"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "src/cryptsetup_reencrypt.c" between
cryptsetup-2.3.6.tar.xz and cryptsetup-2.4.0.tar.xz

About: cryptsetup is a utility used to conveniently setup disk encryption based on the dm-crypt kernel module. These include plain dm-crypt volumes, LUKS volumes, loop-AES and TrueCrypt compatible format.

cryptsetup_reencrypt.c  (cryptsetup-2.3.6.tar.xz):cryptsetup_reencrypt.c  (cryptsetup-2.4.0.tar.xz)
skipping to change at line 22 skipping to change at line 22
* This program is distributed in the hope that it will be useful, * This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of * but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details. * GNU General Public License for more details.
* *
* You should have received a copy of the GNU General Public License * You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software * along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/ */
#include "cryptsetup.h"
#include <sys/ioctl.h> #include <sys/ioctl.h>
#include <linux/fs.h> #include <linux/fs.h>
#include <arpa/inet.h>
#include <uuid/uuid.h> #include <uuid/uuid.h>
#include "cryptsetup.h"
#include "cryptsetup_reencrypt_args.h"
#define PACKAGE_REENC "cryptsetup-reencrypt" #define PACKAGE_REENC "cryptsetup-reencrypt"
#define NO_UUID "cafecafe-cafe-cafe-cafe-cafecafeeeee" #define NO_UUID "cafecafe-cafe-cafe-cafe-cafecafeeeee"
static char *opt_cipher = NULL;
static char *opt_hash = NULL;
static char *opt_key_file = NULL;
static char *opt_master_key_file = NULL;
static char *opt_uuid = NULL;
static char *opt_type = NULL;
static char *opt_pbkdf = NULL;
static char *opt_header_device = NULL;
/* helper strings converted to uint64_t later */
static char *opt_reduce_size_str = NULL;
static char *opt_device_size_str = NULL;
static uint64_t opt_reduce_size = 0;
static uint64_t opt_device_size = 0;
static long opt_keyfile_size = 0;
static long opt_keyfile_offset = 0;
static int opt_iteration_time = 0;
static long opt_pbkdf_memory = DEFAULT_LUKS2_MEMORY_KB;
static long opt_pbkdf_parallel = DEFAULT_LUKS2_PARALLEL_THREADS;
static long opt_pbkdf_iterations = 0;
static int opt_random = 0;
static int opt_urandom = 0;
static int opt_bsize = 4;
static int opt_directio = 0;
static int opt_fsync = 0;
static int opt_write_log = 0;
static int opt_tries = 3;
static int opt_key_slot = CRYPT_ANY_SLOT;
static int opt_key_size = 0;
static int opt_new = 0;
static int opt_keep_key = 0;
static int opt_decrypt = 0;
static const char **action_argv; static const char **action_argv;
static const char *set_pbkdf = NULL; static const char *set_pbkdf = NULL;
static struct tools_log_params log_parms;
#define MAX_SLOT 32 #define MAX_SLOT 32
#define MAX_TOKEN 32 #define MAX_TOKEN 32
struct reenc_ctx { struct reenc_ctx {
char *device; char *device;
char *device_header; char *device_header;
char *device_uuid; char *device_uuid;
const char *type; const char *type;
uint64_t device_size; /* overridden by parameter */ uint64_t device_size; /* overridden by parameter */
uint64_t device_size_new_real; uint64_t device_size_new_real;
uint64_t device_size_org_real; uint64_t device_size_org_real;
skipping to change at line 122 skipping to change at line 90
typedef enum { typedef enum {
MAKE_UNUSABLE, MAKE_UNUSABLE,
MAKE_USABLE, MAKE_USABLE,
CHECK_UNUSABLE, CHECK_UNUSABLE,
CHECK_OPEN, CHECK_OPEN,
} header_magic; } header_magic;
void tools_cleanup(void) void tools_cleanup(void)
{ {
FREE_AND_NULL(opt_cipher); tools_args_free(tool_core_args, ARRAY_SIZE(tool_core_args));
FREE_AND_NULL(opt_hash);
FREE_AND_NULL(opt_key_file);
FREE_AND_NULL(opt_master_key_file);
FREE_AND_NULL(opt_uuid);
FREE_AND_NULL(opt_type);
FREE_AND_NULL(opt_pbkdf);
FREE_AND_NULL(opt_header_device);
FREE_AND_NULL(opt_reduce_size_str);
FREE_AND_NULL(opt_device_size_str);
} }
static void _quiet_log(int level, const char *msg, void *usrptr) static void _quiet_log(int level, const char *msg, void *usrptr)
{ {
if (!opt_debug) if (!ARG_SET(OPT_DEBUG_ID))
return; return;
tool_log(level, msg, usrptr); tool_log(level, msg, usrptr);
} }
static int alignment(int fd) static int alignment(int fd)
{ {
int alignment; int alignment;
alignment = fpathconf(fd, _PC_REC_XFER_ALIGN); alignment = fpathconf(fd, _PC_REC_XFER_ALIGN);
if (alignment < 0) if (alignment < 0)
skipping to change at line 254 skipping to change at line 213
s = read(devfd, buf, buf_size); s = read(devfd, buf, buf_size);
if (s < 0 || s != (ssize_t)buf_size) { if (s < 0 || s != (ssize_t)buf_size) {
log_err(_("Cannot read device %s."), device); log_err(_("Cannot read device %s."), device);
r = -EIO; r = -EIO;
goto out; goto out;
} }
/* Be sure that we do not process new version of header */ /* Be sure that we do not process new version of header */
memcpy((void*)&version, &buf[MAGIC_L], sizeof(uint16_t)); memcpy((void*)&version, &buf[MAGIC_L], sizeof(uint16_t));
version = ntohs(version); version = be16_to_cpu(version);
if (set_magic == MAKE_UNUSABLE && !memcmp(buf, MAGIC, MAGIC_L) && if (set_magic == MAKE_UNUSABLE && !memcmp(buf, MAGIC, MAGIC_L) &&
version == 1) { version == 1) {
log_verbose(_("Marking LUKS1 device %s unusable."), device); log_verbose(_("Marking LUKS1 device %s unusable."), device);
memcpy(buf, NOMAGIC, MAGIC_L); memcpy(buf, NOMAGIC, MAGIC_L);
r = 0; r = 0;
} else if (set_magic == MAKE_UNUSABLE && version == 2) { } else if (set_magic == MAKE_UNUSABLE && version == 2) {
log_verbose(_("Setting LUKS2 offline reencrypt flag on device %s. "), device); log_verbose(_("Setting LUKS2 offline reencrypt flag on device %s. "), device);
r = set_reencrypt_requirement(rc); r = set_reencrypt_requirement(rc);
if (!r) if (!r)
skipping to change at line 414 skipping to change at line 373
static void close_log(struct reenc_ctx *rc) static void close_log(struct reenc_ctx *rc)
{ {
log_dbg("Closing LUKS reencryption log file %s.", rc->log_file); log_dbg("Closing LUKS reencryption log file %s.", rc->log_file);
if (rc->log_fd != -1) if (rc->log_fd != -1)
close(rc->log_fd); close(rc->log_fd);
} }
static int open_log(struct reenc_ctx *rc) static int open_log(struct reenc_ctx *rc)
{ {
int flags = opt_fsync ? O_SYNC : 0; int flags = ARG_SET(OPT_USE_FSYNC_ID) ? O_SYNC : 0;
rc->log_fd = open(rc->log_file, O_RDWR|O_EXCL|O_CREAT|flags, S_IRUSR|S_IW USR); rc->log_fd = open(rc->log_file, O_RDWR|O_EXCL|O_CREAT|flags, S_IRUSR|S_IW USR);
if (rc->log_fd != -1) { if (rc->log_fd != -1) {
log_dbg("Created LUKS reencryption log file %s.", rc->log_file); log_dbg("Created LUKS reencryption log file %s.", rc->log_file);
rc->stained = 0; rc->stained = 0;
} else if (errno == EEXIST) { } else if (errno == EEXIST) {
log_std(_("Log file %s exists, resuming reencryption.\n"), rc->lo g_file); log_std(_("Log file %s exists, resuming reencryption.\n"), rc->lo g_file);
