contrib/cryptsetup/src/cryptsetup.c

   1 #include <string.h>
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <stdint.h>
   5 #include <stdarg.h>
   6 #include <inttypes.h>
   7 #include <errno.h>
   8 #include <unistd.h>
   9 #include <fcntl.h>
  10 #include <assert.h>
  11 #include <getopt.h>
  12
  13 #include <libcryptsetup.h>
  14
  15 #include "config.h"
  16
  17 #include "cryptsetup.h"
  18
  19 static int opt_verbose = 0;
  20 static int opt_debug = 0;
  21 static char *opt_cipher = NULL;
  22 static char *opt_hash = NULL;
  23 static int opt_verify_passphrase = 0;
  24 static char *opt_key_file = NULL;
  25 static char *opt_master_key_file = NULL;
  26 static char *opt_header_backup_file = NULL;
  27 static unsigned int opt_key_size = 0;
  28 static int opt_key_slot = CRYPT_ANY_SLOT;
  29 static uint64_t opt_size = 0;
  30 static uint64_t opt_offset = 0;
  31 static uint64_t opt_skip = 0;
  32 static int opt_readonly = 0;
  33 static int opt_iteration_time = 1000;
  34 static int opt_batch_mode = 0;
  35 static int opt_version_mode = 0;
  36 static int opt_timeout = 0;
  37 static int opt_tries = 3;
  38 static int opt_align_payload = 0;
  39 static int opt_non_exclusive = 0;
  40
  41 static const char **action_argv;
  42 static int action_argc;
  43
  44 static int action_create(int arg);
  45 static int action_remove(int arg);
  46 static int action_resize(int arg);
  47 static int action_status(int arg);
  48 static int action_luksFormat(int arg);
  49 static int action_luksOpen(int arg);
  50 static int action_luksAddKey(int arg);
  51 static int action_luksDelKey(int arg);
  52 static int action_luksKillSlot(int arg);
  53 static int action_luksRemoveKey(int arg);
  54 static int action_isLuks(int arg);
  55 static int action_luksUUID(int arg);
  56 static int action_luksDump(int arg);
  57 static int action_luksSuspend(int arg);
  58 static int action_luksResume(int arg);
  59 static int action_luksBackup(int arg);
  60 static int action_luksRestore(int arg);
  61
  62 static struct action_type {
  63         const char *type;
  64         int (*handler)(int);
  65         int arg;
  66         int required_action_argc;
  67         int required_memlock;
  68         const char *arg_desc;
  69         const char *desc;
  70 } action_types[] = {
  71         { "create",     action_create,          0, 2, 1, N_("<name> <device>"),N_("create device") },
  72         { "remove",     action_remove,          0, 1, 1, N_("<name>"), N_("remove device") },
  73         { "resize",     action_resize,          0, 1, 1, N_("<name>"), N_("resize active device") },
  74         { "status",     action_status,          0, 1, 0, N_("<name>"), N_("show device status") },
  75         { "luksFormat", action_luksFormat,      0, 1, 1, N_("<device> [<new key file>]"), N_("formats a LUKS device") },
  76         { "luksOpen",   action_luksOpen,        0, 2, 1, N_("<device> <name> "), N_("open LUKS device as mapping <name>") },
  77         { "luksAddKey", action_luksAddKey,      0, 1, 1, N_("<device> [<new key file>]"), N_("add key to LUKS device") },
  78         { "luksRemoveKey",action_luksRemoveKey, 0, 1, 1, N_("<device> [<key file>]"), N_("removes supplied key or key file from LUKS device") },
  79         { "luksKillSlot",  action_luksKillSlot, 0, 2, 1, N_("<device> <key slot>"), N_("wipes key with number <key slot> from LUKS device") },
  80         { "luksUUID",   action_luksUUID,        0, 1, 0, N_("<device>"), N_("print UUID of LUKS device") },
  81         { "isLuks",     action_isLuks,          0, 1, 0, N_("<device>"), N_("tests <device> for LUKS partition header") },
  82         { "luksClose",  action_remove,          0, 1, 1, N_("<name>"), N_("remove LUKS mapping") },
  83         { "luksDump",   action_luksDump,        0, 1, 0, N_("<device>"), N_("dump LUKS partition information") },
  84         { "luksSuspend",action_luksSuspend,     0, 1, 1, N_("<device>"), N_("Suspend LUKS device and wipe key (all IOs are frozen).") },
  85         { "luksResume", action_luksResume,      0, 1, 1, N_("<device>"), N_("Resume suspended LUKS device.") },
  86         { "luksHeaderBackup",action_luksBackup, 0, 1, 1, N_("<device>"), N_("Backup LUKS device header and keyslots") },
  87         { "luksHeaderRestore",action_luksRestore,0,1, 1, N_("<device>"), N_("Restore LUKS device header and keyslots") },
  88         { "luksDelKey", action_luksDelKey,      0, 2, 1, N_("<device> <key slot>"), N_("identical to luksKillSlot - DEPRECATED - see man page") },
  89         { "reload",     action_create,          1, 2, 1, N_("<name> <device>"), N_("modify active device - DEPRECATED - see man page") },
  90         { NULL, NULL, 0, 0, 0, NULL, NULL }
  91 };
  92
  93 static void clogger(struct crypt_device *cd, int level, const char *file,
  94                    int line, const char *format, ...)
