1e4b0a90eSBrooks Davis /*- 2e4b0a90eSBrooks Davis * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3e4b0a90eSBrooks Davis * 4e4b0a90eSBrooks Davis * Copyright (c) 2004-2010 Pawel Jakub Dawidek <pjd@FreeBSD.org> 5e4b0a90eSBrooks Davis * All rights reserved. 6e4b0a90eSBrooks Davis * 7e4b0a90eSBrooks Davis * Redistribution and use in source and binary forms, with or without 8e4b0a90eSBrooks Davis * modification, are permitted provided that the following conditions 9e4b0a90eSBrooks Davis * are met: 10e4b0a90eSBrooks Davis * 1. Redistributions of source code must retain the above copyright 11e4b0a90eSBrooks Davis * notice, this list of conditions and the following disclaimer. 12e4b0a90eSBrooks Davis * 2. Redistributions in binary form must reproduce the above copyright 13e4b0a90eSBrooks Davis * notice, this list of conditions and the following disclaimer in the 14e4b0a90eSBrooks Davis * documentation and/or other materials provided with the distribution. 15e4b0a90eSBrooks Davis * 16e4b0a90eSBrooks Davis * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 17e4b0a90eSBrooks Davis * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18e4b0a90eSBrooks Davis * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19e4b0a90eSBrooks Davis * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 20e4b0a90eSBrooks Davis * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21e4b0a90eSBrooks Davis * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22e4b0a90eSBrooks Davis * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23e4b0a90eSBrooks Davis * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24e4b0a90eSBrooks Davis * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25e4b0a90eSBrooks Davis * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26e4b0a90eSBrooks Davis * SUCH DAMAGE. 27e4b0a90eSBrooks Davis */ 28e4b0a90eSBrooks Davis 29e4b0a90eSBrooks Davis #include <sys/cdefs.h> 30e4b0a90eSBrooks Davis __FBSDID("$FreeBSD$"); 31e4b0a90eSBrooks Davis 32e4b0a90eSBrooks Davis #include <sys/param.h> 33e4b0a90eSBrooks Davis #include <sys/mman.h> 34e4b0a90eSBrooks Davis #include <sys/sysctl.h> 35e4b0a90eSBrooks Davis #include <sys/resource.h> 36e4b0a90eSBrooks Davis #include <opencrypto/cryptodev.h> 37e4b0a90eSBrooks Davis 38e4b0a90eSBrooks Davis #include <assert.h> 39e4b0a90eSBrooks Davis #include <err.h> 40e4b0a90eSBrooks Davis #include <errno.h> 41e4b0a90eSBrooks Davis #include <fcntl.h> 42e4b0a90eSBrooks Davis #include <libgeom.h> 43e4b0a90eSBrooks Davis #include <paths.h> 44e4b0a90eSBrooks Davis #include <readpassphrase.h> 45e4b0a90eSBrooks Davis #include <stdbool.h> 46e4b0a90eSBrooks Davis #include <stdint.h> 47e4b0a90eSBrooks Davis #include <stdio.h> 48e4b0a90eSBrooks Davis #include <stdlib.h> 49e4b0a90eSBrooks Davis #include <string.h> 50e4b0a90eSBrooks Davis #include <strings.h> 51e4b0a90eSBrooks Davis #include <unistd.h> 52e4b0a90eSBrooks Davis 53e4b0a90eSBrooks Davis #include <geom/eli/g_eli.h> 54e4b0a90eSBrooks Davis #include <geom/eli/pkcs5v2.h> 55e4b0a90eSBrooks Davis 56e4b0a90eSBrooks Davis #include "core/geom.h" 57e4b0a90eSBrooks Davis #include "misc/subr.h" 58e4b0a90eSBrooks Davis 59e4b0a90eSBrooks Davis 60e4b0a90eSBrooks Davis uint32_t lib_version = G_LIB_VERSION; 61e4b0a90eSBrooks Davis uint32_t version = G_ELI_VERSION; 62e4b0a90eSBrooks Davis 