chiark / gitweb /
c103aa9e03e329735b7e702f3802276d8dbb3e9c
[elogind.git] / src / cryptsetup.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4   This file is part of systemd.
5
6   Copyright 2010 Lennart Poettering
7
8   systemd is free software; you can redistribute it and/or modify it
9   under the terms of the GNU General Public License as published by
10   the Free Software Foundation; either version 2 of the License, or
11   (at your option) any later version.
12
13   systemd is distributed in the hope that it will be useful, but
14   WITHOUT ANY WARRANTY; without even the implied warranty of
15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16   General Public License for more details.
17
18   You should have received a copy of the GNU General Public License
19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <string.h>
23 #include <errno.h>
24 #include <sys/mman.h>
25
26 #include <libcryptsetup.h>
27
28 #include "log.h"
29 #include "util.h"
30 #include "ask-password-api.h"
31
32 static const char *opt_type = NULL; /* LUKS1 or PLAIN */
33 static char *opt_cipher = NULL;
34 static unsigned opt_key_size = 0;
35 static char *opt_hash = NULL;
36 static unsigned opt_tries = 0;
37 static bool opt_readonly = false;
38 static bool opt_verify = false;
39 static usec_t opt_timeout = 0;
40
41 /* Options Debian's crypttab knows we don't:
42
43     offset=
44     skip=
45     precheck=
46     check=
47     checkargs=
48     noearly=
49     loud=
50     keyscript=
51 */
52
53 static int parse_one_option(const char *option) {
54         assert(option);
55
56         /* Handled outside of this tool */
57         if (streq(option, "noauto"))
58                 return 0;
59
60         if (startswith(option, "cipher=")) {
61                 char *t;
62
63                 if (!(t = strdup(option+7)))
64                         return -ENOMEM;
65
66                 free(opt_cipher);
67                 opt_cipher = t;
68
69         } else if (startswith(option, "size=")) {
70
71                 if (safe_atou(option+5, &opt_key_size) < 0) {
72                         log_error("size= parse failure, ignoring.");
73                         return 0;
74                 }
75
76         } else if (startswith(option, "hash=")) {
77                 char *t;
78
79                 if (!(t = strdup(option+5)))
80                         return -ENOMEM;
81
82                 free(opt_hash);
83                 opt_hash = t;
84
85         } else if (startswith(option, "tries=")) {
86
87                 if (safe_atou(option+6, &opt_tries) < 0) {
88                         log_error("tries= parse failure, ignoring.");
89                         return 0;
90                 }
91
92         } else if (streq(option, "readonly"))
93                 opt_readonly = true;
94         else if (streq(option, "verify"))
95                 opt_verify = true;
96         else if (streq(option, "luks"))
97                 opt_type = CRYPT_LUKS1;
98         else if (streq(option, "plain") ||
99                  streq(option, "swap") ||
100                  streq(option, "tmp"))
101                 opt_type = CRYPT_PLAIN;
102         else if (startswith(option, "timeout=")) {
103
104                 if (parse_usec(option+8, &opt_timeout) < 0) {
105                         log_error("timeout= parse failure, ignoring.");
106                         return 0;
107                 }
108
109         } else
110                 log_error("Encountered unknown /etc/crypttab option '%s', ignoring.", option);
111
112         return 0;
113 }
114
115 static int parse_options(const char *options) {
116         char *state;
117         char *w;
118         size_t l;
119
120         assert(options);
121
122         FOREACH_WORD_SEPARATOR(w, l, options, ",", state) {
123                 char *o;
124                 int r;
125
126                 if (!(o = strndup(w, l)))
127                         return -ENOMEM;
128
129                 r = parse_one_option(o);
130                 free(o);
131
132                 if (r < 0)
133                         return r;
134         }
135
136         return 0;
137 }
138
139 static void log_glue(int level, const char *msg, void *usrptr) {
140         log_debug("%s", msg);
141 }
142
143 int main(int argc, char *argv[]) {
144         int r = EXIT_FAILURE;
145         struct crypt_device *cd = NULL;
146         char *password = NULL, *truncated_cipher = NULL;
147         const char *cipher = NULL, *cipher_mode = NULL, *hash = NULL;
148
149         if (argc < 3) {
150                 log_error("This program requires at least two arguments.");
151                 return EXIT_FAILURE;
152         }
153
154         log_set_target(LOG_TARGET_AUTO);
155         log_parse_environment();
156         log_open();
157
158         if (streq(argv[1], "attach")) {
159                 uint32_t flags = 0;
160                 int k;
161                 unsigned try;
162                 const char *key_file = NULL;
163                 usec_t until;
164                 crypt_status_info status;
165
166                 if (argc < 4) {
167                         log_error("attach requires at least two arguments.");
168                         goto finish;
169                 }
170
171                 if (argc >= 5 &&
172                     argv[4][0] &&
173                     !streq(argv[4], "-") &&
174                     !streq(argv[4], "none")) {
175
176                         if (!path_is_absolute(argv[4]))
177                                 log_error("Password file path %s is not absolute. Ignoring.", argv[4]);
178                         else
179                                 key_file = argv[4];
180                 }
181
182                 if (argc >= 6 && argv[5][0] && !streq(argv[5], "-"))
183                         parse_options(argv[5]);
184
185                 /* A delicious drop of snake oil */
186                 mlockall(MCL_FUTURE);
187
188                 if ((k = crypt_init(&cd, argv[3]))) {
189                         log_error("crypt_init() failed: %s", strerror(-k));
190                         goto finish;
191                 }
192
193                 crypt_set_log_callback(cd, log_glue, NULL);
194
195                 status = crypt_status(cd, argv[2]);
196                 if (status == CRYPT_ACTIVE || status == CRYPT_BUSY) {
197                         log_info("Volume %s already active.", argv[2]);
198                         r = EXIT_SUCCESS;
199                         goto finish;
200                 }
201
202                 if (opt_readonly)
203                         flags |= CRYPT_ACTIVATE_READONLY;
204
205                 until = now(CLOCK_MONOTONIC) + (opt_timeout > 0 ? opt_timeout : 60 * USEC_PER_SEC);
206
207                 opt_tries = opt_tries > 0 ? opt_tries : 3;
208                 opt_key_size = (opt_key_size > 0 ? opt_key_size : 256);
209                 hash = opt_hash ? opt_hash : "ripemd160";
210
211                 if (opt_cipher) {
212                         size_t l;
