15232239991

Committed 24 May 2025 08:01PM UTC coverage: 72.053% (-0.02%) from 72.07%

Build # 15232239991

Build Type

push

github

Committed by

web-flow

Commit Message

docs: add man pages for sd_device_enumerator_[new,ref,unref,unrefp] (#37586)

For #20929.

Run Details

299160 of 415197 relevant lines covered (72.05%)

703671.29 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

85.71

/src/shared/cryptsetup-util.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <stdlib.h>

#include "sd-json.h"

#include "alloc-util.h"
#include "cryptsetup-util.h"
#include "dlfcn-util.h"
#include "log.h"
#include "parse-util.h"
#include "string-util.h"
#include "strv.h"

#if HAVE_LIBCRYPTSETUP
static void *cryptsetup_dl = NULL;

DLSYM_PROTOTYPE(crypt_activate_by_passphrase) = NULL;
#if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
DLSYM_PROTOTYPE(crypt_activate_by_signed_key) = NULL;
#endif
DLSYM_PROTOTYPE(crypt_activate_by_volume_key) = NULL;
DLSYM_PROTOTYPE(crypt_deactivate_by_name) = NULL;
DLSYM_PROTOTYPE(crypt_format) = NULL;
DLSYM_PROTOTYPE(crypt_free) = NULL;
DLSYM_PROTOTYPE(crypt_get_cipher) = NULL;
DLSYM_PROTOTYPE(crypt_get_cipher_mode) = NULL;
DLSYM_PROTOTYPE(crypt_get_data_offset) = NULL;
DLSYM_PROTOTYPE(crypt_get_device_name) = NULL;
DLSYM_PROTOTYPE(crypt_get_dir) = NULL;
DLSYM_PROTOTYPE(crypt_get_type) = NULL;
DLSYM_PROTOTYPE(crypt_get_uuid) = NULL;
DLSYM_PROTOTYPE(crypt_get_verity_info) = NULL;
DLSYM_PROTOTYPE(crypt_get_volume_key_size) = NULL;
DLSYM_PROTOTYPE(crypt_init) = NULL;
DLSYM_PROTOTYPE(crypt_init_by_name) = NULL;
DLSYM_PROTOTYPE(crypt_keyslot_add_by_volume_key) = NULL;
DLSYM_PROTOTYPE(crypt_keyslot_destroy) = NULL;
DLSYM_PROTOTYPE(crypt_keyslot_max) = NULL;
DLSYM_PROTOTYPE(crypt_load) = NULL;
DLSYM_PROTOTYPE(crypt_resize) = NULL;
#if HAVE_CRYPT_RESUME_BY_VOLUME_KEY
DLSYM_PROTOTYPE(crypt_resume_by_volume_key) = NULL;
#endif
DLSYM_PROTOTYPE(crypt_set_data_device) = NULL;
DLSYM_PROTOTYPE(crypt_set_debug_level) = NULL;
DLSYM_PROTOTYPE(crypt_set_log_callback) = NULL;
#if HAVE_CRYPT_SET_METADATA_SIZE
DLSYM_PROTOTYPE(crypt_set_metadata_size) = NULL;
#endif
DLSYM_PROTOTYPE(crypt_set_pbkdf_type) = NULL;
DLSYM_PROTOTYPE(crypt_suspend) = NULL;
DLSYM_PROTOTYPE(crypt_token_json_get) = NULL;
DLSYM_PROTOTYPE(crypt_token_json_set) = NULL;
#if HAVE_CRYPT_TOKEN_MAX
DLSYM_PROTOTYPE(crypt_token_max) = NULL;
#endif
#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
DLSYM_PROTOTYPE(crypt_token_set_external_path) = NULL;
#endif
DLSYM_PROTOTYPE(crypt_token_status) = NULL;
DLSYM_PROTOTYPE(crypt_volume_key_get) = NULL;
#if HAVE_CRYPT_REENCRYPT_INIT_BY_PASSPHRASE
DLSYM_PROTOTYPE(crypt_reencrypt_init_by_passphrase) = NULL;
#endif
#if HAVE_CRYPT_REENCRYPT_RUN
DLSYM_PROTOTYPE(crypt_reencrypt_run);
#elif HAVE_CRYPT_REENCRYPT
DLSYM_PROTOTYPE(crypt_reencrypt);
#endif
DLSYM_PROTOTYPE(crypt_metadata_locking) = NULL;
#if HAVE_CRYPT_SET_DATA_OFFSET
DLSYM_PROTOTYPE(crypt_set_data_offset) = NULL;
#endif
DLSYM_PROTOTYPE(crypt_header_restore) = NULL;
DLSYM_PROTOTYPE(crypt_volume_key_keyring) = NULL;