63e4b0a90eSBrooks Davis #define GELI_BACKUP_DIR "/var/backups/" 64e4b0a90eSBrooks Davis #define GELI_ENC_ALGO "aes" 65e4b0a90eSBrooks Davis 66e4b0a90eSBrooks Davis static void eli_main(struct gctl_req *req, unsigned flags); 67e4b0a90eSBrooks Davis static void eli_init(struct gctl_req *req); 68e4b0a90eSBrooks Davis static void eli_attach(struct gctl_req *req); 69e4b0a90eSBrooks Davis static void eli_configure(struct gctl_req *req); 70e4b0a90eSBrooks Davis static void eli_setkey(struct gctl_req *req); 71e4b0a90eSBrooks Davis static void eli_delkey(struct gctl_req *req); 72e4b0a90eSBrooks Davis static void eli_resume(struct gctl_req *req); 73e4b0a90eSBrooks Davis static void eli_kill(struct gctl_req *req); 74e4b0a90eSBrooks Davis static void eli_backup(struct gctl_req *req); 75e4b0a90eSBrooks Davis static void eli_restore(struct gctl_req *req); 76e4b0a90eSBrooks Davis static void eli_resize(struct gctl_req *req); 77e4b0a90eSBrooks Davis static void eli_version(struct gctl_req *req); 78e4b0a90eSBrooks Davis static void eli_clear(struct gctl_req *req); 79e4b0a90eSBrooks Davis static void eli_dump(struct gctl_req *req); 80e4b0a90eSBrooks Davis 81e4b0a90eSBrooks Davis static int eli_backup_create(struct gctl_req *req, const char *prov, 82e4b0a90eSBrooks Davis const char *file); 83e4b0a90eSBrooks Davis 84e4b0a90eSBrooks Davis /* 85e4b0a90eSBrooks Davis * Available commands: 86e4b0a90eSBrooks Davis * 87e4b0a90eSBrooks Davis * init [-bdgPTv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-J newpassfile] [-K newkeyfile] [-s sectorsize] [-V version] prov 88e4b0a90eSBrooks Davis * label - alias for 'init' 89e4b0a90eSBrooks Davis * attach [-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov 90e4b0a90eSBrooks Davis * detach [-fl] prov ... 91e4b0a90eSBrooks Davis * stop - alias for 'detach' 92e4b0a90eSBrooks Davis * onetime [-d] [-a aalgo] [-e ealgo] [-l keylen] prov 93e4b0a90eSBrooks Davis * configure [-bBgGtT] prov ... 94e4b0a90eSBrooks Davis * setkey [-pPv] [-n keyno] [-j passfile] [-J newpassfile] [-k keyfile] [-K newkeyfile] prov 95e4b0a90eSBrooks Davis * delkey [-afv] [-n keyno] prov 96e4b0a90eSBrooks Davis * suspend [-v] -a | prov ... 97e4b0a90eSBrooks Davis * resume [-pv] [-j passfile] [-k keyfile] prov 98e4b0a90eSBrooks Davis * kill [-av] [prov ...] 99e4b0a90eSBrooks Davis * backup [-v] prov file 100e4b0a90eSBrooks Davis * restore [-fv] file prov 101e4b0a90eSBrooks Davis * resize [-v] -s oldsize prov 102e4b0a90eSBrooks Davis * version [prov ...] 103e4b0a90eSBrooks Davis * clear [-v] prov ... 104e4b0a90eSBrooks Davis * dump [-v] prov ... 105e4b0a90eSBrooks Davis */ 106e4b0a90eSBrooks Davis struct g_command class_commands[] = { 107e4b0a90eSBrooks Davis { "init", G_FLAG_VERBOSE, eli_main, 108e4b0a90eSBrooks Davis { 109e4b0a90eSBrooks Davis { 'a', "aalgo", "", G_TYPE_STRING }, 110e4b0a90eSBrooks Davis { 'b', "boot", NULL, G_TYPE_BOOL }, 111e4b0a90eSBrooks Davis { 'B', "backupfile", "", G_TYPE_STRING }, 112e4b0a90eSBrooks Davis { 'd', "displaypass", NULL, G_TYPE_BOOL }, 113e4b0a90eSBrooks Davis { 'e', "ealgo", "", G_TYPE_STRING }, 114e4b0a90eSBrooks Davis { 'g', "geliboot", NULL, G_TYPE_BOOL }, 115e4b0a90eSBrooks Davis { 'i', "iterations", "-1", G_TYPE_NUMBER }, 116e4b0a90eSBrooks Davis { 'J', "newpassfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 117e4b0a90eSBrooks