trailing EOL is stripped)
|
||||
|
||||
cpus - number of processes to start in parallel
|
||||
|
||||
Format of dictionary file is simple one password per line,
|
||||
if first char on line s # it is skiped as comment.
|
||||
|
||||
You have it run as root (device-mapper cannot
|
||||
create dmcrypt devices as nrmal user. Code need
|
||||
to map keyslots as temporary dmcrypt device.)
|
||||
@@ -1,130 +0,0 @@
|
||||
/*
|
||||
* Example of LUKS password dictionary search
|
||||
*
|
||||
* Run this as root, e.g. ./luks_dict test.img /usr/share/john/password.lst 4
|
||||
*
|
||||
* Copyright (C) 2012 Milan Broz <asi@ucw.cz>
|
||||
*
|
||||
* This copyrighted material is made available to anyone wishing to use,
|
||||
* modify, copy, or redistribute it subject to the terms and conditions
|
||||
* of the GNU General Public License v.2.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/wait.h>
|
||||
#include <sys/prctl.h>
|
||||
#include <sys/time.h>
|
||||
#include <sys/resource.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
#define MAX_LEN 512
|
||||
|
||||
static void check(struct crypt_device *cd, const char *pwd_file, unsigned my_id, unsigned max_id)
|
||||
{
|
||||
FILE *f;
|
||||
int len, r = -1;
|
||||
unsigned long line = 0;
|
||||
char pwd[MAX_LEN];
|
||||
|
||||
if (fork())
|
||||
return;
|
||||
|
||||
/* open password file, now in separate process */
|
||||
f = fopen(pwd_file, "r");
|
||||
if (!f) {
|
||||
printf("Cannot open %s.\n", pwd_file);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
while (fgets(pwd, MAX_LEN, f)) {
|
||||
|
||||
/* every process tries N-th line, skip others */
|
||||
if (line++ % max_id != my_id)
|
||||
continue;
|
||||
|
||||
len = strlen(pwd);
|
||||
|
||||
/* strip EOL - this is like a input from tty */
|
||||
if (len && pwd[len - 1] == '\n') {
|
||||
pwd[len - 1] = '\0';
|
||||
len--;
|
||||
}
|
||||
|
||||
/* lines starting "#!comment" are comments */
|
||||
if (len >= 9 && !strncmp(pwd, "#!comment", 9)) {
|
||||
/* printf("skipping %s\n", pwd); */
|
||||
continue;
|
||||
}
|
||||
|
||||
/* printf("%d: checking %s\n", my_id, pwd); */
|
||||
r = crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT, pwd, len, 0);
|
||||
if (r >= 0) {
|
||||
printf("Found passphrase for slot %d: \"%s\"\n", r, pwd);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
fclose(f);
|
||||
crypt_free(cd);
|
||||
exit(r >= 0 ? 2 : EXIT_SUCCESS);
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
int i, status, procs = 4;
|
||||
struct crypt_device *cd;
|
||||
|
||||
if (argc < 3 || argc > 4) {
|
||||
printf("Use: %s <LUKS_device|file> <password file> [#processes] %d\n", argv[0], argc);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if (argc == 4 && (sscanf(argv[3], "%i", &procs) != 1 || procs < 1)) {
|
||||
printf("Wrong number of processes.\n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
/* crypt_set_debug_level(CRYPT_DEBUG_ALL); */
|
||||
|
||||
/*
|
||||
* Need to create temporary keyslot device-mapper devices and allocate loop if needed,
|
||||
* so root is requried here.
|
||||
*/
|
||||
if (getuid() != 0) {
|
||||
printf("You must be root to run this program.\n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
/* signal all children if anything happens */
|
||||
prctl(PR_SET_PDEATHSIG, SIGHUP);
|
||||
setpriority(PRIO_PROCESS, 0, -5);
|
||||
|
||||
/* we are not going to modify anything, so common init is ok */
|
||||
if (crypt_init(&cd, argv[1]) || crypt_load(cd, CRYPT_LUKS1, NULL)) {
|
||||
printf("Cannot open %s.\n", argv[1]);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
/* run scan in separate processes, it is up to scheduler to assign CPUs inteligently */
|
||||
for (i = 0; i < procs; i++)
|
||||
check(cd, argv[2], i, procs);
|
||||
|
||||
/* wait until at least one finishes with error or status 2 (key found) */
|
||||
while (wait(&status) != -1 && WIFEXITED(status)) {
|
||||
if (WEXITSTATUS(status) == EXIT_SUCCESS)
|
||||
continue;
|
||||
/* kill rest of processes */
|
||||
kill(0, SIGHUP);
|
||||
/* not reached */
|
||||
break;
|
||||
}
|
||||
exit(0);
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
Example of simple dracut module for reencryption of system
|
||||
LUKS drive on-the-fly.
|
||||
|
||||
Install in /usr/[share|lib]/dracut/modules.d/90reencrypt, then
|
||||
rebuild intramfs "with dracut -f -a reencrypt".
|
||||
|
||||
Dracut then recognize argument rd_REENCRYPT=name:size,
|
||||
e.g. rd_REENCRYPT=sda2:52G means only 52G of device
|
||||
will be reencrypted (default is whole device).
|
||||
(Name is kernel name of device.)
|
||||
|
||||
Note that reencryption context is stored in ramdisk, any
|
||||
fail can mean complete lost of data!
|
||||
|
||||
Copyright (C) 2012 Milan Broz <asi@ucw.cz>
|
||||
|
||||
This copyrighted material is made available to anyone wishing to use,
|
||||
modify, copy, or redistribute it subject to the terms and conditions
|
||||
of the GNU General Public License v.2.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software Foundation,
|
||||
Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
which cryptsetup-reencrypt >/dev/null 2>&1 || exit 1
|
||||
|
||||
exit 0
|
||||
@@ -1,6 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
inst cryptsetup-reencrypt
|
||||
|
||||
inst_hook cmdline 30 "$moddir/parse-reencrypt.sh"
|
||||
inst "$moddir"/reencrypt.sh /sbin/reencrypt
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
check() {
|
||||
[ -x /sbin/cryptsetup-reencrypt ] || return 1
|
||||
return 255
|
||||
}
|
||||
|
||||
depends() {
|
||||
echo dm rootfs-block
|
||||
return 0
|
||||
}
|
||||
|
||||
installkernel() {
|
||||
instmods dm_crypt =crypto
|
||||
}
|
||||
|
||||
install() {
|
||||
dracut_install cryptsetup-reencrypt
|
||||
|
||||
inst_hook cmdline 30 "$moddir/parse-reencrypt.sh"
|
||||
inst_simple "$moddir"/reencrypt.sh /sbin/reencrypt
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
REENC=$(getargs rd_REENCRYPT=)
|
||||
REENC_DEV=$(echo $REENC | sed 's/:.*//')
|
||||
REENC_SIZE=$(echo $REENC | sed -n 's/.*://p')
|
||||
|
||||
REENC_KEY=$(getargs rd_REENCRYPT_KEY=)
|
||||
if [ -z "$REENC_KEY" ] ; then
|
||||
REENC_KEY=none
|
||||
fi
|
||||
|
||||
if [ -n "$REENC_DEV" ] ; then
|
||||
{
|
||||
printf 'SUBSYSTEM!="block", GOTO="reenc_end"\n'
|
||||
printf 'ACTION!="add|change", GOTO="reenc_end"\n'
|
||||
printf 'KERNEL!="%s", GOTO="reenc_end"\n' $REENC_DEV
|
||||
printf 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="/sbin/initqueue \
|
||||
--unique --onetime --name crypt-reencrypt-%%k \
|
||||
/sbin/reencrypt $env{DEVNAME} %s"\n' "$REENC_KEY $REENC_SIZE"
|
||||
printf 'LABEL="reenc_end"\n'
|
||||
} > /etc/udev/rules.d/69-reencryption.rules
|
||||
fi
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# $1=$device [$2=keyfile|none [$3=size]]
|
||||
#
|
||||
|
||||
[ -d /sys/module/dm_crypt ] || modprobe dm_crypt
|
||||
|
||||
[ -f /tmp/reencrypted ] && exit 0
|
||||
|
||||
. /lib/dracut-lib.sh
|
||||
|
||||
# if device name is /dev/dm-X, convert to /dev/mapper/name
|
||||
if [ "${1##/dev/dm-}" != "$1" ]; then
|
||||
device="/dev/mapper/$(dmsetup info -c --noheadings -o name "$1")"
|
||||
else
|
||||
device="$1"
|
||||
fi
|
||||
|
||||
PARAMS="$device -T 1 --use-fsync -B 32"
|
||||
if [ -n "$3" ]; then
|
||||
PARAMS="$PARAMS --device-size $3"
|
||||
fi
|
||||
|
||||
reenc_readkey() {
|
||||
local keypath="${1#*:}"
|
||||
local keydev="${1%%:*}"
|
||||
|
||||
local mntp="/tmp/reencrypted-mount-tmp"
|
||||
mkdir "$mntp"
|
||||
mount -r "$keydev" "$mntp" && cat "$mntp/$keypath"
|
||||
umount "$mntp"
|
||||
rm -r "$mntp"
|
||||
}
|
||||
|
||||
reenc_run() {
|
||||
local cwd=$(pwd)
|
||||
cd /tmp
|
||||
if [ "$1" = "none" ] ; then
|
||||
/bin/plymouth ask-for-password \
|
||||
--prompt "LUKS password for REENCRYPTING $device" \
|
||||
--command="/sbin/cryptsetup-reencrypt $PARAMS"
|
||||
else
|
||||
info "REENCRYPT using key $1"
|
||||
reenc_readkey "$1" | /sbin/cryptsetup-reencrypt -d - $PARAMS
|
||||
fi
|
||||
cd $cwd
|
||||
}
|
||||
|
||||
info "REENCRYPT $device requested"
|
||||
# flock against other interactive activities
|
||||
{ flock -s 9;
|
||||
reenc_run $2
|
||||
} 9>/.console.lock
|
||||
|
||||
# do not ask again
|
||||
>> /tmp/reencrypted
|
||||
|
||||
exit 0
|
||||
@@ -1,14 +0,0 @@
|
||||
TARGETS=chk_luks_keyslots
|
||||
CFLAGS=-O0 -g -Wall -D_GNU_SOURCE
|
||||
LDLIBS=-lcryptsetup -lm
|
||||
CC=gcc
|
||||
|
||||
all: $(TARGETS)
|
||||
|
||||
chk_luks_keyslots: chk_luks_keyslots.o
|
||||
$(CC) -o $@ $^ $(LDLIBS)
|
||||
|
||||
clean:
|
||||
rm -f *.o *~ core $(TARGETS)
|
||||
|
||||
.PHONY: clean
|
||||
@@ -1,118 +0,0 @@
|
||||
Purpose
|
||||
=======
|
||||
|
||||
chk_luks_keyslots is a tool that searches the keyslot area of a
|
||||
LUKS container for positions where entropy is low and hence
|
||||
there is a high probability of damage from overwrites of parts
|
||||
of the key-slot with data such as a RAID superblock or a partition
|
||||
table.
|
||||
|
||||
|
||||
Installation
|
||||
============
|
||||
|
||||
1. Install the version of cryptsetup the tool came with.
|
||||
2. Compile with
|
||||
gcc -lm -lcryptsetup chk_luks_keyslots.c -o chk_luks_keyslots
|
||||
|
||||
Usage
|
||||
=====
|
||||
|
||||
Call chk_luks_keyslots without arguments for an option summary.
|
||||
|
||||
|
||||
Example of a good keyslot area:
|
||||
-------------------------------
|
||||
|
||||
root> ./chk_luks_keyslots /dev/loop0
|
||||
|
||||
parameters (commandline and LUKS header):
|
||||
sector size: 512
|
||||
threshold: 0.900000
|
||||
|
||||
- processing keyslot 0: start: 0x001000 end: 0x020400
|
||||
- processing keyslot 1: start: 0x021000 end: 0x040400
|
||||
- processing keyslot 2: start: 0x041000 end: 0x060400
|
||||
- processing keyslot 3: start: 0x061000 end: 0x080400
|
||||
- processing keyslot 4: start: 0x081000 end: 0x0a0400
|
||||
- processing keyslot 5: start: 0x0a1000 end: 0x0c0400
|
||||
- processing keyslot 6: start: 0x0c1000 end: 0x0e0400
|
||||
- processing keyslot 7: start: 0x0e1000 end: 0x100400
|
||||
|
||||
|
||||
Example of a fault in slot 8 at offset 0x100200:
|
||||
-----------------------------
|
||||
|
||||
root>./chk_luks_keyslots /dev/loop2
|
||||
|
||||
parameters (commandline and LUKS header):
|
||||
sector size: 512
|
||||
threshold: 0.900000
|
||||
|
||||
- processing keyslot 0: start: 0x001000 end: 0x020400
|
||||
- processing keyslot 1: start: 0x021000 end: 0x040400
|
||||
- processing keyslot 2: start: 0x041000 end: 0x060400
|
||||
- processing keyslot 3: start: 0x061000 end: 0x080400
|
||||
- processing keyslot 4: start: 0x081000 end: 0x0a0400
|
||||
- processing keyslot 5: start: 0x0a1000 end: 0x0c0400
|
||||
- processing keyslot 6: start: 0x0c1000 end: 0x0e0400
|
||||
- processing keyslot 7: start: 0x0e1000 end: 0x100400
|
||||
low entropy at: 0x100200 entropy: 0.846546
|
||||
|
||||
|
||||
Same as last, but verbose:
|
||||
--------------------------
|
||||
root>./chk_luks_keyslots -v /dev/loop2
|
||||
|
||||
parameters (commandline and LUKS header):
|
||||
sector size: 512
|
||||
threshold: 0.900000
|
||||
|
||||
- processing keyslot 0: start: 0x001000 end: 0x020400
|
||||
- processing keyslot 1: start: 0x021000 end: 0x040400
|
||||
- processing keyslot 2: start: 0x041000 end: 0x060400
|
||||
- processing keyslot 3: start: 0x061000 end: 0x080400
|
||||
- processing keyslot 4: start: 0x081000 end: 0x0a0400
|
||||
- processing keyslot 5: start: 0x0a1000 end: 0x0c0400
|
||||
- processing keyslot 6: start: 0x0c1000 end: 0x0e0400
|
||||
- processing keyslot 7: start: 0x0e1000 end: 0x100400
|
||||
low entropy at: 0x100200 entropy: 0.846546
|
||||
Binary dump:
|
||||
0x100200 BD 0E C7 A8 7D EF 04 F6 AF 83 DF 74 94 FE 04 56 ....}......t...V
|
||||
0x100210 3B 64 BD 68 A9 F6 CF 3C 37 CD 66 B7 17 4D 63 2B ;d.h...<7.f..Mc+
|
||||
0x100220 8F 6E 74 7E 96 7A 2B 27 32 1B F0 80 37 5A 9A 41 .nt~.z+'2...7Z.A
|
||||
0x100230 4A 6E CB C0 CF 39 95 45 92 90 E1 0B E6 08 EE 2A Jn...9.E.......*
|
||||
0x100240 FA 66 6D 67 49 89 76 B1 41 CD 24 57 AA 65 F7 69 .fmgI.v.A.$W.e.i
|
||||
0x100250 33 16 A7 C7 61 3D 43 B7 74 D6 86 83 1D 19 BF 85 3...a=C.t.......
|
||||
0x100260 E4 22 3E 16 66 1C B0 1E 11 0D D4 26 37 AD A4 02 .">.f......&7...
|
||||
0x100270 40 77 9A 5A B8 40 39 E3 A3 A0 96 08 4D 57 C5 0C @w.Z.@9.....MW..
|
||||
0x100280 D4 74 89 45 FA 93 F7 FE A7 9D D3 99 43 77 8E 35 .t.E........Cw.5
|
||||
0x100290 E0 55 90 3E 91 29 EA DB 5C 13 19 C9 83 CE D8 0C .U.>.)..\.......
|
||||
0x1002a0 85 7F 96 26 60 16 A0 0B E1 F9 01 13 1E 59 83 98 ...&`........Y..
|
||||
0x1002b0 06 B5 1D 6F B6 81 9D 60 58 70 15 30 29 42 32 C6 ...o...`Xp.0)B2.
|
||||
0x1002c0 A7 55 64 00 65 ED 41 1C B4 C1 C7 10 E1 8E 60 B0 .Ud.e.A.......`.
|
||||
0x1002d0 F0 9E 9C 40 5A 84 92 8D 21 F0 B8 2D 61 4E 21 9D ...@Z...!..-aN!.
|
||||
0x1002e0 FA B8 18 D3 47 A4 4F D4 AB 73 C0 93 F3 8E 9A 95 ....G.O..s......
|
||||
0x1002f0 A4 F1 6D EB 36 85 F4 F7 62 BA 26 D5 15 57 0D 0C ..m.6...b.&..W..
|
||||
0x100300 C9 4E 19 F2 5B 5A F5 54 B8 F4 B5 57 72 08 1B 7A .N..[Z.T...Wr..z
|
||||
0x100310 C3 66 7F 82 1E 75 92 C2 E9 97 64 5E F7 FB A9 05 .f...u....d^....
|
||||
0x100320 CF 30 C8 6A D1 35 9B 9D 22 52 22 46 0E 4B DE 53 .0.j.5.."R"F.K.S
|
||||
0x100330 68 C8 DA 5F C7 CA 31 D0 C9 B4 57 CF 0F 1F 4B 9C h.._..1...W...K.
|
||||
0x100340 DF 0C F8 7C F2 E3 32 52 3C 0D D2 DC 5C CF F0 00 ...|..2R<...\...
|
||||
0x100350 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x100360 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x100370 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x100380 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x100390 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x1003a0 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
|
||||
0x1003b0 B4 81 7A F0 BE 38 7E 00 A4 61 41 06 ED 7B 40 D9 ..z..8~..aA..{@.
|
||||
0x1003c0 BF 58 51 C9 CD 37 78 4D 4D B3 6E B4 7D 86 3C CB .XQ..7xMM.n.}.<.
|
||||
0x1003d0 D5 39 2E FC 78 B1 3E DE C0 7F 55 25 65 71 AD 2A .9..x.>...U%eq.*
|
||||
0x1003e0 1E 68 D3 3B 78 17 5F D2 08 93 50 88 D8 0A 75 4F .h.;x._...P...uO
|
||||
0x1003f0 E5 AA 26 0F B4 F7 F5 88 65 2B E4 92 18 08 32 9E ..&.....e+....2.
|
||||
|
||||
|
||||
----
|
||||
Copyright (C) 2012, Arno Wagner <arno@wagner.name>
|
||||
This file is free documentation; the author gives
|
||||
unlimited permission to copy, distribute and modify it.
|
||||
@@ -1,370 +0,0 @@
|
||||
/*
|
||||
* LUKS keyslot entropy tester. Works only for header version 1.
|
||||
*
|
||||
* Functionality: Determines sample entropy (symbols: bytes) for
|
||||
* each (by default) 512B sector in each used keyslot. If it
|
||||
* is lower than a threshold, the sector address is printed
|
||||
* as it is suspected of having non-"random" data in it, indicating
|
||||
* damage by overwriting. This can obviously not find overwriting
|
||||
* with random or random-like data (encrypted, compressed).
|
||||
*
|
||||
* Version history:
|
||||
* v0.1: 09.09.2012 Initial release
|
||||
* v0.2: 08.10.2012 Converted to use libcryptsetup
|
||||
*
|
||||
* Copyright (C) 2012, Arno Wagner <arno@wagner.name>
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <unistd.h>
|
||||
#include <ctype.h>
|
||||
#include <math.h>
|
||||
#include <fcntl.h>
|
||||
#include <inttypes.h>
|
||||
#include <libcryptsetup.h>
|
||||
|
||||
const char *help =
|
||||
"Version 0.2 [8.10.2012]\n"
|
||||
"\n"
|
||||
" chk_luks_keyslots [options] luks-device \n"
|
||||
"\n"
|
||||
"This tool checks all keyslots of a LUKS device for \n"
|
||||
"low entropy sections. If any are found, they are reported. \n"
|
||||
"This allows to find areas damaged by things like filesystem \n"
|
||||
"creation or RAID superblocks. \n"
|
||||
"\n"
|
||||
"Options: \n"
|
||||
" -t <num> Entropy threshold. Possible values 0.0 ... 1.0 \n"
|
||||
" Default: 0.90, which works well for 512B sectors.\n"
|
||||
" For 512B sectors, you will get frequent misdetections\n"
|
||||
" at thresholds around 0.94\n"
|
||||
" Higher value: more sensitive but more false detections.\n"
|
||||
" -s <num> Sector size. Must divide keyslot-size.\n"
|
||||
" Default: 512 Bytes.\n"
|
||||
" Values smaller than 128 are generally not very useful.\n"
|
||||
" For values smaller than the default, you need to adjust\n"
|
||||
" the threshold down to reduce misdetection. For values\n"
|
||||
" larger than the default you need to adjust the threshold\n"
|
||||
" up to retain sensitivity.\n"
|
||||
" -v Print found suspicuous sectors verbosely. \n"
|
||||
" -d Print decimal addresses instead of hex ones.\n"
|
||||
"\n";
|
||||
|
||||
|
||||
/* Config defaults */
|
||||
|
||||
static int sector_size = 512;
|
||||
static double threshold = 0.90;
|
||||
static int print_decimal = 0;
|
||||
static int verbose = 0;
|
||||
|
||||
/* tools */
|
||||
|
||||
/* Calculates and returns sample entropy on byte level for
|
||||
* The argument.
