src/cryptsetup/cryptsetup-generator.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <sys/stat.h>
   6 #include <sys/types.h>
   7
   8 #include "alloc-util.h"
   9 #include "dropin.h"
  10 #include "escape.h"
  11 #include "fd-util.h"
  12 #include "fileio.h"
  13 #include "fstab-util.h"
  14 #include "generator.h"
  15 #include "hashmap.h"
  16 #include "id128-util.h"
  17 #include "log.h"
  18 #include "mkdir.h"
  19 #include "parse-util.h"
  20 #include "path-util.h"
  21 #include "proc-cmdline.h"
  22 #include "specifier.h"
  23 #include "string-util.h"
  24 #include "strv.h"
  25 #include "unit-name.h"
  26 #include "util.h"
  27
  28 typedef struct crypto_device {
  29         char *uuid;
  30         char *keyfile;
  31         char *keydev;
  32         char *headerdev;
  33         char *datadev;
  34         char *name;
  35         char *options;
  36         bool create;
  37 } crypto_device;
  38
  39 static const char *arg_dest = NULL;
  40 static bool arg_enabled = true;
  41 static bool arg_read_crypttab = true;
  42 static const char *arg_crypttab = NULL;
  43 static const char *arg_runtime_directory = NULL;
  44 static bool arg_allow_list = false;
  45 static Hashmap *arg_disks = NULL;
  46 static char *arg_default_options = NULL;
  47 static char *arg_default_keyfile = NULL;
  48
  49 STATIC_DESTRUCTOR_REGISTER(arg_disks, hashmap_freep);
  50 STATIC_DESTRUCTOR_REGISTER(arg_default_options, freep);
  51 STATIC_DESTRUCTOR_REGISTER(arg_default_keyfile, freep);
  52
  53 static int split_locationspec(const char *locationspec, char **ret_file, char **ret_device) {
  54         _cleanup_free_ char *file = NULL, *device = NULL;
  55         const char *c;
  56
  57         assert(ret_file);
  58         assert(ret_device);
  59
  60         if (!locationspec) {
  61                 *ret_file = *ret_device = NULL;
  62                 return 0;
  63         }
  64
  65         c = strrchr(locationspec, ':');
  66         if (c) {
  67                 /* The device part has to be either an absolute path to device node (/dev/something,
  68                  * /dev/foo/something, or even possibly /dev/foo/something:part), or a fstab device
  69                  * specification starting with LABEL= or similar. The file part has the same syntax.
  70                  *
  71                  * Let's try to guess if the second part looks like a device specification, or just part of a
  72                  * filename with a colon. fstab_node_to_udev_node() will convert the fstab device syntax to
  73                  * an absolute path. If we didn't get an absolute path, assume that it is just part of the
  74                  * first file argument. */
  75
  76                 device = fstab_node_to_udev_node(c + 1);
  77                 if (!device)
  78                         return log_oom();
  79
  80                 if (path_is_absolute(device))
  81                         file = strndup(locationspec, c-locationspec);
  82                 else {
  83                         log_debug("Location specification argument contains a colon, but \"%s\" doesn't look like a device specification.\n"
  84                                   "Assuming that \"%s\" is a single device specification.",
  85                                   c + 1, locationspec);
  86                         device = mfree(device);
  87                         c = NULL;
  88                 }
  89         }
  90
  91         if (!c)
  92                 /* No device specified */
  93                 file = strdup(locationspec);
  94
  95         if (!file)
  96                 return log_oom();
  97
  98         *ret_file = TAKE_PTR(file);
  99         *ret_device = TAKE_PTR(device);
 100
 101         return 0;
 102 }
 103
 104 static int generate_device_mount(
 105                 const char *name,
 106                 const char *device,
 107                 const char *type_prefix, /* "keydev" or "headerdev" */
 108                 const char *device_timeout,
 109                 bool canfail,
 110                 bool readonly,
 111                 char **unit,
 112                 char **mount) {
 113
 114         _cleanup_free_ char *u = NULL, *where = NULL, *name_escaped = NULL, *device_unit = NULL;
 115         _cleanup_fclose_ FILE *f = NULL;
 116         int r;
 117         usec_t timeout_us;
 118
 119         assert(name);
 120         assert(device);
 121         assert(unit);
 122         assert(mount);
 123