  95 {
  96         va_list argp;
  97         char *target = NULL;
  98
  99         va_start(argp, format);
 100
 101         if (vasprintf(&target, format, argp) > 0) {
 102                 if (level >= 0) {
 103                         crypt_log(cd, level, target);
 104 #ifdef CRYPT_DEBUG
 105                 } else if (opt_debug)
 106                         printf("# %s:%d %s\n", file ?: "?", line, target);
 107 #else
 108                 } else if (opt_debug)
 109                         printf("# %s\n", target);
 110 #endif
 111         }
 112
 113         va_end(argp);
 114         free(target);
 115 }
 116
 117 /* Interface Callbacks */
 118 static int yesDialog(char *msg)
 119 {
 120         char *answer = NULL;
 121         size_t size = 0;
 122         int r = 1;
 123
 124         if(isatty(0) && !opt_batch_mode) {
 125                 log_std("\nWARNING!\n========\n");
 126                 log_std("%s\n\nAre you sure? (Type uppercase yes): ", msg);
 127                 if(getline(&answer, &size, stdin) == -1) {
 128                         perror("getline");
 129                         free(answer);
 130                         return 0;
 131                 }
 132                 if(strcmp(answer, "YES\n"))
 133                         r = 0;
 134                 free(answer);
 135         }
 136
 137         return r;
 138 }
 139
 140 static void cmdLineLog(int level, char *msg) {
 141         switch(level) {
 142
 143         case CRYPT_LOG_NORMAL:
 144                 fputs(msg, stdout);
 145                 break;
 146         case CRYPT_LOG_VERBOSE:
 147                 if (opt_verbose)
 148                         fputs(msg, stdout);
 149                 break;
 150         case CRYPT_LOG_ERROR:
 151                 fputs(msg, stderr);
 152                 break;
 153         default:
 154                 fprintf(stderr, "Internal error on logging class for msg: %s", msg);
 155                 break;
 156         }
 157 }
 158
 159 static struct interface_callbacks cmd_icb = {
 160         .yesDialog = yesDialog,
 161         .log = cmdLineLog,
 162 };
 163
 164 static void _log(int level, const char *msg, void *usrptr)
 165 {
 166         cmdLineLog(level, (char *)msg);
 167 }
 168
 169 static int _yesDialog(const char *msg, void *usrptr)
 170 {
 171         return yesDialog((char*)msg);
 172 }
 173
 174 /* End ICBs */
 175
 176 static void show_status(int errcode)
 177 {
 178         char error[256];
 179         int ret;
 180
 181         if(!opt_verbose)
 182                 return;
 183
 184         if(!errcode) {
 185                 log_std(_("Command successful.\n"));
 186                 return;
 187         }
 188
 189         crypt_get_error(error, sizeof(error));
 190
 191         if (!error[0]) {
 192                 ret = strerror_r(-errcode, error, sizeof(error));
 193         }
 194
 195         log_err(_("Command failed with code %i"), -errcode);
 196         if (*error)
 197                 log_err(": %s\n", error);
 198         else
 199                 log_err(".\n");
 200 }
 201
 202 static int action_create(int reload)
 203 {
 204         struct crypt_options options = {
 205                 .name = action_argv[0],
 206                 .device = action_argv[1],
 207                 .cipher = opt_cipher ? opt_cipher : DEFAULT_CIPHER(PLAIN),
 208                 .hash = opt_hash ?: DEFAULT_PLAIN_HASH,
 209                 .key_file = opt_key_file,
 210                 .key_size = (opt_key_size ?: DEFAULT_PLAIN_KEYBITS) / 8,
 211                 .key_slot = opt_key_slot,
 212                 .flags = 0,
 213                 .size = opt_size,
 214                 .offset = opt_offset,
 215                 .skip = opt_skip,
 216                 .timeout = opt_timeout,
 217                 .tries = opt_tries,
 218                 .icb = &cmd_icb,
 219         };
 220         int r;
 221
 222         if(reload)
 223                 log_err(_("The reload action is deprecated. Please use \"dmsetup reload\" in case you really need this functionality.\nWARNING: do not use reload to touch LUKS devices. If that is the case, hit Ctrl-C now.\n"));
 224
 225         if (options.hash && strcmp(options.hash, "plain") == 0)
 226                 options.hash = NULL;