Davis { 'K', "newkeyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 118e4b0a90eSBrooks Davis { 'l', "keylen", "0", G_TYPE_NUMBER }, 119e4b0a90eSBrooks Davis { 'P', "nonewpassphrase", NULL, G_TYPE_BOOL }, 120e4b0a90eSBrooks Davis { 's', "sectorsize", "0", G_TYPE_NUMBER }, 121e4b0a90eSBrooks Davis { 'T', "notrim", NULL, G_TYPE_BOOL }, 122e4b0a90eSBrooks Davis { 'V', "mdversion", "-1", G_TYPE_NUMBER }, 123e4b0a90eSBrooks Davis G_OPT_SENTINEL 124e4b0a90eSBrooks Davis }, 125e4b0a90eSBrooks Davis "[-bdgPTv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-J newpassfile] [-K newkeyfile] [-s sectorsize] [-V version] prov" 126e4b0a90eSBrooks Davis }, 127e4b0a90eSBrooks Davis { "label", G_FLAG_VERBOSE, eli_main, 128e4b0a90eSBrooks Davis { 129e4b0a90eSBrooks Davis { 'a', "aalgo", "", G_TYPE_STRING }, 130e4b0a90eSBrooks Davis { 'b', "boot", NULL, G_TYPE_BOOL }, 131e4b0a90eSBrooks Davis { 'B', "backupfile", "", G_TYPE_STRING }, 132e4b0a90eSBrooks Davis { 'd', "displaypass", NULL, G_TYPE_BOOL }, 133e4b0a90eSBrooks Davis { 'e', "ealgo", "", G_TYPE_STRING }, 134e4b0a90eSBrooks Davis { 'g', "geliboot", NULL, G_TYPE_BOOL }, 135e4b0a90eSBrooks Davis { 'i', "iterations", "-1", G_TYPE_NUMBER }, 136e4b0a90eSBrooks Davis { 'J', "newpassfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 137e4b0a90eSBrooks Davis { 'K', "newkeyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 138e4b0a90eSBrooks Davis { 'l', "keylen", "0", G_TYPE_NUMBER }, 139e4b0a90eSBrooks Davis { 'P', "nonewpassphrase", NULL, G_TYPE_BOOL }, 140e4b0a90eSBrooks Davis { 's', "sectorsize", "0", G_TYPE_NUMBER }, 141e4b0a90eSBrooks Davis { 'V', "mdversion", "-1", G_TYPE_NUMBER }, 142e4b0a90eSBrooks Davis G_OPT_SENTINEL 143e4b0a90eSBrooks Davis }, 144e4b0a90eSBrooks Davis "- an alias for 'init'" 145e4b0a90eSBrooks Davis }, 146e4b0a90eSBrooks Davis { "attach", G_FLAG_VERBOSE | G_FLAG_LOADKLD, eli_main, 147e4b0a90eSBrooks Davis { 148e4b0a90eSBrooks Davis { 'C', "dryrun", NULL, G_TYPE_BOOL }, 149e4b0a90eSBrooks Davis { 'd', "detach", NULL, G_TYPE_BOOL }, 150e4b0a90eSBrooks Davis { 'j', "passfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 151e4b0a90eSBrooks Davis { 'k', "keyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 152e4b0a90eSBrooks Davis { 'n', "keyno", "-1", G_TYPE_NUMBER }, 153e4b0a90eSBrooks Davis { 'p', "nopassphrase", NULL, G_TYPE_BOOL }, 154e4b0a90eSBrooks Davis { 'r', "readonly", NULL, G_TYPE_BOOL }, 155e4b0a90eSBrooks Davis G_OPT_SENTINEL 156e4b0a90eSBrooks Davis }, 157e4b0a90eSBrooks Davis "[-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov" 158e4b0a90eSBrooks Davis }, 159e4b0a90eSBrooks Davis { "detach", 0, NULL, 160e4b0a90eSBrooks Davis { 161e4b0a90eSBrooks Davis { 'f', "force", NULL, G_TYPE_BOOL }, 162e4b0a90eSBrooks Davis { 'l', "last", NULL, G_TYPE_BOOL }, 163e4b0a90eSBrooks Davis G_OPT_SENTINEL 164e4b0a90eSBrooks Davis }, 165e4b0a90eSBrooks Davis "[-fl] prov ..." 