1 /* SPDX-License-Identifier: LGPL-2.1+ */
10 #include "alloc-util.h"
11 #include "ask-password-api.h"
12 #include "crypt-util.h"
13 #include "device-util.h"
17 #include "mount-util.h"
18 #include "parse-util.h"
19 #include "path-util.h"
20 #include "string-util.h"
22 #include "terminal-util.h"
26 #define ANY_LUKS "LUKS"
28 static const char *arg_type
= NULL
; /* ANY_LUKS, CRYPT_LUKS1, CRYPT_LUKS2, CRYPT_TCRYPT or CRYPT_PLAIN */
29 static char *arg_cipher
= NULL
;
30 static unsigned arg_key_size
= 0;
31 static int arg_key_slot
= CRYPT_ANY_SLOT
;
32 static unsigned arg_keyfile_size
= 0;
33 static uint64_t arg_keyfile_offset
= 0;
34 static char *arg_hash
= NULL
;
35 static char *arg_header
= NULL
;
36 static unsigned arg_tries
= 3;
37 static bool arg_readonly
= false;
38 static bool arg_verify
= false;
39 static bool arg_discards
= false;
40 static bool arg_tcrypt_hidden
= false;
41 static bool arg_tcrypt_system
= false;
42 #ifdef CRYPT_TCRYPT_VERA_MODES
43 static bool arg_tcrypt_veracrypt
= false;
45 static char **arg_tcrypt_keyfiles
= NULL
;
46 static uint64_t arg_offset
= 0;
47 static uint64_t arg_skip
= 0;
48 static usec_t arg_timeout
= USEC_INFINITY
;
50 /* Options Debian's crypttab knows we don't:
60 static int parse_one_option(const char *option
) {
66 /* Handled outside of this tool */
67 if (STR_IN_SET(option
, "noauto", "auto", "nofail", "fail", "_netdev"))
70 if ((val
= startswith(option
, "cipher="))) {
71 r
= free_and_strdup(&arg_cipher
, val
);
75 } else if ((val
= startswith(option
, "size="))) {
77 r
= safe_atou(val
, &arg_key_size
);
79 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
83 if (arg_key_size
% 8) {
84 log_error("size= not a multiple of 8, ignoring.");
90 } else if ((val
= startswith(option
, "key-slot="))) {
93 r
= safe_atoi(val
, &arg_key_slot
);
95 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
99 } else if ((val
= startswith(option
, "tcrypt-keyfile="))) {
101 arg_type
= CRYPT_TCRYPT
;
102 if (path_is_absolute(val
)) {
103 if (strv_extend(&arg_tcrypt_keyfiles
, val
) < 0)
106 log_error("Key file path \"%s\" is not absolute. Ignoring.", val
);
108 } else if ((val
= startswith(option
, "keyfile-size="))) {
110 r
= safe_atou(val
, &arg_keyfile_size
);
112 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
116 } else if ((val
= startswith(option
, "keyfile-offset="))) {
119 r
= safe_atou64(val
, &off
);
121 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
125 if ((size_t) off
!= off
) {
126 /* https://gitlab.com/cryptsetup/cryptsetup/issues/359 */
127 log_error("keyfile-offset= value would truncated to %zu, ignoring.", (size_t) off
);
131 arg_keyfile_offset
= off
;
133 } else if ((val
= startswith(option
, "hash="))) {
134 r
= free_and_strdup(&arg_hash
, val
);
138 } else if ((val
= startswith(option
, "header="))) {
141 if (!path_is_absolute(val
)) {
142 log_error("Header path \"%s\" is not absolute, refusing.", val
);
147 log_error("Duplicate header= option, refusing.");
151 arg_header
= strdup(val
);
155 } else if ((val
= startswith(option
, "tries="))) {
157 r
= safe_atou(val
, &arg_tries
);
159 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
163 } else if (STR_IN_SET(option
, "readonly", "read-only"))
165 else if (streq(option
, "verify"))
167 else if (STR_IN_SET(option
, "allow-discards", "discard"))
169 else if (streq(option
, "luks"))
171 else if (streq(option
, "tcrypt"))
172 arg_type
= CRYPT_TCRYPT
;
173 else if (streq(option
, "tcrypt-hidden")) {
174 arg_type
= CRYPT_TCRYPT
;
175 arg_tcrypt_hidden
= true;
176 } else if (streq(option
, "tcrypt-system")) {
177 arg_type
= CRYPT_TCRYPT
;
178 arg_tcrypt_system
= true;
179 } else if (streq(option
, "tcrypt-veracrypt")) {
180 #ifdef CRYPT_TCRYPT_VERA_MODES