 227         if (opt_verify_passphrase)
 228                 options.flags |= CRYPT_FLAG_VERIFY;
 229         if (opt_readonly)
 230                 options.flags |= CRYPT_FLAG_READONLY;
 231
 232         if (reload)
 233                 r = crypt_update_device(&options);
 234         else
 235                 r = crypt_create_device(&options);
 236
 237         return r;
 238 }
 239
 240 static int action_remove(int arg)
 241 {
 242         struct crypt_options options = {
 243                 .name = action_argv[0],
 244                 .icb = &cmd_icb,
 245         };
 246
 247         return crypt_remove_device(&options);
 248 }
 249
 250 static int action_resize(int arg)
 251 {
 252         struct crypt_options options = {
 253                 .name = action_argv[0],
 254                 .size = opt_size,
 255                 .icb = &cmd_icb,
 256         };
 257
 258         return crypt_resize_device(&options);
 259 }
 260
 261 static int action_status(int arg)
 262 {
 263         struct crypt_options options = {
 264                 .name = action_argv[0],
 265                 .icb = &cmd_icb,
 266         };
 267         int r;
 268
 269         r = crypt_query_device(&options);
 270         if (r < 0)
 271                 return r;
 272
 273         if (r == 0) {
 274                 /* inactive */
 275                 log_std("%s/%s is inactive.\n", crypt_get_dir(), options.name);
 276                 r = 1;
 277         } else {
 278                 /* active */
 279                 log_std("%s/%s is active:\n", crypt_get_dir(), options.name);
 280                 log_std("  cipher:  %s\n", options.cipher);
 281                 log_std("  keysize: %d bits\n", options.key_size * 8);
 282                 log_std("  device:  %s\n", options.device ?: "");
 283                 log_std("  offset:  %" PRIu64 " sectors\n", options.offset);
 284                 log_std("  size:    %" PRIu64 " sectors\n", options.size);
 285                 if (options.skip)
 286                         log_std("  skipped: %" PRIu64 " sectors\n", options.skip);
 287                 log_std("  mode:    %s\n", (options.flags & CRYPT_FLAG_READONLY)
 288                                            ? "readonly" : "read/write");
 289                 crypt_put_options(&options);
 290                 r = 0;
 291         }
 292         return r;
 293 }
 294
 295 static int _action_luksFormat_generateMK()
 296 {
 297         struct crypt_options options = {
 298                 .key_size = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8,
 299                 .key_slot = opt_key_slot,
 300                 .device = action_argv[0],
 301                 .cipher = opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 302                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 303                 .new_key_file = opt_key_file ?: (action_argc > 1 ? action_argv[1] : NULL),
 304                 .flags = opt_verify_passphrase ? CRYPT_FLAG_VERIFY : (!opt_batch_mode?CRYPT_FLAG_VERIFY_IF_POSSIBLE :  0),
 305                 .iteration_time = opt_iteration_time,
 306                 .timeout = opt_timeout,
 307                 .align_payload = opt_align_payload,
 308                 .icb = &cmd_icb,
 309         };
 310
 311         return crypt_luksFormat(&options);
 312 }
 313
 314 static int _read_mk(const char *file, char **key, int keysize)
 315 {
 316         int fd;
 317
 318         *key = malloc(keysize);
 319         if (!*key)
 320                 return -ENOMEM;
 321
 322         fd = open(file, O_RDONLY);
 323         if (fd == -1) {
 324                 log_err("Cannot read keyfile %s.\n", file);
 325                 return -EINVAL;
 326         }
 327         if ((read(fd, *key, keysize) != keysize)) {
 328                 log_err("Cannot read %d bytes from keyfile %s.\n", keysize, file);
 329                 close(fd);
 330                 memset(*key, 0, keysize);
 331                 free(*key);
 332                 return -EINVAL;
 333         }
 334         close(fd);
 335         return 0;
 336 }
 337
 338 static int _action_luksFormat_useMK()
 339 {
 340         int r = -EINVAL, keysize;
 341         char *key = NULL, cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
 342         struct crypt_device *cd = NULL;