rc->log_fd = open(rc->log_file, O_RDWR|flags); rc->log_fd = open(rc->log_file, O_RDWR|flags);
rc->in_progress = 1; rc->in_progress = 1;
} }
skipping to change at line 472 skipping to change at line 431
pwd_new_len = rc->p[rc->keyslot].passwordLen; pwd_new_len = rc->p[rc->keyslot].passwordLen;
} else } else
return -EINVAL; return -EINVAL;
if ((r = crypt_init_data_device(&cd, rc->header_file_org, rc->device)) || if ((r = crypt_init_data_device(&cd, rc->header_file_org, rc->device)) ||
(r = crypt_load(cd, CRYPT_LUKS, NULL))) (r = crypt_load(cd, CRYPT_LUKS, NULL)))
goto out; goto out;
log_verbose(_("Activating temporary device using old LUKS header.")); log_verbose(_("Activating temporary device using old LUKS header."));
if ((r = crypt_activate_by_passphrase(cd, rc->header_file_org, if ((r = crypt_activate_by_passphrase(cd, rc->header_file_org,
opt_key_slot, pwd_old, pwd_old_len, ARG_INT32(OPT_KEY_SLOT_ID), pwd_old, pwd_old_len,
CRYPT_ACTIVATE_READONLY|CRYPT_ACTIVATE_PRIVATE)) < 0) CRYPT_ACTIVATE_READONLY|CRYPT_ACTIVATE_PRIVATE)) < 0)
goto out; goto out;
if ((r = crypt_init_data_device(&cd_new, rc->header_file_new, rc->device) ) || if ((r = crypt_init_data_device(&cd_new, rc->header_file_new, rc->device) ) ||
(r = crypt_load(cd_new, CRYPT_LUKS, NULL))) (r = crypt_load(cd_new, CRYPT_LUKS, NULL)))
goto out; goto out;
log_verbose(_("Activating temporary device using new LUKS header.")); log_verbose(_("Activating temporary device using new LUKS header."));
if ((r = crypt_activate_by_passphrase(cd_new, rc->header_file_new, if ((r = crypt_activate_by_passphrase(cd_new, rc->header_file_new,
opt_key_slot, pwd_new, pwd_new_len, ARG_INT32(OPT_KEY_SLOT_ID), pwd_new, pwd_new_len,
CRYPT_ACTIVATE_SHARED|CRYPT_ACTIVATE_PRIVATE)) < 0) CRYPT_ACTIVATE_SHARED|CRYPT_ACTIVATE_PRIVATE)) < 0)
goto out; goto out;
r = 0; r = 0;
out: out:
crypt_free(cd); crypt_free(cd);
crypt_free(cd_new); crypt_free(cd_new);
if (r < 0) if (r < 0)
log_err(_("Activation of temporary devices failed.")); log_err(_("Activation of temporary devices failed."));
return r; return r;
} }
skipping to change at line 504 skipping to change at line 463
static int set_pbkdf_params(struct crypt_device *cd, const char *dev_type) static int set_pbkdf_params(struct crypt_device *cd, const char *dev_type)
{ {
const struct crypt_pbkdf_type *pbkdf_default; const struct crypt_pbkdf_type *pbkdf_default;
struct crypt_pbkdf_type pbkdf = {}; struct crypt_pbkdf_type pbkdf = {};
pbkdf_default = crypt_get_pbkdf_default(dev_type); pbkdf_default = crypt_get_pbkdf_default(dev_type);
if (!pbkdf_default) if (!pbkdf_default)
return -EINVAL; return -EINVAL;
pbkdf.type = set_pbkdf ?: pbkdf_default->type; pbkdf.type = set_pbkdf ?: pbkdf_default->type;
pbkdf.hash = opt_hash ?: pbkdf_default->hash; pbkdf.hash = ARG_STR(OPT_HASH_ID) ?: pbkdf_default->hash;
pbkdf.time_ms = (uint32_t)opt_iteration_time ?: pbkdf_default->time_ms; pbkdf.time_ms = ARG_UINT32(OPT_ITER_TIME_ID) ?: pbkdf_default->time_ms;
if (strcmp(pbkdf.type, CRYPT_KDF_PBKDF2)) { if (strcmp(pbkdf.type, CRYPT_KDF_PBKDF2)) {
pbkdf.max_memory_kb = (uint32_t)opt_pbkdf_memory ?: pbkdf_default pbkdf.max_memory_kb = ARG_UINT32(OPT_PBKDF_MEMORY_ID) ?: pbkdf_de
->max_memory_kb; fault->max_memory_kb;
pbkdf.parallel_threads = (uint32_t)opt_pbkdf_parallel ?: pbkdf_de pbkdf.parallel_threads = ARG_UINT32(OPT_PBKDF_PARALLEL_ID) ?: pbk
fault->parallel_threads; df_default->parallel_threads;
} }
if (opt_pbkdf_iterations) { if (ARG_SET(OPT_PBKDF_FORCE_ITERATIONS_ID)) {
pbkdf.iterations = opt_pbkdf_iterations; pbkdf.iterations = ARG_UINT32(OPT_PBKDF_FORCE_ITERATIONS_ID);
pbkdf.time_ms = 0; pbkdf.time_ms = 0;
pbkdf.flags |= CRYPT_PBKDF_NO_BENCHMARK; pbkdf.flags |= CRYPT_PBKDF_NO_BENCHMARK;
} }
return crypt_set_pbkdf_type(cd, &pbkdf); return crypt_set_pbkdf_type(cd, &pbkdf);
} }
static int create_new_keyslot(struct reenc_ctx *rc, int keyslot, static int create_new_keyslot(struct reenc_ctx *rc, int keyslot,
struct crypt_device *cd_old, struct crypt_device *cd_old,
struct crypt_device *cd_new) struct crypt_device *cd_new)
skipping to change at line 564 skipping to change at line 523
uint64_t metadata_size, uint64_t metadata_size,
uint64_t keyslots_size, uint64_t keyslots_size,
void *params) void *params)
{ {
struct crypt_device *cd_new = NULL; struct crypt_device *cd_new = NULL;
int i, r; int i, r;
if ((r = crypt_init(&cd_new, rc->header_file_new))) if ((r = crypt_init(&cd_new, rc->header_file_new)))
goto out; goto out;
if (opt_random) if (ARG_SET(OPT_USE_RANDOM_ID))
crypt_set_rng_type(cd_new, CRYPT_RNG_RANDOM); crypt_set_rng_type(cd_new, CRYPT_RNG_RANDOM);
else if (opt_urandom) else if (ARG_SET(OPT_USE_URANDOM_ID))
crypt_set_rng_type(cd_new, CRYPT_RNG_URANDOM); crypt_set_rng_type(cd_new, CRYPT_RNG_URANDOM);
r = set_pbkdf_params(cd_new, type); r = set_pbkdf_params(cd_new, type);
if (r) { if (r) {
log_err(_("Failed to set pbkdf parameters.")); log_err(_("Failed to set pbkdf parameters."));
goto out; goto out;
} }
r = crypt_set_data_offset(cd_new, rc->data_offset); r = crypt_set_data_offset(cd_new, rc->data_offset);
if (r) { if (r) {
skipping to change at line 729 skipping to change at line 688
/* coverity[toctou] */ /* coverity[toctou] */
if ((r = chmod(rc->header_file_tmp, st.st_mode | S_IWUSR))) if ((r = chmod(rc->header_file_tmp, st.st_mode | S_IWUSR)))
goto out; goto out;
} }
log_verbose(_("%s header backup of device %s created."), isLUKS2(rc->type ) ? "LUKS2" : "LUKS1", rc->device); log_verbose(_("%s header backup of device %s created."), isLUKS2(rc->type ) ? "LUKS2" : "LUKS1", rc->device);
/* For decrypt, new header will be fake one, so we are done here. */ /* For decrypt, new header will be fake one, so we are done here. */
if (rc->reencrypt_mode == DECRYPT) if (rc->reencrypt_mode == DECRYPT)
goto out; goto out;
rc->data_offset = crypt_get_data_offset(cd) + ROUND_SECTOR(opt_reduce_siz e); rc->data_offset = crypt_get_data_offset(cd) + ROUND_SECTOR(ARG_UINT64(OPT _REDUCE_DEVICE_SIZE_ID));
if ((r = create_empty_header(rc->header_file_new))) if ((r = create_empty_header(rc->header_file_new)))
goto out; goto out;
params.hash = opt_hash ?: DEFAULT_LUKS1_HASH; params.hash = ARG_STR(OPT_HASH_ID) ?: DEFAULT_LUKS1_HASH;
params2.data_device = params.data_device = rc->device; params2.data_device = params.data_device = rc->device;
params2.sector_size = crypt_get_sector_size(cd); params2.sector_size = crypt_get_sector_size(cd);
if (opt_cipher) { if (ARG_SET(OPT_CIPHER_ID)) {
r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mo r = crypt_parse_name_and_mode(ARG_STR(OPT_CIPHER_ID), cipher, NUL
de); L, cipher_mode);
if (r < 0) { if (r < 0) {