static void cryptsetup_log_glue(int level, const char *msg, void *usrptr) {

        switch (level) {
        case CRYPT_LOG_NORMAL:
                level = LOG_NOTICE;
                break;
        case CRYPT_LOG_ERROR:
                level = LOG_ERR;
                break;
        case CRYPT_LOG_VERBOSE:
                level = LOG_INFO;
                break;
        case CRYPT_LOG_DEBUG:
                level = LOG_DEBUG;
                break;
        default:
                log_error("Unknown libcryptsetup log level: %d", level);
                level = LOG_ERR;
        }

        log_full(level, "%s", msg);
}

void cryptsetup_enable_logging(struct crypt_device *cd) {
        /* It's OK to call this with a NULL parameter, in which case libcryptsetup will set the default log
         * function.
         *
         * Note that this is also called from dlopen_cryptsetup(), which we call here too. Sounds like an
         * endless loop, but isn't because we break it via the check for 'cryptsetup_dl' early in
         * dlopen_cryptsetup(). */

        if (dlopen_cryptsetup() < 0)
                return; /* If this fails, let's gracefully ignore the issue, this is just debug logging after
                         * all, and if this failed we already generated a debug log message that should help
                         * to track things down. */

        sym_crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
        sym_crypt_set_debug_level(DEBUG_LOGGING ? CRYPT_DEBUG_ALL : CRYPT_DEBUG_NONE);
}

int cryptsetup_set_minimal_pbkdf(struct crypt_device *cd) {

        /* With CRYPT_PBKDF_NO_BENCHMARK flag set .time_ms member is ignored
         * while .iterations must be set at least to recommended minimum value. */

        static const struct crypt_pbkdf_type minimal_pbkdf = {
                .hash = "sha512",
                .type = CRYPT_KDF_PBKDF2,
                .iterations = 1000, /* recommended minimum count for pbkdf2
                                     * according to NIST SP 800-132, ch. 5.2 */
                .flags = CRYPT_PBKDF_NO_BENCHMARK
        };

        int r;

        /* Sets a minimal PKBDF in case we already have a high entropy key. */

        r = dlopen_cryptsetup();
        if (r < 0)
                return r;

        r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
        if (r < 0)
                return r;

        return 0;
}

int cryptsetup_get_token_as_json(
                struct crypt_device *cd,
                int idx,
                const char *verify_type,
                sd_json_variant **ret) {

        _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
        const char *text;
        int r;

        assert(cd);

        /* Extracts and parses the LUKS2 JSON token data from a LUKS2 device. Optionally verifies the type of
         * the token. Returns:
         *
         *      -EINVAL → token index out of range or "type" field missing
         *      -ENOENT → token doesn't exist
         * -EMEDIUMTYPE → "verify_type" specified and doesn't match token's type
         */

        r = dlopen_cryptsetup();
        if (r < 0)
                return r;

        r = sym_crypt_token_json_get(cd, idx, &text);
        if (r < 0)
                return r;

        r = sd_json_parse(text, 0, &v, NULL, NULL);
        if (r < 0)
                return r;

        if (verify_type) {
                sd_json_variant *w;