 343         struct crypt_params_luks1 params = {
 344                 .hash = opt_hash ?: DEFAULT_LUKS1_HASH,
 345                 .data_alignment = opt_align_payload,
 346         };
 347
 348         if (sscanf(opt_cipher ?: DEFAULT_CIPHER(LUKS1),
 349                    "%" MAX_CIPHER_LEN_STR "[^-]-%" MAX_CIPHER_LEN_STR "s",
 350                    cipher, cipher_mode) != 2) {
 351                 log_err("No known cipher specification pattern detected.\n");
 352                 return -EINVAL;
 353         }
 354
 355         keysize = (opt_key_size ?: DEFAULT_LUKS1_KEYBITS) / 8;
 356         if (_read_mk(opt_master_key_file, &key, keysize) < 0)
 357                 return -EINVAL;
 358
 359         if ((r = crypt_init(&cd, action_argv[0])))
 360                 goto out;
 361
 362         crypt_set_password_verify(cd, 1);
 363         crypt_set_timeout(cd, opt_timeout);
 364         if (opt_iteration_time)
 365                 crypt_set_iterarion_time(cd, opt_iteration_time);
 366
 367         if ((r = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, key, keysize, &params)))
 368                 goto out;
 369
 370         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot, key, keysize, NULL, 0);
 371 out:
 372
 373         crypt_free(cd);
 374         if (key) {
 375                 memset(key, 0, keysize);
 376                 free(key);
 377         }
 378         return r;
 379 }
 380
 381 static int action_luksFormat(int arg)
 382 {
 383         int r = 0; char *msg = NULL;
 384
 385         /* Avoid overwriting possibly wrong part of device than user requested by rejecting these options */
 386         if (opt_offset || opt_skip) {
 387                 log_err("Options --offset and --skip are not supported for luksFormat.\n");
 388                 return -EINVAL;
 389         }
 390
 391         if (action_argc > 1 && opt_key_file)
 392                 log_err(_("Option --key-file takes precedence over specified key file argument.\n"));
 393
 394         if(asprintf(&msg, _("This will overwrite data on %s irrevocably."), action_argv[0]) == -1) {
 395                 log_err(_("memory allocation error in action_luksFormat"));
 396                 return -ENOMEM;
 397         }
 398         r = yesDialog(msg);
 399         free(msg);
 400
 401         if (!r)
 402                 return -EINVAL;
 403
 404         if (opt_master_key_file)
 405                 return _action_luksFormat_useMK();
 406         else
 407                 return _action_luksFormat_generateMK();
 408 }
 409
 410 static int action_luksOpen(int arg)
 411 {
 412         struct crypt_options options = {
 413                 .name = action_argv[1],
 414                 .device = action_argv[0],
 415                 .key_file = opt_key_file,
 416                 .key_size = opt_key_file ? (opt_key_size / 8) : 0, /* limit bytes read from keyfile */
 417                 .timeout = opt_timeout,
 418                 .tries = opt_key_file ? 1 : opt_tries, /* verify is usefull only for tty */
 419                 .icb = &cmd_icb,
 420         };
 421
 422         if (opt_readonly)
 423                 options.flags |= CRYPT_FLAG_READONLY;
 424         if (opt_non_exclusive)
 425                 log_err(_("Obsolete option --non-exclusive is ignored.\n"));
 426
 427         return crypt_luksOpen(&options);
 428 }
 429
 430 static int action_luksDelKey(int arg)
 431 {
 432         log_err("luksDelKey is a deprecated action name.\nPlease use luksKillSlot.\n");
 433         return action_luksKillSlot(arg);
 434 }
 435
 436 static int action_luksKillSlot(int arg)
 437 {
 438         struct crypt_options options = {
 439                 .device = action_argv[0],
 440                 .key_slot = atoi(action_argv[1]),
 441                 .key_file = opt_key_file,
 442                 .timeout = opt_timeout,
 443                 .flags = !opt_batch_mode?CRYPT_FLAG_VERIFY_ON_DELKEY : 0,
 444                 .icb = &cmd_icb,
 445         };
 446
 447         return crypt_luksKillSlot(&options);
 448 }
 449
 450 static int action_luksRemoveKey(int arg)
 451 {
 452         struct crypt_options options = {
 453                 .device = action_argv[0],
 454                 .new_key_file = action_argc>1?action_argv[1]:NULL,