|
||||
*/
|
||||
static double ent_samp(unsigned char * buf, int len)
|
||||
{
|
||||
int freq[256]; /* stores symbol frequencies */
|
||||
int i;
|
||||
double e, f;
|
||||
|
||||
/* 0. Plausibility checks */
|
||||
if (len <= 0)
|
||||
return 0.0;
|
||||
|
||||
/* 1. count all frequencies */
|
||||
for (i = 0; i < 256; i++) {
|
||||
freq[i] = 0.0;
|
||||
}
|
||||
|
||||
for (i = 0; i < len; i ++)
|
||||
freq[buf[i]]++;
|
||||
|
||||
/* 2. calculate sample entropy */
|
||||
e = 0.0;
|
||||
for (i = 0; i < 256; i++) {
|
||||
f = freq[i];
|
||||
if (f > 0) {
|
||||
f = f / (double)len;
|
||||
e += f * log2(f);
|
||||
}
|
||||
}
|
||||
|
||||
if (e != 0.0)
|
||||
e = -1.0 * e;
|
||||
|
||||
e = e / 8.0;
|
||||
return e;
|
||||
}
|
||||
|
||||
static void print_address(FILE *out, uint64_t value)
|
||||
{
|
||||
if (print_decimal) {
|
||||
fprintf(out,"%08" PRIu64 " ", value);
|
||||
} else {
|
||||
fprintf(out,"%#08" PRIx64 " ", value);
|
||||
}
|
||||
}
|
||||
|
||||
/* uses default "hd" style, i.e. 16 bytes followed by ASCII */
|
||||
static void hexdump_line(FILE *out, uint64_t address, unsigned char *buf) {
|
||||
int i;
|
||||
static char tbl[16] = "0123456789ABCDEF";
|
||||
|
||||
fprintf(out," ");
|
||||
print_address(out, address);
|
||||
fprintf(out," ");
|
||||
|
||||
/* hex */
|
||||
for (i = 0; i < 16; i++) {
|
||||
fprintf(out, "%c%c",
|
||||
tbl[(unsigned char)buf[i]>> 4],
|
||||
tbl[(unsigned char)buf[i] & 0x0f]);
|
||||
fprintf(out," ");
|
||||
if (i == 7)
|
||||
fprintf(out," ");
|
||||
}
|
||||
|
||||
fprintf(out," ");
|
||||
|
||||
/* ascii */
|
||||
for (i = 0; i < 16; i++) {
|
||||
if (isprint(buf[i])) {
|
||||
fprintf(out, "%c", buf[i]);
|
||||
} else {
|
||||
fprintf(out, ".");
|
||||
}
|
||||
}
|
||||
fprintf(out, "\n");
|
||||
}
|
||||
|
||||
static void hexdump_sector(FILE *out, unsigned char *buf, uint64_t address, int len)
|
||||
{
|
||||
int done;
|
||||
|
||||
done = 0;
|
||||
while (len - done >= 16) {
|
||||
hexdump_line(out, address + done, buf + done);
|
||||
done += 16;
|
||||
}
|
||||
}
|
||||
|
||||
static int check_keyslots(FILE *out, struct crypt_device *cd, int f_luks)
|
||||
{
|
||||
int i;
|
||||
double ent;
|
||||
off_t ofs;
|
||||
uint64_t start, length, end;
|
||||
crypt_keyslot_info ki;
|
||||
unsigned char buffer[sector_size];
|
||||
|
||||
for (i = 0; i < crypt_keyslot_max(CRYPT_LUKS1) ; i++) {
|
||||
fprintf(out, "- processing keyslot %d:", i);
|
||||
ki = crypt_keyslot_status(cd, i);
|
||||
if (ki == CRYPT_SLOT_INACTIVE) {
|
||||
fprintf(out, " keyslot not in use\n");
|
||||
continue;
|
||||
}
|
||||
|
||||
if (ki == CRYPT_SLOT_INVALID) {
|
||||
fprintf(out, "\nError: keyslot invalid.\n");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
|
||||
if (crypt_keyslot_area(cd, i, &start, &length) < 0) {
|
||||
fprintf(stderr,"\nError: querying keyslot area failed for slot %d\n", i);
|
||||
perror(NULL);
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
end = start + length;
|
||||
|
||||
fprintf(out, " start: ");
|
||||
print_address(out, start);
|
||||
fprintf(out, " end: ");
|
||||
print_address(out, end);
|
||||
fprintf(out, "\n");
|
||||
|
||||
/* check whether sector-size divides size */
|
||||
if (length % sector_size != 0) {
|
||||
fprintf(stderr,"\nError: Argument to -s does not divide keyslot size\n");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
|
||||
for (ofs = start; (uint64_t)ofs < end; ofs += sector_size) {
|
||||
if (lseek(f_luks, ofs, SEEK_SET) != ofs) {
|
||||
fprintf(stderr,"\nCannot seek to keyslot area.\n");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
if (read(f_luks, buffer, sector_size) != sector_size) {
|
||||
fprintf(stderr,"\nCannot read keyslot area.\n");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
ent = ent_samp(buffer, sector_size);
|
||||
if (ent < threshold) {
|
||||
fprintf(out, " low entropy at: ");
|
||||
print_address(out, ofs);
|
||||
fprintf(out, " entropy: %f\n", ent);
|
||||
if (verbose) {
|
||||
fprintf(out, " Binary dump:\n");
|
||||
hexdump_sector(out, buffer, (uint64_t)ofs, sector_size);
|
||||
fprintf(out,"\n");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return EXIT_SUCCESS;
|
||||
}
|
||||
|
||||
/* Main */
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
/* for option processing */
|
||||
int c, r;
|
||||
char *device;
|
||||
|
||||
/* for use of libcryptsetup */
|
||||
struct crypt_device *cd;
|
||||
|
||||
/* Other vars */
|
||||
int f_luks; /* device file for the luks device */
|
||||
FILE *out;
|
||||
|
||||
/* temporary helper vars */
|
||||
int res;
|
||||
|
||||
/* getopt values */
|
||||
char *s, *end;
|
||||
double tvalue;
|
||||
int svalue;
|
||||
|
||||
/* global initializations */
|
||||
out = stdout;
|
||||
|
||||
/* get commandline parameters */
|
||||
while ((c = getopt (argc, argv, "t:s:vd")) != -1) {
|
||||
switch (c) {
|
||||
case 't':
|
||||
s = optarg;
|
||||
tvalue = strtod(s, &end);
|
||||
if (s == end) {
|
||||
fprintf(stderr, "\nError: Parsing of argument to -t failed.\n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if (tvalue < 0.0 || tvalue > 1.0) {
|
||||
fprintf(stderr,"\nError: Argument to -t must be in 0.0 ... 1.0\n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
threshold = tvalue;
|
||||
break;
|
||||
case 's':
|
||||
s = optarg;
|
||||
svalue = strtol(s, &end, 10);
|
||||
if (s == end) {
|
||||
fprintf(stderr, "\nError: Parsing of argument to -s failed.\n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
if (svalue < 1) {
|
||||
fprintf(stderr,"\nError: Argument to -s must be >= 1 \n");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
sector_size = svalue;
|
||||
break;
|
||||
case 'v':
|
||||
verbose = 1;
|
||||
break;
|
||||
case 'd':
|
||||
print_decimal = 1;
|
||||
break;
|
||||
case '?':
|
||||
if (optopt == 't' || optopt == 's')
|
||||
fprintf (stderr,"\nError: Option -%c requires an argument.\n",
|
||||
optopt);
|
||||
else if (isprint (optopt)) {
|
||||
fprintf(stderr,"\nError: Unknown option `-%c'.\n", optopt);
|
||||
fprintf(stderr,"\n\n%s", help);
|
||||
} else {
|
||||
fprintf (stderr, "\nError: Unknown option character `\\x%x'.\n",
|
||||
optopt);
|
||||
fprintf(stderr,"\n\n%s", help);
|
||||
}
|
||||
exit(EXIT_SUCCESS);
|
||||
default:
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
}
|
||||
|
||||
/* parse non-option stuff. Should be exactly one, the device. */
|
||||
if (optind+1 != argc) {
|
||||
fprintf(stderr,"\nError: exactly one non-option argument expected!\n");
|
||||
fprintf(stderr,"\n\n%s", help);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
device = argv[optind];
|
||||
|
||||
/* test whether we can open and read device */
|
||||
/* This is neded as we are reading the actual data
|
||||
* in the keyslots dirtectly from the LUKS container.
|
||||
*/
|
||||
f_luks = open(device, O_RDONLY);
|
||||
if (f_luks == -1) {
|
||||
fprintf(stderr,"\nError: Opening of device %s failed:\n", device);
|
||||
perror(NULL);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
/* now get the parameters we need via libcryptsetup */
|
||||
/* Basically we need all active keyslots and their placement on disk */
|
||||
|
||||
/* first init. This does the following:
|
||||
* - gets us a crypt_device struct with some values filled in
|
||||
* Note: This does some init stuff we do not need, but that
|
||||
* should not cause trouble.
|
||||
*/
|
||||
|
||||
res = crypt_init(&cd, device);
|
||||
if (res < 0) {
|
||||
fprintf(stderr, "crypt_init() failed. Maybe not running as root?\n");
|
||||
close(f_luks);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
/* now load LUKS header into the crypt_device
|
||||
* This should also make sure a valid LUKS1 header is on disk
|
||||
* and hence we should be able to skip magic and version checks.
|
||||
*/
|
||||
res = crypt_load(cd, CRYPT_LUKS1, NULL);
|
||||
if (res < 0) {
|
||||
fprintf(stderr, "crypt_load() failed. LUKS header too broken/absent?\n");
|
||||
crypt_free(cd);
|
||||
close(f_luks);
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
|
||||
fprintf(out, "\nparameters (commandline and LUKS header):\n");
|
||||
fprintf(out, " sector size: %d\n", sector_size);
|
||||
fprintf(out, " threshold: %0f\n\n", threshold);
|
||||
|
||||
r = check_keyslots(out, cd, f_luks);
|
||||
|
||||
crypt_free(cd);
|
||||
close(f_luks);
|
||||
return r;
|
||||
}
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
# Try to get LUKS info and master key from active mapping and prepare parameters for cryptsetup.
|
||||
#
|
||||
# Copyright (C) 2010,2011,2012 Milan Broz <asi@ucw.cz>
|
||||
# Copyright (C) 2010,2011 Milan Broz <asi@ucw.cz>
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing to use,
|
||||
# modify, copy, or redistribute it subject to the terms and conditions
|
||||
@@ -10,24 +10,13 @@
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software Foundation,
|
||||
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
# Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
#
|
||||
umask 0077
|
||||
|
||||
fail() { echo -e $1 ; exit 1 ; }
|
||||
field() { echo $(dmsetup table --target crypt --showkeys $DEVICE | sed 's/.*: //' | cut -d' ' -f$1) ; }
|
||||
field_uuid() { echo $(dmsetup info $1 --noheadings -c -o uuid) ; }
|
||||
field_device() {
|
||||
TEMP=$(readlink /sys/dev/block/$1 | sed -e 's/.*\///')
|
||||
if [ ${TEMP:0:3} = "dm-" -a -e /sys/block/$TEMP/dm/name ] ; then
|
||||
TEMP=/dev/mapper/$(cat /sys/block/$TEMP/dm/name)
|
||||
else
|
||||
TEMP=/dev/$TEMP
|
||||
fi
|
||||
echo $TEMP
|
||||
}
|
||||
field_cryptsetup() { echo $(cryptsetup status $DEVICE | grep $1 | sed "s/.*$1:\s*//;s/\ .*//") ; }
|
||||
|
||||
which readlink >/dev/null || fail "You need readlink (part of coreutils package)."
|
||||
which xxd >/dev/null || fail "You need xxd (part of vim package) installed to convert key."
|
||||
|
||||
[ -z "$2" ] && fail "Recover LUKS header from active mapping, use:\n $0 crypt_mapped_device mk_file_name"
|
||||
@@ -37,23 +26,20 @@ MK_FILE=$2
|
||||
|
||||
[ -z "$(field 4)" ] && fail "Mapping $1 not active or it is not crypt target."
|
||||
|
||||
CIPHER=$(field 4)
|
||||
OFFSET=$(field 8)
|
||||
SYS_DEVICE=$(field 7)
|
||||
REAL_DEVICE=$(field_device $SYS_DEVICE)
|
||||
# FIXME:
|
||||
# - add UUID
|
||||
# - check for CRYPT-LUKS1-* DM-UUID
|
||||
|
||||
CIPHER=$(field_cryptsetup cipher)
|
||||
OFFSET=$(field_cryptsetup offset)
|
||||
REAL_DEVICE=$(field_cryptsetup device)
|
||||
KEY_SIZE=$(field_cryptsetup keysize)
|
||||
KEY=$(field 5)
|
||||
KEY_SIZE=$(( ${#KEY} / 2 * 8 ))
|
||||
SYS_UUID=$(field_uuid $DEVICE)
|
||||
UUID="${SYS_UUID:12:8}-${SYS_UUID:20:4}-${SYS_UUID:24:4}-${SYS_UUID:28:4}-${SYS_UUID:32:12}"
|
||||
|
||||
#echo "CIPHER=$CIPHER OFFSET=$OFFSET SYS_DEVICE=$SYS_DEVICE REAL_DEVICE=$REAL_DEVICE KEY_SIZE=$KEY_SIZE KEY=$KEY UUID=$UUID SYS_UUID=$SYS_UUID"
|
||||
|
||||
[ -z "$CIPHER" -o -z "$OFFSET" -o "$OFFSET" -le 383 -o \
|
||||
-z "$KEY" -o -z "$UUID" -o -z "$REAL_DEVICE" -o "${SYS_UUID:0:12}" != "CRYPT-LUKS1-" ] && \
|
||||
fail "Incompatible device, sorry."
|
||||
[ -z "$CIPHER" -o -z "$OFFSET" -o "$OFFSET" -le 383 -o -z "$KEY" ] && fail "Incompatible device, sorry."
|
||||
|
||||
echo "Generating master key to file $MK_FILE."
|
||||
echo -E -n $KEY| xxd -r -p >$MK_FILE
|
||||
|
||||
echo "You can now try to reformat LUKS device using:"
|
||||
echo " cryptsetup luksFormat -c $CIPHER -s $KEY_SIZE --align-payload=$OFFSET --master-key-file=$MK_FILE --uuid=$UUID $REAL_DEVICE"
|
||||
echo " cryptsetup luksFormat -c $CIPHER -s $KEY_SIZE --align-payload=$OFFSET --master-key-file=$MK_FILE $REAL_DEVICE"
|
||||
|
||||
@@ -7,5 +7,4 @@ it
|
||||
nl
|
||||
pl
|
||||
sv
|
||||
uk
|
||||
vi
|
||||
|
||||
@@ -5,16 +5,10 @@ lib/utils.c
|
||||
lib/crypt_plain.c
|
||||
lib/utils_crypt.c
|
||||
lib/utils_loop.c
|
||||
lib/utils_fips.c
|
||||
lib/utils_device.c
|
||||
lib/utils_debug.c
|
||||
lib/luks1/af.c
|
||||
lib/luks1/keyencryption.c
|
||||
lib/luks1/keymanage.c
|
||||
lib/luks1/pbkdf.c
|
||||
lib/loopaes/loopaes.c
|
||||
lib/verity/verity.c
|
||||
lib/verity/verity_hash.c
|
||||
src/cryptsetup.c
|
||||
src/veritysetup.c
|
||||
src/cryptsetup_reencrypt.c
|
||||
src/utils_tools.c
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
INCLUDES = -I$(top_srcdir)/lib $(PYTHON_INCLUDES)
|
||||
EXTRA_DIST = pycryptsetup-test.py
|
||||
CLEANFILES = *.img
|
||||
|
||||
if PYTHON_CRYPTSETUP
|
||||
TESTS = pycryptsetup-test.py
|
||||
|
||||
pyexec_LTLIBRARIES = pycryptsetup.la
|
||||
|
||||
pycryptsetup_la_SOURCES = pycryptsetup.c
|
||||
pycryptsetup_la_CPPFLAGS = $(AM_CPPFLAGS) $(PYTHON_CPPFLAGS) -fno-strict-aliasing
|
||||
pycryptsetup_la_LDFLAGS = -avoid-version -module
|
||||
pycryptsetup_la_LIBADD = $(top_builddir)/lib/libcryptsetup.la -lpython$(PYTHON_VERSION)
|
||||
else
|
||||
all:
|
||||
endif
|
||||
@@ -1,131 +0,0 @@
|
||||
#!/usr/bin/python
|
||||
#
|
||||
# Python bindings to libcryptsetup test
|
||||
#
|
||||
# Copyright (C) 2011, Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This file is free software; you can redistribute it and/or
|
||||
# modify it under the terms of the GNU Lesser General Public
|
||||
# License as published by the Free Software Foundation; either
|
||||
# version 2.1 of the License, or (at your option) any later version.
|
||||
#
|
||||
# This file is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
# Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public
|
||||
# License along with this file; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
import sys
|
||||
import os
|
||||
|
||||
sys.path.insert(0, ".libs")
|
||||
import pycryptsetup
|
||||
|
||||
IMG = "test.img"
|
||||
PASSWORD = "password"
|
||||
PASSWORD2 = "password2"
|
||||
DEVICE = "pycryptsetup_test_dev"
|
||||
|
||||
def log(level, txt):
|
||||
if level == pycryptsetup.CRYPT_LOG_ERROR:
|
||||
print txt,
|
||||
return
|
||||
|
||||
def askyes(txt):
|
||||
print "Question:", txt
|
||||
return 1
|
||||
|
||||
def askpassword(txt):
|
||||
return PASSWORD
|
||||
|
||||
def print_status(c):
|
||||
r = c.status()
|
||||
print "status :",
|
||||
if r == pycryptsetup.CRYPT_ACTIVE:
|
||||
print "ACTIVE"
|
||||
elif r == pycryptsetup.CRYPT_INACTIVE:
|
||||
print "INACTIVE"
|
||||
else:
|
||||
print "ERROR"
|
||||
return
|
||||
|
||||
if os.geteuid() != 0:
|
||||
print "WARNING: You must be root to run this test, test skipped."
|
||||
sys.exit(0)
|
||||
|
||||
os.system("dd if=/dev/zero of=" + IMG + " bs=1M count=32 >/dev/null 2>&1")
|
||||
|
||||
c = pycryptsetup.CryptSetup(
|
||||
device = IMG,
|
||||
name = DEVICE,
|
||||
yesDialog = askyes,
|
||||
logFunc = log,
|
||||
passwordDialog = askpassword)
|
||||
|
||||
#c.debugLevel(pycryptsetup.CRYPT_DEBUG_ALL);
|
||||
c.debugLevel(pycryptsetup.CRYPT_DEBUG_NONE);
|
||||
c.iterationTime(1)
|
||||
r = c.isLuks()
|
||||
print "isLuks :", r
|
||||
c.askyes(message = "Is there anybody out there?")
|
||||
c.log(priority = pycryptsetup.CRYPT_LOG_ERROR, message = "Nobody there...\n")
|
||||
c.luksFormat(cipher = "aes", cipherMode= "xts-plain64", keysize = 512)
|
||||
print "isLuks :", c.isLuks()
|
||||
print "luksUUID:", c.luksUUID()
|
||||
print "addKeyVK:", c.addKeyByVolumeKey(newPassphrase = PASSWORD, slot = 2)
|
||||
print "addKeyP :", c.addKeyByPassphrase(passphrase = PASSWORD,
|
||||
newPassphrase = PASSWORD2, slot = 3)
|
||||
print "removeP :", c.removePassphrase(passphrase = PASSWORD2)
|
||||
print "addKeyP :", c.addKeyByPassphrase(PASSWORD, PASSWORD2)
|
||||
# original api required wrong passphrase parameter here
|
||||
# print "killSlot:", c.killSlot(passphrase = "xxx", slot = 0)
|
||||
print "killSlot:", c.killSlot(slot = 0)
|
||||
print "activate:", c.activate(name = DEVICE, passphrase = PASSWORD)
|
||||
print "suspend :", c.suspend()
|
||||
# os.system("dmsetup info -c " + DEVICE)
|
||||
print "resume :", c.resume(passphrase = PASSWORD)
|
||||
print_status(c)
|
||||
info = c.info()
|
||||
print "cipher :", info["cipher"]
|
||||
print "cmode :", info["cipher_mode"]
|
||||
print "keysize :", info["keysize"]
|
||||
print "dir :", info["dir"]
|
||||
print "device :", info["device"]
|
||||
print "offset :", info["offset"]
|
||||
print "name :", info["name"]
|
||||
print "uuid :", info["uuid"]
|
||||
# os.system("cryptsetup luksDump " + info["device"])
|
||||
print "deact. :", c.deactivate()
|
||||
|
||||
del c
|
||||
|
||||
c = pycryptsetup.CryptSetup(
|
||||
device = IMG,
|
||||
name = DEVICE,
|
||||
yesDialog = askyes,
|
||||
logFunc = log,
|
||||
passwordDialog = askpassword)
|
||||
|
||||
print "activate:", c.activate(name = DEVICE, passphrase = PASSWORD)
|
||||
|
||||
c2 = pycryptsetup.CryptSetup(
|
||||
name = DEVICE,
|
||||
yesDialog = askyes,
|
||||
logFunc = log,
|
||||
passwordDialog = askpassword)
|
||||
|
||||
info = c2.info()
|
||||
print "cipher :", info["cipher"]
|
||||
print "cmode :", info["cipher_mode"]
|
||||
print "keysize :", info["keysize"]
|
||||
|
||||
print "deact. :", c.deactivate()
|
||||
r = c2.deactivate()
|
||||
print "deact. :", r
|
||||
del c
|
||||
del c2
|
||||
|
||||
os.remove(IMG)
|
||||
@@ -1,713 +0,0 @@
|
||||
/*
|
||||
* Python bindings to libcryptsetup
|
||||
*
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Written by Martin Sivak
|
||||
*
|
||||
* This file is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 2.1 of the License, or (at your option) any later version.