                w = sd_json_variant_by_key(v, "type");
                if (!w)
                        return -EINVAL;

                if (!streq_ptr(sd_json_variant_string(w), verify_type))
                        return -EMEDIUMTYPE;
        }

        if (ret)
                *ret = TAKE_PTR(v);

        return 0;
}

int cryptsetup_add_token_json(struct crypt_device *cd, sd_json_variant *v) {
        _cleanup_free_ char *text = NULL;
        int r;

        r = dlopen_cryptsetup();
        if (r < 0)
                return r;

        r = sd_json_variant_format(v, 0, &text);
        if (r < 0)
                return log_debug_errno(r, "Failed to format token data for LUKS: %m");

        log_debug("Adding token text <%s>", text);

        r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
        if (r < 0)
                return log_debug_errno(r, "Failed to write token data to LUKS: %m");

        return 0;
}
#endif

int dlopen_cryptsetup(void) {
#if HAVE_LIBCRYPTSETUP
        int r;

        /* libcryptsetup added crypt_reencrypt() in 2.2.0, and marked it obsolete in 2.4.0, replacing it with
         * crypt_reencrypt_run(), which takes one extra argument but is otherwise identical. The old call is
         * still available though, and given we want to support 2.2.0 for a while longer, we'll use the old
         * symbol if the new one is not available. */

        ELF_NOTE_DLOPEN("cryptsetup",
                        "Support for disk encryption, integrity, and authentication",
                        ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED,
                        "libcryptsetup.so.12");

        r = dlopen_many_sym_or_warn(
                        &cryptsetup_dl, "libcryptsetup.so.12", LOG_DEBUG,
                        DLSYM_ARG(crypt_activate_by_passphrase),
#if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
                        DLSYM_ARG(crypt_activate_by_signed_key),
#endif
                        DLSYM_ARG(crypt_activate_by_volume_key),
                        DLSYM_ARG(crypt_deactivate_by_name),
                        DLSYM_ARG(crypt_format),
                        DLSYM_ARG(crypt_free),
                        DLSYM_ARG(crypt_get_cipher),
                        DLSYM_ARG(crypt_get_cipher_mode),
                        DLSYM_ARG(crypt_get_data_offset),
                        DLSYM_ARG(crypt_get_device_name),
                        DLSYM_ARG(crypt_get_dir),
                        DLSYM_ARG(crypt_get_type),
                        DLSYM_ARG(crypt_get_uuid),
                        DLSYM_ARG(crypt_get_verity_info),
                        DLSYM_ARG(crypt_get_volume_key_size),
                        DLSYM_ARG(crypt_init),
                        DLSYM_ARG(crypt_init_by_name),
                        DLSYM_ARG(crypt_keyslot_add_by_volume_key),
                        DLSYM_ARG(crypt_keyslot_destroy),
                        DLSYM_ARG(crypt_keyslot_max),
                        DLSYM_ARG(crypt_load),
                        DLSYM_ARG(crypt_resize),
#if HAVE_CRYPT_RESUME_BY_VOLUME_KEY
                        DLSYM_ARG(crypt_resume_by_volume_key),
#endif
                        DLSYM_ARG(crypt_set_data_device),
                        DLSYM_ARG(crypt_set_debug_level),
                        DLSYM_ARG(crypt_set_log_callback),
#if HAVE_CRYPT_SET_METADATA_SIZE
                        DLSYM_ARG(crypt_set_metadata_size),
#endif
                        DLSYM_ARG(crypt_set_pbkdf_type),
                        DLSYM_ARG(crypt_suspend),
                        DLSYM_ARG(crypt_token_json_get),
                        DLSYM_ARG(crypt_token_json_set),
#if HAVE_CRYPT_TOKEN_MAX
                        DLSYM_ARG(crypt_token_max),
#endif
#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
                        DLSYM_ARG(crypt_token_set_external_path),
#endif
                        DLSYM_ARG(crypt_token_status),
                        DLSYM_ARG(crypt_volume_key_get),
#if HAVE_CRYPT_REENCRYPT_INIT_BY_PASSPHRASE
                        DLSYM_ARG(crypt_reencrypt_init_by_passphrase),
#endif
#if HAVE_CRYPT_REENCRYPT_RUN
                        DLSYM_ARG(crypt_reencrypt_run),
#elif HAVE_CRYPT_REENCRYPT
                        DLSYM_ARG(crypt_reencrypt),
#endif
                        DLSYM_ARG(crypt_metadata_locking),
#if HAVE_CRYPT_SET_DATA_OFFSET
                        DLSYM_ARG(crypt_set_data_offset),
#endif
                        DLSYM_ARG(crypt_header_restore),
                        DLSYM_ARG(crypt_volume_key_keyring));
        if (r <= 0)
                return r;