 455                 .key_file = opt_key_file,
 456                 .timeout = opt_timeout,
 457                 .flags = !opt_batch_mode?CRYPT_FLAG_VERIFY_ON_DELKEY : 0,
 458                 .icb = &cmd_icb,
 459         };
 460
 461         return crypt_luksRemoveKey(&options);
 462 }
 463
 464 static int _action_luksAddKey_useMK()
 465 {
 466         int r = -EINVAL, keysize = 0;
 467         char *key = NULL;
 468         struct crypt_device *cd = NULL;
 469
 470         if ((r = crypt_init(&cd, action_argv[0])))
 471                 goto out;
 472
 473         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 474                 goto out;
 475
 476         keysize = crypt_get_volume_key_size(cd);
 477         crypt_set_password_verify(cd, 1);
 478         crypt_set_timeout(cd, opt_timeout);
 479         if (opt_iteration_time)
 480                 crypt_set_iterarion_time(cd, opt_iteration_time);
 481
 482         if (_read_mk(opt_master_key_file, &key, keysize) < 0)
 483                 goto out;
 484
 485         r = crypt_keyslot_add_by_volume_key(cd, opt_key_slot, key, keysize, NULL, 0);
 486 out:
 487         crypt_free(cd);
 488         if (key) {
 489                 memset(key, 0, keysize);
 490                 free(key);
 491         }
 492         return r;
 493 }
 494
 495 static int action_luksAddKey(int arg)
 496 {
 497         struct crypt_options options = {
 498                 .device = action_argv[0],
 499                 .new_key_file = action_argc>1?action_argv[1]:NULL,
 500                 .key_file = opt_key_file,
 501                 .key_slot = opt_key_slot,
 502                 .flags = opt_verify_passphrase ? CRYPT_FLAG_VERIFY : (!opt_batch_mode?CRYPT_FLAG_VERIFY_IF_POSSIBLE : 0),
 503                 .iteration_time = opt_iteration_time,
 504                 .timeout = opt_timeout,
 505                 .icb = &cmd_icb,
 506         };
 507
 508         if (opt_master_key_file)
 509                 return _action_luksAddKey_useMK();
 510         else
 511                 return crypt_luksAddKey(&options);
 512 }
 513
 514 static int action_isLuks(int arg)
 515 {
 516         struct crypt_options options = {
 517                 .device = action_argv[0],
 518                 .icb = &cmd_icb,
 519         };
 520
 521         return crypt_isLuks(&options);
 522 }
 523
 524 static int action_luksUUID(int arg)
 525 {
 526         struct crypt_options options = {
 527                 .device = action_argv[0],
 528                 .icb = &cmd_icb,
 529         };
 530
 531         return crypt_luksUUID(&options);
 532 }
 533
 534 static int action_luksDump(int arg)
 535 {
 536         struct crypt_options options = {
 537                 .device = action_argv[0],
 538                 .icb = &cmd_icb,
 539         };
 540
 541         return crypt_luksDump(&options);
 542 }
 543
 544 static int action_luksSuspend(int arg)
 545 {
 546         struct crypt_device *cd = NULL;
 547         int r;
 548
 549         r = crypt_init_by_name(&cd, action_argv[0]);
 550         if (!r)
 551                 r = crypt_suspend(cd, action_argv[0]);
 552
 553         crypt_free(cd);
 554         return r;
 555 }
 556
 557 static int action_luksResume(int arg)
 558 {
 559         struct crypt_device *cd = NULL;
 560         int r;
 561
 562         if ((r = crypt_init_by_name(&cd, action_argv[0])))
 563                 goto out;
 564
 565         if ((r = crypt_load(cd, CRYPT_LUKS1, NULL)))
 566                 goto out;
 567
 568         if (opt_key_file)
 569                 r = crypt_resume_by_keyfile(cd, action_argv[0], CRYPT_ANY_SLOT,
 570                                             opt_key_file, opt_key_size / 8);
 571         else
 572                 r = crypt_resume_by_passphrase(cd, action_argv[0], CRYPT_ANY_SLOT,
 573                                                NULL, 0);
 574 out:
 575         crypt_free(cd);
 576         return r;
 577 }
 578
 579 static int action_luksBackup(int arg)
 580 {
 581         struct crypt_device *cd = NULL;
 582         int r;
 583
 584         if (!opt_header_backup_file) {
 585                 log_err(_("Option --header-backup-file is required.\n"));
 586                 return -EINVAL;
 587         }
 588
 589         if ((r = crypt_init(&cd, action_argv[0])))