 124         r = mkdir_parents(arg_runtime_directory, 0755);
 125         if (r < 0)
 126                 return r;
 127
 128         r = mkdir(arg_runtime_directory, 0700);
 129         if (r < 0 && errno != EEXIST)
 130                 return -errno;
 131
 132         name_escaped = cescape(name);
 133         if (!name_escaped)
 134                 return -ENOMEM;
 135
 136         where = strjoin(arg_runtime_directory, "/", type_prefix, "-", name_escaped);
 137         if (!where)
 138                 return -ENOMEM;
 139
 140         r = mkdir(where, 0700);
 141         if (r < 0 && errno != EEXIST)
 142                 return -errno;
 143
 144         r = unit_name_from_path(where, ".mount", &u);
 145         if (r < 0)
 146                 return r;
 147
 148         r = generator_open_unit_file(arg_dest, NULL, u, &f);
 149         if (r < 0)
 150                 return r;
 151
 152         fprintf(f,
 153                 "[Unit]\n"
 154                 "DefaultDependencies=no\n\n"
 155                 "[Mount]\n"
 156                 "What=%s\n"
 157                 "Where=%s\n"
 158                 "Options=%s%s\n", device, where, readonly ? "ro" : "rw", canfail ? ",nofail" : "");
 159
 160         if (device_timeout) {
 161                 r = parse_sec_fix_0(device_timeout, &timeout_us);
 162                 if (r >= 0) {
 163                         r = unit_name_from_path(device, ".device", &device_unit);
 164                         if (r < 0)
 165                                 return log_error_errno(r, "Failed to generate unit name: %m");
 166
 167                         r = write_drop_in_format(arg_dest, device_unit, 90, "device-timeout",
 168                                 "# Automatically generated by systemd-cryptsetup-generator \n\n"
 169                                 "[Unit]\nJobRunningTimeoutSec=%s", device_timeout);
 170                         if (r < 0)
 171                                 return log_error_errno(r, "Failed to write device drop-in: %m");
 172
 173                 } else
 174                         log_warning_errno(r, "Failed to parse %s, ignoring: %m", device_timeout);
 175
 176         }
 177
 178         r = fflush_and_check(f);
 179         if (r < 0)
 180                 return r;
 181
 182         *unit = TAKE_PTR(u);
 183         *mount = TAKE_PTR(where);
 184
 185         return 0;
 186 }
 187
 188 static int generate_device_umount(const char *name,
 189                                   const char *device_mount,
 190                                   const char *type_prefix, /* "keydev" or "headerdev" */
 191                                   char **ret_umount_unit) {
 192         _cleanup_fclose_ FILE *f = NULL;
 193         _cleanup_free_ char *u = NULL, *name_escaped = NULL, *mount = NULL;
 194         int r;
 195
 196         assert(name);
 197         assert(ret_umount_unit);
 198
 199         name_escaped = cescape(name);
 200         if (!name_escaped)
 201                 return -ENOMEM;
 202
 203         u = strjoin(type_prefix, "-", name_escaped, "-umount.service");
 204         if (!u)
 205                 return -ENOMEM;
 206
 207         r = unit_name_from_path(device_mount, ".mount", &mount);
 208         if (r < 0)
 209                 return r;
 210
 211         r = generator_open_unit_file(arg_dest, NULL, u, &f);
 212         if (r < 0)
 213                 return r;
 214
 215         fprintf(f,
 216                 "[Unit]\n"
 217                 "DefaultDependencies=no\n"
 218                 "After=%s\n\n"
 219                 "[Service]\n"
 220                 "ExecStart=-" UMOUNT_PATH " %s\n\n", mount, device_mount);
 221
 222         r = fflush_and_check(f);
 223         if (r < 0)
 224                 return r;
 225
 226         *ret_umount_unit = TAKE_PTR(u);
 227         return 0;
 228 }
 229
 230 static int print_dependencies(FILE *f, const char* device_path) {
 231         int r;
 232
 233         if (STR_IN_SET(device_path, "-", "none"))
 234                 /* None, nothing to do */
 235                 return 0;
 236
 237         if (PATH_IN_SET(device_path,
 238                         "/dev/urandom",
 239                         "/dev/random",
 240                         "/dev/hw_random",
 241                         "/dev/hwrng")) {
 242                 /* RNG device, add random dep */
 243                 fputs("After=systemd-random-seed.service\n", f);
 244                 return 0;
 245         }
 246