|
||||
*
|
||||
* This file is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this file; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include <Python.h>
|
||||
#include <structmember.h>
|
||||
#include <errno.h>
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
|
||||
typedef struct {
|
||||
PyObject_HEAD
|
||||
|
||||
/* Type-specific fields go here. */
|
||||
struct crypt_device *device;
|
||||
char *activated_as;
|
||||
|
||||
/* Callbacks */
|
||||
PyObject *yesDialogCB;
|
||||
PyObject *cmdLineLogCB;
|
||||
PyObject *passwordDialogCB;
|
||||
} CryptSetupObject;
|
||||
|
||||
static int yesDialog(const char *msg, void *this)
|
||||
{
|
||||
CryptSetupObject *self = this;
|
||||
PyObject *result, *arglist;
|
||||
int r;
|
||||
|
||||
if (self->yesDialogCB){
|
||||
arglist = Py_BuildValue("(s)", msg);
|
||||
if (!arglist)
|
||||
return -ENOMEM;
|
||||
|
||||
result = PyEval_CallObject(self->yesDialogCB, arglist);
|
||||
Py_DECREF(arglist);
|
||||
|
||||
if (!result)
|
||||
return -EINVAL;
|
||||
|
||||
if (!PyArg_Parse(result, "i", &r))
|
||||
r = -EINVAL;
|
||||
|
||||
Py_DECREF(result);
|
||||
return r;
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int passwordDialog(const char *msg, char *buf, size_t length, void *this)
|
||||
{
|
||||
CryptSetupObject *self = this;
|
||||
PyObject *result, *arglist;
|
||||
size_t len;
|
||||
char *res = NULL;
|
||||
|
||||
if(self->passwordDialogCB){
|
||||
arglist = Py_BuildValue("(s)", msg);
|
||||
if (!arglist)
|
||||
return -ENOMEM;
|
||||
|
||||
result = PyEval_CallObject(self->passwordDialogCB, arglist);
|
||||
Py_DECREF(arglist);
|
||||
|
||||
if (!result)
|
||||
return -EINVAL;
|
||||
|
||||
if (!PyArg_Parse(result, "z", &res)) {
|
||||
Py_DECREF(result);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
strncpy(buf, res, length - 1);
|
||||
len = strlen(res);
|
||||
|
||||
memset(res, 0, len);
|
||||
Py_DECREF(result);
|
||||
|
||||
return (int)len;
|
||||
}
|
||||
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
static void cmdLineLog(int cls, const char *msg, void *this)
|
||||
{
|
||||
CryptSetupObject *self = this;
|
||||
PyObject *result, *arglist;
|
||||
|
||||
if(self->cmdLineLogCB) {
|
||||
arglist = Py_BuildValue("(is)", cls, msg);
|
||||
if(!arglist)
|
||||
return;
|
||||
|
||||
result = PyEval_CallObject(self->cmdLineLogCB, arglist);
|
||||
Py_DECREF(arglist);
|
||||
Py_XDECREF(result);
|
||||
}
|
||||
}
|
||||
|
||||
static void CryptSetup_dealloc(CryptSetupObject* self)
|
||||
{
|
||||
/* free the callbacks */
|
||||
Py_XDECREF(self->yesDialogCB);
|
||||
Py_XDECREF(self->cmdLineLogCB);
|
||||
Py_XDECREF(self->passwordDialogCB);
|
||||
|
||||
free(self->activated_as);
|
||||
|
||||
crypt_free(self->device);
|
||||
|
||||
/* free self */
|
||||
self->ob_type->tp_free((PyObject*)self);
|
||||
}
|
||||
|
||||
static PyObject *CryptSetup_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
CryptSetupObject *self = (CryptSetupObject *)type->tp_alloc(type, 0);
|
||||
|
||||
if (self) {
|
||||
self->yesDialogCB = NULL;
|
||||
self->passwordDialogCB = NULL;
|
||||
self->cmdLineLogCB = NULL;
|
||||
self->activated_as = NULL;
|
||||
}
|
||||
|
||||
return (PyObject *)self;
|
||||
}
|
||||
|
||||
static PyObject *PyObjectResult(int is)
|
||||
{
|
||||
PyObject *result = Py_BuildValue("i", is);
|
||||
|
||||
if (!result)
|
||||
PyErr_SetString(PyExc_RuntimeError, "Error during constructing values for return value");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#define CryptSetup_HELP "CryptSetup object\n\n\
|
||||
constructor takes one to five arguments:\n\
|
||||
__init__(device, name, yesDialog, passwordDialog, logFunc)\n\n\
|
||||
yesDialog - python function with func(text) signature, \n\
|
||||
which asks the user question text and returns 1\n\
|
||||
of the answer was positive or 0 if not\n\
|
||||
logFunc - python function with func(level, text) signature to log stuff somewhere"
|
||||
|
||||
static int CryptSetup_init(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"device", "name", "yesDialog", "passwordDialog", "logFunc", NULL};
|
||||
PyObject *yesDialogCB = NULL,
|
||||
*passwordDialogCB = NULL,
|
||||
*cmdLineLogCB = NULL,
|
||||
*tmp = NULL;
|
||||
char *device = NULL, *deviceName = NULL;
|
||||
int r;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzOOO", kwlist, &device, &deviceName,
|
||||
&yesDialogCB, &passwordDialogCB, &cmdLineLogCB))
|
||||
return -1;
|
||||
|
||||
if (device) {
|
||||
if (crypt_init(&(self->device), device)) {
|
||||
PyErr_SetString(PyExc_IOError, "Device cannot be opened");
|
||||
return -1;
|
||||
}
|
||||
/* Try to load header form device */
|
||||
r = crypt_load(self->device, NULL, NULL);
|
||||
if (r && r != -EINVAL) {
|
||||
PyErr_SetString(PyExc_RuntimeError, "Cannot initialize device context");
|
||||
return -1;
|
||||
}
|
||||
} else if (deviceName) {
|
||||
if (crypt_init_by_name(&(self->device), deviceName)) {
|
||||
PyErr_SetString(PyExc_IOError, "Device cannot be opened");
|
||||
return -1;
|
||||
}
|
||||
/* Context is initialized automatically from active device */
|
||||
} else {
|
||||
PyErr_SetString(PyExc_RuntimeError, "Either device file or luks name has to be specified");
|
||||
return -1;
|
||||
}
|
||||
|
||||
if(deviceName)
|
||||
self->activated_as = strdup(deviceName);
|
||||
|
||||
if (yesDialogCB) {
|
||||
tmp = self->yesDialogCB;
|
||||
Py_INCREF(yesDialogCB);
|
||||
self->yesDialogCB = yesDialogCB;
|
||||
Py_XDECREF(tmp);
|
||||
crypt_set_confirm_callback(self->device, yesDialog, self);
|
||||
}
|
||||
|
||||
if (passwordDialogCB) {
|
||||
tmp = self->passwordDialogCB;
|
||||
Py_INCREF(passwordDialogCB);
|
||||
self->passwordDialogCB = passwordDialogCB;
|
||||
Py_XDECREF(tmp);
|
||||
crypt_set_password_callback(self->device, passwordDialog, self);
|
||||
}
|
||||
|
||||
if (cmdLineLogCB) {
|
||||
tmp = self->cmdLineLogCB;
|
||||
Py_INCREF(cmdLineLogCB);
|
||||
self->cmdLineLogCB = cmdLineLogCB;
|
||||
Py_XDECREF(tmp);
|
||||
crypt_set_log_callback(self->device, cmdLineLog, self);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#define CryptSetup_activate_HELP "Activate LUKS device\n\n\
|
||||
activate(name)"
|
||||
|
||||
static PyObject *CryptSetup_activate(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"name", "passphrase", NULL};
|
||||
char *name = NULL, *passphrase = NULL;
|
||||
int is;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "s|s", kwlist, &name, &passphrase))
|
||||
return NULL;
|
||||
|
||||
// FIXME: allow keyfile and \0 in passphrase
|
||||
is = crypt_activate_by_passphrase(self->device, name, CRYPT_ANY_SLOT,
|
||||
passphrase, passphrase ? strlen(passphrase) : 0, 0);
|
||||
|
||||
if (is >= 0) {
|
||||
free(self->activated_as);
|
||||
self->activated_as = strdup(name);
|
||||
}
|
||||
|
||||
return PyObjectResult(is);
|
||||
}
|
||||
|
||||
#define CryptSetup_deactivate_HELP "Dectivate LUKS device\n\n\
|
||||
deactivate()"
|
||||
|
||||
static PyObject *CryptSetup_deactivate(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
int is = crypt_deactivate(self->device, self->activated_as);
|
||||
|
||||
if (!is) {
|
||||
free(self->activated_as);
|
||||
self->activated_as = NULL;
|
||||
}
|
||||
|
||||
return PyObjectResult(is);
|
||||
}
|
||||
|
||||
#define CryptSetup_askyes_HELP "Asks a question using the configured dialog CB\n\n\
|
||||
int askyes(message)"
|
||||
|
||||
static PyObject *CryptSetup_askyes(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"message", NULL};
|
||||
PyObject *message = NULL, *result, *arglist;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "O", kwlist, &message))
|
||||
return NULL;
|
||||
|
||||
Py_INCREF(message);
|
||||
|
||||
arglist = Py_BuildValue("(O)", message);
|
||||
if (!arglist){
|
||||
PyErr_SetString(PyExc_RuntimeError, "Error during constructing values for internal call");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
result = PyEval_CallObject(self->yesDialogCB, arglist);
|
||||
Py_DECREF(arglist);
|
||||
Py_DECREF(message);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#define CryptSetup_log_HELP "Logs a string using the configured log CB\n\n\
|
||||
log(int level, message)"
|
||||
|
||||
static PyObject *CryptSetup_log(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"priority", "message", NULL};
|
||||
PyObject *message = NULL, *priority = NULL, *result, *arglist;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "OO", kwlist, &message, &priority))
|
||||
return NULL;
|
||||
|
||||
Py_INCREF(message);
|
||||
Py_INCREF(priority);
|
||||
|
||||
arglist = Py_BuildValue("(OO)", message, priority);
|
||||
if (!arglist){
|
||||
PyErr_SetString(PyExc_RuntimeError, "Error during constructing values for internal call");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
result = PyEval_CallObject(self->cmdLineLogCB, arglist);
|
||||
Py_DECREF(arglist);
|
||||
Py_DECREF(priority);
|
||||
Py_DECREF(message);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#define CryptSetup_luksUUID_HELP "Get UUID of the LUKS device\n\n\
|
||||
luksUUID()"
|
||||
|
||||
static PyObject *CryptSetup_luksUUID(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
PyObject *result;
|
||||
|
||||
result = Py_BuildValue("s", crypt_get_uuid(self->device));
|
||||
if (!result)
|
||||
PyErr_SetString(PyExc_RuntimeError, "Error during constructing values for return value");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#define CryptSetup_isLuks_HELP "Is the device LUKS?\n\n\
|
||||
isLuks()"
|
||||
|
||||
static PyObject *CryptSetup_isLuks(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
return PyObjectResult(crypt_load(self->device, CRYPT_LUKS1, NULL));
|
||||
}
|
||||
|
||||
#define CryptSetup_Info_HELP "Returns dictionary with info about opened device\nKeys:\n\
|
||||
dir\n name\n uuid\n cipher\n cipher_mode\n keysize\n device\n\
|
||||
offset\n size\n skip\n mode\n"
|
||||
|
||||
static PyObject *CryptSetup_Info(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
PyObject *result;
|
||||
|
||||
result = Py_BuildValue("{s:s,s:s,s:z,s:s,s:s,s:s,s:i,s:K}",
|
||||
"dir", crypt_get_dir(),
|
||||
"device", crypt_get_device_name(self->device),
|
||||
"name", self->activated_as,
|
||||
"uuid", crypt_get_uuid(self->device),
|
||||
"cipher", crypt_get_cipher(self->device),
|
||||
"cipher_mode", crypt_get_cipher_mode(self->device),
|
||||
"keysize", crypt_get_volume_key_size(self->device) * 8,
|
||||
//"size", co.size,
|
||||
//"mode", (co.flags & CRYPT_FLAG_READONLY) ? "readonly" : "read/write",
|
||||
"offset", crypt_get_data_offset(self->device)
|
||||
);
|
||||
|
||||
if (!result)
|
||||
PyErr_SetString(PyExc_RuntimeError, "Error during constructing values for return value");
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#define CryptSetup_luksFormat_HELP "Format device to enable LUKS\n\n\
|
||||
luksFormat(cipher = 'aes', cipherMode = 'cbc-essiv:sha256', keysize = 256)\n\n\
|
||||
cipher - cipher specification, e.g. aes, serpent\n\
|
||||
cipherMode - cipher mode specification, e.g. cbc-essiv:sha256, xts-plain64\n\
|
||||
keysize - key size in bits"
|
||||
|
||||
static PyObject *CryptSetup_luksFormat(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"cipher", "cipherMode", "keysize", NULL};
|
||||
char *cipher_mode = NULL, *cipher = NULL;
|
||||
int keysize = 256;
|
||||
PyObject *keysize_object = NULL;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "|zzO", kwlist,
|
||||
&cipher, &cipher_mode, &keysize_object))
|
||||
return NULL;
|
||||
|
||||
if (!keysize_object || keysize_object == Py_None) {
|
||||
/* use default value */
|
||||
} else if (!PyInt_Check(keysize_object)) {
|
||||
PyErr_SetString(PyExc_TypeError, "keysize must be an integer");
|
||||
return NULL;
|
||||
} else if (PyInt_AsLong(keysize_object) % 8) {
|
||||
PyErr_SetString(PyExc_TypeError, "keysize must have integer value dividable by 8");
|
||||
return NULL;
|
||||
} else if (PyInt_AsLong(keysize_object) <= 0) {
|
||||
PyErr_SetString(PyExc_TypeError, "keysize must be positive number bigger than 0");
|
||||
return NULL;
|
||||
} else
|
||||
keysize = PyInt_AsLong(keysize_object);
|
||||
|
||||
// FIXME use #defined defaults
|
||||
return PyObjectResult(crypt_format(self->device, CRYPT_LUKS1,
|
||||
cipher ?: "aes", cipher_mode ?: "cbc-essiv:sha256",
|
||||
NULL, NULL, keysize / 8, NULL));
|
||||
}
|
||||
|
||||
#define CryptSetup_addKeyByPassphrase_HELP "Initialize keyslot using passphrase\n\n\
|
||||
addKeyByPassphrase(passphrase, newPassphrase, slot)\n\n\
|
||||
passphrase - string or none to ask the user\n\
|
||||
newPassphrase - passphrase to add\n\
|
||||
slot - which slot to use (optional)"
|
||||
|
||||
static PyObject *CryptSetup_addKeyByPassphrase(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"passphrase", "newPassphrase", "slot", NULL};
|
||||
char *passphrase = NULL, *newpassphrase = NULL;
|
||||
size_t passphrase_len = 0, newpassphrase_len = 0;
|
||||
int slot = CRYPT_ANY_SLOT;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "ss|i", kwlist, &passphrase, &newpassphrase, &slot))
|
||||
return NULL;
|
||||
|
||||
if(passphrase)
|
||||
passphrase_len = strlen(passphrase);
|
||||
|
||||
if(newpassphrase)
|
||||
newpassphrase_len = strlen(newpassphrase);
|
||||
|
||||
return PyObjectResult(crypt_keyslot_add_by_passphrase(self->device, slot,
|
||||
passphrase, passphrase_len,
|
||||
newpassphrase, newpassphrase_len));
|
||||
}
|
||||
|
||||
#define CryptSetup_addKeyByVolumeKey_HELP "Initialize keyslot using cached volume key\n\n\
|
||||
addKeyByVolumeKey(passphrase, newPassphrase, slot)\n\n\
|
||||
newPassphrase - passphrase to add\n\
|
||||
slot - which slot to use (optional)"
|
||||
|
||||
static PyObject *CryptSetup_addKeyByVolumeKey(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"newPassphrase", "slot", NULL};
|
||||
char *newpassphrase = NULL;
|
||||
size_t newpassphrase_len = 0;
|
||||
int slot = CRYPT_ANY_SLOT;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "s|i", kwlist, &newpassphrase, &slot))
|
||||
return NULL;
|
||||
|
||||
if (newpassphrase)
|
||||
newpassphrase_len = strlen(newpassphrase);
|
||||
|
||||
return PyObjectResult(crypt_keyslot_add_by_volume_key(self->device, slot,
|
||||
NULL, 0, newpassphrase, newpassphrase_len));
|
||||
}
|
||||
|
||||
#define CryptSetup_removePassphrase_HELP "Destroy keyslot using passphrase\n\n\
|
||||
removePassphrase(passphrase)\n\n\
|
||||
passphrase - string or none to ask the user"
|
||||
|
||||
static PyObject *CryptSetup_removePassphrase(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"passphrase", NULL};
|
||||
char *passphrase = NULL;
|
||||
size_t passphrase_len = 0;
|
||||
int is;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "s", kwlist, &passphrase))
|
||||
return NULL;
|
||||
|
||||
if (passphrase)
|
||||
passphrase_len = strlen(passphrase);
|
||||
|
||||
is = crypt_activate_by_passphrase(self->device, NULL, CRYPT_ANY_SLOT,
|
||||
passphrase, passphrase_len, 0);
|
||||
if (is < 0)
|
||||
return PyObjectResult(is);
|
||||
|
||||
return PyObjectResult(crypt_keyslot_destroy(self->device, is));
|
||||
}
|
||||
|
||||
#define CryptSetup_killSlot_HELP "Destroy keyslot\n\n\
|
||||
killSlot(slot)\n\n\
|
||||
slot - the slot to remove"
|
||||
|
||||
static PyObject *CryptSetup_killSlot(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"slot", NULL};
|
||||
int slot = CRYPT_ANY_SLOT;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "i", kwlist, &slot))
|
||||
return NULL;
|
||||
|
||||
switch (crypt_keyslot_status(self->device, slot)) {
|
||||
case CRYPT_SLOT_ACTIVE:
|
||||
return PyObjectResult(crypt_keyslot_destroy(self->device, slot));
|
||||
case CRYPT_SLOT_ACTIVE_LAST:
|
||||
PyErr_SetString(PyExc_ValueError, "Last slot, removing it would render the device unusable");
|
||||
break;
|
||||
case CRYPT_SLOT_INACTIVE:
|
||||
PyErr_SetString(PyExc_ValueError, "Inactive slot");
|
||||
break;
|
||||
case CRYPT_SLOT_INVALID:
|
||||
PyErr_SetString(PyExc_ValueError, "Invalid slot");
|
||||
break;
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
#define CryptSetup_Status_HELP "Status of LUKS device\n\n\
|
||||
luksStatus()"
|
||||
|
||||
static PyObject *CryptSetup_Status(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
if (!self->activated_as){
|
||||
PyErr_SetString(PyExc_IOError, "Device has not been activated yet.");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return PyObjectResult(crypt_status(self->device, self->activated_as));
|
||||
}
|
||||
|
||||
#define CryptSetup_Resume_HELP "Resume LUKS device\n\n\
|
||||
luksOpen(passphrase)\n\n\
|
||||
passphrase - string or none to ask the user"
|
||||
|
||||
static PyObject *CryptSetup_Resume(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"passphrase", NULL};
|
||||
char* passphrase = NULL;
|
||||
size_t passphrase_len = 0;
|
||||
|
||||
if (!self->activated_as){
|
||||
PyErr_SetString(PyExc_IOError, "Device has not been activated yet.");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
if (! PyArg_ParseTupleAndKeywords(args, kwds, "|s", kwlist, &passphrase))
|
||||
return NULL;
|
||||
|
||||
if (passphrase)
|
||||
passphrase_len = strlen(passphrase);
|
||||
|
||||
return PyObjectResult(crypt_resume_by_passphrase(self->device, self->activated_as,
|
||||
CRYPT_ANY_SLOT, passphrase, passphrase_len));
|
||||
}
|
||||
|
||||
#define CryptSetup_Suspend_HELP "Suspend LUKS device\n\n\
|
||||
luksSupsend()"
|
||||
|
||||
static PyObject *CryptSetup_Suspend(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
if (!self->activated_as){
|
||||
PyErr_SetString(PyExc_IOError, "Device has not been activated yet.");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return PyObjectResult(crypt_suspend(self->device, self->activated_as));
|
||||
}
|
||||
|
||||
#define CryptSetup_debugLevel_HELP "Set debug level\n\n\
|
||||
debugLevel(level)\n\n\
|
||||
level - debug level"
|
||||
|
||||
static PyObject *CryptSetup_debugLevel(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"level", NULL};
|
||||
int level = 0;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "i", kwlist, &level))
|
||||
return NULL;
|
||||
|
||||
crypt_set_debug_level(level);
|
||||
|
||||
Py_RETURN_NONE;
|
||||
}
|
||||
|
||||
#define CryptSetup_iterationTime_HELP "Set iteration time\n\n\
|
||||
iterationTime(time_ms)\n\n\
|
||||
time_ms - time in miliseconds"
|
||||
|
||||
static PyObject *CryptSetup_iterationTime(CryptSetupObject* self, PyObject *args, PyObject *kwds)
|
||||
{
|
||||
static char *kwlist[] = {"time_ms", NULL};
|
||||
uint64_t time_ms = 0;
|
||||
|
||||
if (!PyArg_ParseTupleAndKeywords(args, kwds, "K", kwlist, &time_ms))
|
||||
return NULL;
|
||||
|
||||
crypt_set_iteration_time(self->device, time_ms);
|
||||
|
||||
Py_RETURN_NONE;
|
||||
}
|
||||
|
||||
static PyMemberDef CryptSetup_members[] = {
|
||||
{"yesDialogCB", T_OBJECT_EX, offsetof(CryptSetupObject, yesDialogCB), 0, "confirmation dialog callback"},
|
||||
{"cmdLineLogCB", T_OBJECT_EX, offsetof(CryptSetupObject, cmdLineLogCB), 0, "logging callback"},
|
||||
{"passwordDialogCB", T_OBJECT_EX, offsetof(CryptSetupObject, passwordDialogCB), 0, "password dialog callback"},
|
||||
{NULL}
|
||||
};
|
||||
|
||||
static PyMethodDef CryptSetup_methods[] = {
|
||||
/* self-test methods */
|
||||
{"log", (PyCFunction)CryptSetup_log, METH_VARARGS|METH_KEYWORDS, CryptSetup_askyes_HELP},
|
||||
{"askyes", (PyCFunction)CryptSetup_askyes, METH_VARARGS|METH_KEYWORDS, CryptSetup_log_HELP},
|
||||
|
||||
/* activation and deactivation */
|
||||
{"deactivate", (PyCFunction)CryptSetup_deactivate, METH_NOARGS, CryptSetup_deactivate_HELP},
|
||||
{"activate", (PyCFunction)CryptSetup_activate, METH_VARARGS|METH_KEYWORDS, CryptSetup_activate_HELP},
|
||||
|
||||
/* cryptsetup info entrypoints */
|
||||
{"luksUUID", (PyCFunction)CryptSetup_luksUUID, METH_NOARGS, CryptSetup_luksUUID_HELP},
|
||||
