#include "journal-def.h"
#include "journal-verify.h"
#include "journal-authenticate.h"
+#include "journal-qrcode.h"
#include "fsprg.h"
#define DEFAULT_FSS_INTERVAL_USEC (15*USEC_PER_MINUTE)
static const char *arg_directory = NULL;
static int arg_priorities = 0xFF;
static const char *arg_verify_key = NULL;
+#ifdef HAVE_GCRYPT
static usec_t arg_interval = DEFAULT_FSS_INTERVAL_USEC;
+#endif
static enum {
ACTION_SHOW,
"Commands:\n"
" --new-id128 Generate a new 128 Bit ID\n"
" --header Show journal header information\n"
+#ifdef HAVE_GCRYPT
" --setup-keys Generate new FSS key pair\n"
" --interval=TIME Time interval for changing the FSS sealing key\n"
" --verify Verify journal file consistency\n"
- " --verify-key=KEY Specify FSS verification key\n",
- program_invocation_short_name);
+ " --verify-key=KEY Specify FSS verification key\n"
+#endif
+ , program_invocation_short_name);
return 0;
}
arg_action = ACTION_PRINT_HEADER;
break;
+ case ARG_VERIFY:
+ arg_action = ACTION_VERIFY;
+ break;
+
+#ifdef HAVE_GCRYPT
case ARG_SETUP_KEYS:
arg_action = ACTION_SETUP_KEYS;
break;
- case ARG_VERIFY:
- arg_action = ACTION_VERIFY;
- break;
case ARG_VERIFY_KEY:
arg_action = ACTION_VERIFY;
return -EINVAL;
}
break;
+#else
+ case ARG_SETUP_KEYS:
+ case ARG_VERIFY_KEY:
+ case ARG_INTERVAL:
+ log_error("Forward-secure sealing not available.");
+ return -ENOTSUP;
+#endif
case 'p': {
const char *dots;
printf("/%llx-%llx\n", (unsigned long long) n, (unsigned long long) arg_interval);
if (isatty(STDOUT_FILENO)) {
- char tsb[FORMAT_TIMESPAN_MAX];
+ char tsb[FORMAT_TIMESPAN_MAX], *hn;
fprintf(stderr,
ANSI_HIGHLIGHT_OFF "\n"
"The sealing key is automatically changed every %s.\n",
format_timespan(tsb, sizeof(tsb), arg_interval));
+
+ hn = gethostname_malloc();
+
+ if (hn) {
+ hostname_cleanup(hn);
+ fprintf(stderr, "The keys have been generated for host %s (" SD_ID128_FORMAT_STR ").\n", hn, SD_ID128_FORMAT_VAL(machine));
+ } else
+ fprintf(stderr, "The keys have been generated for host " SD_ID128_FORMAT_STR ".\n", SD_ID128_FORMAT_VAL(machine));
+
+#ifdef HAVE_QRENCODE
+ fputc('\n', stderr);
+ print_qr_code(stderr, seed, seed_size, n, arg_interval, hn, machine);
+ fprintf(stderr, "\nScan this QR code with your mobile phone to transfer the verification key to it.\n");
+#endif
+ free(hn);
}
r = 0;
return r;
#else
- log_error("Forward-secure journal verification not available.");
+ log_error("Forward-secure sealing not available.");
+ return -ENOTSUP;
#endif
}
usec_t from, to, total;
#ifdef HAVE_GCRYPT
- if (!arg_verify_key && journal_file_fss_enabled(f))
+ if (!arg_verify_key && JOURNAL_HEADER_SEALED(f->header))
log_warning("Journal file %s has sealing enabled but verification key has not been passed using --verify-key=.", f->path);
#endif
char a[FORMAT_TIMESTAMP_MAX], b[FORMAT_TIMESTAMP_MAX], c[FORMAT_TIMESPAN_MAX];
log_info("PASS: %s", f->path);
- if (arg_verify_key && journal_file_fss_enabled(f))
+ if (arg_verify_key && JOURNAL_HEADER_SEALED(f->header))
log_info("=> Validated from %s to %s, %s missing",
format_timestamp(a, sizeof(a), from),
format_timestamp(b, sizeof(b), to),