 247         _cleanup_free_ char *udev_node = fstab_node_to_udev_node(device_path);
 248         if (!udev_node)
 249                 return log_oom();
 250
 251         if (path_equal(udev_node, "/dev/null"))
 252                 return 0;
 253
 254         if (path_startswith(udev_node, "/dev/")) {
 255                 /* We are dealing with a block device, add dependency for corresponding unit */
 256                 _cleanup_free_ char *unit = NULL;
 257
 258                 r = unit_name_from_path(udev_node, ".device", &unit);
 259                 if (r < 0)
 260                         return log_error_errno(r, "Failed to generate unit name: %m");
 261
 262                 fprintf(f,
 263                         "After=%1$s\n"
 264                         "Requires=%1$s\n", unit);
 265         } else {
 266                 /* Regular file, add mount dependency */
 267                 _cleanup_free_ char *escaped_path = specifier_escape(device_path);
 268                 if (!escaped_path)
 269                         return log_oom();
 270
 271                 fprintf(f, "RequiresMountsFor=%s\n", escaped_path);
 272         }
 273
 274         return 0;
 275 }
 276
 277 static int create_disk(
 278                 const char *name,
 279                 const char *device,
 280                 const char *password,
 281                 const char *keydev,
 282                 const char *headerdev,
 283                 const char *options,
 284                 const char *source) {
 285
 286         _cleanup_free_ char *n = NULL, *d = NULL, *u = NULL, *e = NULL,
 287                 *keydev_mount = NULL, *keyfile_timeout_value = NULL,
 288                 *filtered = NULL, *u_escaped = NULL, *name_escaped = NULL, *header_path = NULL, *password_buffer = NULL,
 289                 *tmp_fstype = NULL, *filtered_header = NULL, *headerdev_mount = NULL;
 290         _cleanup_fclose_ FILE *f = NULL;
 291         const char *dmname;
 292         bool noauto, nofail, swap, netdev, attach_in_initrd;
 293         int r, detached_header, keyfile_can_timeout, tmp;
 294
 295         assert(name);
 296         assert(device);
 297
 298         noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0");
 299         nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0");
 300         swap = fstab_test_option(options, "swap\0");
 301         netdev = fstab_test_option(options, "_netdev\0");
 302         attach_in_initrd = fstab_test_option(options, "x-initrd.attach\0");
 303
 304         keyfile_can_timeout = fstab_filter_options(options, "keyfile-timeout\0", NULL, &keyfile_timeout_value, NULL);
 305         if (keyfile_can_timeout < 0)
 306                 return log_error_errno(keyfile_can_timeout, "Failed to parse keyfile-timeout= option value: %m");
 307
 308         detached_header = fstab_filter_options(
 309                 options,
 310                 "header\0",
 311                 NULL,
 312                 &header_path,
 313                 headerdev ? &filtered_header : NULL);
 314         if (detached_header < 0)
 315                 return log_error_errno(detached_header, "Failed to parse header= option value: %m");
 316
 317         tmp = fstab_filter_options(options, "tmp\0", NULL, &tmp_fstype, NULL);
 318         if (tmp < 0)
 319                 return log_error_errno(tmp, "Failed to parse tmp= option value: %m");
 320
 321         if (tmp && swap)
 322                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 323                                        "Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.",
 324                                        name);
 325
 326         name_escaped = specifier_escape(name);
 327         if (!name_escaped)
 328                 return log_oom();
 329
 330         e = unit_name_escape(name);
 331         if (!e)
 332                 return log_oom();
 333
 334         u = fstab_node_to_udev_node(device);
 335         if (!u)
 336                 return log_oom();
 337
 338         r = unit_name_build("systemd-cryptsetup", e, ".service", &n);
 339         if (r < 0)
 340                 return log_error_errno(r, "Failed to generate unit name: %m");
 341
 342         u_escaped = specifier_escape(u);
 343         if (!u_escaped)
 344                 return log_oom();
 345
 346         r = unit_name_from_path(u, ".device", &d);
 347         if (r < 0)
 348                 return log_error_errno(r, "Failed to generate unit name: %m");
 349
 350         if (keydev && !password)