 590                 goto out;
 591
 592         crypt_set_log_callback(cd, _log, NULL);
 593         crypt_set_confirm_callback(cd, _yesDialog, NULL);
 594
 595         r = crypt_header_backup(cd, CRYPT_LUKS1, opt_header_backup_file);
 596 out:
 597         crypt_free(cd);
 598         return r;
 599 }
 600
 601 static int action_luksRestore(int arg)
 602 {
 603         struct crypt_device *cd = NULL;
 604         int r = 0;
 605
 606         if (!opt_header_backup_file) {
 607                 log_err(_("Option --header-backup-file is required.\n"));
 608                 return -EINVAL;
 609         }
 610
 611         if ((r = crypt_init(&cd, action_argv[0])))
 612                 goto out;
 613
 614         crypt_set_log_callback(cd, _log, NULL);
 615         crypt_set_confirm_callback(cd, _yesDialog, NULL);
 616         r = crypt_header_restore(cd, CRYPT_LUKS1, opt_header_backup_file);
 617 out:
 618         crypt_free(cd);
 619         return r;
 620 }
 621
 622 static void usage(const char *msg)
 623 {
 624         log_err("Usage: cryptsetup [-?vyrq] [-?|--help] [--usage] [-v|--verbose]\n"
 625             "        [--debug] [-c|--cipher=STRING] [-h|--hash=STRING]\n"
 626             "        [-y|--verify-passphrase] [-d|--key-file=STRING]\n"
 627             "        [--master-key-file=STRING] [-s|--key-size=BITS] [-S|--key-slot=INT]\n"
 628             "        [-b|--size=SECTORS] [-o|--offset=SECTORS] [-p|--skip=SECTORS]\n"
 629             "        [-r|--readonly] [-i|--iter-time=msecs] [-q|--batch-mode] [--version]\n"
 630             "        [-t|--timeout=secs] [-T|--tries=INT] [--align-payload=SECTORS]\n"
 631             "        [--non-exclusive] [--header-backup-file=STRING] [OPTION...]\n"
 632             "        <action> <action-specific>]\n");
 633
 634         if (msg)
 635                 log_err("%s\n", msg);
 636
 637         exit(1);
 638 }
 639
 640 static void help()
 641 {
 642         struct action_type *action;
 643
 644         log_std("%s\n",PACKAGE_STRING);
 645         log_std("Usage: cryptsetup [OPTION...] <action> <action-specific>]\n"
 646             "  -v, --verbose                       Shows more detailed error messages\n"
 647             "      --debug                         Show debug messages\n"
 648             "  -c, --cipher=STRING                 The cipher used to encrypt the disk (see /proc/crypto)\n"
 649             "  -h, --hash=STRING                   The hash used to create the encryption key from the passphrase\n"
 650             "  -y, --verify-passphrase             Verifies the passphrase by asking for it twice\n"
 651             "  -d, --key-file=STRING               Read the key from a file (can be /dev/random)\n"
 652             "      --master-key-file=STRING        Read the volume (master) key from file.\n"
 653             "  -s, --key-size=BITS                 The size of the encryption key\n"
 654             "  -S, --key-slot=INT                  Slot number for new key (default is first free)\n"
 655             "  -b, --size=SECTORS                  The size of the device\n"
 656             "  -o, --offset=SECTORS                The start offset in the backend device\n"
 657             "  -p, --skip=SECTORS                  How many sectors of the encrypted data to skip at the beginning\n"
 658             "  -r, --readonly                      Create a readonly mapping\n"
 659             "  -i, --iter-time=msecs               PBKDF2 iteration time for LUKS (in ms)\n"
 660             "  -q, --batch-mode                    Do not ask for confirmation\n"
 661             "      --version                       Print package version\n"
 662             "  -t, --timeout=secs                  Timeout for interactive passphrase prompt (in seconds)\n"
 663             "  -T, --tries=INT                     How often the input of the passphrase can be retried\n"
 664             "      --align-payload=SECTORS         Align payload at <n> sector boundaries - for luksFormat\n"
 665             "      --non-exclusive                 (Obsoleted, see man page.)\n"
 666             "      --header-backup-file=STRING     File with LUKS header and keyslots backup.\n"
 667             "\n"
 668             "Help options:\n"