        /* Redirect the default logging calls of libcryptsetup to our own logging infra. (Note that
         * libcryptsetup also maintains per-"struct crypt_device" log functions, which we'll also set
         * whenever allocating a "struct crypt_device" context. Why set both? To be defensive: maybe some
         * other code loaded into this process also changes the global log functions of libcryptsetup, who
         * knows? And if so, we still want our own objects to log via our own infra, at the very least.) */
        cryptsetup_enable_logging(NULL);

        const char *e = secure_getenv("SYSTEMD_CRYPTSETUP_TOKEN_PATH");
        if (e) {
#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
                r = sym_crypt_token_set_external_path(e);
                if (r < 0)
                        log_debug_errno(r, "Failed to set the libcryptsetup external token path to '%s', ignoring: %m", e);
#else
                log_debug("libcryptsetup version does not support setting the external token path, not setting it to '%s'.", e);
#endif
        }

        return 1;
#else
        return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "cryptsetup support is not compiled in.");
#endif
}

int cryptsetup_get_keyslot_from_token(sd_json_variant *v) {
        int keyslot, r;
        sd_json_variant *w;

        /* Parses the "keyslots" field of a LUKS2 token object. The field can be an array, but here we assume
         * that it contains a single element only, since that's the only way we ever generate it
         * ourselves. */

        w = sd_json_variant_by_key(v, "keyslots");
        if (!w)
                return -ENOENT;
        if (!sd_json_variant_is_array(w) || sd_json_variant_elements(w) != 1)
                return -EMEDIUMTYPE;

        w = sd_json_variant_by_index(w, 0);
        if (!w)
                return -ENOENT;
        if (!sd_json_variant_is_string(w))
                return -EMEDIUMTYPE;

        r = safe_atoi(sd_json_variant_string(w), &keyslot);
        if (r < 0)
                return r;
        if (keyslot < 0)
                return -EINVAL;