 351                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 352                                        "Key device is specified, but path to the password file is missing.");
 353
 354         r = generator_open_unit_file(arg_dest, NULL, n, &f);
 355         if (r < 0)
 356                 return r;
 357
 358         r = generator_write_cryptsetup_unit_section(f, source);
 359         if (r < 0)
 360                 return r;
 361
 362         if (netdev)
 363                 fprintf(f, "After=remote-fs-pre.target\n");
 364
 365         /* If initrd takes care of attaching the disk then it should also detach it during shutdown. */
 366         if (!attach_in_initrd)
 367                 fprintf(f, "Conflicts=umount.target\n");
 368
 369         if (keydev) {
 370                 _cleanup_free_ char *unit = NULL, *umount_unit = NULL;
 371
 372                 r = generate_device_mount(
 373                         name,
 374                         keydev,
 375                         "keydev",
 376                         keyfile_timeout_value,
 377                         /* canfail = */ keyfile_can_timeout > 0,
 378                         /* readonly= */ true,
 379                         &unit,
 380                         &keydev_mount);
 381                 if (r < 0)
 382                         return log_error_errno(r, "Failed to generate keydev mount unit: %m");
 383
 384                 r = generate_device_umount(name, keydev_mount, "keydev", &umount_unit);
 385                 if (r < 0)
 386                         return log_error_errno(r, "Failed to generate keydev umount unit: %m");
 387
 388                 password_buffer = path_join(keydev_mount, password);
 389                 if (!password_buffer)
 390                         return log_oom();
 391
 392                 password = password_buffer;
 393
 394                 fprintf(f, "After=%s\n", unit);
 395                 if (keyfile_can_timeout > 0)
 396                         fprintf(f, "Wants=%s\n", unit);
 397                 else
 398                         fprintf(f, "Requires=%s\n", unit);
 399
 400                 if (umount_unit)
 401                         fprintf(f,
 402                                 "Wants=%s\n"
 403                                 "Before=%s\n",
 404                                 umount_unit,
 405                                 umount_unit
 406                         );
 407         }
 408
 409         if (headerdev) {
 410                 _cleanup_free_ char *unit = NULL, *umount_unit = NULL, *p = NULL;
 411
 412                 r = generate_device_mount(
 413                         name,
 414                         headerdev,
 415                         "headerdev",
 416                         NULL,
 417                         /* canfail=  */ false, /* header is always necessary */
 418                         /* readonly= */ false, /* LUKS2 recovery requires rw header access */
 419                         &unit,
 420                         &headerdev_mount);
 421                 if (r < 0)
 422                         return log_error_errno(r, "Failed to generate header device mount unit: %m");
 423
 424                 r = generate_device_umount(name, headerdev_mount, "headerdev", &umount_unit);
 425                 if (r < 0)
 426                         return log_error_errno(r, "Failed to generate header device umount unit: %m");
 427
 428                 p = path_join(headerdev_mount, header_path);
 429                 if (!p)
 430                         return log_oom();
 431
 432                 free_and_replace(header_path, p);
 433
 434                 if (isempty(filtered_header))
 435                         p = strjoin("header=", header_path);
 436                 else
 437                         p = strjoin(filtered_header, ",header=", header_path);
 438
 439                 if (!p)
 440                         return log_oom();
 441
 442                 free_and_replace(filtered_header, p);
 443                 options = filtered_header;
 444
 445                 fprintf(f, "After=%s\n"
 446                            "Requires=%s\n", unit, unit);
 447
 448                 if (umount_unit) {
 449                         fprintf(f,
 450                                 "Wants=%s\n"
 451                                 "Before=%s\n",
 452                                 umount_unit,
 453                                 umount_unit
 454                         );
 455                 }