log_err(_("No known cipher specification pattern detected .")); log_err(_("No known cipher specification pattern detected ."));
goto out; goto out;
} }
} }
key_size = opt_key_size ? opt_key_size / 8 : crypt_get_volume_key_size(cd ); key_size = ARG_SET(OPT_KEY_SIZE_ID) ? ARG_UINT32(OPT_KEY_SIZE_ID) / 8 : ( uint32_t)crypt_get_volume_key_size(cd);
if (opt_keep_key) { if (ARG_SET(OPT_KEEP_KEY_ID)) {
log_dbg("Keeping key from old header."); log_dbg("Keeping key from old header.");
key_size = crypt_get_volume_key_size(cd); key_size = crypt_get_volume_key_size(cd);
key = crypt_safe_alloc(key_size); key = crypt_safe_alloc(key_size);
if (!key) { if (!key) {
r = -ENOMEM; r = -ENOMEM;
goto out; goto out;
} }
r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, key, &key_size, r = crypt_volume_key_get(cd, CRYPT_ANY_SLOT, key, &key_size,
rc->p[rc->keyslot].password, rc->p[rc->keyslot].passwordL en); rc->p[rc->keyslot].password, rc->p[rc->keyslot].passwordL en);
} else if (opt_master_key_file) { } else if (ARG_SET(OPT_MASTER_KEY_FILE_ID)) {
log_dbg("Loading new key from file."); log_dbg("Loading new key from file.");
r = tools_read_mk(opt_master_key_file, &key, key_size); r = tools_read_mk(ARG_STR(OPT_MASTER_KEY_FILE_ID), &key, key_size );
} }
if (r < 0) if (r < 0)
goto out; goto out;
if (isLUKS2(crypt_get_type(cd)) && crypt_get_metadata_size(cd, &mdata_siz e, &keyslots_size)) if (isLUKS2(crypt_get_type(cd)) && crypt_get_metadata_size(cd, &mdata_siz e, &keyslots_size))
goto out; goto out;
r = create_new_header(rc, cd, r = create_new_header(rc, cd,
opt_cipher ? cipher : crypt_get_cipher(cd), ARG_SET(OPT_CIPHER_ID) ? cipher : crypt_get_cipher(cd),
opt_cipher ? cipher_mode : crypt_get_cipher_mode(cd), ARG_SET(OPT_CIPHER_ID) ? cipher_mode : crypt_get_cipher_mode(cd),
crypt_get_uuid(cd), crypt_get_uuid(cd),
key, key,
key_size, key_size,
rc->type, rc->type,
mdata_size, mdata_size,
keyslots_size, keyslots_size,
isLUKS2(rc->type) ? (void*)&params2 : (void*)&params); isLUKS2(rc->type) ? (void*)&params2 : (void*)&params);
if (!r && isLUKS2(rc->type)) if (!r && isLUKS2(rc->type))
r = luks2_metadata_copy(rc); r = luks2_metadata_copy(rc);
skipping to change at line 805 skipping to change at line 764
struct crypt_params_luks2 params2 = {0}; struct crypt_params_luks2 params2 = {0};
char cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN]; char cipher [MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
const char *header_file_fake; const char *header_file_fake;
int r; int r;
log_dbg("Creating fake (cipher_null) header for %s device.", log_dbg("Creating fake (cipher_null) header for %s device.",
(rc->reencrypt_mode == DECRYPT) ? "new" : "original"); (rc->reencrypt_mode == DECRYPT) ? "new" : "original");
header_file_fake = (rc->reencrypt_mode == DECRYPT) ? rc->header_file_new : rc->header_file_org; header_file_fake = (rc->reencrypt_mode == DECRYPT) ? rc->header_file_new : rc->header_file_org;
if (!opt_key_size) if (!ARG_SET(OPT_KEY_SIZE_ID))
opt_key_size = DEFAULT_LUKS1_KEYBITS; ARG_SET_UINT32(OPT_KEY_SIZE_ID, DEFAULT_LUKS1_KEYBITS);
if (opt_cipher) { if (ARG_SET(OPT_CIPHER_ID)) {
r = crypt_parse_name_and_mode(opt_cipher, cipher, NULL, cipher_mo r = crypt_parse_name_and_mode(ARG_STR(OPT_CIPHER_ID), cipher, NUL
de); L, cipher_mode);
if (r < 0) { if (r < 0) {
log_err(_("No known cipher specification pattern detected .")); log_err(_("No known cipher specification pattern detected ."));
goto out; goto out;
} }
} }
r = create_empty_header(header_file_fake); r = create_empty_header(header_file_fake);
if (r < 0) if (r < 0)
return r; return r;
params.hash = opt_hash ?: DEFAULT_LUKS1_HASH; params.hash = ARG_STR(OPT_HASH_ID) ?: DEFAULT_LUKS1_HASH;
params2.data_alignment = params.data_alignment = 0; params2.data_alignment = params.data_alignment = 0;
params2.data_device = params.data_device = rc->device; params2.data_device = params.data_device = rc->device;
params2.sector_size = crypt_get_sector_size(NULL); params2.sector_size = crypt_get_sector_size(NULL);
params2.pbkdf = crypt_get_pbkdf_default(CRYPT_LUKS2); params2.pbkdf = crypt_get_pbkdf_default(CRYPT_LUKS2);
r = crypt_init(&cd_new, header_file_fake); r = crypt_init(&cd_new, header_file_fake);
if (r < 0) if (r < 0)
return r; return r;
r = crypt_format(cd_new, CRYPT_LUKS1, "cipher_null", "ecb", r = crypt_format(cd_new, CRYPT_LUKS1, "cipher_null", "ecb",
NO_UUID, NULL, opt_key_size / 8, &params); NO_UUID, NULL, ARG_UINT32(OPT_KEY_SIZE_ID) / 8, &params) ;
check_signal(&r); check_signal(&r);
if (r < 0) if (r < 0)
goto out; goto out;
r = crypt_keyslot_add_by_volume_key(cd_new, rc->keyslot, NULL, 0, r = crypt_keyslot_add_by_volume_key(cd_new, rc->keyslot, NULL, 0,
rc->p[rc->keyslot].password, rc->p[rc->keyslot].passwordL en); rc->p[rc->keyslot].password, rc->p[rc->keyslot].passwordL en);
check_signal(&r); check_signal(&r);
if (r < 0) if (r < 0)
goto out; goto out;
/* The real header is backup header created in backup_luks_headers() */ /* The real header is backup header created in backup_luks_headers() */
if (rc->reencrypt_mode == DECRYPT) { if (rc->reencrypt_mode == DECRYPT) {
r = 0; r = 0;
goto out; goto out;
} }
r = create_empty_header(rc->header_file_new); r = create_empty_header(rc->header_file_new);
if (r < 0) if (r < 0)
goto out; goto out;
params2.data_alignment = params.data_alignment = ROUND_SECTOR(opt_reduce_ size); params2.data_alignment = params.data_alignment = ROUND_SECTOR(ARG_UINT64( OPT_REDUCE_DEVICE_SIZE_ID));
r = create_new_header(rc, NULL, r = create_new_header(rc, NULL,
opt_cipher ? cipher : DEFAULT_LUKS1_CIPHER, ARG_SET(OPT_CIPHER_ID) ? cipher : DEFAULT_LUKS1_CIPHER,
opt_cipher ? cipher_mode : DEFAULT_LUKS1_MODE, ARG_SET(OPT_CIPHER_ID) ? cipher_mode : DEFAULT_LUKS1_MODE,
NULL, NULL, NULL, NULL,
(opt_key_size ? opt_key_size : DEFAULT_LUKS1_KEYBITS) / 8, ARG_UINT32(OPT_KEY_SIZE_ID) / 8,
rc->type, rc->type,
0, 0,
0, 0,
isLUKS2(rc->type) ? (void*)&params2 : (void*)&params); isLUKS2(rc->type) ? (void*)&params2 : (void*)&params);
out: out:
crypt_free(cd_new); crypt_free(cd_new);
return r; return r;
} }
static void remove_headers(struct reenc_ctx *rc) static void remove_headers(struct reenc_ctx *rc)
skipping to change at line 895 skipping to change at line 854
struct stat st; struct stat st;
struct crypt_device *cd = NULL; struct crypt_device *cd = NULL;
int fd, r; int fd, r;
log_dbg("Restoring header for %s from %s.", hdr_device(rc), rc->header_fi le_new); log_dbg("Restoring header for %s from %s.", hdr_device(rc), rc->header_fi le_new);
/* /*
* For new encryption and new detached header in file just move it. * For new encryption and new detached header in file just move it.
* For existing file try to ensure we have preallocated space for restore . * For existing file try to ensure we have preallocated space for restore .