166e4b0a90eSBrooks Davis }, 167e4b0a90eSBrooks Davis { "stop", 0, NULL, 168e4b0a90eSBrooks Davis { 169e4b0a90eSBrooks Davis { 'f', "force", NULL, G_TYPE_BOOL }, 170e4b0a90eSBrooks Davis { 'l', "last", NULL, G_TYPE_BOOL }, 171e4b0a90eSBrooks Davis G_OPT_SENTINEL 172e4b0a90eSBrooks Davis }, 173e4b0a90eSBrooks Davis "- an alias for 'detach'" 174e4b0a90eSBrooks Davis }, 175e4b0a90eSBrooks Davis { "onetime", G_FLAG_VERBOSE | G_FLAG_LOADKLD, NULL, 176e4b0a90eSBrooks Davis { 177e4b0a90eSBrooks Davis { 'a', "aalgo", "", G_TYPE_STRING }, 178e4b0a90eSBrooks Davis { 'd', "detach", NULL, G_TYPE_BOOL }, 179e4b0a90eSBrooks Davis { 'e', "ealgo", GELI_ENC_ALGO, G_TYPE_STRING }, 180e4b0a90eSBrooks Davis { 'l', "keylen", "0", G_TYPE_NUMBER }, 181e4b0a90eSBrooks Davis { 's', "sectorsize", "0", G_TYPE_NUMBER }, 182e4b0a90eSBrooks Davis { 'T', "notrim", NULL, G_TYPE_BOOL }, 183e4b0a90eSBrooks Davis G_OPT_SENTINEL 184e4b0a90eSBrooks Davis }, 185e4b0a90eSBrooks Davis "[-dT] [-a aalgo] [-e ealgo] [-l keylen] [-s sectorsize] prov" 186e4b0a90eSBrooks Davis }, 187e4b0a90eSBrooks Davis { "configure", G_FLAG_VERBOSE, eli_main, 188e4b0a90eSBrooks Davis { 189e4b0a90eSBrooks Davis { 'b', "boot", NULL, G_TYPE_BOOL }, 190e4b0a90eSBrooks Davis { 'B', "noboot", NULL, G_TYPE_BOOL }, 191e4b0a90eSBrooks Davis { 'd', "displaypass", NULL, G_TYPE_BOOL }, 192e4b0a90eSBrooks Davis { 'D', "nodisplaypass", NULL, G_TYPE_BOOL }, 193e4b0a90eSBrooks Davis { 'g', "geliboot", NULL, G_TYPE_BOOL }, 194e4b0a90eSBrooks Davis { 'G', "nogeliboot", NULL, G_TYPE_BOOL }, 195e4b0a90eSBrooks Davis { 't', "trim", NULL, G_TYPE_BOOL }, 196e4b0a90eSBrooks Davis { 'T', "notrim", NULL, G_TYPE_BOOL }, 197e4b0a90eSBrooks Davis G_OPT_SENTINEL 198e4b0a90eSBrooks Davis }, 199e4b0a90eSBrooks Davis "[-bBdDgGtT] prov ..." 200e4b0a90eSBrooks Davis }, 201e4b0a90eSBrooks Davis { "setkey", G_FLAG_VERBOSE, eli_main, 202e4b0a90eSBrooks Davis { 203e4b0a90eSBrooks Davis { 'i', "iterations", "-1", G_TYPE_NUMBER }, 204e4b0a90eSBrooks Davis { 'j', "passfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 205e4b0a90eSBrooks Davis { 'J', "newpassfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 206e4b0a90eSBrooks Davis { 'k', "keyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 207e4b0a90eSBrooks Davis { 'K', "newkeyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 208e4b0a90eSBrooks Davis { 'n', "keyno", "-1", G_TYPE_NUMBER }, 209e4b0a90eSBrooks Davis { 'p', "nopassphrase", NULL, G_TYPE_BOOL }, 210e4b0a90eSBrooks Davis { 'P', "nonewpassphrase", NULL, G_TYPE_BOOL }, 211e4b0a90eSBrooks Davis G_OPT_SENTINEL 212e4b0a90eSBrooks Davis }, 213e4b0a90eSBrooks Davis "[-pPv] [-n keyno] [-i iterations] [-j passfile] [-J newpassfile] [-k keyfile] [-K newkeyfile] prov" 214e4b0a90eSBrooks Davis }, 215e4b0a90eSBrooks Davis { "delkey", G_FLAG_VERBOSE, eli_main, 216e4b0a90eSBrooks Davis { 217e4b0a90eSBrooks Davis { 'a', "all", NULL, G_TYPE_BOOL }, 218e4b0a90eSBrooks Davis { 'f', "force", NULL, G_TYPE_BOOL }, 219e4b0a90eSBrooks Davis { 'n', "keyno", "-1", G_TYPE_NUMBER }, 220e4b0a90eSBrooks Davis G_OPT_SENTINEL 221e4b0a90eSBrooks Davis }, 222e4b0a90eSBrooks Davis "[-afv] [-n keyno] prov" 223e4b0a90eSBrooks Davis }, 224e4b0a90eSBrooks Davis { "suspend", G_FLAG_VERBOSE, NULL, 225e4b0a90eSBrooks Davis { 226e4b0a90eSBrooks Davis { 'a', "all", NULL, G_TYPE_BOOL }, 227e4b0a90eSBrooks Davis G_OPT_SENTINEL 228e4b0a90eSBrooks Davis }, 229e4b0a90eSBrooks Davis "[-v] -a | prov ..." 