        return keyslot;
}

const char* mangle_none(const char *s) {
        /* A helper that turns cryptsetup/integritysetup/veritysetup "options" strings into NULL if they are effectively empty */
        return isempty(s) || STR_IN_SET(s, "-", "none") ? NULL : s;
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <stdlib.h>
4
5	#include "sd-json.h"
6
7	#include "alloc-util.h"
8	#include "cryptsetup-util.h"
9	#include "dlfcn-util.h"
10	#include "log.h"
11	#include "parse-util.h"
12	#include "string-util.h"
13	#include "strv.h"
14
15	#if HAVE_LIBCRYPTSETUP
16	static void *cryptsetup_dl = NULL;
17
18	DLSYM_PROTOTYPE(crypt_activate_by_passphrase) = NULL;
19	#if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
20	DLSYM_PROTOTYPE(crypt_activate_by_signed_key) = NULL;
21	#endif
22	DLSYM_PROTOTYPE(crypt_activate_by_volume_key) = NULL;
23	DLSYM_PROTOTYPE(crypt_deactivate_by_name) = NULL;
24	DLSYM_PROTOTYPE(crypt_format) = NULL;
25	DLSYM_PROTOTYPE(crypt_free) = NULL;
26	DLSYM_PROTOTYPE(crypt_get_cipher) = NULL;
27	DLSYM_PROTOTYPE(crypt_get_cipher_mode) = NULL;
28	DLSYM_PROTOTYPE(crypt_get_data_offset) = NULL;
29	DLSYM_PROTOTYPE(crypt_get_device_name) = NULL;
30	DLSYM_PROTOTYPE(crypt_get_dir) = NULL;
31	DLSYM_PROTOTYPE(crypt_get_type) = NULL;
32	DLSYM_PROTOTYPE(crypt_get_uuid) = NULL;
33	DLSYM_PROTOTYPE(crypt_get_verity_info) = NULL;
34	DLSYM_PROTOTYPE(crypt_get_volume_key_size) = NULL;
35	DLSYM_PROTOTYPE(crypt_init) = NULL;
36	DLSYM_PROTOTYPE(crypt_init_by_name) = NULL;
37	DLSYM_PROTOTYPE(crypt_keyslot_add_by_volume_key) = NULL;
38	DLSYM_PROTOTYPE(crypt_keyslot_destroy) = NULL;
39	DLSYM_PROTOTYPE(crypt_keyslot_max) = NULL;
40	DLSYM_PROTOTYPE(crypt_load) = NULL;
41	DLSYM_PROTOTYPE(crypt_resize) = NULL;
42	#if HAVE_CRYPT_RESUME_BY_VOLUME_KEY
43	DLSYM_PROTOTYPE(crypt_resume_by_volume_key) = NULL;
44	#endif
45	DLSYM_PROTOTYPE(crypt_set_data_device) = NULL;
46	DLSYM_PROTOTYPE(crypt_set_debug_level) = NULL;
47	DLSYM_PROTOTYPE(crypt_set_log_callback) = NULL;
48	#if HAVE_CRYPT_SET_METADATA_SIZE
49	DLSYM_PROTOTYPE(crypt_set_metadata_size) = NULL;
50	#endif
51	DLSYM_PROTOTYPE(crypt_set_pbkdf_type) = NULL;
52	DLSYM_PROTOTYPE(crypt_suspend) = NULL;
53	DLSYM_PROTOTYPE(crypt_token_json_get) = NULL;
54	DLSYM_PROTOTYPE(crypt_token_json_set) = NULL;
55	#if HAVE_CRYPT_TOKEN_MAX
56	DLSYM_PROTOTYPE(crypt_token_max) = NULL;
57	#endif
58	#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
59	DLSYM_PROTOTYPE(crypt_token_set_external_path) = NULL;
60	#endif
61	DLSYM_PROTOTYPE(crypt_token_status) = NULL;
62	DLSYM_PROTOTYPE(crypt_volume_key_get) = NULL;
63	#if HAVE_CRYPT_REENCRYPT_INIT_BY_PASSPHRASE
64	DLSYM_PROTOTYPE(crypt_reencrypt_init_by_passphrase) = NULL;
65	#endif
66	#if HAVE_CRYPT_REENCRYPT_RUN
67	DLSYM_PROTOTYPE(crypt_reencrypt_run);
68	#elif HAVE_CRYPT_REENCRYPT
69	DLSYM_PROTOTYPE(crypt_reencrypt);
70	#endif
71	DLSYM_PROTOTYPE(crypt_metadata_locking) = NULL;
72	#if HAVE_CRYPT_SET_DATA_OFFSET
73	DLSYM_PROTOTYPE(crypt_set_data_offset) = NULL;
74	#endif
75	DLSYM_PROTOTYPE(crypt_header_restore) = NULL;