*/ */
if (opt_new && rc->device_header) { if (ARG_SET(OPT_NEW_ID) && rc->device_header) {
r = stat(rc->device_header, &st); r = stat(rc->device_header, &st);
if (r == -1) { if (r == -1) {
r = rename(rc->header_file_new, rc->device_header); r = rename(rc->header_file_new, rc->device_header);
goto out; goto out;
} else if ((st.st_mode & S_IFMT) == S_IFREG && } else if ((st.st_mode & S_IFMT) == S_IFREG &&
stat(rc->header_file_new, &st) != -1) { stat(rc->header_file_new, &st) != -1) {
/* coverity[toctou] */ /* coverity[toctou] */
fd = open(rc->device_header, O_WRONLY); fd = open(rc->device_header, O_WRONLY);
if (fd != -1) { if (fd != -1) {
if (posix_fallocate(fd, 0, st.st_size)) {}; if (posix_fallocate(fd, 0, st.st_size)) {};
skipping to change at line 954 skipping to change at line 913
} }
} while (read_size != count); } while (read_size != count);
return (ssize_t)count; return (ssize_t)count;
} }
static int copy_data_forward(struct reenc_ctx *rc, int fd_old, int fd_new, static int copy_data_forward(struct reenc_ctx *rc, int fd_old, int fd_new,
size_t block_size, void *buf, uint64_t *bytes) size_t block_size, void *buf, uint64_t *bytes)
{ {
ssize_t s1, s2; ssize_t s1, s2;
struct tools_progress_params prog_parms = {
.frequency = ARG_UINT32(OPT_PROGRESS_FREQUENCY_ID),
.batch_mode = ARG_SET(OPT_BATCH_MODE_ID)
};
log_dbg("Reencrypting in forward direction."); log_dbg("Reencrypting in forward direction.");
if (lseek64(fd_old, rc->device_offset, SEEK_SET) < 0 || if (lseek64(fd_old, rc->device_offset, SEEK_SET) < 0 ||
lseek64(fd_new, rc->device_offset, SEEK_SET) < 0) { lseek64(fd_new, rc->device_offset, SEEK_SET) < 0) {
log_err(_("Cannot seek to device offset.")); log_err(_("Cannot seek to device offset."));
return -EIO; return -EIO;
} }
rc->resume_bytes = *bytes = rc->device_offset; rc->resume_bytes = *bytes = rc->device_offset;
tools_reencrypt_progress(rc->device_size, *bytes, NULL); tools_reencrypt_progress(rc->device_size, *bytes, &prog_parms);
if (write_log(rc) < 0) if (write_log(rc) < 0)
return -EIO; return -EIO;
while (!quit && rc->device_offset < rc->device_size) { while (!quit && rc->device_offset < rc->device_size) {
s1 = read_buf(fd_old, buf, block_size); s1 = read_buf(fd_old, buf, block_size);
if (s1 < 0 || ((size_t)s1 != block_size && if (s1 < 0 || ((size_t)s1 != block_size &&
(rc->device_offset + s1) != rc->device_size)) { (rc->device_offset + s1) != rc->device_size)) {
log_dbg("Read error, expecting %zu, got %zd.", log_dbg("Read error, expecting %zu, got %zd.",
block_size, s1); block_size, s1);
skipping to change at line 991 skipping to change at line 954
s1 = rc->device_size - rc->device_offset; s1 = rc->device_size - rc->device_offset;
s2 = write(fd_new, buf, s1); s2 = write(fd_new, buf, s1);
if (s2 < 0) { if (s2 < 0) {
log_dbg("Write error, expecting %zu, got %zd.", log_dbg("Write error, expecting %zu, got %zd.",
block_size, s2); block_size, s2);
return -EIO; return -EIO;
} }
rc->device_offset += s1; rc->device_offset += s1;
if (opt_write_log && write_log(rc) < 0) if (ARG_SET(OPT_WRITE_LOG_ID) && write_log(rc) < 0)
return -EIO; return -EIO;
if (opt_fsync && fsync(fd_new) < 0) { if (ARG_SET(OPT_USE_FSYNC_ID) && fsync(fd_new) < 0) {
log_dbg("Write error, fsync."); log_dbg("Write error, fsync.");
return -EIO; return -EIO;
} }
*bytes += (uint64_t)s2; *bytes += (uint64_t)s2;
tools_reencrypt_progress(rc->device_size, *bytes, NULL); tools_reencrypt_progress(rc->device_size, *bytes, &prog_parms);
} }
return quit ? -EAGAIN : 0; return quit ? -EAGAIN : 0;
} }
static int copy_data_backward(struct reenc_ctx *rc, int fd_old, int fd_new, static int copy_data_backward(struct reenc_ctx *rc, int fd_old, int fd_new,
size_t block_size, void *buf, uint64_t *bytes) size_t block_size, void *buf, uint64_t *bytes)
{ {
ssize_t s1, s2, working_block; ssize_t s1, s2, working_block;
off64_t working_offset; off64_t working_offset;
struct tools_progress_params prog_parms = {
.frequency = ARG_UINT32(OPT_PROGRESS_FREQUENCY_ID),
.batch_mode = ARG_SET(OPT_BATCH_MODE_ID)
};
log_dbg("Reencrypting in backward direction."); log_dbg("Reencrypting in backward direction.");
if (!rc->in_progress) { if (!rc->in_progress) {
rc->device_offset = rc->device_size; rc->device_offset = rc->device_size;
rc->resume_bytes = 0; rc->resume_bytes = 0;
*bytes = 0; *bytes = 0;
} else { } else {
rc->resume_bytes = rc->device_size - rc->device_offset; rc->resume_bytes = rc->device_size - rc->device_offset;
*bytes = rc->resume_bytes; *bytes = rc->resume_bytes;
} }
tools_reencrypt_progress(rc->device_size, *bytes, NULL); tools_reencrypt_progress(rc->device_size, *bytes, &prog_parms);
if (write_log(rc) < 0) if (write_log(rc) < 0)
return -EIO; return -EIO;
/* dirty the device during ENCRYPT mode */ /* dirty the device during ENCRYPT mode */
rc->stained = 1; rc->stained = 1;
while (!quit && rc->device_offset) { while (!quit && rc->device_offset) {
if (rc->device_offset < block_size) { if (rc->device_offset < block_size) {
working_offset = 0; working_offset = 0;
skipping to change at line 1062 skipping to change at line 1029
} }
s2 = write(fd_new, buf, working_block); s2 = write(fd_new, buf, working_block);
if (s2 < 0) { if (s2 < 0) {
log_dbg("Write error, expecting %zu, got %zd.", log_dbg("Write error, expecting %zu, got %zd.",
block_size, s2); block_size, s2);
return -EIO; return -EIO;
} }
rc->device_offset -= s1; rc->device_offset -= s1;
if (opt_write_log && write_log(rc) < 0) if (ARG_SET(OPT_WRITE_LOG_ID) && write_log(rc) < 0)
return -EIO; return -EIO;
if (opt_fsync && fsync(fd_new) < 0) { if (ARG_SET(OPT_USE_FSYNC_ID) && fsync(fd_new) < 0) {
log_dbg("Write error, fsync."); log_dbg("Write error, fsync.");
return -EIO; return -EIO;
} }
*bytes += (uint64_t)s2; *bytes += (uint64_t)s2;
tools_reencrypt_progress(rc->device_size, *bytes, NULL); tools_reencrypt_progress(rc->device_size, *bytes, &prog_parms);
} }
return quit ? -EAGAIN : 0; return quit ? -EAGAIN : 0;
} }
static void zero_rest_of_device(int fd, size_t block_size, void *buf, static void zero_rest_of_device(int fd, size_t block_size, void *buf,
uint64_t *bytes, uint64_t offset) uint64_t *bytes, uint64_t offset)
{ {
ssize_t s1, s2; ssize_t s1, s2;
skipping to change at line 1104 skipping to change at line 1071
if (*bytes < (uint64_t)s1) if (*bytes < (uint64_t)s1)
s1 = *bytes; s1 = *bytes;
s2 = write(fd, buf, s1); s2 = write(fd, buf, s1);
if (s2 != s1) { if (s2 != s1) {
log_dbg("Write error, expecting %zd, got %zd.", log_dbg("Write error, expecting %zd, got %zd.",
s1, s2); s1, s2);
return; return;
} }
if (opt_fsync && fsync(fd) < 0) { if (ARG_SET(OPT_USE_FSYNC_ID) && fsync(fd) < 0) {
log_dbg("Write error, fsync."); log_dbg("Write error, fsync.");
return; return;
} }
*bytes -= s2; *bytes -= s2;
} }
} }
static int copy_data(struct reenc_ctx *rc) static int copy_data(struct reenc_ctx *rc)