 456         }
 457
 458         if (!nofail)
 459                 fprintf(f,
 460                         "Before=%s\n",
 461                         netdev ? "remote-cryptsetup.target" : "cryptsetup.target");
 462
 463         if (password && !keydev) {
 464                 r = print_dependencies(f, password);
 465                 if (r < 0)
 466                         return r;
 467         }
 468
 469         /* Check if a header option was specified */
 470         if (detached_header > 0 && !headerdev) {
 471                 r = print_dependencies(f, header_path);
 472                 if (r < 0)
 473                         return r;
 474         }
 475
 476         if (path_startswith(u, "/dev/"))
 477                 fprintf(f,
 478                         "BindsTo=%s\n"
 479                         "After=%s\n"
 480                         "Before=umount.target\n",
 481                         d, d);
 482         else
 483                 /* For loopback devices, add systemd-tmpfiles-setup-dev.service
 484                    dependency to ensure that loopback support is available in
 485                    the kernel (/dev/loop-control needs to exist) */
 486                 fprintf(f,
 487                         "RequiresMountsFor=%s\n"
 488                         "Requires=systemd-tmpfiles-setup-dev.service\n"
 489                         "After=systemd-tmpfiles-setup-dev.service\n",
 490                         u_escaped);
 491
 492         r = generator_write_timeouts(arg_dest, device, name, options, &filtered);
 493         if (r < 0)
 494                 log_warning_errno(r, "Failed to write device timeout drop-in: %m");
 495
 496         r = generator_write_cryptsetup_service_section(f, name, u, password, filtered);
 497         if (r < 0)
 498                 return r;
 499
 500         if (tmp) {
 501                 _cleanup_free_ char *tmp_fstype_escaped = NULL;
 502
 503                 if (tmp_fstype) {
 504                         tmp_fstype_escaped = specifier_escape(tmp_fstype);
 505                         if (!tmp_fstype_escaped)
 506                                 return log_oom();
 507                 }
 508
 509                 fprintf(f,
 510                         "ExecStartPost=" ROOTLIBEXECDIR "/systemd-makefs '%s' '/dev/mapper/%s'\n",
 511                         tmp_fstype_escaped ?: "ext4", name_escaped);
 512         }
 513
 514         if (swap)
 515                 fprintf(f,
 516                         "ExecStartPost=" ROOTLIBEXECDIR "/systemd-makefs swap '/dev/mapper/%s'\n",
 517                         name_escaped);
 518
 519         r = fflush_and_check(f);
 520         if (r < 0)
 521                 return log_error_errno(r, "Failed to write unit file %s: %m", n);
 522
 523         if (!noauto) {
 524                 r = generator_add_symlink(arg_dest,
 525                                           netdev ? "remote-cryptsetup.target" : "cryptsetup.target",
 526                                           nofail ? "wants" : "requires", n);
 527                 if (r < 0)
 528                         return r;
 529         }
 530
 531         dmname = strjoina("dev-mapper-", e, ".device");
 532         r = generator_add_symlink(arg_dest, dmname, "requires", n);
 533         if (r < 0)
 534                 return r;
 535
 536         if (!noauto && !nofail) {
 537                 r = write_drop_in(arg_dest, dmname, 40, "device-timeout",
 538                                   "# Automatically generated by systemd-cryptsetup-generator\n\n"
 539                                   "[Unit]\nJobTimeoutSec=0");
 540                 if (r < 0)
 541                         log_warning_errno(r, "Failed to write device timeout drop-in: %m");
 542         }
 543
 544         return 0;
 545 }
 546
 547 static crypto_device* crypt_device_free(crypto_device *d) {
 548         if (!d)
 549                 return NULL;
 550
 551         free(d->uuid);
 552         free(d->keyfile);
 553         free(d->keydev);
 554         free(d->name);
 555         free(d->options);
 556         return mfree(d);
 557 }
 558
 559 static crypto_device *get_crypto_device(const char *uuid) {
 560         int r;
 561         crypto_device *d;
 562
 563         assert(uuid);
 564
 565         d = hashmap_get(arg_disks, uuid);
 566         if (!d) {
 567                 d = new0(struct crypto_device, 1);
 568                 if (!d)
 569                         return NULL;
 570