181 arg_type
= CRYPT_TCRYPT
;
182 arg_tcrypt_veracrypt
= true;
184 log_error("This version of cryptsetup does not support tcrypt-veracrypt; refusing.");
187 } else if (STR_IN_SET(option
, "plain", "swap", "tmp"))
188 arg_type
= CRYPT_PLAIN
;
189 else if ((val
= startswith(option
, "timeout="))) {
191 r
= parse_sec_fix_0(val
, &arg_timeout
);
193 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
197 } else if ((val
= startswith(option
, "offset="))) {
199 r
= safe_atou64(val
, &arg_offset
);
201 return log_error_errno(r
, "Failed to parse %s: %m", option
);
203 } else if ((val
= startswith(option
, "skip="))) {
205 r
= safe_atou64(val
, &arg_skip
);
207 return log_error_errno(r
, "Failed to parse %s: %m", option
);
209 } else if (!streq(option
, "none"))
210 log_warning("Encountered unknown /etc/crypttab option '%s', ignoring.", option
);
215 static int parse_options(const char *options
) {
216 const char *word
, *state
;
222 FOREACH_WORD_SEPARATOR(word
, l
, options
, ",", state
) {
223 _cleanup_free_
char *o
;
225 o
= strndup(word
, l
);
228 r
= parse_one_option(o
);
233 /* sanity-check options */
234 if (arg_type
!= NULL
&& !streq(arg_type
, CRYPT_PLAIN
)) {
236 log_warning("offset= ignored with type %s", arg_type
);
238 log_warning("skip= ignored with type %s", arg_type
);
244 static char* disk_description(const char *path
) {
246 static const char name_fields
[] =
247 "ID_PART_ENTRY_NAME\0"
249 "ID_MODEL_FROM_DATABASE\0"
252 _cleanup_(sd_device_unrefp
) sd_device
*device
= NULL
;
259 if (stat(path
, &st
) < 0)
262 if (!S_ISBLK(st
.st_mode
))
265 r
= sd_device_new_from_devnum(&device
, 'b', st
.st_rdev
);
269 NULSTR_FOREACH(i
, name_fields
) {
272 r
= sd_device_get_property_value(device
, i
, &name
);
273 if (r
>= 0 && !isempty(name
))
280 static char *disk_mount_point(const char *label
) {
281 _cleanup_free_
char *device
= NULL
;
282 _cleanup_endmntent_
FILE *f
= NULL
;
285 /* Yeah, we don't support native systemd unit files here for now */
287 if (asprintf(&device
, "/dev/mapper/%s", label
) < 0)
290 f
= setmntent("/etc/fstab", "re");
294 while ((m
= getmntent(f
)))
295 if (path_equal(m
->mnt_fsname
, device
))
296 return strdup(m
->mnt_dir
);
301 static int get_password(const char *vol
, const char *src
, usec_t until
, bool accept_cached
, char ***ret
) {
302 _cleanup_free_
char *description
= NULL
, *name_buffer
= NULL
, *mount_point
= NULL
, *text
= NULL
, *disk_path
= NULL
;
303 _cleanup_strv_free_erase_
char **passwords
= NULL
;
304 const char *name
= NULL
;
312 description
= disk_description(src
);
313 mount_point
= disk_mount_point(vol
);
315 disk_path
= cescape(src
);
319 if (description
&& streq(vol
, description
))
320 /* If the description string is simply the
321 * volume name, then let's not show this
323 description
= mfree(description
);
325 if (mount_point
&& description
)
326 r
= asprintf(&name_buffer
, "%s (%s) on %s", description
, vol
, mount_point
);
327 else if (mount_point
)
328 r
= asprintf(&name_buffer
, "%s on %s", vol
, mount_point
);
329 else if (description
)
330 r
= asprintf(&name_buffer
, "%s (%s)", description
, vol
);
335 name
= name_buffer
? name_buffer
: vol
;
337 if (asprintf(&text
, "Please enter passphrase for disk %s!", name
) < 0)
340 id
= strjoina("cryptsetup:", disk_path
);
342 r
= ask_password_auto(text
, "drive-harddisk", id
, "cryptsetup", until
,
343 ASK_PASSWORD_PUSH_CACHE
| (accept_cached
*ASK_PASSWORD_ACCEPT_CACHED
),
346 return log_error_errno(r
, "Failed to query password: %m");
349 _cleanup_strv_free_erase_
char **passwords2
= NULL
;
351 assert(strv_length(passwords
) == 1);
353 if (asprintf(&text
, "Please enter passphrase for disk %s! (verification)", name
) < 0)
356 id