{ {
size_t block_size = opt_bsize * 1024 * 1024; size_t block_size = ARG_UINT32(OPT_BLOCK_SIZE_ID) * 1024 * 1024;
int fd_old = -1, fd_new = -1; int fd_old = -1, fd_new = -1;
int r = -EINVAL; int r = -EINVAL;
void *buf = NULL; void *buf = NULL;
uint64_t bytes = 0; uint64_t bytes = 0;
log_dbg("Data copy preparation."); log_dbg("Data copy preparation.");
fd_old = open(rc->crypt_path_org, O_RDONLY | (opt_directio ? O_DIRECT : 0 )); fd_old = open(rc->crypt_path_org, O_RDONLY | (ARG_SET(OPT_USE_DIRECTIO_ID ) ? O_DIRECT : 0));
if (fd_old == -1) { if (fd_old == -1) {
log_err(_("Cannot open temporary LUKS device.")); log_err(_("Cannot open temporary LUKS device."));
goto out; goto out;
} }
fd_new = open(rc->crypt_path_new, O_WRONLY | (opt_directio ? O_DIRECT : 0 )); fd_new = open(rc->crypt_path_new, O_WRONLY | (ARG_SET(OPT_USE_DIRECTIO_ID ) ? O_DIRECT : 0));
if (fd_new == -1) { if (fd_new == -1) {
log_err(_("Cannot open temporary LUKS device.")); log_err(_("Cannot open temporary LUKS device."));
goto out; goto out;
} }
if (ioctl(fd_old, BLKGETSIZE64, &rc->device_size_org_real) < 0) { if (ioctl(fd_old, BLKGETSIZE64, &rc->device_size_org_real) < 0) {
log_err(_("Cannot get device size.")); log_err(_("Cannot get device size."));
goto out; goto out;
} }
if (ioctl(fd_new, BLKGETSIZE64, &rc->device_size_new_real) < 0) { if (ioctl(fd_new, BLKGETSIZE64, &rc->device_size_new_real) < 0) {
log_err(_("Cannot get device size.")); log_err(_("Cannot get device size."));
goto out; goto out;
} }
if (opt_device_size) if (ARG_SET(OPT_DEVICE_SIZE_ID))
rc->device_size = opt_device_size; rc->device_size = ARG_UINT64(OPT_DEVICE_SIZE_ID);
else if (rc->reencrypt_mode == DECRYPT) else if (rc->reencrypt_mode == DECRYPT)
rc->device_size = rc->device_size_org_real; rc->device_size = rc->device_size_org_real;
else else
rc->device_size = rc->device_size_new_real; rc->device_size = rc->device_size_new_real;
if (posix_memalign((void *)&buf, alignment(fd_new), block_size)) { if (posix_memalign((void *)&buf, alignment(fd_new), block_size)) {
log_err(_("Allocation of aligned memory failed.")); log_err(_("Allocation of aligned memory failed."));
r = -ENOMEM; r = -ENOMEM;
goto out; goto out;
} }
skipping to change at line 1196 skipping to change at line 1163
} }
static int initialize_uuid(struct reenc_ctx *rc) static int initialize_uuid(struct reenc_ctx *rc)
{ {
struct crypt_device *cd = NULL; struct crypt_device *cd = NULL;
int r; int r;
uuid_t device_uuid; uuid_t device_uuid;
log_dbg("Initialising UUID."); log_dbg("Initialising UUID.");
if (opt_new) { if (ARG_SET(OPT_NEW_ID)) {
rc->device_uuid = strdup(NO_UUID); rc->device_uuid = strdup(NO_UUID);
rc->type = luksType(opt_type); rc->type = luksType(ARG_STR(OPT_TYPE_ID));
return 0; return 0;
} }
if (opt_decrypt && opt_uuid) { if (ARG_SET(OPT_DECRYPT_ID) && ARG_SET(OPT_UUID_ID)) {
r = uuid_parse(opt_uuid, device_uuid); r = uuid_parse(ARG_STR(OPT_UUID_ID), device_uuid);
if (!r) if (!r)
rc->device_uuid = strdup(opt_uuid); rc->device_uuid = strdup(ARG_STR(OPT_UUID_ID));
else else
log_err(_("Provided UUID is invalid.")); log_err(_("Provided UUID is invalid."));
return r; return r;
} }
/* Try to load LUKS from device */ /* Try to load LUKS from device */
if ((r = crypt_init(&cd, hdr_device(rc)))) if ((r = crypt_init(&cd, hdr_device(rc))))
return r; return r;
crypt_set_log_callback(cd, _quiet_log, NULL); crypt_set_log_callback(cd, _quiet_log, NULL);
skipping to change at line 1246 skipping to change at line 1213
size_t passwordLen; size_t passwordLen;
/* mode ENCRYPT call this without header */ /* mode ENCRYPT call this without header */
if (cd && slot_to_check != CRYPT_ANY_SLOT) { if (cd && slot_to_check != CRYPT_ANY_SLOT) {
ki = crypt_keyslot_status(cd, slot_to_check); ki = crypt_keyslot_status(cd, slot_to_check);
if (ki < CRYPT_SLOT_ACTIVE) if (ki < CRYPT_SLOT_ACTIVE)
return -ENOENT; return -ENOENT;
} else } else
ki = CRYPT_SLOT_ACTIVE; ki = CRYPT_SLOT_ACTIVE;
retry_count = opt_tries ?: 1; retry_count = ARG_UINT32(OPT_TRIES_ID) ?: 1;
while (retry_count--) { while (retry_count--) {
r = tools_get_key(msg, &password, &passwordLen, 0, 0, r = tools_get_key(msg, &password, &passwordLen, 0, 0,
NULL /*opt_key_file*/, 0, verify, 0 /*pwquality */, cd); NULL /*opt_key_file*/, 0, verify, 0 /*pwquality */, cd);
if (r < 0) if (r < 0)
return r; return r;
if (quit) { if (quit) {
crypt_safe_free(password); crypt_safe_free(password);
password = NULL; password = NULL;
passwordLen = 0; passwordLen = 0;
return -EAGAIN; return -EAGAIN;
skipping to change at line 1296 skipping to change at line 1263
return r; return r;
} }
static int init_keyfile(struct reenc_ctx *rc, struct crypt_device *cd, int slot_ check) static int init_keyfile(struct reenc_ctx *rc, struct crypt_device *cd, int slot_ check)
{ {
char *password; char *password;
int r; int r;
size_t passwordLen; size_t passwordLen;
r = tools_get_key(NULL, &password, &passwordLen, opt_keyfile_offset, r = tools_get_key(NULL, &password, &passwordLen, ARG_UINT64(OPT_KEYFILE_O
opt_keyfile_size, opt_key_file, 0, 0, 0, cd); FFSET_ID),
ARG_UINT32(OPT_KEYFILE_SIZE_ID), ARG_STR(OPT_KEY_FILE_I
D), 0, 0, 0, cd);
if (r < 0) if (r < 0)
return r; return r;
/* mode ENCRYPT call this without header */ /* mode ENCRYPT call this without header */
if (cd) { if (cd) {
r = crypt_activate_by_passphrase(cd, NULL, slot_check, password, r = crypt_activate_by_passphrase(cd, NULL, slot_check, password,
passwordLen, 0); passwordLen, 0);
/* /*
* Allow keyslot only if it is last slot or if user explicitly * Allow keyslot only if it is last slot or if user explicitly
* specify which slot to use (IOW others will be disabled). * specify which slot to use (IOW others will be disabled).
*/ */
if (r >= 0 && opt_key_slot == CRYPT_ANY_SLOT && if (r >= 0 && ARG_INT32(OPT_KEY_SLOT_ID) == CRYPT_ANY_SLOT &&
crypt_keyslot_status(cd, r) != CRYPT_SLOT_ACTIVE_LAST) { crypt_keyslot_status(cd, r) != CRYPT_SLOT_ACTIVE_LAST) {
log_err(_("Key file can be used only with --key-slot or w ith " log_err(_("Key file can be used only with --key-slot or w ith "
"exactly one key slot active.")); "exactly one key slot active."));
r = -EINVAL; r = -EINVAL;
} }
} else { } else {
r = slot_check == CRYPT_ANY_SLOT ? 0 : slot_check; r = slot_check == CRYPT_ANY_SLOT ? 0 : slot_check;
} }
if (r < 0) { if (r < 0) {
skipping to change at line 1344 skipping to change at line 1311
static int initialize_passphrase(struct reenc_ctx *rc, const char *device) static int initialize_passphrase(struct reenc_ctx *rc, const char *device)
{ {
struct crypt_device *cd = NULL; struct crypt_device *cd = NULL;
char msg[256]; char msg[256];
int i, r; int i, r;
log_dbg("Passphrases initialization."); log_dbg("Passphrases initialization.");