 571                 d->uuid = strdup(uuid);
 572                 if (!d->uuid)
 573                         return mfree(d);
 574
 575                 r = hashmap_put(arg_disks, d->uuid, d);
 576                 if (r < 0) {
 577                         free(d->uuid);
 578                         return mfree(d);
 579                 }
 580         }
 581
 582         return d;
 583 }
 584
 585 static bool warn_uuid_invalid(const char *uuid, const char *key) {
 586         assert(key);
 587
 588         if (!id128_is_valid(uuid)) {
 589                 log_warning("Failed to parse %s= kernel command line switch. UUID is invalid, ignoring.", key);
 590                 return true;
 591         }
 592
 593         return false;
 594 }
 595
 596 static int filter_header_device(const char *options,
 597                                 char **ret_headerdev,
 598                                 char **ret_filtered_headerdev_options) {
 599         int r;
 600         _cleanup_free_ char *headerfile = NULL, *headerdev = NULL, *headerspec = NULL,
 601                             *filtered_headerdev = NULL, *filtered_headerspec = NULL;
 602
 603         assert(ret_headerdev);
 604         assert(ret_filtered_headerdev_options);
 605
 606         r = fstab_filter_options(options, "header\0", NULL, &headerspec, &filtered_headerspec);
 607         if (r < 0)
 608                 return log_error_errno(r, "Failed to parse header= option value: %m");
 609
 610         if (r > 0) {
 611                 r = split_locationspec(headerspec, &headerfile, &headerdev);
 612                 if (r < 0)
 613                         return r;
 614
 615                 if (isempty(filtered_headerspec))
 616                         filtered_headerdev = strjoin("header=", headerfile);
 617                 else
 618                         filtered_headerdev = strjoin(filtered_headerspec, ",header=", headerfile);
 619
 620                 if (!filtered_headerdev)
 621                         return log_oom();
 622         } else
 623                 filtered_headerdev = TAKE_PTR(filtered_headerspec);
 624
 625         *ret_filtered_headerdev_options = TAKE_PTR(filtered_headerdev);
 626         *ret_headerdev = TAKE_PTR(headerdev);
 627
 628         return 0;
 629 }
 630
 631 static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
 632         _cleanup_free_ char *uuid = NULL, *uuid_value = NULL;
 633         crypto_device *d;
 634         int r;
 635
 636         if (streq(key, "luks")) {
 637
 638                 r = value ? parse_boolean(value) : 1;
 639                 if (r < 0)
 640                         log_warning("Failed to parse luks= kernel command line switch %s. Ignoring.", value);
 641                 else
 642                         arg_enabled = r;
 643
 644         } else if (streq(key, "luks.crypttab")) {
 645
 646                 r = value ? parse_boolean(value) : 1;
 647                 if (r < 0)
 648                         log_warning("Failed to parse luks.crypttab= kernel command line switch %s. Ignoring.", value);
 649                 else
 650                         arg_read_crypttab = r;
 651
 652         } else if (streq(key, "luks.uuid")) {
 653
 654                 if (proc_cmdline_value_missing(key, value))
 655                         return 0;
 656
 657                 d = get_crypto_device(startswith(value, "luks-") ?: value);
 658                 if (!d)
 659                         return log_oom();
 660
 661                 d->create = arg_allow_list = true;
 662
 663         } else if (streq(key, "luks.options")) {
 664                 _cleanup_free_ char *headerdev = NULL, *filtered_headerdev_options = NULL;
 665
 666                 if (proc_cmdline_value_missing(key, value))
 667                         return 0;
 668
 669                 r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value);
 670                 if (r != 2)
 671                         return free_and_strdup(&arg_default_options, value) < 0 ? log_oom() : 0;
 672
 673                 if (warn_uuid_invalid(uuid, key))
 674                         return 0;
 675
 676                 d = get_crypto_device(uuid);
 677                 if (!d)
 678                         return log_oom();
 679
 680                 r = filter_header_device(uuid_value, &headerdev, &filtered_headerdev_options);
 681                 if (r < 0)
 682                         return r;
 683
 684                 free_and_replace(d->options, filtered_headerdev_options);