{"isLuks", (PyCFunction)CryptSetup_isLuks, METH_NOARGS, CryptSetup_isLuks_HELP},
|
||||
{"info", (PyCFunction)CryptSetup_Info, METH_NOARGS, CryptSetup_Info_HELP},
|
||||
{"status", (PyCFunction)CryptSetup_Status, METH_NOARGS, CryptSetup_Status_HELP},
|
||||
|
||||
/* cryptsetup mgmt entrypoints */
|
||||
{"luksFormat", (PyCFunction)CryptSetup_luksFormat, METH_VARARGS|METH_KEYWORDS, CryptSetup_luksFormat_HELP},
|
||||
{"addKeyByPassphrase", (PyCFunction)CryptSetup_addKeyByPassphrase, METH_VARARGS|METH_KEYWORDS, CryptSetup_addKeyByPassphrase_HELP},
|
||||
{"addKeyByVolumeKey", (PyCFunction)CryptSetup_addKeyByVolumeKey, METH_VARARGS|METH_KEYWORDS, CryptSetup_addKeyByVolumeKey_HELP},
|
||||
{"removePassphrase", (PyCFunction)CryptSetup_removePassphrase, METH_VARARGS|METH_KEYWORDS, CryptSetup_removePassphrase_HELP},
|
||||
{"killSlot", (PyCFunction)CryptSetup_killSlot, METH_VARARGS|METH_KEYWORDS, CryptSetup_killSlot_HELP},
|
||||
|
||||
/* suspend resume */
|
||||
{"resume", (PyCFunction)CryptSetup_Resume, METH_VARARGS|METH_KEYWORDS, CryptSetup_Resume_HELP},
|
||||
{"suspend", (PyCFunction)CryptSetup_Suspend, METH_NOARGS, CryptSetup_Suspend_HELP},
|
||||
|
||||
/* misc */
|
||||
{"debugLevel", (PyCFunction)CryptSetup_debugLevel, METH_VARARGS|METH_KEYWORDS, CryptSetup_debugLevel_HELP},
|
||||
{"iterationTime", (PyCFunction)CryptSetup_iterationTime, METH_VARARGS|METH_KEYWORDS, CryptSetup_iterationTime_HELP},
|
||||
|
||||
{NULL} /* Sentinel */
|
||||
};
|
||||
|
||||
static PyTypeObject CryptSetupType = {
|
||||
PyObject_HEAD_INIT(NULL)
|
||||
0, /*ob_size*/
|
||||
"pycryptsetup.CryptSetup", /*tp_name*/
|
||||
sizeof(CryptSetupObject), /*tp_basicsize*/
|
||||
0, /*tp_itemsize*/
|
||||
(destructor)CryptSetup_dealloc, /*tp_dealloc*/
|
||||
0, /*tp_print*/
|
||||
0, /*tp_getattr*/
|
||||
0, /*tp_setattr*/
|
||||
0, /*tp_compare*/
|
||||
0, /*tp_repr*/
|
||||
0, /*tp_as_number*/
|
||||
0, /*tp_as_sequence*/
|
||||
0, /*tp_as_mapping*/
|
||||
0, /*tp_hash */
|
||||
0, /*tp_call*/
|
||||
0, /*tp_str*/
|
||||
0, /*tp_getattro*/
|
||||
0, /*tp_setattro*/
|
||||
0, /*tp_as_buffer*/
|
||||
Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /*tp_flags*/
|
||||
CryptSetup_HELP, /* tp_doc */
|
||||
0, /* tp_traverse */
|
||||
0, /* tp_clear */
|
||||
0, /* tp_richcompare */
|
||||
0, /* tp_weaklistoffset */
|
||||
0, /* tp_iter */
|
||||
0, /* tp_iternext */
|
||||
CryptSetup_methods, /* tp_methods */
|
||||
CryptSetup_members, /* tp_members */
|
||||
0, /* tp_getset */
|
||||
0, /* tp_base */
|
||||
0, /* tp_dict */
|
||||
0, /* tp_descr_get */
|
||||
0, /* tp_descr_set */
|
||||
0, /* tp_dictoffset */
|
||||
(initproc)CryptSetup_init, /* tp_init */
|
||||
0, /* tp_alloc */
|
||||
CryptSetup_new, /* tp_new */
|
||||
};
|
||||
|
||||
static PyMethodDef pycryptsetup_methods[] = {
|
||||
{NULL} /* Sentinel */
|
||||
};
|
||||
|
||||
PyMODINIT_FUNC initpycryptsetup(void);
|
||||
PyMODINIT_FUNC initpycryptsetup(void)
|
||||
{
|
||||
PyObject *m;
|
||||
|
||||
if (PyType_Ready(&CryptSetupType) < 0)
|
||||
return;
|
||||
|
||||
m = Py_InitModule3("pycryptsetup", pycryptsetup_methods, "CryptSetup pythonized API.");
|
||||
Py_INCREF(&CryptSetupType);
|
||||
|
||||
PyModule_AddObject(m, "CryptSetup", (PyObject *)&CryptSetupType);
|
||||
|
||||
/* debug constants */
|
||||
PyModule_AddIntConstant(m, "CRYPT_DEBUG_ALL", CRYPT_DEBUG_ALL);
|
||||
PyModule_AddIntConstant(m, "CRYPT_DEBUG_NONE", CRYPT_DEBUG_NONE);
|
||||
|
||||
/* log constants */
|
||||
PyModule_AddIntConstant(m, "CRYPT_LOG_NORMAL", CRYPT_LOG_NORMAL);
|
||||
PyModule_AddIntConstant(m, "CRYPT_LOG_ERROR", CRYPT_LOG_ERROR);
|
||||
PyModule_AddIntConstant(m, "CRYPT_LOG_VERBOSE", CRYPT_LOG_VERBOSE);
|
||||
PyModule_AddIntConstant(m, "CRYPT_LOG_DEBUG", CRYPT_LOG_DEBUG);
|
||||
|
||||
/* status constants */
|
||||
PyModule_AddIntConstant(m, "CRYPT_INVALID", CRYPT_INVALID);
|
||||
PyModule_AddIntConstant(m, "CRYPT_INACTIVE", CRYPT_INACTIVE);
|
||||
PyModule_AddIntConstant(m, "CRYPT_ACTIVE", CRYPT_ACTIVE);
|
||||
PyModule_AddIntConstant(m, "CRYPT_BUSY", CRYPT_BUSY);
|
||||
}
|
||||
@@ -9,25 +9,21 @@ INCLUDES = \
|
||||
-DVERSION=\""$(VERSION)"\" \
|
||||
-D_GNU_SOURCE
|
||||
|
||||
# cryptsetup
|
||||
cryptsetup_SOURCES = \
|
||||
$(top_builddir)/lib/utils_crypt.c \
|
||||
$(top_builddir)/lib/utils_loop.c \
|
||||
$(top_builddir)/lib/utils_fips.c \
|
||||
utils_tools.c \
|
||||
cryptsetup.c \
|
||||
cryptsetup.h
|
||||
|
||||
cryptsetup_LDADD = \
|
||||
$(top_builddir)/lib/libcryptsetup.la \
|
||||
@POPT_LIBS@ \
|
||||
@FIPSCHECK_LIBS@
|
||||
@POPT_LIBS@
|
||||
|
||||
cryptsetup_CFLAGS = -Wall
|
||||
|
||||
sbin_PROGRAMS=cryptsetup
|
||||
|
||||
if STATIC_TOOLS
|
||||
if STATIC_CRYPTSETUP
|
||||
sbin_PROGRAMS += cryptsetup.static
|
||||
cryptsetup_static_SOURCES = $(cryptsetup_SOURCES)
|
||||
cryptsetup_static_CFLAGS = $(cryptsetup_CFLAGS)
|
||||
@@ -37,58 +33,3 @@ cryptsetup_static_LDADD = $(cryptsetup_LDADD) \
|
||||
@DEVMAPPER_STATIC_LIBS@ \
|
||||
@UUID_LIBS@
|
||||
endif
|
||||
|
||||
# veritysetup
|
||||
if VERITYSETUP
|
||||
|
||||
veritysetup_SOURCES = \
|
||||
$(top_builddir)/lib/utils_crypt.c \
|
||||
$(top_builddir)/lib/utils_loop.c \
|
||||
utils_tools.c \
|
||||
veritysetup.c \
|
||||
cryptsetup.h
|
||||
|
||||
veritysetup_LDADD = \
|
||||
$(top_builddir)/lib/libcryptsetup.la \
|
||||
@POPT_LIBS@
|
||||
|
||||
veritysetup_CFLAGS = $(cryptsetup_CFLAGS)
|
||||
|
||||
sbin_PROGRAMS += veritysetup
|
||||
|
||||
if STATIC_TOOLS
|
||||
sbin_PROGRAMS += veritysetup.static
|
||||
veritysetup_static_SOURCES = $(veritysetup_SOURCES)
|
||||
veritysetup_static_CFLAGS = $(veritysetup_CFLAGS)
|
||||
veritysetup_static_LDFLAGS = -all-static
|
||||
veritysetup_static_LDADD = $(veritysetup_LDADD) \
|
||||
@CRYPTO_STATIC_LIBS@ \
|
||||
@DEVMAPPER_STATIC_LIBS@ \
|
||||
@UUID_LIBS@
|
||||
endif
|
||||
endif
|
||||
|
||||
# reencrypt
|
||||
if REENCRYPT
|
||||
cryptsetup_reencrypt_SOURCES = \
|
||||
$(top_builddir)/lib/utils_crypt.c \
|
||||
utils_tools.c \
|
||||
cryptsetup_reencrypt.c \
|
||||
cryptsetup.h
|
||||
|
||||
cryptsetup_reencrypt_LDADD = $(cryptsetup_LDADD)
|
||||
cryptsetup_reencrypt_CFLAGS = $(cryptsetup_CFLAGS)
|
||||
|
||||
sbin_PROGRAMS += cryptsetup-reencrypt
|
||||
|
||||
if STATIC_TOOLS
|
||||
sbin_PROGRAMS += cryptsetup-reencrypt.static
|
||||
cryptsetup_reencrypt_static_SOURCES = $(cryptsetup_reencrypt_SOURCES)
|
||||
cryptsetup_reencrypt_static_CFLAGS = $(cryptsetup_reencrypt_CFLAGS)
|
||||
cryptsetup_reencrypt_static_LDFLAGS = -all-static
|
||||
cryptsetup_reencrypt_static_LDADD = $(cryptsetup_reencrypt_LDADD) \
|
||||
@CRYPTO_STATIC_LIBS@ \
|
||||
@DEVMAPPER_STATIC_LIBS@ \
|
||||
@UUID_LIBS@
|
||||
endif
|
||||
endif
|
||||
|
||||
407
src/cryptsetup.c
407
src/cryptsetup.c
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2011, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -16,11 +16,27 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <string.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdint.h>
|
||||
#include <stdarg.h>
|
||||
#include <inttypes.h>
|
||||
#include <errno.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
#include <assert.h>
|
||||
#include <limits.h>
|
||||
#include <libcryptsetup.h>
|
||||
#include <popt.h>
|
||||
|
||||
#include "cryptsetup.h"
|
||||
|
||||
static int opt_verbose = 0;
|
||||
static int opt_debug = 0;
|
||||
static const char *opt_cipher = NULL;
|
||||
static const char *opt_hash = NULL;
|
||||
static int opt_verify_passphrase = 0;
|
||||
@@ -32,8 +48,6 @@ static const char *opt_header_device = NULL;
|
||||
static int opt_key_size = 0;
|
||||
static long opt_keyfile_size = 0;
|
||||
static long opt_new_keyfile_size = 0;
|
||||
static long opt_keyfile_offset = 0;
|
||||
static long opt_new_keyfile_offset = 0;
|
||||
static int opt_key_slot = CRYPT_ANY_SLOT;
|
||||
static uint64_t opt_size = 0;
|
||||
static uint64_t opt_offset = 0;
|
||||
@@ -41,6 +55,7 @@ static uint64_t opt_skip = 0;
|
||||
static int opt_skip_valid = 0;
|
||||
static int opt_readonly = 0;
|
||||
static int opt_iteration_time = 1000;
|
||||
static int opt_batch_mode = 0;
|
||||
static int opt_version_mode = 0;
|
||||
static int opt_timeout = 0;
|
||||
static int opt_tries = 3;
|
||||
@@ -50,11 +65,9 @@ static int opt_urandom = 0;
|
||||
static int opt_dump_master_key = 0;
|
||||
static int opt_shared = 0;
|
||||
static int opt_allow_discards = 0;
|
||||
static int opt_test_passphrase = 0;
|
||||
|
||||
static const char **action_argv;
|
||||
static int action_argc;
|
||||
static const char *null_action_argv[] = {NULL, NULL};
|
||||
|
||||
static int action_create(int arg);
|
||||
static int action_remove(int arg);
|
||||
@@ -74,7 +87,6 @@ static int action_luksResume(int arg);
|
||||
static int action_luksBackup(int arg);
|
||||
static int action_luksRestore(int arg);
|
||||
static int action_loopaesOpen(int arg);
|
||||
static int action_luksRepair(int arg);
|
||||
|
||||
static struct action_type {
|
||||
const char *type;
|
||||
@@ -89,7 +101,6 @@ static struct action_type {
|
||||
{ "remove", action_remove, 0, 1, 1, N_("<name>"), N_("remove device") },
|
||||
{ "resize", action_resize, 0, 1, 1, N_("<name>"), N_("resize active device") },
|
||||
{ "status", action_status, 0, 1, 0, N_("<name>"), N_("show device status") },
|
||||
{ "repair", action_luksRepair, 0, 1, 1, N_("<device>"), N_("try to repair on-disk metadata") },
|
||||
{ "luksFormat", action_luksFormat, 0, 1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
|
||||
{ "luksOpen", action_luksOpen, 0, 2, 1, N_("<device> <name> "), N_("open LUKS device as mapping <name>") },
|
||||
{ "luksAddKey", action_luksAddKey, 0, 1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
|
||||
@@ -109,22 +120,111 @@ static struct action_type {
|
||||
{ NULL, NULL, 0, 0, 0, NULL, NULL }
|
||||
};
|
||||
|
||||
static int _verify_passphrase(int def)
|
||||
__attribute__((format(printf, 5, 6)))
|
||||
static void clogger(struct crypt_device *cd, int level, const char *file,
|
||||
int line, const char *format, ...)
|
||||
{
|
||||
/* Batch mode switch off verify - if not overrided by -y */
|
||||
if (opt_verify_passphrase)
|
||||
def = 1;
|
||||
else if (opt_batch_mode)
|
||||
def = 0;
|
||||
va_list argp;
|
||||
char *target = NULL;
|
||||
|
||||
/* Non-tty input doesn't allow verify */
|
||||
if (def && !isatty(STDIN_FILENO)) {
|
||||
if (opt_verify_passphrase)
|
||||
log_err(_("Can't do passphrase verification on non-tty inputs.\n"));
|
||||
def = 0;
|
||||
va_start(argp, format);
|
||||
|
||||
if (vasprintf(&target, format, argp) > 0) {
|
||||
if (level >= 0) {
|
||||
crypt_log(cd, level, target);
|
||||
#ifdef CRYPT_DEBUG
|
||||
} else if (opt_debug)
|
||||
printf("# %s:%d %s\n", file ?: "?", line, target);
|
||||
#else
|
||||
} else if (opt_debug)
|
||||
printf("# %s\n", target);
|
||||
#endif
|
||||
}
|
||||
|
||||
return def;
|
||||
va_end(argp);
|
||||
free(target);
|
||||
}
|
||||
|
||||
static int _yesDialog(const char *msg, void *usrptr __attribute__((unused)))
|
||||
{
|
||||
char *answer = NULL;
|
||||
size_t size = 0;
|
||||
int r = 1;
|
||||
|
||||
if(isatty(0) && !opt_batch_mode) {
|
||||
log_std("\nWARNING!\n========\n");
|
||||
log_std("%s\n\nAre you sure? (Type uppercase yes): ", msg);
|
||||
if(getline(&answer, &size, stdin) == -1) {
|
||||
perror("getline");
|
||||
free(answer);
|
||||
return 0;
|
||||
}
|
||||
if(strcmp(answer, "YES\n"))
|
||||
r = 0;
|
||||
free(answer);
|
||||
}
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
static void _log(int level, const char *msg, void *usrptr __attribute__((unused)))
|
||||
{
|
||||
switch(level) {
|
||||
|
||||
case CRYPT_LOG_NORMAL:
|
||||
fputs(msg, stdout);
|
||||
break;
|
||||
case CRYPT_LOG_VERBOSE:
|
||||
if (opt_verbose)
|
||||
fputs(msg, stdout);
|
||||
break;
|
||||
case CRYPT_LOG_ERROR:
|
||||
fputs(msg, stderr);
|
||||
break;
|
||||
case CRYPT_LOG_DEBUG:
|
||||
if (opt_debug)
|
||||
printf("# %s\n", msg);
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Internal error on logging class for msg: %s", msg);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
static void _quiet_log(int level, const char *msg, void *usrptr)
|
||||
{
|
||||
if (!opt_verbose && (level == CRYPT_LOG_ERROR || level == CRYPT_LOG_NORMAL))
|
||||
level = CRYPT_LOG_VERBOSE;
|
||||
_log(level, msg, usrptr);
|
||||
}
|
||||
|
||||
static void show_status(int errcode)
|
||||
{
|
||||
char error[256], *error_;
|
||||
|
||||
if(!opt_verbose)
|
||||
return;
|
||||
|
||||
if(!errcode) {
|
||||
log_std(_("Command successful.\n"));
|
||||
return;
|
||||
}
|
||||
|
||||
crypt_get_error(error, sizeof(error));
|
||||
|
||||
if (!error[0]) {
|
||||
error_ = strerror_r(-errcode, error, sizeof(error));
|
||||
if (error_ != error) {
|
||||
strncpy(error, error_, sizeof(error));
|
||||
error[sizeof(error) - 1] = '\0';
|
||||
}
|
||||
}
|
||||
|
||||
log_err(_("Command failed with code %i"), -errcode);
|
||||
if (*error)
|
||||
log_err(": %s\n", error);
|
||||
else
|
||||
log_err(".\n");
|
||||
}
|
||||
|
||||
static int action_create(int arg __attribute__((unused)))
|
||||
@@ -150,9 +250,9 @@ static int action_create(int arg __attribute__((unused)))
|
||||
if (opt_key_file && strcmp(opt_key_file, "-"))
|
||||
params.hash = NULL;
|
||||
|
||||
if ((opt_keyfile_offset || opt_keyfile_size) && opt_key_file)
|
||||
log_std(("Ignoring keyfile offset and size options, keyfile read "
|
||||
"size is always the same as encryption key size.\n"));
|
||||
if (opt_keyfile_size && opt_key_file)
|
||||
log_std(("Ignoring keyfile size option, keyfile read size "
|
||||
"is always the same as encryption key size.\n"));
|
||||
|
||||
r = crypt_parse_name_and_mode(opt_cipher ?: DEFAULT_CIPHER(PLAIN),
|
||||
cipher, NULL, cipher_mode);
|
||||
@@ -186,16 +286,14 @@ static int action_create(int arg __attribute__((unused)))
|
||||
|
||||
if (opt_key_file)
|
||||
/* With hashing, read the whole keyfile */
|
||||
r = crypt_activate_by_keyfile_offset(cd, action_argv[0],
|
||||
CRYPT_ANY_SLOT, opt_key_file,
|
||||
params.hash ? 0 : key_size, 0,
|
||||
r = crypt_activate_by_keyfile(cd, action_argv[0],
|
||||
CRYPT_ANY_SLOT, opt_key_file, params.hash ? 0 : key_size,
|
||||
activate_flags);
|
||||
else {
|
||||
r = crypt_get_key(_("Enter passphrase: "),
|
||||
&password, &passwordLen,
|
||||
opt_keyfile_offset, opt_keyfile_size,
|
||||
&password, &passwordLen, opt_keyfile_size,
|
||||
NULL, opt_timeout,
|
||||
_verify_passphrase(0),
|
||||
opt_batch_mode ? 0 : opt_verify_passphrase,
|
||||
cd);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
@@ -241,9 +339,8 @@ static int action_loopaesOpen(int arg __attribute__((unused)))
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
r = crypt_activate_by_keyfile_offset(cd, action_argv[1], CRYPT_ANY_SLOT,
|
||||
opt_key_file, opt_keyfile_size,
|
||||
opt_keyfile_size, activate_flags);
|
||||
r = crypt_activate_by_keyfile(cd, action_argv[1], CRYPT_ANY_SLOT,
|
||||
opt_key_file, opt_keyfile_size, activate_flags);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
|
||||
@@ -281,14 +378,9 @@ static int action_status(int arg __attribute__((unused)))
|
||||
crypt_status_info ci;
|
||||
struct crypt_active_device cad;
|
||||
struct crypt_device *cd = NULL;
|
||||
struct stat st;
|
||||
char *backing_file;
|
||||
const char *device;
|
||||
int path = 0, r = 0;
|
||||
|
||||
/* perhaps a path, not a dm device name */
|
||||
if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
|
||||
path = 1;
|
||||
int r = 0;
|
||||
|
||||
ci = crypt_status(NULL, action_argv[0]);
|
||||
switch (ci) {
|
||||
@@ -296,22 +388,14 @@ static int action_status(int arg __attribute__((unused)))
|
||||
r = -EINVAL;
|
||||
break;
|
||||
case CRYPT_INACTIVE:
|
||||
if (path)
|
||||
log_std("%s is inactive.\n", action_argv[0]);
|
||||
else
|
||||
log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
|
||||
log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
|
||||
r = -ENODEV;
|
||||
break;
|
||||
case CRYPT_ACTIVE:
|
||||
case CRYPT_BUSY:
|
||||
if (path)
|
||||
log_std("%s is active%s.\n", action_argv[0],
|
||||
ci == CRYPT_BUSY ? " and is in use" : "");
|
||||
else
|
||||
log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
|
||||
ci == CRYPT_BUSY ? " and is in use" : "");
|
||||
|
||||
r = crypt_init_by_name_and_header(&cd, action_argv[0], opt_header_device);
|
||||
log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
|
||||
ci == CRYPT_BUSY ? " and is in use" : "");
|
||||
r = crypt_init_by_name(&cd, action_argv[0]);
|
||||
if (r < 0 || !crypt_get_type(cd))
|
||||
goto out;
|
||||
|
||||
@@ -341,8 +425,6 @@ static int action_status(int arg __attribute__((unused)))
|
||||
}
|
||||
out:
|
||||
crypt_free(cd);
|
||||
if (r == -ENOTSUP)
|
||||
r = 0;
|
||||
return r;
|
||||
}
|
||||
|
||||
@@ -372,32 +454,6 @@ fail:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
static int action_luksRepair(int arg __attribute__((unused)))
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
/* Currently only LUKS1 allows repair */
|
||||
crypt_set_log_callback(cd, quiet_log, NULL);
|
||||
r = crypt_load(cd, CRYPT_LUKS1, NULL);
|
||||
crypt_set_log_callback(cd, tool_log, NULL);
|
||||
if (r == 0) {
|
||||
log_verbose( _("No known problems detected for LUKS header.\n"));
|
||||
goto out;
|
||||
}
|
||||
|
||||
r = yesDialog(_("Really try to repair LUKS device header?"),
|
||||
NULL) ? 0 : -EINVAL;
|
||||
if (r == 0)
|
||||
r = crypt_repair(cd, CRYPT_LUKS1, NULL);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int action_luksFormat(int arg __attribute__((unused)))
|
||||
{
|
||||
int r = -EINVAL, keysize;
|
||||
@@ -420,7 +476,7 @@ static int action_luksFormat(int arg __attribute__((unused)))
|
||||
r = -ENOMEM;
|
||||
goto out;
|
||||
}
|
||||
r = yesDialog(msg, NULL) ? 0 : -EINVAL;
|
||||
r = _yesDialog(msg, NULL) ? 0 : -EINVAL;
|
||||
free(msg);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
@@ -440,9 +496,10 @@ static int action_luksFormat(int arg __attribute__((unused)))
|
||||
|
||||
keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
|
||||
|
||||
crypt_set_password_verify(cd, 1);
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
if (opt_iteration_time)
|
||||
crypt_set_iteration_time(cd, opt_iteration_time);
|
||||
crypt_set_iterarion_time(cd, opt_iteration_time);
|
||||
|
||||
if (opt_random)
|
||||
crypt_set_rng_type(cd, CRYPT_RNG_RANDOM);
|
||||
@@ -450,8 +507,8 @@ static int action_luksFormat(int arg __attribute__((unused)))
|
||||
crypt_set_rng_type(cd, CRYPT_RNG_URANDOM);
|
||||
|
||||
r = crypt_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
|
||||
opt_keyfile_offset, opt_keyfile_size, opt_key_file,
|
||||
opt_timeout, _verify_passphrase(1), cd);
|
||||
opt_keyfile_size, opt_key_file, opt_timeout,
|
||||
opt_batch_mode ? 0 : 1 /* always verify */, cd);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -480,21 +537,18 @@ out:
|
||||
static int action_luksOpen(int arg __attribute__((unused)))
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
const char *data_device, *header_device, *activated_name;
|
||||
char *key = NULL;
|
||||
const char *data_device, *header_device;
|
||||
uint32_t flags = 0;
|
||||
int r, keysize;
|
||||
int r;
|
||||
|
||||
if (opt_header_device) {
|
||||
header_device = uuid_or_device(opt_header_device);
|
||||
header_device = opt_header_device;
|
||||
data_device = action_argv[0];
|
||||
} else {
|
||||
header_device = uuid_or_device(action_argv[0]);
|
||||
header_device = action_argv[0];
|
||||
data_device = NULL;
|
||||
}
|
||||
|
||||
activated_name = opt_test_passphrase ? NULL : action_argv[1];
|
||||
|
||||
if ((r = crypt_init(&cd, header_device)))
|
||||
goto out;
|
||||
|
||||
@@ -513,10 +567,9 @@ static int action_luksOpen(int arg __attribute__((unused)))
|
||||
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
crypt_set_password_retry(cd, opt_tries);
|
||||
crypt_set_password_verify(cd, _verify_passphrase(0));