if (rc->reencrypt_mode == ENCRYPT && !rc->in_progress) { if (rc->reencrypt_mode == ENCRYPT && !rc->in_progress) {
if (opt_key_file) if (ARG_SET(OPT_KEY_FILE_ID))
r = init_keyfile(rc, NULL, opt_key_slot); r = init_keyfile(rc, NULL, ARG_INT32(OPT_KEY_SLOT_ID));
else else
r = init_passphrase1(rc, NULL, _("Enter new passphrase: " ), opt_key_slot, 0, 1); r = init_passphrase1(rc, NULL, _("Enter new passphrase: " ), ARG_INT32(OPT_KEY_SLOT_ID), 0, 1);
return r > 0 ? 0 : r; return r > 0 ? 0 : r;
} }
if ((r = crypt_init_data_device(&cd, device, rc->device)) || if ((r = crypt_init_data_device(&cd, device, rc->device)) ||
(r = crypt_load(cd, CRYPT_LUKS, NULL))) { (r = crypt_load(cd, CRYPT_LUKS, NULL))) {
crypt_free(cd); crypt_free(cd);
return r; return r;
} }
if (opt_key_slot != CRYPT_ANY_SLOT) if (ARG_INT32(OPT_KEY_SLOT_ID) != CRYPT_ANY_SLOT)
snprintf(msg, sizeof(msg), snprintf(msg, sizeof(msg),
_("Enter passphrase for key slot %d: "), opt_key_slot); _("Enter passphrase for key slot %d: "), ARG_INT32(OPT_K EY_SLOT_ID));
else else
snprintf(msg, sizeof(msg), _("Enter any existing passphrase: ")); snprintf(msg, sizeof(msg), _("Enter any existing passphrase: "));
if (opt_key_file) { if (ARG_SET(OPT_KEY_FILE_ID)) {
r = init_keyfile(rc, cd, opt_key_slot); r = init_keyfile(rc, cd, ARG_INT32(OPT_KEY_SLOT_ID));
} else if (rc->in_progress || } else if (rc->in_progress ||
opt_key_slot != CRYPT_ANY_SLOT || ARG_INT32(OPT_KEY_SLOT_ID) != CRYPT_ANY_SLOT ||
rc->reencrypt_mode == DECRYPT) { rc->reencrypt_mode == DECRYPT) {
r = init_passphrase1(rc, cd, msg, opt_key_slot, 1, 0); r = init_passphrase1(rc, cd, msg, ARG_INT32(OPT_KEY_SLOT_ID), 1, 0);
} else for (i = 0; i < crypt_keyslot_max(crypt_get_type(cd)); i++) { } else for (i = 0; i < crypt_keyslot_max(crypt_get_type(cd)); i++) {
snprintf(msg, sizeof(msg), _("Enter passphrase for key slot %d: " ), i); snprintf(msg, sizeof(msg), _("Enter passphrase for key slot %d: " ), i);
r = init_passphrase1(rc, cd, msg, i, 1, 0); r = init_passphrase1(rc, cd, msg, i, 1, 0);
if (r == -ENOENT) { if (r == -ENOENT) {
r = 0; r = 0;
continue; continue;
} }
if (r < 0) if (r < 0)
break; break;
} }
skipping to change at line 1399 skipping to change at line 1366
/* FIXME: replace MAX_KEYSLOT with crypt_keyslot_max(CRYPT_LUKS2) */ /* FIXME: replace MAX_KEYSLOT with crypt_keyslot_max(CRYPT_LUKS2) */
if (crypt_keyslot_max(CRYPT_LUKS2) > MAX_SLOT) { if (crypt_keyslot_max(CRYPT_LUKS2) > MAX_SLOT) {
log_dbg("Internal error"); log_dbg("Internal error");
return -EINVAL; return -EINVAL;
} }
if (!(rc->device = strndup(device, PATH_MAX))) if (!(rc->device = strndup(device, PATH_MAX)))
return -ENOMEM; return -ENOMEM;
if (opt_header_device && !(rc->device_header = strndup(opt_header_device, PATH_MAX))) if (ARG_SET(OPT_HEADER_ID) && !(rc->device_header = strndup(ARG_STR(OPT_H EADER_ID), PATH_MAX)))
return -ENOMEM; return -ENOMEM;
if (device_check(rc, rc->device, CHECK_OPEN) < 0) if (device_check(rc, rc->device, CHECK_OPEN) < 0)
return -EINVAL; return -EINVAL;
if (initialize_uuid(rc)) { if (initialize_uuid(rc)) {
log_err(_("Device %s is not a valid LUKS device."), device); log_err(_("Device %s is not a valid LUKS device."), device);
return -EINVAL; return -EINVAL;
} }
if (opt_key_slot != CRYPT_ANY_SLOT && if (ARG_INT32(OPT_KEY_SLOT_ID) != CRYPT_ANY_SLOT &&
opt_key_slot >= crypt_keyslot_max(rc->type)) { ARG_INT32(OPT_KEY_SLOT_ID) >= crypt_keyslot_max(rc->type)) {
log_err(_("Key slot is invalid.")); log_err(_("Key slot is invalid."));
return -EINVAL; return -EINVAL;
} }
/* Prepare device names */ /* Prepare device names */
if (snprintf(rc->log_file, PATH_MAX, if (snprintf(rc->log_file, PATH_MAX,
"LUKS-%s.log", rc->device_uuid) < 0) "LUKS-%s.log", rc->device_uuid) < 0)
return -ENOMEM; return -ENOMEM;
if (snprintf(rc->header_file_org, PATH_MAX, if (snprintf(rc->header_file_org, PATH_MAX,
"LUKS-%s.org", rc->device_uuid) < 0) "LUKS-%s.org", rc->device_uuid) < 0)
skipping to change at line 1446 skipping to change at line 1413
return -ENOMEM; return -ENOMEM;
remove_headers(rc); remove_headers(rc);
if (open_log(rc) < 0) { if (open_log(rc) < 0) {
log_err(_("Cannot open reencryption log file.")); log_err(_("Cannot open reencryption log file."));
return -EINVAL; return -EINVAL;
} }
if (!rc->in_progress) { if (!rc->in_progress) {
if (opt_uuid) { if (ARG_SET(OPT_UUID_ID)) {
log_err(_("No decryption in progress, provided UUID can " log_err(_("No decryption in progress, provided UUID can "
"be used only to resume suspended decryption process.")); "be used only to resume suspended decryption process."));
return -EINVAL; return -EINVAL;
} }
if (!opt_reduce_size) if (!ARG_SET(OPT_REDUCE_DEVICE_SIZE_ID))
rc->reencrypt_direction = FORWARD; rc->reencrypt_direction = FORWARD;
else { else {
rc->reencrypt_direction = BACKWARD; rc->reencrypt_direction = BACKWARD;
rc->device_offset = (uint64_t)~0; rc->device_offset = (uint64_t)~0;
} }
if (opt_new) if (ARG_SET(OPT_NEW_ID))
rc->reencrypt_mode = ENCRYPT; rc->reencrypt_mode = ENCRYPT;
else if (opt_decrypt) else if (ARG_SET(OPT_DECRYPT_ID))
rc->reencrypt_mode = DECRYPT; rc->reencrypt_mode = DECRYPT;
else else
rc->reencrypt_mode = REENCRYPT; rc->reencrypt_mode = REENCRYPT;
} }
return 0; return 0;
} }
static void destroy_context(struct reenc_ctx *rc) static void destroy_context(struct reenc_ctx *rc)
{ {
skipping to change at line 1551 skipping to change at line 1518
static struct reenc_ctx rc = { static struct reenc_ctx rc = {
.stained = 1 .stained = 1
}; };
set_int_handler(0); set_int_handler(0);
if (initialize_context(&rc, device)) if (initialize_context(&rc, device))
goto out; goto out;
/* short-circuit LUKS2 keyslot parameters change */ /* short-circuit LUKS2 keyslot parameters change */
if (opt_keep_key && isLUKS2(rc.type)) { if (ARG_SET(OPT_KEEP_KEY_ID) && isLUKS2(rc.type)) {
r = luks2_change_pbkdf_params(&rc); r = luks2_change_pbkdf_params(&rc);
goto out; goto out;
} }
log_dbg("Running reencryption."); log_dbg("Running reencryption.");
if (!rc.in_progress) { if (!rc.in_progress) {
if ((r = initialize_passphrase(&rc, hdr_device(&rc)))) if ((r = initialize_passphrase(&rc, hdr_device(&rc))))
goto out; goto out;
skipping to change at line 1578 skipping to change at line 1545
if ((r = backup_luks_headers(&rc))) if ((r = backup_luks_headers(&rc)))
goto out; goto out;
/* Create fake header for decrypted device */ /* Create fake header for decrypted device */
if (rc.reencrypt_mode == DECRYPT && if (rc.reencrypt_mode == DECRYPT &&
(r = backup_fake_header(&rc))) (r = backup_fake_header(&rc)))
goto out; goto out;
if ((r = device_check(&rc, hdr_device(&rc), MAKE_UNUSABLE ))) if ((r = device_check(&rc, hdr_device(&rc), MAKE_UNUSABLE )))
goto out; goto out;
} }
} else { } else {
if ((r = initialize_passphrase(&rc, opt_decrypt ? rc.header_file_ org : rc.header_file_new))) if ((r = initialize_passphrase(&rc, ARG_SET(OPT_DECRYPT_ID) ? rc. header_file_org : rc.header_file_new)))