76	DLSYM_PROTOTYPE(crypt_volume_key_keyring) = NULL;
77
78	static void cryptsetup_log_glue(int level, const char msg, void usrptr) {	29,070✔
79
80	switch (level) {	29,070✔
81	case CRYPT_LOG_NORMAL:
82	level = LOG_NOTICE;
83	break;
84	case CRYPT_LOG_ERROR:	38✔
85	level = LOG_ERR;	38✔
86	break;	38✔
87	case CRYPT_LOG_VERBOSE:	×
88	level = LOG_INFO;	×
89	break;	×
90	case CRYPT_LOG_DEBUG:	29,032✔
91	level = LOG_DEBUG;	29,032✔
92	break;	29,032✔
93	default:
94	log_error("Unknown libcryptsetup log level: %d", level);	×
95	level = LOG_ERR;
96	}
97
98	log_full(level, "%s", msg);	29,070✔
99	}	29,070✔
100
101	void cryptsetup_enable_logging(struct crypt_device *cd) {	1,227✔
102	/* It's OK to call this with a NULL parameter, in which case libcryptsetup will set the default log
103	* function.
104	*
105	* Note that this is also called from dlopen_cryptsetup(), which we call here too. Sounds like an
106	* endless loop, but isn't because we break it via the check for 'cryptsetup_dl' early in
107	* dlopen_cryptsetup(). */
108
109	if (dlopen_cryptsetup() < 0)	1,227✔
110	return; /* If this fails, let's gracefully ignore the issue, this is just debug logging after
111	* all, and if this failed we already generated a debug log message that should help
112	* to track things down. */
113
114	sym_crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);	1,227✔
115	sym_crypt_set_debug_level(DEBUG_LOGGING ? CRYPT_DEBUG_ALL : CRYPT_DEBUG_NONE);	1,248✔
116	}
117
118	int cryptsetup_set_minimal_pbkdf(struct crypt_device *cd) {	45✔
119
120	/* With CRYPT_PBKDF_NO_BENCHMARK flag set .time_ms member is ignored
121	* while .iterations must be set at least to recommended minimum value. */
122
123	static const struct crypt_pbkdf_type minimal_pbkdf = {	45✔
124	.hash = "sha512",
125	.type = CRYPT_KDF_PBKDF2,
126	.iterations = 1000, /* recommended minimum count for pbkdf2
127	* according to NIST SP 800-132, ch. 5.2 */
128	.flags = CRYPT_PBKDF_NO_BENCHMARK
129	};
130
131	int r;	45✔
132
133	/* Sets a minimal PKBDF in case we already have a high entropy key. */
134
135	r = dlopen_cryptsetup();	45✔
136	if (r < 0)	45✔
137	return r;
138
139	r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);	45✔
140	if (r < 0)	45✔
141	return r;	×
142
143	return 0;
144	}
145
146	int cryptsetup_get_token_as_json(	5,621✔
147	struct crypt_device *cd,
148	int idx,
149	const char *verify_type,
150	sd_json_variant **ret) {
151
152	_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;	5,621✔
153	const char *text;	5,621✔
154	int r;	5,621✔
155
156	assert(cd);	5,621✔
157
158	/* Extracts and parses the LUKS2 JSON token data from a LUKS2 device. Optionally verifies the type of
159	* the token. Returns:
160	*
161	* -EINVAL → token index out of range or "type" field missing
162	* -ENOENT → token doesn't exist
163	* -EMEDIUMTYPE → "verify_type" specified and doesn't match token's type
164	*/
165
166	r = dlopen_cryptsetup();	5,621✔
167	if (r < 0)	5,621✔
168	return r;
169
170	r = sym_crypt_token_json_get(cd, idx, &text);	5,621✔
171	if (r < 0)	5,621✔
172	return r;
173
174	r = sd_json_parse(text, 0, &v, NULL, NULL);	403✔