230e4b0a90eSBrooks Davis }, 231e4b0a90eSBrooks Davis { "resume", G_FLAG_VERBOSE, eli_main, 232e4b0a90eSBrooks Davis { 233e4b0a90eSBrooks Davis { 'j', "passfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 234e4b0a90eSBrooks Davis { 'k', "keyfile", G_VAL_OPTIONAL, G_TYPE_STRING | G_TYPE_MULTI }, 235e4b0a90eSBrooks Davis { 'p', "nopassphrase", NULL, G_TYPE_BOOL }, 236e4b0a90eSBrooks Davis G_OPT_SENTINEL 237e4b0a90eSBrooks Davis }, 238e4b0a90eSBrooks Davis "[-pv] [-j passfile] [-k keyfile] prov" 239e4b0a90eSBrooks Davis }, 240e4b0a90eSBrooks Davis { "kill", G_FLAG_VERBOSE, eli_main, 241e4b0a90eSBrooks Davis { 242e4b0a90eSBrooks Davis { 'a', "all", NULL, G_TYPE_BOOL }, 243e4b0a90eSBrooks Davis G_OPT_SENTINEL 244e4b0a90eSBrooks Davis }, 245e4b0a90eSBrooks Davis "[-av] [prov ...]" 246e4b0a90eSBrooks Davis }, 247e4b0a90eSBrooks Davis { "backup", G_FLAG_VERBOSE, eli_main, G_NULL_OPTS, 248e4b0a90eSBrooks Davis "[-v] prov file" 249e4b0a90eSBrooks Davis }, 250e4b0a90eSBrooks Davis { "restore", G_FLAG_VERBOSE, eli_main, 251e4b0a90eSBrooks Davis { 252e4b0a90eSBrooks Davis { 'f', "force", NULL, G_TYPE_BOOL }, 253e4b0a90eSBrooks Davis G_OPT_SENTINEL 254e4b0a90eSBrooks Davis }, 255e4b0a90eSBrooks Davis "[-fv] file prov" 256e4b0a90eSBrooks Davis }, 257e4b0a90eSBrooks Davis { "resize", G_FLAG_VERBOSE, eli_main, 258e4b0a90eSBrooks Davis { 259e4b0a90eSBrooks Davis { 's', "oldsize", NULL, G_TYPE_NUMBER }, 260e4b0a90eSBrooks Davis G_OPT_SENTINEL 261e4b0a90eSBrooks Davis }, 262e4b0a90eSBrooks Davis "[-v] -s oldsize prov" 263e4b0a90eSBrooks Davis }, 264e4b0a90eSBrooks Davis { "version", G_FLAG_LOADKLD, eli_main, G_NULL_OPTS, 265e4b0a90eSBrooks Davis "[prov ...]" 266e4b0a90eSBrooks Davis }, 267e4b0a90eSBrooks Davis { "clear", G_FLAG_VERBOSE, eli_main, G_NULL_OPTS, 268e4b0a90eSBrooks Davis "[-v] prov ..." 269e4b0a90eSBrooks Davis }, 270e4b0a90eSBrooks Davis { "dump", G_FLAG_VERBOSE, eli_main, G_NULL_OPTS, 271e4b0a90eSBrooks Davis "[-v] prov ..." 272e4b0a90eSBrooks Davis }, 273e4b0a90eSBrooks Davis G_CMD_SENTINEL 274e4b0a90eSBrooks Davis }; 275e4b0a90eSBrooks Davis 276e4b0a90eSBrooks Davis static int verbose = 0; 277e4b0a90eSBrooks Davis 278e4b0a90eSBrooks Davis #define BUFSIZE 1024 279e4b0a90eSBrooks Davis 280e4b0a90eSBrooks Davis static int 281e4b0a90eSBrooks Davis eli_protect(struct gctl_req *req) 282e4b0a90eSBrooks Davis { 283e4b0a90eSBrooks Davis struct rlimit rl; 284e4b0a90eSBrooks Davis 285e4b0a90eSBrooks Davis /* Disable core dumps. */ 286e4b0a90eSBrooks Davis rl.rlim_cur = 0; 287e4b0a90eSBrooks Davis rl.rlim_max = 0; 288e4b0a90eSBrooks Davis if (setrlimit(RLIMIT_CORE, &rl) == -1) { 289e4b0a90eSBrooks Davis gctl_error(req, "Cannot disable core dumps: %s.", 290e4b0a90eSBrooks Davis strerror(errno)); 291e4b0a90eSBrooks Davis return (-1); 292e4b0a90eSBrooks Davis } 293e4b0a90eSBrooks Davis /* Disable swapping. */ 294e4b0a90eSBrooks Davis if (mlockall(MCL_FUTURE) == -1) { 295e4b0a90eSBrooks Davis gctl_error(req, "Cannot lock memory: %s.", strerror(errno)); 296e4b0a90eSBrooks Davis return (-1); 297e4b0a90eSBrooks Davis } 298e4b0a90eSBrooks Davis return (0); 299e4b0a90eSBrooks Davis } 300e4b0a90eSBrooks Davis 301e4b0a90eSBrooks Davis static void 302e4b0a90eSBrooks Davis eli_main(struct gctl_req *req, unsigned int flags) 303e4b0a90eSBrooks Davis { 304e4b0a90eSBrooks Davis const char *name; 305e4b0a90eSBrooks Davis 306e4b0a90eSBrooks Davis if (eli_protect(req) == -1) 307e4b0a90eSBrooks Davis return; 308e4b0a90eSBrooks Davis 309e4b0a90eSBrooks Davis if ((flags & G_FLAG_VERBOSE) != 0) 310e4b0a90eSBrooks Davis verbose = 1; 311e4b0a90eSBrooks Davis 312e4b0a90eSBrooks Davis name = gctl_get_ascii(req, "verb"); 313e4b0a90eSBrooks Davis if (name == NULL) { 314e4b0a90eSBrooks Davis gctl_error(req, "No '%s' argument.", "verb"); 315e4b0a90eSBrooks Davis return; 316e4b0a90eSBrooks Davis } 317e4b0a90eSBrooks Davis if (strcmp(name, "init") == 0 || strcmp(name, "label") == 0) 318e4b0a90eSBrooks Davis eli_init(req); 319e4b0a90eSBrooks Davis else if (strcmp(name, "attach") == 0) 320e4b0a90eSBrooks Davis eli_attach(req); 321e4b0a90eSBrooks Davis else if (strcmp(name, "configure") == 0) 322e4b0a90eSBrooks Davis eli_configure(req); 323e4b0a90eSBrooks Davis else if (strcmp(name, "setkey") == 0) 324e4b0a90eSBrooks Davis eli_setkey(req); 325e4b0a90eSBrooks Davis else if (strcmp(name, "delkey") == 0) 326e4b0a90eSBrooks Davis eli_delkey(req); 327e4b0a90eSBrooks Davis else if (strcmp(name, "resume") == 0) 328e4b0a90eSBrooks Davis eli_resume(req); 329e4b0a90eSBrooks Davis else if (strcmp(name, "kill") == 0) 330e4b0a90eSBrooks Davis eli_kill(req); 331e4b0a90eSBrooks Davis else if (strcmp(name, "backup") == 0) 332e4b0a90eSBrooks Davis eli_backup(req); 333e4b0a90eSBrooks Davis else if (strcmp(name, "restore") == 0) 334e4b0a90eSBrooks Davis eli_restore(req); 335e4b0a90eSBrooks Davis else if (strcmp(name, "resize") == 0) 336e4b0a90eSBrooks Davis eli_resize(req); 337e4b0a90eSBrooks Davis else if (strcmp(name, "version") == 0) 338e4b0a90eSBrooks Davis eli_version(req); 339e4b0a90eSBrooks Davis else if (strcmp(name, "dump") == 0) 340e4b0a90eSBrooks Davis eli_dump(req); 341e4b0a90eSBrooks Davis else if (strcmp(name, "clear") == 0) 342e4b0a90eSBrooks Davis eli_clear(req); 343e4b0a90eSBrooks Davis else 344e4b0a90eSBrooks Davis gctl_error(req, "Unknown command: %s.", name); 345e4b0a90eSBrooks Davis } 346e4b0a90eSBrooks Davis 347e4b0a90eSBrooks Davis static bool 348e4b0a90eSBrooks Davis eli_is_attached(const char *prov) 349e4b0a90eSBrooks Davis { 350e4b0a90eSBrooks Davis char name[MAXPATHLEN]; 351e4b0a90eSBrooks Davis 352e4b0a90eSBrooks Davis /* 353e4b0a90eSBrooks Davis * Not the best way to do it, but the easiest. 354e4b0a90eSBrooks Davis * We try to open provider and check if it is a GEOM provider 355e4b0a90eSBrooks Davis * by asking about its sectorsize. 356e4b0a90eSBrooks Davis */ 357e4b0a90eSBrooks Davis snprintf(name, sizeof(name), "%s%s", prov, G_ELI_SUFFIX); 358e4b0a90eSBrooks Davis return (g_get_sectorsize(name) > 0); 359e4b0a90eSBrooks Davis } 360e4b0a90eSBrooks Davis 361e4b0a90eSBrooks Davis static int 362e4b0a90eSBrooks Davis eli_genkey_files(struct gctl_req *req, bool new, const char *type, 363e4b0a90eSBrooks Davis struct hmac_ctx *ctxp, char *passbuf, size_t passbufsize) 364e4b0a90eSBrooks Davis { 365e4b0a90eSBrooks Davis char *p, buf[BUFSIZE], argname[16]; 366e4b0a90eSBrooks Davis const char *file; 367e4b0a90eSBrooks Davis int error, fd, i; 368e4b0a90eSBrooks Davis ssize_t done; 369e4b0a90eSBrooks Davis 370e4b0a90eSBrooks Davis assert((strcmp(type, "keyfile") == 0 && ctxp != NULL && 371e4b0a90eSBrooks Davis passbuf == NULL && passbufsize == 0) || 372e4b0a90eSBrooks Davis (strcmp(type, "passfile") == 0 && ctxp == NULL && 373e4b0a90eSBrooks Davis passbuf != NULL && passbufsize > 0)); 374e4b0a90eSBrooks Davis assert(strcmp(type, "keyfile") == 0 || passbuf[0] == '\0'); 375e4b0a90eSBrooks Davis 376e4b0a90eSBrooks Davis for (i = 0; ; i++) { 377e4b0a90eSBrooks Davis