 685                 free_and_replace(d->headerdev, headerdev);
 686         } else if (streq(key, "luks.key")) {
 687                 size_t n;
 688                 _cleanup_free_ char *keyfile = NULL, *keydev = NULL;
 689                 const char *keyspec;
 690
 691                 if (proc_cmdline_value_missing(key, value))
 692                         return 0;
 693
 694                 n = strspn(value, ALPHANUMERICAL "-");
 695                 if (value[n] != '=') {
 696                         if (free_and_strdup(&arg_default_keyfile, value) < 0)
 697                                  return log_oom();
 698                         return 0;
 699                 }
 700
 701                 uuid = strndup(value, n);
 702                 if (!uuid)
 703                         return log_oom();
 704
 705                 if (warn_uuid_invalid(uuid, key))
 706                         return 0;
 707
 708                 d = get_crypto_device(uuid);
 709                 if (!d)
 710                         return log_oom();
 711
 712                 keyspec = value + n + 1;
 713                 r = split_locationspec(keyspec, &keyfile, &keydev);
 714                 if (r < 0)
 715                         return r;
 716
 717                 free_and_replace(d->keyfile, keyfile);
 718                 free_and_replace(d->keydev, keydev);
 719         } else if (streq(key, "luks.data")) {
 720                 size_t n;
 721                 _cleanup_free_ char *datadev = NULL;
 722
 723                 if (proc_cmdline_value_missing(key, value))
 724                         return 0;
 725
 726                 n = strspn(value, ALPHANUMERICAL "-");
 727                 if (value[n] != '=') {
 728                         log_warning("Failed to parse luks.data= kernel command line switch. UUID is invalid, ignoring.");
 729                         return 0;
 730                 }
 731
 732                 uuid = strndup(value, n);
 733                 if (!uuid)
 734                         return log_oom();
 735
 736                 if (warn_uuid_invalid(uuid, key))
 737                         return 0;
 738
 739                 d = get_crypto_device(uuid);
 740                 if (!d)
 741                         return log_oom();
 742
 743                 datadev = fstab_node_to_udev_node(value + n + 1);
 744                 if (!datadev)
 745                         return log_oom();
 746
 747                 free_and_replace(d->datadev, datadev);
 748         } else if (streq(key, "luks.name")) {
 749
 750                 if (proc_cmdline_value_missing(key, value))
 751                         return 0;
 752
 753                 r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value);
 754                 if (r == 2) {
 755                         d = get_crypto_device(uuid);
 756                         if (!d)
 757                                 return log_oom();
 758
 759                         d->create = arg_allow_list = true;
 760
 761                         free_and_replace(d->name, uuid_value);
 762                 } else
 763                         log_warning("Failed to parse luks name switch %s. Ignoring.", value);
 764         }
 765
 766         return 0;
 767 }
 768
 769 static int add_crypttab_devices(void) {
 770         _cleanup_fclose_ FILE *f = NULL;
 771         unsigned crypttab_line = 0;
 772         int r;
 773
 774         if (!arg_read_crypttab)
 775                 return 0;
 776
 777         r = fopen_unlocked(arg_crypttab, "re", &f);
 778         if (r < 0) {
 779                 if (errno != ENOENT)
 780                         log_error_errno(errno, "Failed to open %s: %m", arg_crypttab);
 781                 return 0;
 782         }
 783
 784         for (;;) {
 785                 _cleanup_free_ char *line = NULL, *name = NULL, *device = NULL, *keyspec = NULL, *options = NULL,
 786                                     *keyfile = NULL, *keydev = NULL, *headerdev = NULL, *filtered_header = NULL;
 787                 crypto_device *d = NULL;
 788                 char *l, *uuid;
 789                 int k;
 790
 791                 r = read_line(f, LONG_LINE_MAX, &line);
 792                 if (r < 0)
 793                         return log_error_errno(r, "Failed to read %s: %m", arg_crypttab);
 794                 if (r == 0)
 795                         break;
 796
 797                 crypttab_line++;
 798
 799                 l = strstrip(line);