175	if (r < 0)	403✔
176	return r;
177
178	if (verify_type) {	403✔
179	sd_json_variant *w;	240✔
180
181	w = sd_json_variant_by_key(v, "type");	240✔
182	if (!w)	240✔
183	return -EINVAL;
184
185	if (!streq_ptr(sd_json_variant_string(w), verify_type))	240✔
186	return -EMEDIUMTYPE;
187	}
188
189	if (ret)	179✔
190	*ret = TAKE_PTR(v);	179✔
191
192	return 0;
193	}
194
195	int cryptsetup_add_token_json(struct crypt_device cd, sd_json_variant v) {	45✔
196	_cleanup_free_ char *text = NULL;	45✔
197	int r;	45✔
198
199	r = dlopen_cryptsetup();	45✔
200	if (r < 0)	45✔
201	return r;
202
203	r = sd_json_variant_format(v, 0, &text);	45✔
204	if (r < 0)	45✔
205	return log_debug_errno(r, "Failed to format token data for LUKS: %m");	×
206
207	log_debug("Adding token text <%s>", text);	45✔
208
209	r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);	45✔
210	if (r < 0)	45✔
211	return log_debug_errno(r, "Failed to write token data to LUKS: %m");	×
212
213	return 0;
214	}
215	#endif
216
217	int dlopen_cryptsetup(void) {	7,100✔
218	#if HAVE_LIBCRYPTSETUP
219	int r;	7,100✔
220
221	/* libcryptsetup added crypt_reencrypt() in 2.2.0, and marked it obsolete in 2.4.0, replacing it with
222	* crypt_reencrypt_run(), which takes one extra argument but is otherwise identical. The old call is
223	* still available though, and given we want to support 2.2.0 for a while longer, we'll use the old
224	* symbol if the new one is not available. */
225
226	ELF_NOTE_DLOPEN("cryptsetup",	7,100✔
227	"Support for disk encryption, integrity, and authentication",
228	ELF_NOTE_DLOPEN_PRIORITY_SUGGESTED,
229	"libcryptsetup.so.12");
230
231	r = dlopen_many_sym_or_warn(	7,100✔
232	&cryptsetup_dl, "libcryptsetup.so.12", LOG_DEBUG,
233	DLSYM_ARG(crypt_activate_by_passphrase),
234	#if HAVE_CRYPT_ACTIVATE_BY_SIGNED_KEY
235	DLSYM_ARG(crypt_activate_by_signed_key),
236	#endif
237	DLSYM_ARG(crypt_activate_by_volume_key),
238	DLSYM_ARG(crypt_deactivate_by_name),
239	DLSYM_ARG(crypt_format),
240	DLSYM_ARG(crypt_free),
241	DLSYM_ARG(crypt_get_cipher),
242	DLSYM_ARG(crypt_get_cipher_mode),
243	DLSYM_ARG(crypt_get_data_offset),
244	DLSYM_ARG(crypt_get_device_name),
245	DLSYM_ARG(crypt_get_dir),
246	DLSYM_ARG(crypt_get_type),
247	DLSYM_ARG(crypt_get_uuid),
248	DLSYM_ARG(crypt_get_verity_info),
249	DLSYM_ARG(crypt_get_volume_key_size),
250	DLSYM_ARG(crypt_init),
251	DLSYM_ARG(crypt_init_by_name),
252	DLSYM_ARG(crypt_keyslot_add_by_volume_key),
253	DLSYM_ARG(crypt_keyslot_destroy),
254	DLSYM_ARG(crypt_keyslot_max),
255	DLSYM_ARG(crypt_load),
256	DLSYM_ARG(crypt_resize),
257	#if HAVE_CRYPT_RESUME_BY_VOLUME_KEY
258	DLSYM_ARG(crypt_resume_by_volume_key),
259	#endif
260	DLSYM_ARG(crypt_set_data_device),
261	DLSYM_ARG(crypt_set_debug_level),
262	DLSYM_ARG(crypt_set_log_callback),
263	#if HAVE_CRYPT_SET_METADATA_SIZE
264	DLSYM_ARG(crypt_set_metadata_size),
265	#endif
266	DLSYM_ARG(crypt_set_pbkdf_type),
267	DLSYM_ARG(crypt_suspend),
268	DLSYM_ARG(crypt_token_json_get),
269	DLSYM_ARG(crypt_token_json_set),
270	#if HAVE_CRYPT_TOKEN_MAX
271	DLSYM_ARG(crypt_token_max),