 669             "  -?, --help                          Show this help message\n"
 670             "      --usage                         Display brief usage\n" );
 671
 672         log_std(_("\n"
 673                  "<action> is one of:\n"));
 674
 675         for(action = action_types; action->type; action++)
 676                 log_std("\t%s %s - %s\n", action->type, _(action->arg_desc), _(action->desc));
 677
 678         log_std(_("\n"
 679                  "<name> is the device to create under %s\n"
 680                  "<device> is the encrypted device\n"
 681                  "<key slot> is the LUKS key slot number to modify\n"
 682                  "<key file> optional key file for the new key for luksAddKey action\n"),
 683                 crypt_get_dir());
 684
 685         log_std(_("\nDefault compiled-in device cipher parameters:\n"
 686                  "\tplain: %s, Key: %d bits, Password hashing: %s\n"
 687                  "\tLUKS1: %s, Key: %d bits, LUKS header hashing: %s\n"),
 688                  DEFAULT_CIPHER(PLAIN), DEFAULT_PLAIN_KEYBITS, DEFAULT_PLAIN_HASH,
 689                  DEFAULT_CIPHER(LUKS1), DEFAULT_LUKS1_KEYBITS, DEFAULT_LUKS1_HASH);
 690         exit(0);
 691
 692 }
 693
 694 void set_debug_level(int level);
 695
 696 static void _dbg_version_and_cmd(int argc, char **argv)
 697 {
 698         int i;
 699
 700         log_std("# %s %s processing \"", PACKAGE_NAME, PACKAGE_VERSION);
 701         for (i = 0; i < argc; i++) {
 702                 if (i)
 703                         log_std(" ");
 704                 log_std(argv[i]);
 705         }
 706         log_std("\"\n");
 707 }
 708
 709 static int run_action(struct action_type *action)
 710 {
 711         int r;
 712
 713         if (action->required_memlock)
 714                 crypt_memory_lock(NULL, 1);
 715
 716         r = action->handler(action->arg);
 717
 718         if (action->required_memlock)
 719                 crypt_memory_lock(NULL, 0);
 720
 721         show_status(r);
 722
 723         return r;
 724 }
 725
 726 int main(int argc, char **argv)
 727 {
 728         static struct option options[] = {
 729                 { "help",              no_argument,             NULL, '?' },
 730                 { "usage",             no_argument,             NULL, 'u' },
 731                 { "verbose",           no_argument,             NULL, 'v' },
 732                 { "debug",             no_argument,             &opt_debug, 1 },
 733                 { "cipher",            required_argument,       NULL, 'c' },
 734                 { "hash",              required_argument,       NULL, 'h' },
 735                 { "verify-passphrase", no_argument,             NULL, 'y' },
 736                 { "key-file",          required_argument,       NULL, 'd' },
 737                 { "master-key-file",   required_argument,       NULL, 'm' },
 738                 { "key-size",          required_argument,       NULL, 's' },
 739                 { "key-slot",          required_argument,       NULL, 'S' },
 740                 { "size",              required_argument,       NULL, 'b' },
 741                 { "offset",            required_argument,       NULL, 'o' },
 742                 { "skip",              required_argument,       NULL, 'p' },
 743                 { "readonly",          no_argument,             NULL, 'r' },
 744                 { "iter-time",         required_argument,       NULL, 'i' },
 745                 { "batch-mode",        no_argument,             NULL, 'q' },
 746                 { "version",           no_argument,             &opt_version_mode, 1 },
 747                 { "timeout",           required_argument,       NULL, 't' },
 748                 { "tries",             required_argument,       NULL, 'T' },
 749                 { "align-payload",     required_argument,       NULL, 'a' },
 750                 { "header-backup-file",required_argument,       NULL, 'x' },
 751                 { NULL,                 0,                      NULL, 0 }
 752         };
 753         struct action_type *action;
 754         char *aname;
 755         int r;
 756         const char *null_action_argv[] = {NULL};
 757
 758         crypt_set_log_callback(NULL, _log, NULL);
 759
 760         setlocale(LC_ALL, "");