213
214                         l = strcspn(opt_cipher, "-");
215
216                         if (!(truncated_cipher = strndup(opt_cipher, l))) {
217                                 log_error("Out of memory");
218                                 goto finish;
219                         }
220
221                         cipher = truncated_cipher;
222                         cipher_mode = opt_cipher[l] ? opt_cipher+l+1 : "plain";
223                 } else {
224                         cipher = "aes";
225                         cipher_mode = "cbc-essiv:sha256";
226                 }
227
228                 for (try = 0; try < opt_tries; try++) {
229                         bool pass_volume_key = false;
230
231                         free(password);
232                         password = NULL;
233
234                         if (!key_file) {
235
236                                 if ((k = ask_password_auto("Please enter passphrase for disk:", "drive-harddisk", until, &password)) < 0) {
237                                         log_error("Failed to query password: %s", strerror(-k));
238                                         goto finish;
239                                 }
240
241                                 if (opt_verify) {
242                                         char *password2 = NULL;
243
244                                         if ((k = ask_password_auto("Please enter passphrase for disk (verification):", "drive-harddisk", until, &password2)) < 0) {
245                                                 log_error("Failed to query verification password: %s", strerror(-k));
246                                                 goto finish;
247                                         }
248
249                                         if (!streq(password, password2)) {
250                                                 log_warning("Passwords did not match, retrying.");
251                                                 free(password2);
252                                                 continue;
253                                         }
254
255                                         free(password2);
256                                 }
257
258                                 if (strlen(password)+1 < opt_key_size) {
259                                         char *c;
260
261                                         /* Pad password if necessary */
262
263                                         if (!(c = new(char, opt_key_size))) {
264                                                 log_error("Out of memory.");
265                                                 goto finish;
266                                         }
267
268                                         strncpy(c, password, opt_key_size);
269                                         free(password);
270                                         password = c;
271                                 }
272                         }
273
274                         if (!opt_type || streq(opt_type, CRYPT_LUKS1))
275                                 k = crypt_load(cd, CRYPT_LUKS1, NULL);
276
277                         if ((!opt_type && k < 0) || streq_ptr(opt_type, CRYPT_PLAIN)) {
278                                 struct crypt_params_plain params;
279
280                                 zero(params);
281                                 params.hash = hash;
282
283                                 /* In contrast to what the name
284                                  * crypt_setup() might suggest this
285                                  * doesn't actually format anything,
286                                  * it just configures encryption
287                                  * parameters when used for plain
288                                  * mode. */
289                                 k = crypt_format(cd, CRYPT_PLAIN,
290                                                  cipher,
291                                                  cipher_mode,
292                                                  NULL,
293                                                  NULL,
294                                                  opt_key_size / 8,
295                                                  &params);
296
297                                 pass_volume_key = streq(hash, "plain");
298                         }
299
300                         if (k < 0) {
301                                 log_error("Loading of cryptographic parameters failed: %s", strerror(-k));
302                                 goto finish;
303                         }
304
305                         log_info("Set cipher %s, mode %s, key size %i bits for device %s.",
306                                  crypt_get_cipher(cd),
307                                  crypt_get_cipher_mode(cd),
308                                  crypt_get_volume_key_size(cd)*8,
309                                  argv[3]);
310
311                         if (key_file)
312                                 k = crypt_activate_by_keyfile(cd, argv[2], CRYPT_ANY_SLOT, key_file, opt_key_size, flags);
313                         else if (pass_volume_key)
314                                 k = crypt_activate_by_volume_key(cd, argv[2], password, opt_key_size, flags);
315                         else
316                                 k = crypt_activate_by_passphrase(cd, argv[2], CRYPT_ANY_SLOT, password, strlen(password), flags);
317
318                         if (k >= 0)
319                                 break;
320
321                         if (k != -EPERM) {
322                                 log_error("Failed to activate: %s", strerror(-k));
323                                 goto finish;
324                         }
325
326                         log_warning("Invalid passphrase.");
327                 }
328
329                 if (try >= opt_tries) {
330                         log_error("Too many attempts.");
331                         r = EXIT_FAILURE;
332                 }
333
334         } else if (streq(argv[1], "detach")) {
335                 int k;
336
337                 if ((k = crypt_init_by_name(&cd, argv[2]))) {
338                         log_error("crypt_init() failed: %s", strerror(-k));
339                         goto finish;
340                 }
341
342                 crypt_set_log_callback(cd, log_glue, NULL);
343
344                 if ((k = crypt_deactivate(cd, argv[2])) < 0) {
345                         log_error("Failed to deactivate: %s", strerror(-k));
346                         goto finish;
347                 }
348
349         } else {
350                 log_error("Unknown verb %s.", argv[1]);
351                 goto finish;
352         }
353
354         r = EXIT_SUCCESS;
355
356 finish:
357
358         if (cd)
359                 crypt_free(cd);
360
361         free(opt_cipher);
362         free(opt_hash);
363
364         free(truncated_cipher);
365
366         free(password);
367
368         return r;
369 }