 800                 if (IN_SET(l[0], 0, '#'))
 801                         continue;
 802
 803                 k = sscanf(l, "%ms %ms %ms %ms", &name, &device, &keyspec, &options);
 804                 if (k < 2 || k > 4) {
 805                         log_error("Failed to parse %s:%u, ignoring.", arg_crypttab, crypttab_line);
 806                         continue;
 807                 }
 808
 809                 uuid = startswith(device, "UUID=");
 810                 if (!uuid)
 811                         uuid = path_startswith(device, "/dev/disk/by-uuid/");
 812                 if (!uuid)
 813                         uuid = startswith(name, "luks-");
 814                 if (uuid)
 815                         d = hashmap_get(arg_disks, uuid);
 816
 817                 if (arg_allow_list && !d) {
 818                         log_info("Not creating device '%s' because it was not specified on the kernel command line.", name);
 819                         continue;
 820                 }
 821
 822                 r = split_locationspec(keyspec, &keyfile, &keydev);
 823                 if (r < 0)
 824                         return r;
 825
 826                 if (options && (!d || !d->options)) {
 827                         r = filter_header_device(options, &headerdev, &filtered_header);
 828                         if (r < 0)
 829                                 return r;
 830                         free_and_replace(options, filtered_header);
 831                 }
 832
 833                 r = create_disk(name,
 834                                 device,
 835                                 keyfile,
 836                                 keydev,
 837                                 (d && d->options) ? d->headerdev : headerdev,
 838                                 (d && d->options) ? d->options : options,
 839                                 arg_crypttab);
 840                 if (r < 0)
 841                         return r;
 842
 843                 if (d)
 844                         d->create = false;
 845         }
 846
 847         return 0;
 848 }
 849
 850 static int add_proc_cmdline_devices(void) {
 851         int r;
 852         crypto_device *d;
 853
 854         HASHMAP_FOREACH(d, arg_disks) {
 855                 _cleanup_free_ char *device = NULL;
 856
 857                 if (!d->create)
 858                         continue;
 859
 860                 if (!d->name) {
 861                         d->name = strjoin("luks-", d->uuid);
 862                         if (!d->name)
 863                                 return log_oom();
 864                 }
 865
 866                 device = strjoin("UUID=", d->uuid);
 867                 if (!device)
 868                         return log_oom();
 869
 870                 r = create_disk(d->name,
 871                                 d->datadev ?: device,
 872                                 d->keyfile ?: arg_default_keyfile,
 873                                 d->keydev,
 874                                 d->headerdev,
 875                                 d->options ?: arg_default_options,
 876                                 "/proc/cmdline");
 877                 if (r < 0)
 878                         return r;
 879         }
 880
 881         return 0;
 882 }
 883
 884 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(crypt_device_hash_ops, char, string_hash_func, string_compare_func,
 885                                               crypto_device, crypt_device_free);
 886
 887 static int run(const char *dest, const char *dest_early, const char *dest_late) {
 888         int r;
 889
 890         assert_se(arg_dest = dest);
 891
 892         arg_crypttab = getenv("SYSTEMD_CRYPTTAB") ?: "/etc/crypttab";
 893         arg_runtime_directory = getenv("RUNTIME_DIRECTORY") ?: "/run/systemd/cryptsetup";
 894
 895         arg_disks = hashmap_new(&crypt_device_hash_ops);
 896         if (!arg_disks)
 897                 return log_oom();
 898
 899         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
 900         if (r < 0)
 901                 return log_warning_errno(r, "Failed to parse kernel command line: %m");
 902
 903         if (!arg_enabled)
 904                 return 0;
 905
 906         r = add_crypttab_devices();
 907         if (r < 0)
 908                 return r;
 909
 910         r = add_proc_cmdline_devices();
 911         if (r < 0)
 912                 return r;
 913
 914         return 0;
 915 }
 916
 917 DEFINE_MAIN_GENERATOR_FUNCTION(run);