= strjoina("cryptsetup-verification:", disk_path
);
358 r
= ask_password_auto(text
, "drive-harddisk", id
, "cryptsetup", until
, ASK_PASSWORD_PUSH_CACHE
, &passwords2
);
360 return log_error_errno(r
, "Failed to query verification password: %m");
362 assert(strv_length(passwords2
) == 1);
364 if (!streq(passwords
[0], passwords2
[0])) {
365 log_warning("Passwords did not match, retrying.");
370 strv_uniq(passwords
);
372 STRV_FOREACH(p
, passwords
) {
375 if (strlen(*p
)+1 >= arg_key_size
)
378 /* Pad password if necessary */
379 c
= new(char, arg_key_size
);
383 strncpy(c
, *p
, arg_key_size
);
388 *ret
= TAKE_PTR(passwords
);
393 static int attach_tcrypt(
394 struct crypt_device
*cd
,
396 const char *key_file
,
401 _cleanup_free_
char *passphrase
= NULL
;
402 struct crypt_params_tcrypt params
= {
403 .flags
= CRYPT_TCRYPT_LEGACY_MODES
,
404 .keyfiles
= (const char **)arg_tcrypt_keyfiles
,
405 .keyfiles_count
= strv_length(arg_tcrypt_keyfiles
)
410 assert(key_file
|| (passwords
&& passwords
[0]));
412 if (arg_tcrypt_hidden
)
413 params
.flags
|= CRYPT_TCRYPT_HIDDEN_HEADER
;
415 if (arg_tcrypt_system
)
416 params
.flags
|= CRYPT_TCRYPT_SYSTEM_HEADER
;
418 #ifdef CRYPT_TCRYPT_VERA_MODES
419 if (arg_tcrypt_veracrypt
)
420 params
.flags
|= CRYPT_TCRYPT_VERA_MODES
;
424 r
= read_one_line_file(key_file
, &passphrase
);
426 log_error_errno(r
, "Failed to read password file '%s': %m", key_file
);
430 params
.passphrase
= passphrase
;
432 params
.passphrase
= passwords
[0];
433 params
.passphrase_size
= strlen(params
.passphrase
);
435 r
= crypt_load(cd
, CRYPT_TCRYPT
, ¶ms
);
437 if (key_file
&& r
== -EPERM
) {
438 log_error("Failed to activate using password file '%s'.", key_file
);
444 return crypt_activate_by_volume_key(cd
, name
, NULL
, 0, flags
);
447 static int attach_luks_or_plain(struct crypt_device
*cd
,
449 const char *key_file
,
450 const char *data_device
,
454 bool pass_volume_key
= false;
458 assert(key_file
|| passwords
);
460 if (!arg_type
|| STR_IN_SET(arg_type
, ANY_LUKS
, CRYPT_LUKS1
)) {
461 r
= crypt_load(cd
, CRYPT_LUKS
, NULL
);
463 log_error("crypt_load() failed on device %s.\n", crypt_get_device_name(cd
));
468 r
= crypt_set_data_device(cd
, data_device
);
471 if ((!arg_type
&& r
< 0) || streq_ptr(arg_type
, CRYPT_PLAIN
)) {
472 struct crypt_params_plain params
= {
473 .offset
= arg_offset
,
476 const char *cipher
, *cipher_mode
;
477 _cleanup_free_
char *truncated_cipher
= NULL
;
480 /* plain isn't a real hash type. it just means "use no hash" */
481 if (!streq(arg_hash
, "plain"))
482 params
.hash
= arg_hash
;
483 } else if (!key_file
)
484 /* for CRYPT_PLAIN, the behaviour of cryptsetup
485 * package is to not hash when a key file is provided */
486 params
.hash
= "ripemd160";
491 l
= strcspn(arg_cipher
, "-");
492 truncated_cipher
= strndup(arg_cipher
, l
);
493 if (!truncated_cipher
)
496 cipher
= truncated_cipher
;
497 cipher_mode
= arg_cipher
[l
] ? arg_cipher
+l
+1 : "plain";
500 cipher_mode
= "cbc-essiv:sha256";
503 /* for CRYPT_PLAIN limit reads
504 * from keyfile to key length, and
505 * ignore keyfile-size */
506 arg_keyfile_size
= arg_key_size
;
508 /* In contrast to what the name
509 * crypt_setup() might suggest this
510 * doesn't actually format anything,
511 * it just configures encryption
512 * parameters when used for plain
514 r
= crypt_format(cd
, CRYPT_PLAIN
, cipher
, cipher_mode
, NULL
, NULL
, arg_keyfile_size
, ¶ms
);
516 /* hash == NULL implies the user passed "plain" */
517 pass_volume_key
= (params
.hash
== NULL
);
521 return log_error_errno(r
, "Loading of cryptographic parameters failed: %m");
523 log_info("Set cipher %s, mode %s, key size %i bits for device %s.",
524 crypt_get_cipher(cd
),