snprintf(argname, sizeof(argname), "%s%s%d", 378e4b0a90eSBrooks Davis new ? "new" : "", type, i); 379e4b0a90eSBrooks Davis 380e4b0a90eSBrooks Davis /* No more {key,pass}files? */ 381e4b0a90eSBrooks Davis if (!gctl_has_param(req, argname)) 382e4b0a90eSBrooks Davis return (i); 383e4b0a90eSBrooks Davis 384e4b0a90eSBrooks Davis file = gctl_get_ascii(req, "%s", argname); 385e4b0a90eSBrooks Davis assert(file != NULL); 386e4b0a90eSBrooks Davis 387e4b0a90eSBrooks Davis if (strcmp(file, "-") == 0) 388e4b0a90eSBrooks Davis fd = STDIN_FILENO; 389e4b0a90eSBrooks Davis else { 390e4b0a90eSBrooks Davis fd = open(file, O_RDONLY); 391e4b0a90eSBrooks Davis if (fd == -1) { 392e4b0a90eSBrooks Davis gctl_error(req, "Cannot open %s %s: %s.", 393e4b0a90eSBrooks Davis type, file, strerror(errno)); 394e4b0a90eSBrooks Davis return (-1); 395e4b0a90eSBrooks Davis } 396e4b0a90eSBrooks Davis } 397e4b0a90eSBrooks Davis if (strcmp(type, "keyfile") == 0) { 398e4b0a90eSBrooks Davis while ((done = read(fd, buf, sizeof(buf))) > 0) 399e4b0a90eSBrooks Davis g_eli_crypto_hmac_update(ctxp, buf, done); 400e4b0a90eSBrooks Davis } else /* if (strcmp(type, "passfile") == 0) */ { 401e4b0a90eSBrooks Davis assert(strcmp(type, "passfile") == 0); 402e4b0a90eSBrooks Davis 403e4b0a90eSBrooks Davis while ((done = read(fd, buf, sizeof(buf) - 1)) > 0) { 404e4b0a90eSBrooks Davis buf[done] = '\0'; 405e4b0a90eSBrooks Davis p = strchr(buf, '\n'); 406e4b0a90eSBrooks Davis if (p != NULL) { 407e4b0a90eSBrooks Davis *p = '\0'; 408e4b0a90eSBrooks Davis done = p - buf; 409e4b0a90eSBrooks Davis } 410e4b0a90eSBrooks Davis if (strlcat(passbuf, buf, passbufsize) >= 411e4b0a90eSBrooks Davis passbufsize) { 412e4b0a90eSBrooks Davis gctl_error(req, 413e4b0a90eSBrooks Davis "Passphrase in %s too long.", file); 414e4b0a90eSBrooks Davis bzero(buf, sizeof(buf)); 415e4b0a90eSBrooks Davis return (-1); 416e4b0a90eSBrooks Davis } 417e4b0a90eSBrooks Davis if (p != NULL) 418e4b0a90eSBrooks Davis break; 419e4b0a90eSBrooks Davis } 420e4b0a90eSBrooks Davis } 421e4b0a90eSBrooks Davis error = errno; 422e4b0a90eSBrooks Davis if (strcmp(file, "-") != 0) 423e4b0a90eSBrooks Davis close(fd); 424e4b0a90eSBrooks Davis bzero(buf, sizeof(buf)); 425e4b0a90eSBrooks Davis if (done == -1) { 426e4b0a90eSBrooks Davis gctl_error(req, "Cannot read %s %s: %s.", 427e4b0a90eSBrooks Davis type, file, strerror(error)); 428e4b0a90eSBrooks Davis return (-1); 429e4b0a90eSBrooks Davis } 430e4b0a90eSBrooks Davis } 431e4b0a90eSBrooks Davis /* NOTREACHED */ 432e4b0a90eSBrooks Davis } 433e4b0a90eSBrooks Davis 434e4b0a90eSBrooks Davis static int 435e4b0a90eSBrooks Davis eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf, 436e4b0a90eSBrooks Davis size_t passbufsize) 437e4b0a90eSBrooks Davis { 438e4b0a90eSBrooks Davis char *p; 439e4b0a90eSBrooks Davis 440e4b0a90eSBrooks Davis for (;;) { 441e4b0a90eSBrooks Davis p = readpassphrase( 442e4b0a90eSBrooks Davis new ? "Enter new passphrase: " : "Enter passphrase: ", 443e4b0a90eSBrooks Davis passbuf, passbufsize, RPP_ECHO_OFF | RPP_REQUIRE_TTY); 444e4b0a90eSBrooks Davis if (p == NULL) { 445e4b0a90eSBrooks Davis bzero(passbuf, passbufsize); 446e4b0a90eSBrooks Davis gctl_error(req, "Cannot read passphrase: %s.", 447e4b0a90eSBrooks Davis strerror(errno)); 448e4b0a90eSBrooks Davis return (-1); 449e4b0a90eSBrooks Davis } 450e4b0a90eSBrooks