goto out; goto out;
} }
if (!opt_keep_key) { if (!ARG_SET(OPT_KEEP_KEY_ID)) {
log_dbg("Running data area reencryption."); log_dbg("Running data area reencryption.");
if ((r = activate_luks_headers(&rc))) if ((r = activate_luks_headers(&rc)))
goto out; goto out;
if ((r = copy_data(&rc))) if ((r = copy_data(&rc)))
goto out; goto out;
} else } else
log_dbg("Keeping existing key, skipping data area reencryption.") ; log_dbg("Keeping existing key, skipping data area reencryption.") ;
// FIXME: fix error path above to not skip this // FIXME: fix error path above to not skip this
skipping to change at line 1623 skipping to change at line 1590
exit(EXIT_SUCCESS); exit(EXIT_SUCCESS);
} else if (key->shortName == 'V') { } else if (key->shortName == 'V') {
log_std("%s %s\n", PACKAGE_REENC, PACKAGE_VERSION); log_std("%s %s\n", PACKAGE_REENC, PACKAGE_VERSION);
tools_cleanup(); tools_cleanup();
poptFreeContext(popt_context); poptFreeContext(popt_context);
exit(EXIT_SUCCESS); exit(EXIT_SUCCESS);
} else } else
usage(popt_context, EXIT_SUCCESS, NULL, NULL); usage(popt_context, EXIT_SUCCESS, NULL, NULL);
} }
static bool needs_size_conversion(unsigned arg_id)
{
return arg_id == OPT_DEVICE_SIZE_ID || arg_id == OPT_REDUCE_DEVICE_SIZE_I
D;
}
static void basic_options_cb(poptContext popt_context,
enum poptCallbackReason reason __attribute__((unused)),
struct poptOption *key,
const char *arg,
void *data __attribute__((unused)))
{
tools_parse_arg_value(popt_context, tool_core_args[key->val].type, tool_c
ore_args + key->val, arg, key->val, needs_size_conversion);
/* special cases additional handling */
switch (key->val) {
case OPT_DEBUG_ID:
log_parms.debug = true;
/* fall through */
case OPT_VERBOSE_ID:
log_parms.verbose = true;
break;
case OPT_BLOCK_SIZE_ID:
if (ARG_UINT32(OPT_BLOCK_SIZE_ID) < 1 || ARG_UINT32(OPT_BLOCK_SIZ
E_ID) > 64)
usage(popt_context, EXIT_FAILURE,
_("Only values between 1 MiB and 64 MiB allowed for
reencryption block size."),
poptGetInvocationName(popt_context));
break;
case OPT_KEY_SIZE_ID:
if (ARG_UINT32(OPT_KEY_SIZE_ID) == 0)
usage(popt_context, EXIT_FAILURE, poptStrerror(POPT_ERROR
_BADNUMBER),
poptGetInvocationName(popt_context));
if (ARG_UINT32(OPT_KEY_SIZE_ID) % 8)
usage(popt_context, EXIT_FAILURE,
_("Key size must be a multiple of 8 bits"),
poptGetInvocationName(popt_context));
break;
case OPT_REDUCE_DEVICE_SIZE_ID:
if (ARG_UINT64(OPT_REDUCE_DEVICE_SIZE_ID) > 64 * 1024 * 1024)
usage(popt_context, EXIT_FAILURE, _("Maximum device reduc
e size is 64 MiB."),
poptGetInvocationName(popt_context));
if (ARG_UINT64(OPT_REDUCE_DEVICE_SIZE_ID) % SECTOR_SIZE)
usage(popt_context, EXIT_FAILURE, _("Reduce size must be
multiple of 512 bytes sector."),
poptGetInvocationName(popt_context));
break;
}
}
int main(int argc, const char **argv) int main(int argc, const char **argv)
{ {
static struct poptOption popt_help_options[] = { static struct poptOption popt_help_options[] = {
{ NULL, '\0', POPT_ARG_CALLBACK, help, 0, NULL, NULL }, { NULL, '\0', POPT_ARG_CALLBACK, help, 0, NULL, NULL },
{ "help", '?', POPT_ARG_NONE, NULL, 0, N_("Show this help m essage"), NULL }, { "help", '?', POPT_ARG_NONE, NULL, 0, N_("Show this help m essage"), NULL },
{ "usage", '\0', POPT_ARG_NONE, NULL, 0, N_("Display brief us age"), NULL }, { "usage", '\0', POPT_ARG_NONE, NULL, 0, N_("Display brief us age"), NULL },
{ "version",'V', POPT_ARG_NONE, NULL, 0, N_("Print package ve rsion"), NULL }, { "version",'V', POPT_ARG_NONE, NULL, 0, N_("Print package ve rsion"), NULL },
POPT_TABLEEND POPT_TABLEEND
}; };
static struct poptOption popt_basic_options[] = {
{ NULL, '\0', POPT_ARG_CALLBACK, basic_options_cb, 0, NULL, NU
LL },
#define ARG(A, B, C, D, E, F, G) { A, B, C, NULL, A ## _ID, D, E },
#include "cryptsetup_reencrypt_arg_list.h"
#undef arg
POPT_TABLEEND
};
static struct poptOption popt_options[] = { static struct poptOption popt_options[] = {
{ NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_op tions, 0, N_("Help options:"), NULL }, { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_help_op tions, 0, N_("Help options:"), NULL },
{ "verbose", 'v', POPT_ARG_NONE, &opt_verbose, { NULL, '\0', POPT_ARG_INCLUDE_TABLE, popt_basic_o
0, N_("Shows more detailed error messages"), NULL }, ptions, 0, NULL, NULL },
{ "debug", '\0', POPT_ARG_NONE, &opt_debug,
0, N_("Show debug messages"), NULL },
{ "block-size", 'B', POPT_ARG_INT, &opt_bsize,
0, N_("Reencryption block size"), N_("MiB") },
{ "cipher", 'c', POPT_ARG_STRING, &opt_cipher,
0, N_("The cipher used to encrypt the disk (see /proc/crypto)"), NULL },
{ "key-size", 's', POPT_ARG_INT, &opt_key_size,
0, N_("The size of the encryption key"), N_("BITS") },
{ "hash", 'h', POPT_ARG_STRING, &opt_hash,
0, N_("The hash used to create the encryption key from the passphrase"),
NULL },
{ "keep-key", '\0', POPT_ARG_NONE, &opt_keep_key,
0, N_("Do not change key, no data area reencryption"), NULL },
{ "key-file", 'd', POPT_ARG_STRING, &opt_key_file,
0, N_("Read the key from a file"), NULL },
{ "master-key-file", '\0', POPT_ARG_STRING, &opt_master_key_fil
e, 0, N_("Read new volume (master) key from file"), NULL },
{ "iter-time", 'i', POPT_ARG_INT, &opt_iteration_time,
0, N_("PBKDF2 iteration time for LUKS (in ms)"), N_("msecs") },
{ "batch-mode", 'q', POPT_ARG_NONE, &opt_batch_mode,
0, N_("Do not ask for confirmation"), NULL },
{ "progress-frequency",'\0', POPT_ARG_INT, &opt_progress_frequenc
y, 0, N_("Progress line update (in seconds)"), N_("secs") },
{ "tries", 'T', POPT_ARG_INT, &opt_tries,
0, N_("How often the input of the passphrase can be retried"), NULL },
{ "use-random", '\0', POPT_ARG_NONE, &opt_random,
0, N_("Use /dev/random for generating volume key"), NULL },
{ "use-urandom", '\0', POPT_ARG_NONE, &opt_urandom,
0, N_("Use /dev/urandom for generating volume key"), NULL },
{ "use-directio", '\0', POPT_ARG_NONE, &opt_directio,
0, N_("Use direct-io when accessing devices"), NULL },
{ "use-fsync", '\0', POPT_ARG_NONE, &opt_fsync,
0, N_("Use fsync after each block"), NULL },
{ "write-log", '\0', POPT_ARG_NONE, &opt_write_log,
0, N_("Update log file after every block"), NULL },
{ "key-slot", 'S', POPT_ARG_INT, &opt_key_slot,
0, N_("Use only this slot (others will be disabled)"), NULL },
{ "keyfile-offset", '\0', POPT_ARG_LONG, &opt_keyfile_offset,
0, N_("Number of bytes to skip in keyfile"), N_("bytes") },
{ "keyfile-size", 'l', POPT_ARG_LONG, &opt_keyfile_size,
0, N_("Limits the read from keyfile"), N_("bytes") },
{ "reduce-device-size",'\0', POPT_ARG_STRING, &opt_reduce_size_st
r, 0, N_("Reduce data device size (move data offset). DANGEROUS!"), N_("byte
s") },
{ "device-size", '\0', POPT_ARG_STRING, &opt_device_size_st
r, 0, N_("Use only specified device size (ignore rest of device). DANGEROUS!