 761         bindtextdomain(PACKAGE, LOCALEDIR);
 762         textdomain(PACKAGE);
 763
 764         while((r = getopt_long(argc, argv, "?vc:h:yd:m:s:S:b:o:p:ri:qt:T:", options, NULL)) != -1)
 765         {
 766                 switch (r) {
 767                 case 'u':
 768                         usage(NULL);
 769                         break;
 770                 case 'v':
 771                         opt_verbose = 1;
 772                         break;
 773                 case 'c':
 774                         opt_cipher = optarg;
 775                         break;
 776                 case 'h':
 777                         opt_hash = optarg;
 778                         break;
 779                 case 'y':
 780                         opt_verify_passphrase = 1;
 781                         break;
 782                 case 'd':
 783                         opt_key_file = optarg;
 784                         break;
 785                 case 'm':
 786                         opt_master_key_file = optarg;
 787                         break;
 788                 case 's':
 789                         opt_key_size = atoi(optarg);
 790                         break;
 791                 case 'S':
 792                         opt_key_slot = atoi(optarg);
 793                         break;
 794                 case 'b':
 795                         opt_size = strtoull(optarg, NULL, 0);
 796                         break;
 797                 case 'o':
 798                         opt_offset = strtoull(optarg, NULL, 0);
 799                         break;
 800                 case 'p':
 801                         opt_skip = strtoull(optarg, NULL, 0);
 802                         break;
 803                 case 'r':
 804                         opt_readonly = 1;
 805                         break;
 806                 case 'i':
 807                         opt_iteration_time = atoi(optarg);
 808                         break;
 809                 case 'q':
 810                         opt_batch_mode = 1;
 811                         break;
 812                 case 't':
 813                         opt_timeout = atoi(optarg);
 814                         break;
 815                 case 'T':
 816                         opt_tries = atoi(optarg);
 817                         break;
 818                 case 'a':
 819                         opt_align_payload = atoi(optarg);
 820                         break;
 821                 case 'x':
 822                         opt_header_backup_file = optarg;
 823                         break;
 824                 case '?':
 825                         help();
 826                         break;
 827                 case 0:
 828                         if (opt_version_mode) {
 829                                 log_std("%s %s\n", PACKAGE_NAME, PACKAGE_VERSION);
 830                                 exit(0);
 831                         }
 832                         break;
 833                 }
 834         }
 835
 836         if (opt_key_size % 8)
 837                 usage(_("Key size must be a multiple of 8 bits"));
 838
 839         argc -= optind;
 840         argv += optind;
 841
 842         if (argc == 0) {
 843                 usage(_("Argument <action> missing."));
 844                 /* NOTREACHED */
 845         }
 846
 847         aname = argv[0];
 848         for(action = action_types; action->type; action++)
 849                 if (strcmp(action->type, aname) == 0)
 850                         break;
 851         if (!action->type) {
 852                 usage( _("Unknown action."));
 853                 /* NOTREACHED */
 854         }
 855
 856         action_argc = argc-1;
 857         action_argv = &argv[1];
 858
 859         if(action_argc < action->required_action_argc) {
 860                 char buf[128];
 861                 snprintf(buf, 128,_("%s: requires %s as arguments"), action->type, action->arg_desc);
 862                 usage(buf);
 863                 /* NOTREACHED */
 864         }
 865
 866         if (opt_debug) {
 867                 opt_verbose = 1;
 868                 crypt_set_debug_level(-1);
 869                 _dbg_version_and_cmd(argc, argv);
 870         }
 871
 872         return run_action(action);
 873 }