|
||||
|
||||
if (opt_iteration_time)
|
||||
crypt_set_iteration_time(cd, opt_iteration_time);
|
||||
crypt_set_iterarion_time(cd, opt_iteration_time);
|
||||
|
||||
if (opt_readonly)
|
||||
flags |= CRYPT_ACTIVATE_READONLY;
|
||||
@@ -524,31 +577,22 @@ static int action_luksOpen(int arg __attribute__((unused)))
|
||||
if (opt_allow_discards)
|
||||
flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
|
||||
|
||||
if (opt_master_key_file) {
|
||||
keysize = crypt_get_volume_key_size(cd);
|
||||
r = _read_mk(opt_master_key_file, &key, keysize);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
r = crypt_activate_by_volume_key(cd, activated_name,
|
||||
key, keysize, flags);
|
||||
} else if (opt_key_file) {
|
||||
if (opt_key_file) {
|
||||
crypt_set_password_retry(cd, 1);
|
||||
r = crypt_activate_by_keyfile_offset(cd, activated_name,
|
||||
r = crypt_activate_by_keyfile(cd, action_argv[1],
|
||||
opt_key_slot, opt_key_file, opt_keyfile_size,
|
||||
opt_keyfile_offset, flags);
|
||||
flags);
|
||||
} else
|
||||
r = crypt_activate_by_passphrase(cd, activated_name,
|
||||
r = crypt_activate_by_passphrase(cd, action_argv[1],
|
||||
opt_key_slot, NULL, 0, flags);
|
||||
out:
|
||||
crypt_safe_free(key);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int verify_keyslot(struct crypt_device *cd, int key_slot,
|
||||
char *msg_last, char *msg_pass,
|
||||
const char *key_file, int keyfile_offset,
|
||||
int keyfile_size)
|
||||
const char *key_file, int keyfile_size)
|
||||
{
|
||||
crypt_keyslot_info ki;
|
||||
char *password = NULL;
|
||||
@@ -556,12 +600,12 @@ static int verify_keyslot(struct crypt_device *cd, int key_slot,
|
||||
int i, r;
|
||||
|
||||
ki = crypt_keyslot_status(cd, key_slot);
|
||||
if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !yesDialog(msg_last, NULL))
|
||||
if (ki == CRYPT_SLOT_ACTIVE_LAST && msg_last && !_yesDialog(msg_last, NULL))
|
||||
return -EPERM;
|
||||
|
||||
r = crypt_get_key(msg_pass, &password, &passwordLen,
|
||||
keyfile_offset, keyfile_size, key_file, opt_timeout,
|
||||
_verify_passphrase(0), cd);
|
||||
keyfile_size, key_file, opt_timeout,
|
||||
opt_batch_mode ? 0 : opt_verify_passphrase, cd);
|
||||
if(r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -583,7 +627,7 @@ static int verify_keyslot(struct crypt_device *cd, int key_slot,
|
||||
}
|
||||
}
|
||||
|
||||
if (r == -EPERM)
|
||||
if (r < 0)
|
||||
log_err(_("No key available with this passphrase.\n"));
|
||||
out:
|
||||
crypt_safe_free(password);
|
||||
@@ -595,10 +639,10 @@ static int action_luksKillSlot(int arg __attribute__((unused)))
|
||||
struct crypt_device *cd = NULL;
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
@@ -620,7 +664,7 @@ static int action_luksKillSlot(int arg __attribute__((unused)))
|
||||
r = verify_keyslot(cd, opt_key_slot,
|
||||
_("This is the last keyslot. Device will become unusable after purging this key."),
|
||||
_("Enter any remaining LUKS passphrase: "),
|
||||
opt_key_file, opt_keyfile_offset, opt_keyfile_size);
|
||||
opt_key_file, opt_keyfile_size);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
}
|
||||
@@ -638,10 +682,10 @@ static int action_luksRemoveKey(int arg __attribute__((unused)))
|
||||
size_t passwordLen;
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
@@ -649,9 +693,9 @@ static int action_luksRemoveKey(int arg __attribute__((unused)))
|
||||
|
||||
r = crypt_get_key(_("Enter LUKS passphrase to be deleted: "),
|
||||
&password, &passwordLen,
|
||||
opt_keyfile_offset, opt_keyfile_size, opt_key_file,
|
||||
opt_keyfile_size, opt_key_file,
|
||||
opt_timeout,
|
||||
_verify_passphrase(0),
|
||||
opt_batch_mode ? 0 : opt_verify_passphrase,
|
||||
cd);
|
||||
if(r < 0)
|
||||
goto out;
|
||||
@@ -665,7 +709,7 @@ static int action_luksRemoveKey(int arg __attribute__((unused)))
|
||||
log_verbose(_("Key slot %d selected for deletion.\n"), opt_key_slot);
|
||||
|
||||
if (crypt_keyslot_status(cd, opt_key_slot) == CRYPT_SLOT_ACTIVE_LAST &&
|
||||
!yesDialog(_("This is the last keyslot. "
|
||||
!_yesDialog(_("This is the last keyslot. "
|
||||
"Device will become unusable after purging this key."),
|
||||
NULL)) {
|
||||
r = -EPERM;
|
||||
@@ -686,20 +730,19 @@ static int action_luksAddKey(int arg __attribute__((unused)))
|
||||
const char *opt_new_key_file = (action_argc > 1 ? action_argv[1] : NULL);
|
||||
struct crypt_device *cd = NULL;
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
goto out;
|
||||
|
||||
keysize = crypt_get_volume_key_size(cd);
|
||||
/* FIXME: lib cannot properly set verification for new/old passphrase */
|
||||
crypt_set_password_verify(cd, _verify_passphrase(0));
|
||||
crypt_set_password_verify(cd, opt_verify_passphrase ? 1 : 0);
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
if (opt_iteration_time)
|
||||
crypt_set_iteration_time(cd, opt_iteration_time);
|
||||
crypt_set_iterarion_time(cd, opt_iteration_time);
|
||||
|
||||
if (opt_master_key_file) {
|
||||
r = _read_mk(opt_master_key_file, &key, keysize);
|
||||
@@ -709,9 +752,9 @@ static int action_luksAddKey(int arg __attribute__((unused)))
|
||||
r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot,
|
||||
key, keysize, NULL, 0);
|
||||
} else if (opt_key_file || opt_new_key_file) {
|
||||
r = crypt_keyslot_add_by_keyfile_offset(cd, opt_key_slot,
|
||||
opt_key_file, opt_keyfile_size, opt_keyfile_offset,
|
||||
opt_new_key_file, opt_new_keyfile_size, opt_new_keyfile_offset);
|
||||
r = crypt_keyslot_add_by_keyfile(cd, opt_key_slot,
|
||||
opt_key_file, opt_keyfile_size,
|
||||
opt_new_key_file, opt_new_keyfile_size);
|
||||
} else {
|
||||
r = crypt_keyslot_add_by_passphrase(cd, opt_key_slot,
|
||||
NULL, 0, NULL, 0);
|
||||
@@ -741,19 +784,19 @@ static int action_luksChangeKey(int arg __attribute__((unused)))
|
||||
size_t vk_size;
|
||||
int new_key_slot, old_key_slot, r;
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
goto out;
|
||||
|
||||
if (opt_iteration_time)
|
||||
crypt_set_iteration_time(cd, opt_iteration_time);
|
||||
crypt_set_iterarion_time(cd, opt_iteration_time);
|
||||
|
||||
r = crypt_get_key(_("Enter LUKS passphrase to be changed: "),
|
||||
&password, &passwordLen,
|
||||
opt_keyfile_offset, opt_keyfile_size, opt_key_file,
|
||||
opt_timeout, _verify_passphrase(0), cd);
|
||||
opt_keyfile_size, opt_key_file, opt_timeout,
|
||||
opt_batch_mode ? 0 : opt_verify_passphrase, cd);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -789,9 +832,8 @@ static int action_luksChangeKey(int arg __attribute__((unused)))
|
||||
passwordLen = 0;
|
||||
r = crypt_get_key(_("Enter new LUKS passphrase: "),
|
||||
&password, &passwordLen,
|
||||
opt_new_keyfile_offset, opt_new_keyfile_size,
|
||||
opt_new_key_file,
|
||||
opt_timeout, _verify_passphrase(0), cd);
|
||||
opt_new_keyfile_size, opt_new_key_file,
|
||||
opt_timeout, opt_batch_mode ? 0 : 1, cd);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -828,7 +870,7 @@ static int action_isLuks(int arg __attribute__((unused)))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_log_callback(cd, quiet_log, NULL);
|
||||
crypt_set_log_callback(cd, _quiet_log, NULL);
|
||||
r = crypt_load(cd, CRYPT_LUKS1, NULL);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
@@ -844,7 +886,7 @@ static int action_luksUUID(int arg __attribute__((unused)))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
goto out;
|
||||
@@ -869,8 +911,8 @@ static int luksDump_with_volume_key(struct crypt_device *cd)
|
||||
unsigned i;
|
||||
int r;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
if (!yesDialog(
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
if (!_yesDialog(
|
||||
_("LUKS header dump with volume key is sensitive information\n"
|
||||
"which allows access to encrypted partition without passphrase.\n"
|
||||
"This dump should be always stored encrypted on safe place."),
|
||||
@@ -883,8 +925,7 @@ static int luksDump_with_volume_key(struct crypt_device *cd)
|
||||
return -ENOMEM;
|
||||
|
||||
r = crypt_get_key(_("Enter LUKS passphrase: "), &password, &passwordLen,
|
||||
opt_keyfile_offset, opt_keyfile_size, opt_key_file,
|
||||
opt_timeout, 0, cd);
|
||||
opt_keyfile_size, opt_key_file, opt_timeout, 0, cd);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
@@ -919,7 +960,7 @@ static int action_luksDump(int arg __attribute__((unused)))
|
||||
struct crypt_device *cd = NULL;
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
|
||||
@@ -957,11 +998,10 @@ static int action_luksResume(int arg __attribute__((unused)))
|
||||
|
||||
crypt_set_timeout(cd, opt_timeout);
|
||||
crypt_set_password_retry(cd, opt_tries);
|
||||
crypt_set_password_verify(cd, _verify_passphrase(0));
|
||||
|
||||
if (opt_key_file)
|
||||
r = crypt_resume_by_keyfile_offset(cd, action_argv[0], CRYPT_ANY_SLOT,
|
||||
opt_key_file, opt_keyfile_size, opt_keyfile_offset);
|
||||
r = crypt_resume_by_keyfile(cd, action_argv[0], CRYPT_ANY_SLOT,
|
||||
opt_key_file, opt_keyfile_size);
|
||||
else
|
||||
r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
|
||||
NULL, 0);
|
||||
@@ -980,10 +1020,10 @@ static int action_luksBackup(int arg __attribute__((unused)))
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if ((r = crypt_init(&cd, uuid_or_device(action_argv[0]))))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
|
||||
r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
|
||||
out:
|
||||
@@ -1004,13 +1044,24 @@ static int action_luksRestore(int arg __attribute__((unused)))
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
goto out;
|
||||
|
||||
crypt_set_confirm_callback(cd, yesDialog, NULL);
|
||||
crypt_set_confirm_callback(cd, _yesDialog, NULL);
|
||||
r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static __attribute__ ((noreturn)) void usage(poptContext popt_context,
|
||||
int exitcode, const char *error,
|
||||
const char *more)
|
||||
{
|
||||
poptPrintUsage(popt_context, stderr, 0);
|
||||
if (error)
|
||||
log_err("%s: %s\n", more, error);
|
||||
poptFreeContext(popt_context);
|
||||
exit(exitcode);
|
||||
}
|
||||
|
||||
static void help(poptContext popt_context,
|
||||
enum poptCallbackReason reason __attribute__((unused)),
|
||||
struct poptOption *key,
|
||||
@@ -1055,6 +1106,19 @@ static void help(poptContext popt_context,
|
||||
usage(popt_context, EXIT_SUCCESS, NULL, NULL);
|
||||
}
|
||||
|
||||
static void _dbg_version_and_cmd(int argc, const char **argv)
|
||||
{
|
||||
int i;
|
||||
|
||||
log_std("# %s %s processing \"", PACKAGE_NAME, PACKAGE_VERSION);
|
||||
for (i = 0; i < argc; i++) {
|
||||
if (i)
|
||||
log_std(" ");
|
||||
log_std("%s", argv[i]);
|
||||
}
|
||||
log_std("\"\n");
|
||||
}
|
||||
|
||||
static int run_action(struct action_type *action)
|
||||
{
|
||||
int r;
|
||||
@@ -1074,7 +1138,22 @@ static int run_action(struct action_type *action)
|
||||
r = 0;
|
||||
|
||||
show_status(r);
|
||||
return translate_errno(r);
|
||||
|
||||
/* Translate exit code to simple codes */
|
||||
switch (r) {
|
||||
case 0: r = EXIT_SUCCESS; break;
|
||||
case -EEXIST:
|
||||
case -EBUSY: r = 5; break;
|
||||
case -ENOTBLK:
|
||||
case -ENODEV: r = 4; break;
|
||||
case -ENOMEM: r = 3; break;
|
||||
case -EPERM: r = 2; break;
|
||||
case -EINVAL:
|
||||
case -ENOENT:
|
||||
case -ENOSYS:
|
||||
default: r = EXIT_FAILURE;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
|
||||
int main(int argc, const char **argv)
|
||||
@@ -1099,9 +1178,7 @@ int main(int argc, const char **argv)
|
||||
{ "dump-master-key", '\0', POPT_ARG_NONE, &opt_dump_master_key, 0, N_("Dump volume (master) key instead of keyslots info."), NULL },
|
||||
{ "key-size", 's', POPT_ARG_INT, &opt_key_size, 0, N_("The size of the encryption key"), N_("BITS") },
|
||||
{ "keyfile-size", 'l', POPT_ARG_LONG, &opt_keyfile_size, 0, N_("Limits the read from keyfile"), N_("bytes") },
|
||||
{ "keyfile-offset", '\0', POPT_ARG_LONG, &opt_keyfile_offset, 0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
|
||||
{ "new-keyfile-size", '\0', POPT_ARG_LONG, &opt_new_keyfile_size, 0, N_("Limits the read from newly added keyfile"), N_("bytes") },
|
||||
{ "new-keyfile-offset",'\0', POPT_ARG_LONG, &opt_new_keyfile_offset, 0, N_("Number of bytes to skip in newly added keyfile"), N_("bytes") },
|
||||
{ "key-slot", 'S', POPT_ARG_INT, &opt_key_slot, 0, N_("Slot number for new key (default is first free)"), NULL },
|
||||
{ "size", 'b', POPT_ARG_STRING, &popt_tmp, 1, N_("The size of the device"), N_("SECTORS") },
|
||||
{ "offset", 'o', POPT_ARG_STRING, &popt_tmp, 2, N_("The start offset in the backend device"), N_("SECTORS") },
|
||||
@@ -1119,25 +1196,23 @@ int main(int argc, const char **argv)
|
||||
{ "uuid", '\0', POPT_ARG_STRING, &opt_uuid, 0, N_("UUID for device to use."), NULL },
|
||||
{ "allow-discards", '\0', POPT_ARG_NONE, &opt_allow_discards, 0, N_("Allow discards (aka TRIM) requests for device."), NULL },
|
||||
{ "header", '\0', POPT_ARG_STRING, &opt_header_device, 0, N_("Device or file with separated LUKS header."), NULL },
|
||||
{ "test-passphrase", '\0', POPT_ARG_NONE, &opt_test_passphrase, 0, N_("Do not activate device, just check passphrase."), NULL },
|
||||
POPT_TABLEEND
|
||||
};
|
||||
poptContext popt_context;
|
||||
struct action_type *action;
|
||||
const char *aname;
|
||||
int r;
|
||||
const char *null_action_argv[] = {NULL};
|
||||
|
||||
crypt_set_log_callback(NULL, tool_log, NULL);
|
||||
crypt_set_log_callback(NULL, _log, NULL);
|
||||
|
||||
setlocale(LC_ALL, "");
|
||||
bindtextdomain(PACKAGE, LOCALEDIR);
|
||||
textdomain(PACKAGE);
|
||||
|
||||
crypt_fips_self_check(NULL);
|
||||
|
||||
popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
|
||||
poptSetOtherOptionHelp(popt_context,
|
||||
_("[OPTION...] <action> <action-specific>"));
|
||||
N_("[OPTION...] <action> <action-specific>]"));
|
||||
|
||||
while((r = poptGetNextOpt(popt_context)) > 0) {
|
||||
unsigned long long ull_value;
|
||||
@@ -1205,33 +1280,30 @@ int main(int argc, const char **argv)
|
||||
|
||||
/* FIXME: rewrite this from scratch */
|
||||
|
||||
if (opt_shared && strcmp(aname, "create"))
|
||||
if (opt_shared && strcmp(aname, "create")) {
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Option --shared is allowed only for create operation.\n"),
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (opt_allow_discards &&
|
||||
strcmp(aname, "luksOpen") &&
|
||||
strcmp(aname, "create") &&
|
||||
strcmp(aname, "loopaesOpen"))
|
||||
strcmp(aname, "loopaesOpen")) {
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Option --allow-discards is allowed only for luksOpen, loopaesOpen and create operation.\n"),
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (opt_key_size &&
|
||||
strcmp(aname, "luksFormat") &&
|
||||
strcmp(aname, "create") &&
|
||||
strcmp(aname, "loopaesOpen"))
|
||||
strcmp(aname, "loopaesOpen")) {
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Option --key-size is allowed only for luksFormat, create and loopaesOpen.\n"
|
||||
"To limit read from keyfile use --keyfile-size=(bytes)."),
|
||||
poptGetInvocationName(popt_context));
|
||||
|
||||
if (opt_test_passphrase &&
|
||||
strcmp(aname, "luksOpen"))
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Option --test-passphrase is allowed only for luksOpen.\n"),
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (opt_key_size % 8)
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
@@ -1254,16 +1326,15 @@ int main(int argc, const char **argv)
|
||||
opt_key_file = action_argv[1];
|
||||
}
|
||||
|
||||
if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0 ||
|
||||
opt_keyfile_offset < 0 || opt_new_keyfile_offset < 0)
|
||||
if (opt_keyfile_size < 0 || opt_new_keyfile_size < 0 || opt_key_size < 0) {
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Negative number for option not permitted."),
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (opt_random && opt_urandom)
|
||||
usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
|
||||
poptGetInvocationName(popt_context));
|
||||
|
||||
if ((opt_random || opt_urandom) && strcmp(aname, "luksFormat"))
|
||||
usage(popt_context, EXIT_FAILURE, _("Option --use-[u]random is allowed only for luksFormat."),
|
||||
poptGetInvocationName(popt_context));
|
||||
@@ -1272,10 +1343,6 @@ int main(int argc, const char **argv)
|
||||
usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed only for luksFormat and luksUUID."),
|
||||
poptGetInvocationName(popt_context));
|
||||
|
||||
if (opt_align_payload && strcmp(aname, "luksFormat"))
|
||||
usage(popt_context, EXIT_FAILURE, _("Option --align-payload is allowed only for luksFormat."),
|
||||
poptGetInvocationName(popt_context));
|
||||
|
||||
if (opt_skip && strcmp(aname, "create") && strcmp(aname, "loopaesOpen"))
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Option --skip is supported only for create and loopaesOpen commands.\n"),
|
||||
@@ -1289,7 +1356,7 @@ int main(int argc, const char **argv)
|
||||
if (opt_debug) {
|
||||
opt_verbose = 1;
|
||||
crypt_set_debug_level(-1);
|
||||
dbg_version_and_cmd(argc, argv);
|
||||
_dbg_version_and_cmd(argc, argv);
|
||||
}
|
||||
|
||||
r = run_action(action);
|
||||
|
||||
@@ -1,76 +1,14 @@
|
||||
/*
|
||||
* cryptsetup - setup cryptographic volumes for dm-crypt
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#ifndef CRYPTSETUP_H
|
||||
#define CRYPTSETUP_H
|
||||
|
||||
#define _LARGEFILE64_SOURCE
|
||||
#define _FILE_OFFSET_BITS 64
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdarg.h>
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
#include <errno.h>
|
||||
#include <unistd.h>
|
||||
#include <inttypes.h>
|
||||
#include <limits.h>
|
||||
#include <ctype.h>
|
||||
#include <fcntl.h>
|
||||
#include <popt.h>
|
||||
#include <sys/stat.h>
|
||||
|
||||
#include "lib/nls.h"
|
||||
#include "lib/utils_crypt.h"
|
||||
#include "lib/utils_loop.h"
|
||||
#include "lib/utils_fips.h"
|
||||
|
||||
#include "libcryptsetup.h"
|
||||
|
||||
#define CONST_CAST(x) (x)(uintptr_t)
|
||||
#define DEFAULT_CIPHER(type) (DEFAULT_##type##_CIPHER "-" DEFAULT_##type##_MODE)
|
||||
#define SECTOR_SIZE 512
|
||||
#define ROUND_SECTOR(x) (((x) + SECTOR_SIZE - 1) / SECTOR_SIZE)
|
||||
|
||||
extern int opt_debug;
|
||||
extern int opt_verbose;
|
||||
extern int opt_batch_mode;
|
||||
|
||||
/* Common tools */
|
||||
void clogger(struct crypt_device *cd, int level, const char *file, int line,
|
||||
const char *format, ...);
|
||||
void tool_log(int level, const char *msg, void *usrptr __attribute__((unused)));
|
||||
void quiet_log(int level, const char *msg, void *usrptr);
|
||||
|
||||
int yesDialog(const char *msg, void *usrptr __attribute__((unused)));
|
||||
void show_status(int errcode);
|
||||
const char *uuid_or_device(const char *spec);
|
||||
void usage(poptContext popt_context, int exitcode, const char *error, const char *more);
|
||||
void dbg_version_and_cmd(int argc, const char **argv);
|
||||
int translate_errno(int r);
|
||||
|
||||
/* Log */
|
||||
#define log_dbg(x...) clogger(NULL, CRYPT_LOG_DEBUG, __FILE__, __LINE__, x)
|
||||
#define log_std(x...) clogger(NULL, CRYPT_LOG_NORMAL, __FILE__, __LINE__, x)
|
||||
#define log_verbose(x...) clogger(NULL, CRYPT_LOG_VERBOSE, __FILE__, __LINE__, x)
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,201 +0,0 @@
|
||||
/*
|
||||
* cryptsetup - setup cryptographic volumes for dm-crypt
|
||||
*
|
||||
* Copyright (C) 2004, Christophe Saout <christophe@saout.de>
|
||||
* Copyright (C) 2004-2007, Clemens Fruhwirth <clemens@endorphin.org>
|
||||
* Copyright (C) 2009-2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include "cryptsetup.h"
|
||||
|
||||
int opt_verbose = 0;
|
||||
int opt_debug = 0;
|
||||
int opt_batch_mode = 0;
|
||||
|
||||
__attribute__((format(printf, 5, 6)))
|
||||
void clogger(struct crypt_device *cd, int level, const char *file, int line,
|
||||
const char *format, ...)