272	#endif
273	#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
274	DLSYM_ARG(crypt_token_set_external_path),
275	#endif
276	DLSYM_ARG(crypt_token_status),
277	DLSYM_ARG(crypt_volume_key_get),
278	#if HAVE_CRYPT_REENCRYPT_INIT_BY_PASSPHRASE
279	DLSYM_ARG(crypt_reencrypt_init_by_passphrase),
280	#endif
281	#if HAVE_CRYPT_REENCRYPT_RUN
282	DLSYM_ARG(crypt_reencrypt_run),
283	#elif HAVE_CRYPT_REENCRYPT
284	DLSYM_ARG(crypt_reencrypt),
285	#endif
286	DLSYM_ARG(crypt_metadata_locking),
287	#if HAVE_CRYPT_SET_DATA_OFFSET
288	DLSYM_ARG(crypt_set_data_offset),
289	#endif
290	DLSYM_ARG(crypt_header_restore),
291	DLSYM_ARG(crypt_volume_key_keyring));
292	if (r <= 0)	7,100✔
293	return r;
294
295	/* Redirect the default logging calls of libcryptsetup to our own logging infra. (Note that
296	* libcryptsetup also maintains per-"struct crypt_device" log functions, which we'll also set
297	* whenever allocating a "struct crypt_device" context. Why set both? To be defensive: maybe some
298	* other code loaded into this process also changes the global log functions of libcryptsetup, who
299	* knows? And if so, we still want our own objects to log via our own infra, at the very least.) */
300	cryptsetup_enable_logging(NULL);	477✔
301
302	const char *e = secure_getenv("SYSTEMD_CRYPTSETUP_TOKEN_PATH");	477✔
303	if (e) {	477✔
304	#if HAVE_CRYPT_TOKEN_SET_EXTERNAL_PATH
305	r = sym_crypt_token_set_external_path(e);	×
306	if (r < 0)	×
307	log_debug_errno(r, "Failed to set the libcryptsetup external token path to '%s', ignoring: %m", e);	×
308	#else
309	log_debug("libcryptsetup version does not support setting the external token path, not setting it to '%s'.", e);
310	#endif
311	}
312
313	return 1;
314	#else
315	return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "cryptsetup support is not compiled in.");
316	#endif
317	}
318
319	int cryptsetup_get_keyslot_from_token(sd_json_variant *v) {	16✔
320	int keyslot, r;	16✔
321	sd_json_variant *w;	16✔
322
323	/* Parses the "keyslots" field of a LUKS2 token object. The field can be an array, but here we assume
324	* that it contains a single element only, since that's the only way we ever generate it
325	* ourselves. */
326
327	w = sd_json_variant_by_key(v, "keyslots");	16✔
328	if (!w)	16✔
329	return -ENOENT;	16✔
330	if (!sd_json_variant_is_array(w) \|\| sd_json_variant_elements(w) != 1)	16✔
331	return -EMEDIUMTYPE;	×
332
333	w = sd_json_variant_by_index(w, 0);	16✔
334	if (!w)	16✔
335	return -ENOENT;
336	if (!sd_json_variant_is_string(w))	16✔
337	return -EMEDIUMTYPE;
338
339	r = safe_atoi(sd_json_variant_string(w), &keyslot);	16✔
340	if (r < 0)	16✔
341	return r;
342	if (keyslot < 0)	16✔
343	return -EINVAL;	×
344
345	return keyslot;
346	}
347
348	const char* mangle_none(const char *s) {	192✔
349	/* A helper that turns cryptsetup/integritysetup/veritysetup "options" strings into NULL if they are effectively empty */
350	return isempty(s) \|\| STR_IN_SET(s, "-", "none") ? NULL : s;	384✔
351	}

systemd / systemd / 15232239991

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous