X-Git-Url: http://git.annexia.org/?p=libguestfs.git;a=blobdiff_plain;f=daemon%2Fluks.c;h=0b59b5ac74a252ca7f01b6dbd5ba698d9c3964f3;hp=f5a0b9dc98ccd54a529bcf59960b5df7be4ad4a6;hb=428a45c3e15f03e9861e1b551e1ae8da821dba5f;hpb=637f8df83726ab9b50e8a6d2181bd1e0e93ec13e;ds=sidebyside

diff --git a/daemon/luks.c b/daemon/luks.c
index f5a0b9d..0b59b5a 100644
--- a/daemon/luks.c
+++ b/daemon/luks.c
@@ -23,7 +23,6 @@
 #include <string.h>
 
 #include "daemon.h"
-#include "c-ctype.h"
 #include "actions.h"
 #include "optgroups.h"
 
@@ -33,43 +32,69 @@ optgroup_luks_available (void)
   return prog_exists ("cryptsetup");
 }
 
-static int
-luks_open (const char *device, const char *key, const char *mapname,
-           int readonly)
+/* Callers must also call remove_temp (tempfile). */
+static char *
+write_key_to_temp (const char *key)
 {
-  /* Sanity check: /dev/mapper/mapname must not exist already.  Note
-   * that the device-mapper control device (/dev/mapper/control) is
-   * always there, so you can't ever have mapname == "control".
-   */
-  size_t len = strlen (mapname);
-  char devmapper[len+32];
-  snprintf (devmapper, len+32, "/dev/mapper/%s", mapname);
-  if (access (devmapper, F_OK) == 0) {
-    reply_with_error ("%s: device already exists", devmapper);
-    return -1;
+  char *tempfile = strdup ("/tmp/luksXXXXXX");
+  if (!tempfile) {
+    reply_with_perror ("strdup");
+    return NULL;
   }
 
-  char tempfile[] = "/tmp/luksXXXXXX";
   int fd = mkstemp (tempfile);
   if (fd == -1) {
     reply_with_perror ("mkstemp");
-    return -1;
+    goto error;
   }
 
-  len = strlen (key);
+  size_t len = strlen (key);
   if (xwrite (fd, key, len) == -1) {
     reply_with_perror ("write");
     close (fd);
-    unlink (tempfile);
-    return -1;
+    goto error;
   }
 
   if (close (fd) == -1) {
     reply_with_perror ("close");
-    unlink (tempfile);
+    goto error;
+  }
+
+  return tempfile;
+
+ error:
+  unlink (tempfile);
+  free (tempfile);
+  return NULL;
+}
+
+static void
+remove_temp (char *tempfile)
+{
+  unlink (tempfile);
+  free (tempfile);
+}
+
+static int
+luks_open (const char *device, const char *key, const char *mapname,
+           int readonly)
+{
+  /* Sanity check: /dev/mapper/mapname must not exist already.  Note
+   * that the device-mapper control device (/dev/mapper/control) is
+   * always there, so you can't ever have mapname == "control".
+   */
+  size_t len = strlen (mapname);
+  char devmapper[len+32];
+  snprintf (devmapper, len+32, "/dev/mapper/%s", mapname);
+  if (access (devmapper, F_OK) == 0) {
+    reply_with_error ("%s: device already exists", devmapper);
     return -1;
   }
 
+  char *tempfile = write_key_to_temp (key);
+  if (!tempfile)
+    return -1;
+
   const char *argv[16];
   size_t i = 0;
 
@@ -84,7 +109,7 @@ luks_open (const char *device, const char *key, const char *mapname,
 
   char *err;
   int r = commandv (NULL, &err, (const char * const *) argv);
-  unlink (tempfile);
+  remove_temp (tempfile);
 
   if (r == -1) {
     reply_with_error ("%s", err);
@@ -136,3 +161,141 @@ do_luks_close (const char *device)
 
   return 0;
 }
+
+static int
+luks_format (const char *device, const char *key, int keyslot,
+             const char *cipher)
+{
+  char *tempfile = write_key_to_temp (key);
+  if (!tempfile)
+    return -1;
+
+  const char *argv[16];
+  char keyslot_s[16];
+  size_t i = 0;
+
+  argv[i++] = "cryptsetup";
+  argv[i++] = "-q";
+  if (cipher) {
+    argv[i++] = "--cipher";
+    argv[i++] = cipher;
+  }
+  argv[i++] = "--key-slot";
+  snprintf (keyslot_s, sizeof keyslot_s, "%d", keyslot);
+  argv[i++] = keyslot_s;
+  argv[i++] = "luksFormat";
+  argv[i++] = device;
+  argv[i++] = tempfile;
+  argv[i++] = NULL;
+
+  char *err;
+  int r = commandv (NULL, &err, (const char * const *) argv);
+  remove_temp (tempfile);
+
+  if (r == -1) {
+    reply_with_error ("%s", err);
+    free (err);
+    return -1;
+  }
+
+  free (err);
+
+  udev_settle ();
+
+  return 0;
+}
+
+int
+do_luks_format (const char *device, const char *key, int keyslot)
+{
+  return luks_format (device, key, keyslot, NULL);
+}
+
+int
+do_luks_format_cipher (const char *device, const char *key, int keyslot,
+                       const char *cipher)
+{
+  return luks_format (device, key, keyslot, cipher);
+}
+
+int
+do_luks_add_key (const char *device, const char *key, const char *newkey,
+                 int keyslot)
+{
+  char *keyfile = write_key_to_temp (key);
+  if (!keyfile)
+    return -1;
+
+  char *newkeyfile = write_key_to_temp (newkey);
+  if (!newkeyfile) {
+    remove_temp (keyfile);
+    return -1;
+  }
+
+  const char *argv[16];
+  char keyslot_s[16];
+  size_t i = 0;
+
+  argv[i++] = "cryptsetup";
+  argv[i++] = "-q";
+  argv[i++] = "-d";
+  argv[i++] = keyfile;
+  argv[i++] = "--key-slot";
+  snprintf (keyslot_s, sizeof keyslot_s, "%d", keyslot);
+  argv[i++] = keyslot_s;
+  argv[i++] = "luksAddKey";
+  argv[i++] = device;
+  argv[i++] = newkeyfile;
+  argv[i++] = NULL;
+
+  char *err;
+  int r = commandv (NULL, &err, (const char * const *) argv);
+  remove_temp (keyfile);
+  remove_temp (newkeyfile);
+
+  if (r == -1) {
+    reply_with_error ("%s", err);
+    free (err);
+    return -1;
+  }
+
+  free (err);
+
+  return 0;
+}
+
+int
+do_luks_kill_slot (const char *device, const char *key, int keyslot)
+{
+  char *tempfile = write_key_to_temp (key);
+  if (!tempfile)
+    return -1;
+
+  const char *argv[16];
+  char keyslot_s[16];
+  size_t i = 0;
+
+  argv[i++] = "cryptsetup";
+  argv[i++] = "-q";
+  argv[i++] = "-d";
+  argv[i++] = tempfile;
+  argv[i++] = "luksKillSlot";
+  argv[i++] = device;
+  snprintf (keyslot_s, sizeof keyslot_s, "%d", keyslot);
+  argv[i++] = keyslot_s;
+  argv[i++] = NULL;
+
+  char *err;
+  int r = commandv (NULL, &err, (const char * const *) argv);
+  remove_temp (tempfile);
+
+  if (r == -1) {
+    reply_with_error ("%s", err);
+    free (err);
+    return -1;
+  }
+
+  free (err);
+
+  return 0;
+}