|
||||
{
|
||||
va_list argp;
|
||||
char *target = NULL;
|
||||
|
||||
va_start(argp, format);
|
||||
|
||||
if (vasprintf(&target, format, argp) > 0) {
|
||||
if (level >= 0) {
|
||||
crypt_log(cd, level, target);
|
||||
#ifdef CRYPT_DEBUG
|
||||
} else if (opt_debug)
|
||||
printf("# %s:%d %s\n", file ?: "?", line, target);
|
||||
#else
|
||||
} else if (opt_debug)
|
||||
printf("# %s\n", target);
|
||||
#endif
|
||||
}
|
||||
|
||||
va_end(argp);
|
||||
free(target);
|
||||
}
|
||||
|
||||
void tool_log(int level, const char *msg, void *usrptr __attribute__((unused)))
|
||||
{
|
||||
switch(level) {
|
||||
|
||||
case CRYPT_LOG_NORMAL:
|
||||
fputs(msg, stdout);
|
||||
break;
|
||||
case CRYPT_LOG_VERBOSE:
|
||||
if (opt_verbose)
|
||||
fputs(msg, stdout);
|
||||
break;
|
||||
case CRYPT_LOG_ERROR:
|
||||
fputs(msg, stderr);
|
||||
break;
|
||||
case CRYPT_LOG_DEBUG:
|
||||
if (opt_debug)
|
||||
printf("# %s\n", msg);
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Internal error on logging class for msg: %s", msg);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
void quiet_log(int level, const char *msg, void *usrptr)
|
||||
{
|
||||
if (!opt_verbose && (level == CRYPT_LOG_ERROR || level == CRYPT_LOG_NORMAL))
|
||||
level = CRYPT_LOG_VERBOSE;
|
||||
tool_log(level, msg, usrptr);
|
||||
}
|
||||
|
||||
int yesDialog(const char *msg, void *usrptr __attribute__((unused)))
|
||||
{
|
||||
char *answer = NULL;
|
||||
size_t size = 0;
|
||||
int r = 1;
|
||||
|
||||
if(isatty(STDIN_FILENO) && !opt_batch_mode) {
|
||||
log_std("\nWARNING!\n========\n");
|
||||
log_std("%s\n\nAre you sure? (Type uppercase yes): ", msg);
|
||||
if(getline(&answer, &size, stdin) == -1) {
|
||||
perror("getline");
|
||||
free(answer);
|
||||
return 0;
|
||||
}
|
||||
if(strcmp(answer, "YES\n"))
|
||||
r = 0;
|
||||
free(answer);
|
||||
}
|
||||
|
||||
return r;
|
||||
}
|
||||
|
||||
void show_status(int errcode)
|
||||
{
|
||||
char error[256], *error_;
|
||||
|
||||
if(!opt_verbose)
|
||||
return;
|
||||
|
||||
if(!errcode) {
|
||||
log_std(_("Command successful.\n"));
|
||||
return;
|
||||
}
|
||||
|
||||
crypt_get_error(error, sizeof(error));
|
||||
|
||||
if (!error[0]) {
|
||||
error_ = strerror_r(-errcode, error, sizeof(error));
|
||||
if (error_ != error) {
|
||||
strncpy(error, error_, sizeof(error));
|
||||
error[sizeof(error) - 1] = '\0';
|
||||
}
|
||||
}
|
||||
|
||||
log_err(_("Command failed with code %i"), -errcode);
|
||||
if (*error)
|
||||
log_err(": %s\n", error);
|
||||
else
|
||||
log_err(".\n");
|
||||
}
|
||||
|
||||
const char *uuid_or_device(const char *spec)
|
||||
{
|
||||
static char device[PATH_MAX];
|
||||
char s, *ptr;
|
||||
int i = 0, uuid_len = 5;
|
||||
|
||||
/* Check if it is correct UUID=<LUKS_UUID> format */
|
||||
if (spec && !strncmp(spec, "UUID=", uuid_len)) {
|
||||
strcpy(device, "/dev/disk/by-uuid/");
|
||||
ptr = &device[strlen(device)];
|
||||
i = uuid_len;
|
||||
while ((s = spec[i++]) && i < PATH_MAX) {
|
||||
if (!isxdigit(s) && s != '-')
|
||||
return spec; /* Bail it out */
|
||||
if (isalpha(s))
|
||||
s = tolower(s);
|
||||
*ptr++ = s;
|
||||
}
|
||||
*ptr = '\0';
|
||||
return device;
|
||||
}
|
||||
|
||||
return spec;
|
||||
}
|
||||
|
||||
__attribute__ ((noreturn)) void usage(poptContext popt_context,
|
||||
int exitcode, const char *error,
|
||||
const char *more)
|
||||
{
|
||||
poptPrintUsage(popt_context, stderr, 0);
|
||||
if (error)
|
||||
log_err("%s: %s\n", more, error);
|
||||
poptFreeContext(popt_context);
|
||||
exit(exitcode);
|
||||
}
|
||||
|
||||
void dbg_version_and_cmd(int argc, const char **argv)
|
||||
{
|
||||
int i;
|
||||
|
||||
log_std("# %s %s processing \"", PACKAGE_NAME, PACKAGE_VERSION);
|
||||
for (i = 0; i < argc; i++) {
|
||||
if (i)
|
||||
log_std(" ");
|
||||
log_std("%s", argv[i]);
|
||||
}
|
||||
log_std("\"\n");
|
||||
}
|
||||
|
||||
/* Translate exit code to simple codes */
|
||||
int translate_errno(int r)
|
||||
{
|
||||
switch (r) {
|
||||
case 0: r = EXIT_SUCCESS; break;
|
||||
case -EEXIST:
|
||||
case -EBUSY: r = 5; break;
|
||||
case -ENOTBLK:
|
||||
case -ENODEV: r = 4; break;
|
||||
case -ENOMEM: r = 3; break;
|
||||
case -EPERM: r = 2; break;
|
||||
case -EINVAL:
|
||||
case -ENOENT:
|
||||
case -ENOSYS:
|
||||
default: r = EXIT_FAILURE;
|
||||
}
|
||||
return r;
|
||||
}
|
||||
@@ -1,480 +0,0 @@
|
||||
/*
|
||||
* veritysetup - setup cryptographic volumes for dm-verity
|
||||
*
|
||||
* Copyright (C) 2012, Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
* version 2 as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
|
||||
#include "cryptsetup.h"
|
||||
|
||||
#define PACKAGE_VERITY "veritysetup"
|
||||
|
||||
static int use_superblock = 1;
|
||||
|
||||
static const char *hash_algorithm = NULL;
|
||||
static int hash_type = 1;
|
||||
static int data_block_size = DEFAULT_VERITY_DATA_BLOCK;
|
||||
static int hash_block_size = DEFAULT_VERITY_HASH_BLOCK;
|
||||
static uint64_t data_blocks = 0;
|
||||
static const char *salt_string = NULL;
|
||||
static uint64_t hash_offset = 0;
|
||||
static const char *opt_uuid = NULL;
|
||||
|
||||
static int opt_version_mode = 0;
|
||||
|
||||
static const char **action_argv;
|
||||
static int action_argc;
|
||||
|
||||
static int _prepare_format(struct crypt_params_verity *params,
|
||||
const char *data_device,
|
||||
uint32_t flags)
|
||||
{
|
||||
char *salt = NULL;
|
||||
int len;
|
||||
|
||||
params->hash_name = hash_algorithm ?: DEFAULT_VERITY_HASH;
|
||||
params->data_device = data_device;
|
||||
|
||||
if (salt_string && !strcmp(salt_string, "-")) {
|
||||
params->salt_size = 0;
|
||||
params->salt = NULL;
|
||||
} else if (salt_string) {
|
||||
len = crypt_hex_to_bytes(salt_string, &salt, 0);
|
||||
if (len < 0) {
|
||||
log_err(_("Invalid salt string specified.\n"));
|
||||
return -EINVAL;
|
||||
}
|
||||
params->salt_size = len;
|
||||
params->salt = salt;
|
||||
} else {
|
||||
params->salt_size = DEFAULT_VERITY_SALT_SIZE;
|
||||
params->salt = NULL;
|
||||
}
|
||||
|
||||
params->data_block_size = data_block_size;
|
||||
params->hash_block_size = hash_block_size;
|
||||
params->data_size = data_blocks;
|
||||
params->hash_area_offset = hash_offset;
|
||||
params->hash_type = hash_type;
|
||||
params->flags = flags;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int action_format(int arg)
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
struct crypt_params_verity params = {};
|
||||
uint32_t flags = CRYPT_VERITY_CREATE_HASH;
|
||||
struct stat st;
|
||||
int r;
|
||||
|
||||
/* Try to create hash image if doesn't exist */
|
||||
if (stat(action_argv[1], &st) < 0) {
|
||||
log_dbg("Creating hash image %s.", action_argv[1]);
|
||||
r = open(action_argv[1], O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
|
||||
if (r < 0) {
|
||||
log_err(_("Cannot create hash image %s for writing.\n"), action_argv[1]);
|
||||
return -EINVAL;
|
||||
}
|
||||
close(r);
|
||||
}
|
||||
|
||||
if ((r = crypt_init(&cd, action_argv[1])))
|
||||
goto out;
|
||||
|
||||
if (!use_superblock)
|
||||
flags |= CRYPT_VERITY_NO_HEADER;
|
||||
|
||||
r = _prepare_format(¶ms, action_argv[0], flags);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, opt_uuid, NULL, 0, ¶ms);
|
||||
if (!r)
|
||||
crypt_dump(cd);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
free(CONST_CAST(char*)params.salt);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int _activate(const char *dm_device,
|
||||
const char *data_device,
|
||||
const char *hash_device,
|
||||
const char *root_hash,
|
||||
uint32_t flags)
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
struct crypt_params_verity params = {};
|
||||
uint32_t activate_flags = CRYPT_ACTIVATE_READONLY;
|
||||
char *root_hash_bytes = NULL;
|
||||
ssize_t hash_size;
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, hash_device)))
|
||||
goto out;
|
||||
|
||||
if (use_superblock) {
|
||||
params.flags = flags;
|
||||
params.hash_area_offset = hash_offset;
|
||||
r = crypt_load(cd, CRYPT_VERITY, ¶ms);
|
||||
} else {
|
||||
r = _prepare_format(¶ms, data_device, flags | CRYPT_VERITY_NO_HEADER);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
r = crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms);
|
||||
}
|
||||
if (r < 0)
|
||||
goto out;
|
||||
r = crypt_set_data_device(cd, data_device);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
hash_size = crypt_get_volume_key_size(cd);
|
||||
if (crypt_hex_to_bytes(root_hash, &root_hash_bytes, 0) != hash_size) {
|
||||
log_err(_("Invalid root hash string specified.\n"));
|
||||
r = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
r = crypt_activate_by_volume_key(cd, dm_device,
|
||||
root_hash_bytes,
|
||||
hash_size,
|
||||
activate_flags);
|
||||
out:
|
||||
crypt_free(cd);
|
||||
free(root_hash_bytes);
|
||||
free(CONST_CAST(char*)params.salt);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int action_create(int arg)
|
||||
{
|
||||
return _activate(action_argv[0],
|
||||
action_argv[1],
|
||||
action_argv[2],
|
||||
action_argv[3], 0);
|
||||
}
|
||||
|
||||
static int action_verify(int arg)
|
||||
{
|
||||
return _activate(NULL,
|
||||
action_argv[0],
|
||||
action_argv[1],
|
||||
action_argv[2],
|
||||
CRYPT_VERITY_CHECK_HASH);
|
||||
}
|
||||
|
||||
static int action_remove(int arg)
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
int r;
|
||||
|
||||
r = crypt_init_by_name(&cd, action_argv[0]);
|
||||
if (r == 0)
|
||||
r = crypt_deactivate(cd, action_argv[0]);
|
||||
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static int action_status(int arg)
|
||||
{
|
||||
crypt_status_info ci;
|
||||
struct crypt_active_device cad;
|
||||
struct crypt_params_verity vp = {};
|
||||
struct crypt_device *cd = NULL;
|
||||
struct stat st;
|
||||
char *backing_file;
|
||||
unsigned i, path = 0;
|
||||
int r = 0;
|
||||
|
||||
/* perhaps a path, not a dm device name */
|
||||
if (strchr(action_argv[0], '/') && !stat(action_argv[0], &st))
|
||||
path = 1;
|
||||
|
||||
ci = crypt_status(NULL, action_argv[0]);
|
||||
switch (ci) {
|
||||
case CRYPT_INVALID:
|
||||
r = -EINVAL;
|
||||
break;
|
||||
case CRYPT_INACTIVE:
|
||||
if (path)
|
||||
log_std("%s is inactive.\n", action_argv[0]);
|
||||
else
|
||||
log_std("%s/%s is inactive.\n", crypt_get_dir(), action_argv[0]);
|
||||
r = -ENODEV;
|
||||
break;
|
||||
case CRYPT_ACTIVE:
|
||||
case CRYPT_BUSY:
|
||||
if (path)
|
||||
log_std("%s is active%s.\n", action_argv[0],
|
||||
ci == CRYPT_BUSY ? " and is in use" : "");
|
||||
else
|
||||
log_std("%s/%s is active%s.\n", crypt_get_dir(), action_argv[0],
|
||||
ci == CRYPT_BUSY ? " and is in use" : "");
|
||||
|
||||
r = crypt_init_by_name_and_header(&cd, action_argv[0], NULL);
|
||||
if (r < 0 || !crypt_get_type(cd))
|
||||
goto out;
|
||||
|
||||
log_std(" type: %s\n", crypt_get_type(cd));
|
||||
|
||||
r = crypt_get_active_device(cd, action_argv[0], &cad);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
log_std(" status: %s\n",
|
||||
cad.flags & CRYPT_ACTIVATE_CORRUPTED ? "corrupted" : "verified");
|
||||
|
||||
r = crypt_get_verity_info(cd, &vp);
|
||||
if (r < 0)
|
||||
goto out;
|
||||
|
||||
log_std(" hash type: %u\n", vp.hash_type);
|
||||
log_std(" data block: %u\n", vp.data_block_size);
|
||||
log_std(" hash block: %u\n", vp.hash_block_size);
|
||||
log_std(" hash name: %s\n", vp.hash_name);
|
||||
log_std(" salt: ");
|
||||
if (vp.salt_size)
|
||||
for(i = 0; i < vp.salt_size; i++)
|
||||
log_std("%02hhx", (const char)vp.salt[i]);
|
||||
else
|
||||
log_std("-");
|
||||
log_std("\n");
|
||||
|
||||
log_std(" data device: %s\n", vp.data_device);
|
||||
if (crypt_loop_device(vp.data_device)) {
|
||||
backing_file = crypt_loop_backing_file(vp.data_device);
|
||||
log_std(" data loop: %s\n", backing_file);
|
||||
free(backing_file);
|
||||
}
|
||||
log_std(" size: %" PRIu64 " sectors\n", cad.size);
|
||||
log_std(" mode: %s\n", cad.flags & CRYPT_ACTIVATE_READONLY ?