525 crypt_get_cipher_mode(cd
),
526 crypt_get_volume_key_size(cd
)*8,
527 crypt_get_device_name(cd
));
530 r
= crypt_activate_by_keyfile_offset(cd
, name
, arg_key_slot
, key_file
, arg_keyfile_size
, arg_keyfile_offset
, flags
);
532 log_error_errno(r
, "Failed to activate with key file '%s': %m", key_file
);
538 STRV_FOREACH(p
, passwords
) {
540 r
= crypt_activate_by_volume_key(cd
, name
, *p
, arg_key_size
, flags
);
542 r
= crypt_activate_by_passphrase(cd
, name
, arg_key_slot
, *p
, strlen(*p
), flags
);
552 static int help(void) {
553 _cleanup_free_
char *link
= NULL
;
556 r
= terminal_urlify_man("systemd-cryptsetup@.service", "8", &link
);
560 printf("%s attach VOLUME SOURCEDEVICE [PASSWORD] [OPTIONS]\n"
561 "%s detach VOLUME\n\n"
562 "Attaches or detaches an encrypted block device.\n"
563 "\nSee the %s for details.\n"
564 , program_invocation_short_name
565 , program_invocation_short_name
572 int main(int argc
, char *argv
[]) {
573 _cleanup_(crypt_freep
) struct crypt_device
*cd
= NULL
;
582 log_error("This program requires at least two arguments.");
586 log_set_target(LOG_TARGET_AUTO
);
587 log_parse_environment();
592 if (streq(argv
[1], "attach")) {
596 crypt_status_info status
;
597 const char *key_file
= NULL
;
599 /* Arguments: systemd-cryptsetup attach VOLUME SOURCE-DEVICE [PASSWORD] [OPTIONS] */
602 log_error("attach requires at least two arguments.");
608 !streq(argv
[4], "-") &&
609 !streq(argv
[4], "none")) {
611 if (!path_is_absolute(argv
[4]))
612 log_error("Password file path '%s' is not absolute. Ignoring.", argv
[4]);
617 if (argc
>= 6 && argv
[5][0] && !streq(argv
[5], "-")) {
618 if (parse_options(argv
[5]) < 0)
622 /* A delicious drop of snake oil */
623 mlockall(MCL_FUTURE
);
626 log_debug("LUKS header: %s", arg_header
);
627 r
= crypt_init(&cd
, arg_header
);
629 r
= crypt_init(&cd
, argv
[3]);
631 log_error_errno(r
, "crypt_init() failed: %m");
635 crypt_set_log_callback(cd
, cryptsetup_log_glue
, NULL
);
637 status
= crypt_status(cd
, argv
[2]);
638 if (IN_SET(status
, CRYPT_ACTIVE
, CRYPT_BUSY
)) {
639 log_info("Volume %s already active.", argv
[2]);
645 flags
|= CRYPT_ACTIVATE_READONLY
;
648 flags
|= CRYPT_ACTIVATE_ALLOW_DISCARDS
;
650 if (arg_timeout
== USEC_INFINITY
)
653 until
= now(CLOCK_MONOTONIC
) + arg_timeout
;
655 arg_key_size
= (arg_key_size
> 0 ? arg_key_size
: (256 / 8));
660 /* Ideally we'd do this on the open fd, but since this is just a
661 * warning it's OK to do this in two steps. */
662 if (stat(key_file
, &st
) >= 0 && S_ISREG(st
.st_mode
) && (st
.st_mode
& 0005))
663 log_warning("Key file %s is world-readable. This is not a good idea!", key_file
);
666 for (tries
= 0; arg_tries
== 0 || tries
< arg_tries
; tries
++) {
667 _cleanup_strv_free_erase_
char **passwords
= NULL
;
670 r
= get_password(argv
[2], argv
[3], until
, tries
== 0 && !arg_verify
, &passwords
);
677 if (streq_ptr(arg_type
, CRYPT_TCRYPT
))
678 r
= attach_tcrypt(cd
, argv
[2], key_file
, passwords
, flags
);
680 r
= attach_luks_or_plain(cd
,
683 arg_header
? argv
[3] : NULL
,
693 log_error_errno(r
, "Failed to activate: %m");
697 log_warning("Invalid passphrase.");
700 if (arg_tries
!= 0 && tries
>= arg_tries
) {
701 log_error("Too many attempts; giving up.");
706 } else if (streq(argv
[1], "detach")) {
708 r
= crypt_init_by_name(&cd
, argv
[2]);
710 log_info("Volume %s already inactive.", argv
[2]);
715 log_error_errno(r
, "crypt_init_by_name() failed: %m");
719 crypt_set_log_callback(cd
, cryptsetup_log_glue
, NULL
);
721 r
= crypt_deactivate(cd
, argv
[2]);
723 log_error_errno(r
, "Failed to deactivate: %m");
728 log_error("Unknown verb %s.", argv
[1]);
738 strv_free(arg_tcrypt_keyfiles
);
740 return r
< 0 ? EXIT_FAILURE
: EXIT_SUCCESS
;