"), N_("bytes") },
{ "new", 'N', POPT_ARG_NONE, &opt_new,
0, N_("Create new header on not encrypted device"), NULL },
{ "decrypt", '\0', POPT_ARG_NONE, &opt_decrypt,
0, N_("Permanently decrypt device (remove encryption)"), NULL },
{ "uuid", '\0', POPT_ARG_STRING, &opt_uuid,
0, N_("The UUID used to resume decryption"), NULL },
{ "type", '\0', POPT_ARG_STRING, &opt_type,
0, N_("Type of LUKS metadata: luks1, luks2"), NULL },
{ "pbkdf", '\0', POPT_ARG_STRING, &opt_pbkdf,
0, N_("PBKDF algorithm (for LUKS2): argon2i, argon2id, pbkdf2"), NULL },
{ "pbkdf-memory", '\0', POPT_ARG_LONG, &opt_pbkdf_memory,
0, N_("PBKDF memory cost limit"), N_("kilobytes") },
{ "pbkdf-parallel", '\0', POPT_ARG_LONG, &opt_pbkdf_parallel,
0, N_("PBKDF parallel cost"), N_("threads") },
{ "pbkdf-force-iterations",'\0',POPT_ARG_LONG, &opt_pbkdf_iterati
ons, 0, N_("PBKDF iterations cost (forced, disables benchmark)"), NULL },
{ "header", '\0', POPT_ARG_STRING, &opt_header_device,
0, N_("Device or file with separated LUKS header"), NULL },
POPT_TABLEEND POPT_TABLEEND
}; };
poptContext popt_context; poptContext popt_context;
int r; int r;
crypt_set_log_callback(NULL, tool_log, NULL); crypt_set_log_callback(NULL, tool_log, &log_parms);
setlocale(LC_ALL, ""); setlocale(LC_ALL, "");
bindtextdomain(PACKAGE, LOCALEDIR); bindtextdomain(PACKAGE, LOCALEDIR);
textdomain(PACKAGE); textdomain(PACKAGE);
popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0); popt_context = poptGetContext(PACKAGE, argc, argv, popt_options, 0);
poptSetOtherOptionHelp(popt_context, poptSetOtherOptionHelp(popt_context,
_("[OPTION...] <device>")); _("[OPTION...] <device>"));
while((r = poptGetNextOpt(popt_context)) > 0) ; while((r = poptGetNextOpt(popt_context)) > 0) ;
if (r < -1) if (r < -1)
usage(popt_context, EXIT_FAILURE, poptStrerror(r), usage(popt_context, EXIT_FAILURE, poptStrerror(r),
poptBadOption(popt_context, POPT_BADOPTION_NOALIAS)); poptBadOption(popt_context, POPT_BADOPTION_NOALIAS));
if (!opt_batch_mode) if (!ARG_SET(OPT_BATCH_MODE_ID))
log_verbose(_("Reencryption will change: %s%s%s%s%s%s."), log_verbose(_("Reencryption will change: %s%s%s%s%s%s."),
opt_keep_key ? "" : _("volume key"), ARG_SET(OPT_KEEP_KEY_ID) ? "" : _("volume key"),
(!opt_keep_key && opt_hash) ? ", " : "", (!ARG_SET(OPT_KEEP_KEY_ID) && ARG_SET(OPT_HASH_ID)) ? ",
opt_hash ? _("set hash to ") : "", opt_hash ?: "", " : "",
opt_cipher ? _(", set cipher to "): "", opt_cipher ?: "") ARG_SET(OPT_HASH_ID) ? _("set hash to ") : "", ARG_STR(OP
; T_HASH_ID) ?: "",
ARG_SET(OPT_CIPHER_ID) ? _(", set cipher to "): "", ARG_S
TR(OPT_CIPHER_ID) ?: "");
action_argv = poptGetArgs(popt_context); action_argv = poptGetArgs(popt_context);
if(!action_argv) if(!action_argv)
usage(popt_context, EXIT_FAILURE, _("Argument required."), usage(popt_context, EXIT_FAILURE, _("Argument required."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_random && opt_urandom) if (ARG_SET(OPT_USE_RANDOM_ID) && ARG_SET(OPT_USE_URANDOM_ID))
usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."), usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_bsize < 0 || opt_key_size < 0 || opt_iteration_time < 0 || if (ARG_SET(OPT_PBKDF_ID) && crypt_parse_pbkdf(ARG_STR(OPT_PBKDF_ID), &se
opt_tries < 0 || opt_keyfile_offset < 0 || opt_key_size < 0 || t_pbkdf))
opt_pbkdf_iterations < 0 || opt_pbkdf_memory < 0 ||
opt_pbkdf_parallel < 0) {
usage(popt_context, EXIT_FAILURE,
_("Negative number for option not permitted."),
poptGetInvocationName(popt_context));
}
if (opt_pbkdf && crypt_parse_pbkdf(opt_pbkdf, &set_pbkdf))
usage(popt_context, EXIT_FAILURE, usage(popt_context, EXIT_FAILURE,
_("Password-based key derivation function (PBKDF) can be only pbk df2 or argon2i/argon2id."), _("Password-based key derivation function (PBKDF) can be only pbk df2 or argon2i/argon2id."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_pbkdf_iterations && opt_iteration_time) if (ARG_SET(OPT_PBKDF_FORCE_ITERATIONS_ID) && ARG_SET(OPT_ITER_TIME_ID))
usage(popt_context, EXIT_FAILURE, usage(popt_context, EXIT_FAILURE,
_("PBKDF forced iterations cannot be combined with iteration time option."), _("PBKDF forced iterations cannot be combined with iteration time option."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_bsize < 1 || opt_bsize > 64) if (ARG_INT32(OPT_KEY_SLOT_ID) != CRYPT_ANY_SLOT &&
usage(popt_context, EXIT_FAILURE, (ARG_INT32(OPT_KEY_SLOT_ID) < 0 || ARG_INT32(OPT_KEY_SLOT_ID) >= cryp
_("Only values between 1 MiB and 64 MiB allowed for reencry t_keyslot_max(CRYPT_LUKS2)))
ption block size."),
poptGetInvocationName(popt_context));
if (opt_key_size % 8)
usage(popt_context, EXIT_FAILURE,
_("Key size must be a multiple of 8 bits"),
poptGetInvocationName(popt_context));
if (opt_key_slot != CRYPT_ANY_SLOT &&
(opt_key_slot < 0 || opt_key_slot >= crypt_keyslot_max(CRYPT_LUKS2)))
usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."), usage(popt_context, EXIT_FAILURE, _("Key slot is invalid."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_random && opt_urandom) if (ARG_SET(OPT_USE_RANDOM_ID) && ARG_SET(OPT_USE_URANDOM_ID))
usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."), usage(popt_context, EXIT_FAILURE, _("Only one of --use-[u]random options is allowed."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_device_size_str && if (ARG_SET(OPT_NEW_ID) && (!ARG_SET(OPT_REDUCE_DEVICE_SIZE_ID) && !ARG_S
tools_string_to_size(NULL, opt_device_size_str, &opt_device_size)) ET(OPT_HEADER_ID)))
usage(popt_context, EXIT_FAILURE, _("Invalid device size specific
ation."),
poptGetInvocationName(popt_context));
if (opt_reduce_size_str &&
tools_string_to_size(NULL, opt_reduce_size_str, &opt_reduce_size))
usage(popt_context, EXIT_FAILURE, _("Invalid device size specific
ation."),
poptGetInvocationName(popt_context));
if (opt_reduce_size > 64 * 1024 * 1024)
usage(popt_context, EXIT_FAILURE, _("Maximum device reduce size i
s 64 MiB."),
poptGetInvocationName(popt_context));
if (opt_reduce_size % SECTOR_SIZE)
usage(popt_context, EXIT_FAILURE, _("Reduce size must be multiple
of 512 bytes sector."),
poptGetInvocationName(popt_context));
if (opt_new && (!opt_reduce_size && !opt_header_device))
usage(popt_context, EXIT_FAILURE, _("Option --new must be used to gether with --reduce-device-size or --header."), usage(popt_context, EXIT_FAILURE, _("Option --new must be used to gether with --reduce-device-size or --header."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_keep_key && (opt_cipher || opt_new || opt_master_key_file)) if (ARG_SET(OPT_KEEP_KEY_ID) && (ARG_SET(OPT_CIPHER_ID) || ARG_SET(OPT_NE W_ID) || ARG_SET(OPT_MASTER_KEY_FILE_ID)))
usage(popt_context, EXIT_FAILURE, _("Option --keep-key can be use d only with --hash, --iter-time or --pbkdf-force-iterations."), usage(popt_context, EXIT_FAILURE, _("Option --keep-key can be use d only with --hash, --iter-time or --pbkdf-force-iterations."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_new && opt_decrypt) if (ARG_SET(OPT_NEW_ID) && ARG_SET(OPT_DECRYPT_ID))
usage(popt_context, EXIT_FAILURE, _("Option --new cannot be used together with --decrypt."), usage(popt_context, EXIT_FAILURE, _("Option --new cannot be used together with --decrypt."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_decrypt && (opt_cipher || opt_hash || opt_reduce_size || opt_keep if (ARG_SET(OPT_DECRYPT_ID) &&
_key || opt_device_size)) (ARG_SET(OPT_CIPHER_ID) || ARG_SET(OPT_HASH_ID) || ARG_SET(OPT_REDUCE
_DEVICE_SIZE_ID) ||
ARG_SET(OPT_KEEP_KEY_ID) || ARG_SET(OPT_DEVICE_SIZE_ID)))
usage(popt_context, EXIT_FAILURE, _("Option --decrypt is incompat ible with specified parameters."), usage(popt_context, EXIT_FAILURE, _("Option --decrypt is incompat ible with specified parameters."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_uuid && !opt_decrypt) if (ARG_SET(OPT_UUID_ID) && !ARG_SET(OPT_DECRYPT_ID))
usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed onl y together with --decrypt."), usage(popt_context, EXIT_FAILURE, _("Option --uuid is allowed onl y together with --decrypt."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (!luksType(opt_type)) if (!luksType(ARG_STR(OPT_TYPE_ID)))
usage(popt_context, EXIT_FAILURE, _("Invalid luks type. Use one o f these: 'luks', 'luks1' or 'luks2'."), usage(popt_context, EXIT_FAILURE, _("Invalid luks type. Use one o f these: 'luks', 'luks1' or 'luks2'."),
poptGetInvocationName(popt_context)); poptGetInvocationName(popt_context));
if (opt_debug) { if (ARG_SET(OPT_DEBUG_ID)) {
opt_verbose = 1; crypt_set_debug_level(CRYPT_DEBUG_ALL);
crypt_set_debug_level(-1);
dbg_version_and_cmd(argc, argv); dbg_version_and_cmd(argc, argv);
} }
r = run_reencrypt(action_argv[0]); r = run_reencrypt(action_argv[0]);
tools_cleanup(); tools_cleanup();
poptFreeContext(popt_context); poptFreeContext(popt_context);
return translate_errno(r); return translate_errno(r);
} }
 End of changes. 88 change blocks. 
257 lines changed or deleted 189 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)