|
||||
"readonly" : "read/write");
|
||||
|
||||
log_std(" hash device: %s\n", vp.hash_device);
|
||||
if (crypt_loop_device(vp.hash_device)) {
|
||||
backing_file = crypt_loop_backing_file(vp.hash_device);
|
||||
log_std(" hash loop: %s\n", backing_file);
|
||||
free(backing_file);
|
||||
}
|
||||
log_std(" hash offset: %" PRIu64 " sectors\n",
|
||||
vp.hash_area_offset * vp.hash_block_size / 512);
|
||||
}
|
||||
out:
|
||||
crypt_free(cd);
|
||||
if (r == -ENOTSUP)
|
||||
r = 0;
|
||||
return r;
|
||||
}
|
||||
|
||||
static int action_dump(int arg)
|
||||
{
|
||||
struct crypt_device *cd = NULL;
|
||||
struct crypt_params_verity params = {};
|
||||
int r;
|
||||
|
||||
if ((r = crypt_init(&cd, action_argv[0])))
|
||||
return r;
|
||||
|
||||
params.hash_area_offset = hash_offset;
|
||||
r = crypt_load(cd, CRYPT_VERITY, ¶ms);
|
||||
if (!r)
|
||||
crypt_dump(cd);
|
||||
crypt_free(cd);
|
||||
return r;
|
||||
}
|
||||
|
||||
static struct action_type {
|
||||
const char *type;
|
||||
int (*handler)(int);
|
||||
int required_action_argc;
|
||||
const char *arg_desc;
|
||||
const char *desc;
|
||||
} action_types[] = {
|
||||
{ "format", action_format, 2, N_("<data_device> <hash_device>"),N_("format device") },
|
||||
{ "verify", action_verify, 3, N_("<data_device> <hash_device> <root_hash>"),N_("verify device") },
|
||||
{ "create", action_create, 4, N_("<name> <data_device> <hash_device> <root_hash>"),N_("create active device") },
|
||||
{ "remove", action_remove, 1, N_("<name>"),N_("remove (deactivate) device") },
|
||||
{ "status", action_status, 1, N_("<name>"),N_("show active device status") },
|
||||
{ "dump", action_dump, 1, N_("<hash_device>"),N_("show on-disk information") },
|
||||
{ NULL, NULL, 0, NULL, NULL }
|
||||
};
|
||||
|
||||
static void help(poptContext popt_context,
|
||||
enum poptCallbackReason reason __attribute__((unused)),
|
||||
struct poptOption *key,
|
||||
const char *arg __attribute__((unused)),
|
||||
void *data __attribute__((unused)))
|
||||
{
|
||||
struct action_type *action;
|
||||
|
||||
if (key->shortName == '?') {
|
||||
log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
|
||||
poptPrintHelp(popt_context, stdout, 0);
|
||||
log_std(_("\n"
|
||||
"<action> is one of:\n"));
|
||||
for(action = action_types; action->type; action++)
|
||||
log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
|
||||
log_std(_("\n"
|
||||
"<name> is the device to create under %s\n"
|
||||
"<data_device> is the data device\n"
|
||||
"<hash_device> is the device containing verification data\n"
|
||||
"<root_hash> hash of the root node on <hash_device>\n"),
|
||||
crypt_get_dir());
|
||||
|
||||
log_std(_("\nDefault compiled-in dm-verity parameters:\n"
|
||||
"\tHash: %s, Data block (bytes): %u, "
|
||||
"Hash block (bytes): %u, Salt size: %u, Hash format: %u\n"),
|
||||
DEFAULT_VERITY_HASH, DEFAULT_VERITY_DATA_BLOCK,
|
||||
DEFAULT_VERITY_HASH_BLOCK, DEFAULT_VERITY_SALT_SIZE,
|
||||
1);
|
||||
exit(EXIT_SUCCESS);
|
||||
} else
|
||||
usage(popt_context, EXIT_SUCCESS, NULL, NULL);
|
||||
}
|
||||
|
||||
static int run_action(struct action_type *action)
|
||||
{
|
||||
int r;
|
||||
|
||||
log_dbg("Running command %s.", action->type);
|
||||
|
||||
r = action->handler(0);
|
||||
|
||||
show_status(r);
|
||||
return translate_errno(r);
|
||||
}
|
||||
|
||||
int main(int argc, const char **argv)
|
||||
{
|
||||
static char *popt_tmp;
|
||||
static const char *null_action_argv[] = {NULL};
|
||||
static struct poptOption popt_help_options[] = {
|
||||
{ NULL, '\0', POPT_ARG_CALLBACK, help, 0, NULL, NULL },
|
||||
{ "help", '?', POPT_ARG_NONE, NULL, 0, N_("Show this help message"), NULL },
|
||||
{ "usage", '\0', POPT_ARG_NONE, NULL, 0, N_("Display brief usage"), NULL },
|
||||
POPT_TABLEEND
|
||||
};
|
||||
static struct poptOption popt_options[] = {
|
||||
{ NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_options, 0, N_("Help options:"), NULL },
|
||||
{ "version", '\0', POPT_ARG_NONE, &opt_version_mode, 0, N_("Print package version"), NULL },
|
||||
{ "verbose", 'v', POPT_ARG_NONE, &opt_verbose, 0, N_("Shows more detailed error messages"), NULL },
|
||||
{ "debug", '\0', POPT_ARG_NONE, &opt_debug, 0, N_("Show debug messages"), NULL },
|
||||
{ "no-superblock", 0, POPT_ARG_VAL, &use_superblock, 0, N_("Do not use verity superblock"), NULL },
|
||||
{ "format", 0, POPT_ARG_INT, &hash_type, 0, N_("Format type (1 - normal, 0 - original Chrome OS)"), N_("number") },
|
||||
{ "data-block-size", 0, POPT_ARG_INT, &data_block_size, 0, N_("Block size on the data device"), N_("bytes") },
|
||||
{ "hash-block-size", 0, POPT_ARG_INT, &hash_block_size, 0, N_("Block size on the hash device"), N_("bytes") },
|
||||
{ "data-blocks", 0, POPT_ARG_STRING, &popt_tmp, 1, N_("The number of blocks in the data file"), N_("blocks") },
|
||||
{ "hash-offset", 0, POPT_ARG_STRING, &popt_tmp, 2, N_("Starting offset on the hash device"), N_("bytes") },
|
||||
{ "hash", 'h', POPT_ARG_STRING, &hash_algorithm, 0, N_("Hash algorithm"), N_("string") },
|
||||
{ "salt", 's', POPT_ARG_STRING, &salt_string, 0, N_("Salt"), N_("hex string") },
|
||||
{ "uuid", '\0', POPT_ARG_STRING, &opt_uuid, 0, N_("UUID for device to use."), NULL },
|
||||
POPT_TABLEEND
|
||||
};
|
||||
|
||||
poptContext popt_context;
|
||||
struct action_type *action;
|
||||
const char *aname;
|
||||
int r;
|
||||
|
||||
crypt_set_log_callback(NULL, tool_log, NULL);
|
||||
|
||||
setlocale(LC_ALL, "");
|
||||
bindtextdomain(PACKAGE, LOCALEDIR);
|
||||
textdomain(PACKAGE);
|
||||
|
||||
popt_context = poptGetContext("verity", argc, argv, popt_options, 0);
|
||||
poptSetOtherOptionHelp(popt_context,
|
||||
_("[OPTION...] <action> <action-specific>"));
|
||||
|
||||
while((r = poptGetNextOpt(popt_context)) > 0) {
|
||||
unsigned long long ull_value;
|
||||
char *endp;
|
||||
|
||||
errno = 0;
|
||||
ull_value = strtoull(popt_tmp, &endp, 10);
|
||||
if (*endp || !*popt_tmp || !isdigit(*popt_tmp) ||
|
||||
(errno == ERANGE && ull_value == ULLONG_MAX) ||
|
||||
(errno != 0 && ull_value == 0))
|
||||
r = POPT_ERROR_BADNUMBER;
|
||||
|
||||
switch(r) {
|
||||
case 1:
|
||||
data_blocks = ull_value;
|
||||
break;
|
||||
case 2:
|
||||
hash_offset = ull_value;
|
||||
break;
|
||||
}
|
||||
|
||||
if (r < 0)
|
||||
break;
|
||||
}
|
||||
|
||||
if (r < -1)
|
||||
usage(popt_context, EXIT_FAILURE, poptStrerror(r),
|
||||
poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
|
||||
|
||||
if (opt_version_mode) {
|
||||
log_std("%s %s\n", PACKAGE_VERITY, PACKAGE_VERSION);
|
||||
poptFreeContext(popt_context);
|
||||
exit(EXIT_SUCCESS);
|
||||
}
|
||||
|
||||
if (!(aname = poptGetArg(popt_context)))
|
||||
usage(popt_context, EXIT_FAILURE, _("Argument <action> missing."),
|
||||
poptGetInvocationName(popt_context));
|
||||
for(action = action_types; action->type; action++)
|
||||
if (strcmp(action->type, aname) == 0)
|
||||
break;
|
||||
if (!action->type)
|
||||
usage(popt_context, EXIT_FAILURE, _("Unknown action."),
|
||||
poptGetInvocationName(popt_context));
|
||||
|
||||
action_argc = 0;
|
||||
action_argv = poptGetArgs(popt_context);
|
||||
/* Make return values of poptGetArgs more consistent in case of remaining argc = 0 */
|
||||
if(!action_argv)
|
||||
action_argv = null_action_argv;
|
||||
|
||||
/* Count args, somewhat unnice, change? */
|
||||
while(action_argv[action_argc] != NULL)
|
||||
action_argc++;
|
||||
|
||||
if(action_argc < action->required_action_argc) {
|
||||
char buf[128];
|
||||
snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc);
|
||||
usage(popt_context, EXIT_FAILURE, buf,
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (data_block_size < 0 || hash_block_size < 0 || hash_type < 0) {
|
||||
usage(popt_context, EXIT_FAILURE,
|
||||
_("Negative number for option not permitted."),
|
||||
poptGetInvocationName(popt_context));
|
||||
}
|
||||
|
||||
if (opt_debug) {
|
||||
opt_verbose = 1;
|
||||
crypt_set_debug_level(-1);
|
||||
dbg_version_and_cmd(argc, argv);
|
||||
}
|
||||
|
||||
r = run_action(action);
|
||||
poptFreeContext(popt_context);
|
||||
return r;
|
||||
}
|
||||
@@ -1,22 +1,11 @@
|
||||
TESTS = api-test compat-test loopaes-test align-test discards-test mode-test password-hash-test
|
||||
|
||||
if VERITYSETUP
|
||||
TESTS += verity-compat-test
|
||||
endif
|
||||
|
||||
if REENCRYPT
|
||||
TESTS += reencryption-compat-test
|
||||
endif
|
||||
|
||||
EXTRA_DIST = compatimage.img.bz2 compatv10image.img.bz2 \
|
||||
valid_header_file.bz2 \
|
||||
EXTRA_DIST = compatimage.img.bz2 valid_header_file.bz2 \
|
||||
evil_hdr-payload_overwrite.bz2 \
|
||||
evil_hdr-stripes_payload_dmg.bz2 \
|
||||
evil_hdr-luks_hdr_damage.bz2 \
|
||||
evil_hdr-small_luks_device.bz2 \
|
||||
compat-test loopaes-test align-test discards-test mode-test password-hash-test \
|
||||
verity-compat-test \
|
||||
reencryption-compat-test \
|
||||
cryptsetup-valg-supps valg.sh valg-api.sh
|
||||
|
||||
CLEANFILES = cryptsetup-tst* valglog*
|
||||
|
||||
104
tests/align-test
104
tests/align-test
@@ -13,7 +13,6 @@ cleanup() {
|
||||
|
||||
fail()
|
||||
{
|
||||
echo "FAIL"
|
||||
[ -n "$1" ] && echo "$1"
|
||||
cleanup
|
||||
exit 100
|
||||
@@ -39,10 +38,11 @@ add_device() {
|
||||
[ -b $DEV ] || fail "Cannot find $DEV."
|
||||
}
|
||||
|
||||
|
||||
format() # key_bits expected [forced]
|
||||
{
|
||||
if [ -z "$3" ] ; then
|
||||
echo -n "Formatting using topology info ($1 bits key)..."
|
||||
echo -n "Formatting using topology info ($1 bits key)...."
|
||||
echo xxx| $CRYPTSETUP luksFormat $DEV -q -i1 -c aes-cbc-essiv:sha256 -s $1
|
||||
else
|
||||
echo -n "Formatting using forced sector alignment $3 ($1 bits key)..."
|
||||
@@ -52,52 +52,15 @@ format() # key_bits expected [forced]
|
||||
ALIGN=$($CRYPTSETUP luksDump $DEV |grep "Payload offset" | sed -e s/.*\\t//)
|
||||
#echo "ALIGN = $ALIGN"
|
||||
|
||||
[ -z "$ALIGN" ] && fail
|
||||
[ $ALIGN -ne $2 ] && fail "Expected alignment differs: expected $2 != detected $ALIGN"
|
||||
|
||||
# test some operation, just in case
|
||||
echo -e "xxx\naaa" | $CRYPTSETUP luksAddKey $DEV -i1 --key-slot 1
|
||||
[ $? -ne 0 ] && fail "Keyslot add failed."
|
||||
|
||||
$CRYPTSETUP -q luksKillSlot $DEV 1
|
||||
[ $? -ne 0 ] && fail "Keyslot removal failed."
|
||||
|
||||
if [ -z "$ALIGN" ] ; then
|
||||
fail "FAIL"
|
||||
elif [ $ALIGN -ne $2 ] ; then
|
||||
echo "FAIL"
|
||||
fail "Expected alignment differs: expected $2 != detected $ALIGN"
|
||||
fi
|
||||
echo "PASSED"
|
||||
}
|
||||
|
||||
get_offsets()
|
||||
{
|
||||
$CRYPTSETUP luksDump $DEV | grep "$1" | cut -s -d ':' -f 2 | sed -e 's/\s//g' -e :a -e N -e 's/\n/:/g' -e 's/\s//g' -e ta
|
||||
}
|
||||
|
||||
format_null()
|
||||
{
|
||||
if [ $3 -eq 0 ] ; then
|
||||
echo -n "Formatting using topology info ($1 bits key) [slot 0"
|
||||
echo xxx| $CRYPTSETUP luksFormat $DEV -q -i1 -c null -s $1
|
||||
else
|
||||
echo -n "Formatting using forced sector alignment $3 ($1 bits key) [slot 0"
|
||||
echo xxx| $CRYPTSETUP luksFormat $DEV -q -i1 -c null -s $1 --align-payload=$3
|
||||
fi
|
||||
|
||||
POFF=$(get_offsets "Payload offset")
|
||||
[ -z "$POFF" ] && fail
|
||||
[ $POFF != $2 ] && fail "Expected data offset differs: expected $2 != detected $POFF"
|
||||
if [ -n "$4" ] ; then
|
||||
for j in 1 2 3 4 5 6 7 ; do
|
||||
echo -e "xxx\nblah$j" | $CRYPTSETUP luksAddKey $DEV -q -i1 --key-slot $j -c null $PARAMS
|
||||
echo -n $j
|
||||
[ $? -ne 0 ] && fail
|
||||
done
|
||||
|
||||
KOFF=$(get_offsets "Key material offset")
|
||||
[ -z "$KOFF" ] && fail
|
||||
[ $KOFF != $4 ] && fail "Expected keyslots offsets differ: expected $4 != detected $KOFF"
|
||||
fi
|
||||
|
||||
echo "]...PASSED"
|
||||
}
|
||||
|
||||
if [ $(id -u) != 0 ]; then
|
||||
echo "WARNING: You must be root to run this test, test skipped."
|
||||
exit 0
|
||||
@@ -135,7 +98,7 @@ format 128 2048
|
||||
format 128 1536 8
|
||||
cleanup
|
||||
|
||||
echo "# Create classic 512B drive and stack dm-linear"
|
||||
echo "# Create classic 512b drive and stack dm-linear"
|
||||
echo "# (logical_block_size=512, physical_block_size=512, alignment_offset=0)"
|
||||
add_device dev_size_mb=16 sector_size=512 num_tgts=1
|
||||
DEV2=$DEV
|
||||
@@ -147,52 +110,3 @@ format 128 2048
|
||||
format 128 1088 8
|
||||
format 128 8192 8192
|
||||
cleanup
|
||||
|
||||
echo "# Offset check: 512B sector drive"
|
||||
add_device dev_size_mb=16 sector_size=512 num_tgts=1
|
||||
# |k| expO reqO expected slot offsets
|
||||
format_null 64 2048 0 8:72:136:200:264:328:392:456
|
||||
format_null 64 520 1
|
||||
format_null 64 520 8
|
||||
format_null 64 640 128
|
||||
format_null 64 2048 2048
|
||||
format_null 128 2048 0 8:136:264:392:520:648:776:904
|
||||
format_null 128 1032 1
|
||||
format_null 128 1032 8
|
||||
format_null 128 1152 128
|
||||
format_null 128 2048 2048
|
||||
format_null 256 4096 0 8:264:520:776:1032:1288:1544:1800
|
||||
format_null 256 2056 1
|
||||
format_null 256 2056 8
|
||||
format_null 256 2176 128
|
||||
format_null 256 4096 2048
|
||||
format_null 512 4096 0 8:512:1016:1520:2024:2528:3032:3536
|
||||
format_null 512 4040 1
|
||||
format_null 512 4040 8
|
||||
format_null 512 4096 128
|
||||
format_null 512 4096 2048
|
||||
cleanup
|
||||
|
||||
echo "# Offset check: 4096B sector drive"
|
||||
add_device dev_size_mb=16 sector_size=4096 num_tgts=1
|
||||
format_null 64 2048 0 8:72:136:200:264:328:392:456
|
||||
format_null 64 520 1
|
||||
format_null 64 520 8
|
||||
format_null 64 640 128
|
||||
format_null 64 2048 2048
|
||||
format_null 128 2048 0 8:136:264:392:520:648:776:904
|
||||
format_null 128 1032 1
|
||||
format_null 128 1032 8
|
||||
format_null 128 1152 128
|
||||
format_null 128 2048 2048
|
||||
format_null 256 4096 0 8:264:520:776:1032:1288:1544:1800
|
||||
format_null 256 2056 1
|
||||
format_null 256 2056 8
|
||||
format_null 256 2176 128
|
||||
format_null 256 4096 2048
|
||||
format_null 512 4096 0 8:512:1016:1520:2024:2528:3032:3536
|
||||
format_null 512 4040 1
|
||||
format_null 512 4040 8
|
||||
format_null 512 4096 128
|
||||
format_null 512 4096 2048
|
||||
cleanup
|
||||
|
||||
168
tests/api-test.c
168
tests/api-test.c
@@ -1,7 +1,7 @@
|
||||
/*
|
||||
* cryptsetup library API check functions
|
||||
*
|
||||
* Copyright (C) 2009-2012 Red Hat, Inc. All rights reserved.
|
||||
* Copyright (C) 2009-2010 Red Hat, Inc. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU General Public License
|
||||
@@ -14,7 +14,7 @@
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
@@ -440,8 +440,6 @@ static int _setup(void)
|
||||
* volume_key = bb21158c733229347bd4e681891e213d94c685be6a5b84818afe7a78a6de7a1a */
|
||||
_system(" [ ! -e " VALID_HEADER " ] && bzip2 -dk " VALID_HEADER ".bz2", 1);
|
||||
|
||||
_system("modprobe dm-crypt", 0);
|
||||
_system("modprobe dm-verity", 0);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -471,10 +469,9 @@ static void check_ko(int status, int line, const char *func)
|
||||
printf(" => errno %d, errmsg: %s\n", status, buf);
|
||||
}
|
||||
|
||||
static void check_equal(int line, const char *func, int64_t x, int64_t y)
|
||||
static void check_equal(int line, const char *func)
|
||||
{
|
||||
printf("FAIL line %d [%s]: expected equal values differs: %"
|
||||
PRIi64 " != %" PRIi64 "\n", line, func, x, y);
|
||||
printf("FAIL line %d [%s]: expected equal values differs.\n", line, func);
|
||||
_cleanup();
|
||||
exit(-1);
|
||||
}
|
||||
@@ -497,9 +494,9 @@ static void xlog(const char *msg, const char *tst, const char *func, int line, c
|
||||
check_ko((x), __LINE__, __FUNCTION__); \
|
||||
} while(0)
|
||||
#define EQ_(x, y) do { xlog("(equal) ", #x " == " #y, __FUNCTION__, __LINE__, NULL); \
|
||||
int64_t _x = (x), _y = (y); \
|
||||
if (_x != _y) check_equal(__LINE__, __FUNCTION__, _x, _y); \
|
||||
if ((x) != (y)) check_equal(__LINE__, __FUNCTION__); \
|
||||
} while(0)
|
||||
|
||||
#define RUN_(x, y) do { printf("%s: %s\n", #x, (y)); x(); } while (0)
|
||||
|
||||
static void AddDevicePlain(void)
|
||||
@@ -663,11 +660,6 @@ static void AddDevicePlain(void)
|
||||
|
||||
FAIL_(crypt_init_by_name_and_header(&cd, CDEVICE_1, H_DEVICE),"can't init plain device by header device");
|
||||
OK_(crypt_init_by_name(&cd, CDEVICE_1));
|
||||
OK_(strcmp(cipher_mode,crypt_get_cipher_mode(cd)));
|
||||
OK_(strcmp(cipher,crypt_get_cipher(cd)));
|
||||
EQ_((int)key_size, crypt_get_volume_key_size(cd));
|
||||
EQ_(params.skip, crypt_get_iv_offset(cd));
|
||||
EQ_(params.offset, crypt_get_data_offset(cd));
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
crypt_free(cd);
|
||||
|
||||
@@ -772,9 +764,6 @@ static void AddDevicePlain(void)
|
||||
EQ_(0, crypt_activate_by_keyfile(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 0, 0));
|
||||
EQ_(crypt_status(cd, CDEVICE_1), CRYPT_ACTIVE);
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
FAIL_(crypt_activate_by_keyfile_offset(cd, NULL, CRYPT_ANY_SLOT, KEYFILE1, 0, strlen(KEY1) + 1, 0), "cannot seek");
|
||||
EQ_(0, crypt_activate_by_keyfile_offset(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 0, 0, 0));
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
_remove_keyfiles();
|
||||
crypt_free(cd);
|
||||
|
||||
@@ -927,8 +916,7 @@ static void SuspendDevice(void)
|
||||
OK_(_prepare_keyfile(KEYFILE1, KEY1, strlen(KEY1)));
|
||||
OK_(crypt_suspend(cd, CDEVICE_1));
|
||||
FAIL_(crypt_resume_by_keyfile(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1 "blah", 0), "wrong keyfile");
|
||||
FAIL_(crypt_resume_by_keyfile_offset(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 1, 0), "wrong key");
|
||||
OK_(crypt_resume_by_keyfile_offset(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 0, 0));
|
||||
OK_(crypt_resume_by_keyfile(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 0));
|
||||
FAIL_(crypt_resume_by_keyfile(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEYFILE1, 0), "not suspended");
|
||||
_remove_keyfiles();
|
||||
out:
|
||||
@@ -988,8 +976,7 @@ static void AddDeviceLuks(void)
|
||||
OK_(get_luks_offsets(0, key_size, params.data_alignment, 0, NULL, &r_payload_offset));
|
||||
OK_(create_dmdevice_over_loop(L_DEVICE_0S, r_payload_offset));
|
||||
OK_(create_dmdevice_over_loop(L_DEVICE_1S, r_payload_offset + 1));
|
||||
//OK_(create_dmdevice_over_loop(L_DEVICE_WRONG, r_payload_offset - 1));
|
||||
OK_(create_dmdevice_over_loop(L_DEVICE_WRONG, 2050 - 1)); //FIXME last keyslot - 1 sector
|
||||
OK_(create_dmdevice_over_loop(L_DEVICE_WRONG, r_payload_offset - 1));
|
||||
|
||||
// 1 sector less than required
|
||||
OK_(crypt_init(&cd, DMDIR L_DEVICE_WRONG));
|
||||
@@ -1054,7 +1041,7 @@ static void AddDeviceLuks(void)
|
||||
// there we've got uuid mismatch
|
||||
OK_(crypt_init_by_name_and_header(&cd, CDEVICE_1, DMDIR H_DEVICE));
|
||||
EQ_(crypt_status(cd, CDEVICE_1), CRYPT_ACTIVE);
|
||||
OK_((int)crypt_get_type(cd));
|
||||
EQ_(crypt_get_type(cd), NULL);
|
||||
FAIL_(crypt_activate_by_volume_key(cd, CDEVICE_1, key, key_size, 0), "Device is active");
|
||||
FAIL_(crypt_activate_by_volume_key(cd, CDEVICE_2, key, key_size, 0), "Device is active");
|
||||
EQ_(crypt_status(cd, CDEVICE_2), CRYPT_INACTIVE);
|
||||
@@ -1079,26 +1066,15 @@ static void AddDeviceLuks(void)
|
||||
EQ_(crypt_status(cd, CDEVICE_2), CRYPT_ACTIVE);
|
||||
OK_(crypt_deactivate(cd, CDEVICE_2));
|
||||
|
||||
crypt_set_iteration_time(cd, 1);
|
||||
EQ_(1, crypt_keyslot_add_by_volume_key(cd, 1, key, key_size, KEY1, strlen(KEY1)));
|
||||
OK_(_prepare_keyfile(KEYFILE1, KEY1, strlen(KEY1)));
|
||||
OK_(_prepare_keyfile(KEYFILE2, KEY2, strlen(KEY2)));
|
||||
EQ_(2, crypt_keyslot_add_by_keyfile(cd, 2, KEYFILE1, 0, KEYFILE2, 0));
|
||||
FAIL_(crypt_keyslot_add_by_keyfile_offset(cd, 3, KEYFILE1, 0, 1, KEYFILE2, 0, 1), "wrong key");
|
||||
EQ_(3, crypt_keyslot_add_by_keyfile_offset(cd, 3, KEYFILE1, 0, 0, KEYFILE2, 0, 1));
|
||||
EQ_(4, crypt_keyslot_add_by_keyfile_offset(cd, 4, KEYFILE2, 0, 1, KEYFILE1, 0, 1));
|
||||
FAIL_(crypt_activate_by_keyfile(cd, CDEVICE_2, CRYPT_ANY_SLOT, KEYFILE2, strlen(KEY2)-1, 0), "key mismatch");
|
||||
EQ_(2, crypt_activate_by_keyfile(cd, NULL, CRYPT_ANY_SLOT, KEYFILE2, 0, 0));
|
||||
EQ_(3, crypt_activate_by_keyfile_offset(cd, NULL, CRYPT_ANY_SLOT, KEYFILE2, 0, 1, 0));
|
||||
EQ_(4, crypt_activate_by_keyfile_offset(cd, NULL, CRYPT_ANY_SLOT, KEYFILE1, 0, 1, 0));
|
||||
FAIL_(crypt_activate_by_keyfile_offset(cd, CDEVICE_2, CRYPT_ANY_SLOT, KEYFILE2, strlen(KEY2), 2, 0), "not enough data");
|
||||
FAIL_(crypt_activate_by_keyfile_offset(cd, CDEVICE_2, CRYPT_ANY_SLOT, KEYFILE2, 0, strlen(KEY2) + 1, 0), "cannot seek");
|
||||
FAIL_(crypt_activate_by_keyfile_offset(cd, CDEVICE_2, CRYPT_ANY_SLOT, KEYFILE2, 0, 2, 0), "wrong key");
|
||||
EQ_(2, crypt_activate_by_keyfile(cd, CDEVICE_2, CRYPT_ANY_SLOT, KEYFILE2, 0, 0));
|
||||
OK_(crypt_keyslot_destroy(cd, 1));
|
||||
OK_(crypt_keyslot_destroy(cd, 2));
|
||||
OK_(crypt_keyslot_destroy(cd, 3));
|
||||
OK_(crypt_keyslot_destroy(cd, 4));
|
||||
OK_(crypt_deactivate(cd, CDEVICE_2));
|
||||
_remove_keyfiles();
|
||||
|
||||
@@ -1301,10 +1277,8 @@ static void LuksHeaderLoad(void)
|
||||
// external header device
|
||||
OK_(create_dmdevice_over_loop(H_DEVICE, r_header_size));
|
||||
// prepared header on a device too small to contain header and payload
|
||||
//OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_payload_offset - 1));
|
||||
OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, 2050 - 1)); //FIXME
|
||||
//snprintf(cmd, sizeof(cmd), "dd if=" EVL_HEADER_4 " of=" DMDIR H_DEVICE_WRONG " bs=512 count=%" PRIu64, r_payload_offset - 1);
|
||||
snprintf(cmd, sizeof(cmd), "dd if=" EVL_HEADER_4 " of=" DMDIR H_DEVICE_WRONG " bs=512 count=%" PRIu64, 2050ULL - 1);
|
||||
OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_payload_offset - 1));
|
||||
snprintf(cmd, sizeof(cmd), "dd if=" EVL_HEADER_4 " of=" DMDIR H_DEVICE_WRONG " bs=512 count=%" PRIu64, r_payload_offset - 1);
|
||||
OK_(_system(cmd, 1));
|
||||
// some device
|
||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 1000));
|
||||
@@ -1330,7 +1304,7 @@ static void LuksHeaderLoad(void)
|
||||
// bad header: device too small (payloadOffset > device_size)
|
||||
OK_(crypt_init(&cd, DMDIR H_DEVICE_WRONG));
|
||||
FAIL_(crypt_load(cd, CRYPT_LUKS1, NULL), "Device too small");
|
||||
OK_((int)crypt_get_type(cd));
|
||||
EQ_(crypt_get_type(cd), NULL);
|
||||
crypt_free(cd);
|
||||
|
||||
// 0 secs for encrypted data area
|
||||
@@ -1347,7 +1321,7 @@ static void LuksHeaderLoad(void)
|
||||
crypt_free(cd);
|
||||
|
||||
// damaged header
|
||||
OK_(_system("dd if=/dev/zero of=" DMDIR L_DEVICE_OK " bs=512 count=8", 1));
|
||||
OK_(_system("dd if=/dev/zero of=" DMDIR L_DEVICE_0S "bs=512 count=8", 1));
|
||||
OK_(crypt_init(&cd, DMDIR L_DEVICE_OK));
|
||||
FAIL_(crypt_load(cd, CRYPT_LUKS1, NULL), "Header not found");
|
||||
crypt_free(cd);
|
||||
@@ -1577,112 +1551,6 @@ static void HashDevicePlain(void)
|
||||
crypt_free(cd);
|
||||
}
|
||||
|
||||
static void VerityTest(void)
|
||||
{
|
||||
struct crypt_device *cd;
|
||||
const char *salt_hex = "20c28ffc129c12360ba6ceea2b6cf04e89c2b41cfe6b8439eb53c1897f50df7b";
|
||||
const char *root_hex = "ab018b003a967fc782effb293b6dccb60b4f40c06bf80d16391acf686d28b5d6";
|
||||
char salt[256], root_hash[256];
|
||||
struct crypt_active_device cad;
|
||||
struct crypt_params_verity params = {
|
||||
.data_device = DEVICE_EMPTY,
|
||||
.salt = salt,
|
||||
.data_size = 0, /* whole device */
|
||||
.hash_area_offset = 0,
|
||||
.flags = CRYPT_VERITY_CREATE_HASH,
|
||||
};
|
||||
|
||||
crypt_decode_key(salt, salt_hex, strlen(salt_hex) / 2);
|
||||
crypt_decode_key(root_hash, root_hex, strlen(root_hex) / 2);
|
||||
|
||||
/* Format */
|
||||
OK_(crypt_init(&cd, DEVICE_2));
|
||||
|
||||
/* block size */
|
||||
params.data_block_size = 333;
|
||||
FAIL_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms),
|
||||
"Unsupppored block size.");
|
||||
params.data_block_size = 4096;
|
||||
params.hash_block_size = 333;
|
||||
FAIL_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms),
|
||||
"Unsupppored block size.");
|
||||
params.hash_block_size = 4096;
|
||||
|
||||
/* salt size */
|
||||
params.salt_size = 257;
|
||||
FAIL_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms),
|
||||
"Too large salt.");
|
||||
params.salt_size = 32;
|
||||
|
||||
/* hash_type */
|
||||
params.hash_type = 3;
|
||||
FAIL_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms),
|
||||
"Unsupported hash type.");
|
||||
params.hash_type = 1;
|
||||
params.hash_name = "blah";
|
||||
FAIL_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms),
|
||||
"Unsupported hash name.");
|
||||
params.hash_name = "sha256";
|
||||
|
||||
OK_(crypt_format(cd, CRYPT_VERITY, NULL, NULL, NULL, NULL, 0, ¶ms));
|
||||
crypt_free(cd);
|
||||
|
||||
/* Verify */
|
||||
OK_(crypt_init(&cd, DEVICE_2));
|
||||
memset(¶ms, 0, sizeof(params));
|
||||
params.data_device = DEVICE_EMPTY;
|
||||
params.flags = CRYPT_VERITY_CHECK_HASH;
|
||||
OK_(crypt_load(cd, CRYPT_VERITY, ¶ms));
|
||||
|
||||
/* check verity params */
|
||||
EQ_(crypt_get_volume_key_size(cd), 32);
|
||||
OK_(strcmp(CRYPT_VERITY, crypt_get_type(cd)));
|
||||
memset(¶ms, 0, sizeof(params));
|
||||
OK_(crypt_get_verity_info(cd, ¶ms));
|
||||
OK_(strcmp("sha256", params.hash_name));
|
||||
EQ_(strlen(salt_hex) / 2, params.salt_size);
|
||||
OK_(memcmp(salt, params.salt, params.salt_size));
|
||||
EQ_(4096, params.data_block_size);
|
||||
EQ_(4096, params.hash_block_size);
|
||||
EQ_(1, params.hash_type);
|
||||
EQ_(crypt_get_volume_key_size(cd), 32);
|
||||
|
||||
OK_(crypt_activate_by_volume_key(cd, NULL, root_hash, 32, 0));
|
||||
OK_(crypt_set_data_device(cd, DEVICE_1));
|
||||
FAIL_(crypt_activate_by_volume_key(cd, NULL, root_hash, 32, 0), "Data corrupted");;
|
||||
|
||||
OK_(crypt_set_data_device(cd, DEVICE_EMPTY));
|
||||
if (crypt_activate_by_volume_key(cd, CDEVICE_1, root_hash, 32,
|
||||
CRYPT_ACTIVATE_READONLY) == -ENOTSUP) {
|
||||
printf("WARNING: kernel dm-verity not supported, skipping test.\n");
|
||||
crypt_free(cd);
|
||||
return;
|
||||
}
|
||||
OK_(crypt_get_active_device(cd, CDEVICE_1, &cad));
|
||||
EQ_(CRYPT_ACTIVATE_READONLY, cad.flags);
|
||||
crypt_free(cd);
|
||||
|
||||
OK_(crypt_init_by_name(&cd, CDEVICE_1));
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
|
||||
/* hash fail */
|
||||
root_hash[1] = ~root_hash[1];
|
||||
OK_(crypt_activate_by_volume_key(cd, CDEVICE_1, root_hash, 32, CRYPT_ACTIVATE_READONLY));
|
||||
OK_(crypt_get_active_device(cd, CDEVICE_1, &cad));
|
||||
EQ_(CRYPT_ACTIVATE_READONLY|CRYPT_ACTIVATE_CORRUPTED, cad.flags);
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
root_hash[1] = ~root_hash[1];
|
||||
|
||||
/* data fail */
|
||||
OK_(crypt_set_data_device(cd, DEVICE_1));
|
||||
OK_(crypt_activate_by_volume_key(cd, CDEVICE_1, root_hash, 32, CRYPT_ACTIVATE_READONLY));
|
||||
OK_(crypt_get_active_device(cd, CDEVICE_1, &cad));
|
||||
EQ_(CRYPT_ACTIVATE_READONLY|CRYPT_ACTIVATE_CORRUPTED, cad.flags);
|
||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
||||
|
||||
crypt_free(cd);
|
||||
}
|
||||
|
||||
// Check that gcrypt is properly initialised in format
|
||||
static void NonFIPSAlg(void)
|
||||
{
|
||||
@@ -1697,28 +1565,22 @@ static void NonFIPSAlg(void)
|
||||
OK_(crypt_init(&cd, DEVICE_2));
|
||||
params.hash = "sha256";
|
||||
OK_(crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, key, key_size, ¶ms));
|
||||
FAIL_(crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, key, key_size, ¶ms),
|
||||
"Already formatted.");
|
||||
crypt_free(cd);
|
||||
|
||||
params.hash = "whirlpool";
|
||||
OK_(crypt_init(&cd, DEVICE_2));
|
||||
ret = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, key, key_size, ¶ms);
|
||||
if (ret < 0) {
|
||||
printf("WARNING: whirlpool not supported, skipping test.\n");
|
||||
crypt_free(cd);
|
||||
return;
|
||||
}
|
||||
crypt_free(cd);
|
||||
|
||||
params.hash = "md5";
|
||||
OK_(crypt_init(&cd, DEVICE_2));
|
||||
FAIL_(crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, key, key_size, ¶ms),
|
||||
"MD5 unsupported, too short");
|
||||
crypt_free(cd);
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
int main (int argc, char *argv[])
|
||||
{
|
||||
int i;
|
||||
|
||||
@@ -1751,8 +1613,8 @@ int main(int argc, char *argv[])
|
||||
RUN_(UseLuksDevice, "Use pre-formated LUKS device");
|
||||
RUN_(SuspendDevice, "Suspend/Resume test");
|
||||
RUN_(UseTempVolumes, "Format and use temporary encrypted device");
|
||||
|
||||
RUN_(CallbacksTest, "API callbacks test");
|
||||
RUN_(VerityTest, "DM verity test");
|
||||
out:
|
||||
_cleanup();
|
||||
return 0;
|
||||
|
||||
@@ -2,20 +2,14 @@
|
||||
|
||||
CRYPTSETUP=../src/cryptsetup
|
||||
|
||||
CRYPTSETUP_VALGRIND=../src/.libs/cryptsetup
|
||||
CRYPTSETUP_LIB_VALGRIND=../lib/.libs
|
||||
|
||||
DEV_NAME=dummy
|
||||
DEV_NAME2=dummy2
|
||||
DEV_NAME3=dummy3
|
||||
ORIG_IMG=luks-test-orig
|
||||
IMG=luks-test
|
||||
IMG10=luks-test-v10
|
||||
HEADER_IMG=luks-header
|
||||
KEY1=key1
|
||||
KEY2=key2
|
||||
KEY5=key5
|
||||
KEYE=keye
|
||||
|
||||
LUKS_HEADER="S0-5 S6-7 S8-39 S40-71 S72-103 S104-107 S108-111 R112-131 R132-163 S164-167 S168-207 A0-591"
|
||||
KEY_SLOT0="S208-211 S212-215 R216-247 A248-251 A251-255"
|
||||
@@ -40,13 +34,7 @@ function remove_mapping()
|
||||
[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove $DEV_NAME2
|
||||
[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove $DEV_NAME
|
||||
losetup -d $LOOPDEV >/dev/null 2>&1
|
||||
rm -f $ORIG_IMG $IMG $IMG10 $KEY1 $KEY2 $KEY5 $KEYE $HEADER_IMG >/dev/null 2>&1
|
||||
}
|
||||
|
||||
function force_uevent()
|
||||
{
|
||||
DNAME=$(echo $LOOPDEV | cut -f3 -d /)
|
||||
echo "change" >/sys/block/$DNAME/uevent
|
||||
rm -f $ORIG_IMG $IMG $KEY1 $KEY2 $KEY5 >/dev/null 2>&1
|
||||
}
|
||||
|
||||
function fail()
|
||||
@@ -78,14 +66,12 @@ function prepare()
|
||||
remove_mapping
|
||||
bzip2 -cd compatimage.img.bz2 > $IMG
|
||||
losetup $LOOPDEV $IMG
|
||||
bzip2 -cd compatv10image.img.bz2 > $IMG10
|
||||
;;
|
||||
reuse | *)
|
||||
if [ ! -e $IMG ]; then
|
||||
bzip2 -cd compatimage.img.bz2 > $IMG
|
||||
losetup $LOOPDEV $IMG
|
||||
fi
|
||||
[ ! -e $IMG10 ] && bzip2 -cd compatv10image.img.bz2 > $IMG10
|
||||
;;
|
||||
esac
|
||||
|
||||
@@ -101,10 +87,6 @@ function prepare()
|
||||
dd if=/dev/urandom of=$KEY5 count=1 bs=16 >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
if [ ! -e $KEYE ]; then
|
||||
touch $KEYE
|
||||
fi
|
||||
|
||||
cp $IMG $ORIG_IMG
|
||||
[ -n "$1" ] && echo "CASE: $1"
|
||||
}
|
||||
@@ -124,14 +106,18 @@ function check_exists()
|
||||
|
||||
function valgrind_setup()
|
||||
{
|
||||
which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind."
|
||||
[ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
|
||||
export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
|
||||
which valgrind >/dev/null 2>&1 || fail "Cannot find valgrind"
|
||||
|
||||
CRYPTSETUP_BIN=$($CRYPTSETUP --lt-debug --version 2>&1 \
|
||||
| grep "newargv\[0\]" \
|
||||
| sed 's/.*newargv\[0\]\:[[:space:]]\+\(.*\)$/\1/g')
|
||||
[ -z "$CRYPTSETUP_BIN" ] && fail "Unable to get location of cryptsetup executable."
|
||||
export LD_LIBRARY_PATH="../lib/.libs:$LD_LIBRARY_PATH"
|
||||
}
|
||||
|
||||
function valgrind_run()
|
||||
{
|
||||
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
|
||||
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_BIN} "$@"
|
||||
}
|
||||
|
||||
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
||||
@@ -141,35 +127,15 @@ function valgrind_run()
|
||||
|
||||
# LUKS tests
|
||||
|
||||
|
||||
prepare "[1] open - compat image - acceptance check" new
|
||||
echo "compatkey" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
check_exists
|
||||
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
||||
[ "$ORG_SHA1" = 676062b66ebf36669dab705442ea0762dfc091b0 ] || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
# Check it can be opened from header backup as well
|
||||
$CRYPTSETUP luksHeaderBackup $IMG --header-backup-file $HEADER_IMG
|
||||
echo "compatkey" | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
||||
check_exists
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
# Repeat for V1.0 header - not aligned first keyslot
|
||||
echo "compatkey" | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME || fail
|
||||
check_exists
|
||||
ORG_SHA1=$(sha1sum -b /dev/mapper/$DEV_NAME | cut -f 1 -d' ')
|
||||
[ "$ORG_SHA1" = 51b48c2471a7593ceaf14dc5e66bca86ed05f6cc ] || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
rm -f $HEADER_IMG
|
||||
$CRYPTSETUP luksHeaderBackup $IMG10 --header-backup-file $HEADER_IMG
|
||||
echo "compatkey" | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME --header $HEADER_IMG || fail
|
||||
check_exists
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[2] open - compat image - denial check" new
|
||||
echo "wrongkey" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
echo "wrongkey" | $CRYPTSETUP luksOpen $IMG10 $DEV_NAME 2>/dev/null && fail
|
||||
check
|
||||
|
||||
# All headers items and first key material section must change
|
||||
@@ -182,8 +148,6 @@ echo "key0" | $CRYPTSETUP -i 1000 -h sha512 -c aes-cbc-essiv:sha256 -s 128 luksF
|
||||
check "$LUKS_HEADER $KEY_SLOT0 $KEY_MATERIAL0"
|
||||
|
||||
prepare "[5] open"
|
||||
echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase || fail
|
||||
echo "blah" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME --test-passphrase 2>/dev/null && fail
|
||||
echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
check_exists
|
||||
|
||||
@@ -273,20 +237,6 @@ echo "key0" | $CRYPTSETUP -q luksFormat --master-key-file /dev/urandom $LOOPDEV
|
||||
$CRYPTSETUP -q luksFormat --master-key-file /dev/urandom -s 256 --uuid $TEST_UUID $LOOPDEV $KEY1 || fail
|
||||
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# open by UUID
|
||||
force_uevent # some systems do not update loop by-uuid
|
||||
$CRYPTSETUP luksOpen -d $KEY1 UUID=X$TEST_UUID $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP luksOpen -d $KEY1 UUID=$TEST_UUID $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# empty keyfile
|
||||
$CRYPTSETUP -q luksFormat $LOOPDEV $KEYE || fail
|
||||
$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
# open by volume key
|
||||
echo "key0" | $CRYPTSETUP -q luksFormat -s 256 --master-key-file $KEY1 $LOOPDEV || fail
|
||||
$CRYPTSETUP luksOpen --master-key-file /dev/urandom $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP -q luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[17] AddKey volume key, passphrase and keyfile" wipe
|
||||
# masterkey
|
||||
@@ -349,7 +299,7 @@ echo "key0" | $CRYPTSETUP -q create $DEV_NAME --hash sha1 --size 100 $LOOPDEV ||
|
||||
$CRYPTSETUP -q status $DEV_NAME | grep "size:" | grep -q "100 sectors" || fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME || fail
|
||||
# verify is ignored on non-tty input
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase 2>/dev/null || fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --verify-passphrase || fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME || fail
|
||||
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size 255 2>/dev/null && fail
|
||||
$CRYPTSETUP create $DEV_NAME $LOOPDEV -d $KEY1 --key-size -1 2>/dev/null && fail
|
||||
@@ -422,8 +372,6 @@ $CRYPTSETUP --key-file=$KEY1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 0 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 14 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset -1 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
$CRYPTSETUP luksAddKey $LOOPDEV -d $KEY1 $KEY2 2>/dev/null && fail
|
||||
@@ -441,23 +389,16 @@ echo "key0" | $CRYPTSETUP luksAddKey $LOOPDEV -d $KEY2 -i1 || fail
|
||||
echo "key0" | $CRYPTSETUP luksRemoveKey $LOOPDEV -l 2 2>/dev/null && fail
|
||||
echo "key01" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d 4 2>/dev/null && fail
|
||||
echo -e "key0\n" | $CRYPTSETUP luksRemoveKey $LOOPDEV -d- -l 4 || fail
|
||||
# offset
|
||||
$CRYPTSETUP -q luksFormat -i1 $LOOPDEV $KEY1 --key-slot 0 -l 13 --keyfile-offset 16 || fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 15 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY1 -l 13 --keyfile-offset 16 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
$CRYPTSETUP luksAddKey $LOOPDEV -i1 -d $KEY1 -l 13 --keyfile-offset 16 $KEY2 --new-keyfile-offset 1 || fail
|
||||
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 11 luksOpen $LOOPDEV $DEV_NAME 2>/dev/null && fail
|
||||
$CRYPTSETUP --key-file=$KEY2 --keyfile-offset 1 luksOpen $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
$CRYPTSETUP luksChangeKey $LOOPDEV -i1 -d $KEY2 --keyfile-offset 1 $KEY2 --new-keyfile-offset 0 || fail
|
||||
$CRYPTSETUP luksOpen -d $KEY2 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[25] Create shared segments" wipe
|
||||
prepare "[25] Create non-overlapping segments" wipe
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME $LOOPDEV --hash sha1 --offset 0 --size 256 || fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 2>/dev/null && fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME2 $LOOPDEV --hash sha1 --offset 512 --size 256 --shared || fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME3 $LOOPDEV --hash sha1 --offset 255 --size 256 --shared 2>/dev/null && fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME3 $LOOPDEV --hash sha1 --offset 256 --size 257 --shared 2>/dev/null && fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME3 $LOOPDEV --hash sha1 --offset 256 --size 1024 --shared 2>/dev/null && fail
|
||||
echo "key0" | $CRYPTSETUP create $DEV_NAME3 $LOOPDEV --hash sha1 --offset 256 --size 256 --shared || fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME3 || fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME2 || fail
|
||||
$CRYPTSETUP -q remove $DEV_NAME || fail
|
||||
|
||||
@@ -505,25 +446,5 @@ $CRYPTSETUP luksOpen -S 1 -d $KEY5 $LOOPDEV $DEV_NAME && fail
|
||||
$CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOPDEV $DEV_NAME && fail
|
||||
[ -b /dev/mapper/$DEV_NAME ] && fail
|
||||
|
||||
prepare "[28] Detached LUKS header" wipe
|
||||
dd if=/dev/zero of=$HEADER_IMG bs=1M count=4 >/dev/null 2>&1
|
||||
echo "key0" | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG || fail
|
||||
echo "key0" | $CRYPTSETUP luksFormat -i1 $LOOPDEV --header $HEADER_IMG --align-payload 0 || fail
|
||||
echo "key0" | $CRYPTSETUP luksOpen $LOOPDEV --header $HEADER_IMG $DEV_NAME || fail
|
||||
$CRYPTSETUP -q resize $DEV_NAME --size 100 --header $HEADER_IMG || fail
|
||||
$CRYPTSETUP -q status $DEV_NAME --header $HEADER_IMG | grep "size:" | grep -q "100 sectors" || fail
|
||||
$CRYPTSETUP luksSuspend $DEV_NAME --header $HEADER_IMG || fail
|
||||
echo "key0" | $CRYPTSETUP luksResume $DEV_NAME --header $HEADER_IMG || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
|
||||
prepare "[29] Repair metadata" wipe
|
||||
$CRYPTSETUP -q luksFormat -i1 $LOOPDEV $KEY1 --key-slot 0 || fail
|
||||
# second sector overwrite should corrupt keyslot 6+7
|
||||
dd if=/dev/urandom of=$LOOPDEV bs=512 seek=1 count=1 >/dev/null 2>&1
|
||||
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME >/dev/null 2>&1 && fail
|
||||
$CRYPTSETUP -q repair $LOOPDEV >/dev/null 2>&1 || fail
|
||||
$CRYPTSETUP luksOpen -d $KEY1 $LOOPDEV $DEV_NAME || fail
|
||||
$CRYPTSETUP luksClose $DEV_NAME || fail
|
||||
|
||||
remove_mapping
|
||||
exit 0
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user