Davis 451e4b0a90eSBrooks Davis if (new) { 452e4b0a90eSBrooks Davis char tmpbuf[BUFSIZE]; 453e4b0a90eSBrooks Davis 454e4b0a90eSBrooks Davis p = readpassphrase("Reenter new passphrase: ", 455e4b0a90eSBrooks Davis tmpbuf, sizeof(tmpbuf), 456e4b0a90eSBrooks Davis RPP_ECHO_OFF | RPP_REQUIRE_TTY); 457e4b0a90eSBrooks Davis if (p == NULL) { 458e4b0a90eSBrooks Davis bzero(passbuf, passbufsize); 459e4b0a90eSBrooks Davis gctl_error(req, 460e4b0a90eSBrooks Davis "Cannot read passphrase: %s.", 461e4b0a90eSBrooks Davis strerror(errno)); 462e4b0a90eSBrooks Davis return (-1); 463e4b0a90eSBrooks Davis } 464e4b0a90eSBrooks Davis 465e4b0a90eSBrooks Davis if (strcmp(passbuf, tmpbuf) != 0) { 466e4b0a90eSBrooks Davis bzero(passbuf, passbufsize); 467e4b0a90eSBrooks Davis fprintf(stderr, "They didn't match.\n"); 468e4b0a90eSBrooks Davis continue; 469e4b0a90eSBrooks Davis } 470e4b0a90eSBrooks Davis bzero(tmpbuf, sizeof(tmpbuf)); 471e4b0a90eSBrooks Davis } 472e4b0a90eSBrooks Davis return (0); 473e4b0a90eSBrooks Davis } 474e4b0a90eSBrooks Davis /* NOTREACHED */ 475e4b0a90eSBrooks Davis } 476e4b0a90eSBrooks Davis 477e4b0a90eSBrooks Davis static int 478e4b0a90eSBrooks Davis eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new, 479e4b0a90eSBrooks Davis struct hmac_ctx *ctxp) 480e4b0a90eSBrooks Davis { 481e4b0a90eSBrooks Davis char passbuf[BUFSIZE]; 482e4b0a90eSBrooks Davis bool nopassphrase; 483e4b0a90eSBrooks Davis int nfiles; 484e4b0a90eSBrooks Davis 485e4b0a90eSBrooks Davis nopassphrase = 486e4b0a90eSBrooks Davis gctl_get_int(req, new ? "nonewpassphrase" : "nopassphrase"); 487e4b0a90eSBrooks Davis if (nopassphrase) { 488e4b0a90eSBrooks Davis if (gctl_has_param(req, new ? "newpassfile0" : "passfile0")) { 489e4b0a90eSBrooks Davis gctl_error(req, 490e4b0a90eSBrooks Davis "Options -%c and -%c are mutually exclusive.", 491e4b0a90eSBrooks Davis new ? 'J' : 'j', new ? 'P' : 'p'); 492e4b0a90eSBrooks Davis return (-1); 493e4b0a90eSBrooks Davis } 494e4b0a90eSBrooks Davis return (0); 495e4b0a90eSBrooks Davis } 496e4b0a90eSBrooks Davis 497e4b0a90eSBrooks Davis if (!new && md->md_iterations == -1) { 498e4b0a90eSBrooks Davis gctl_error(req, "Missing -p flag."); 499e4b0a90eSBrooks Davis return (-1); 500e4b0a90eSBrooks Davis } 501e4b0a90eSBrooks Davis passbuf[0] = '\0'; 502e4b0a90eSBrooks Davis nfiles = eli_genkey_files(req, new, "passfile", NULL, passbuf, 503e4b0a90eSBrooks Davis sizeof(passbuf)); 504e4b0a90eSBrooks Davis if (nfiles == -1) 505e4b0a90eSBrooks Davis return (-1); 506e4b0a90eSBrooks Davis else if (nfiles == 0) { 507e4b0a90eSBrooks Davis if (eli_genkey_passphrase_prompt(req, new, passbuf, 508e4b0a90eSBrooks Davis sizeof(passbuf)) == -1) { 509e4b0a90eSBrooks Davis return (-1); 510e4b0a90eSBrooks Davis } 511e4b0a90eSBrooks Davis } 512e4b0a90eSBrooks Davis /* 513e4b0a90eSBrooks Davis * Field md_iterations equal to -1 means "choose some sane 514e4b0a90eSBrooks Davis * value for me". 515e4b0a90eSBrooks Davis */ 516e4b0a90eSBrooks Davis if (md->md_iterations == -1) { 517e4b0a90eSBrooks Davis assert(new); 518e4b0a90eSBrooks Davis if (verbose) 519e4b0a90eSBrooks Davis printf("Calculating number of iterations...\n"); 520e4b0a90eSBrooks Davis md->md_iterations = pkcs5v2_calculate(2000000); 521e4b0a90eSBrooks Davis assert(md->md_iterations > 0); 522e4b0a90eSBrooks Davis if (verbose) { 523e4b0a90eSBrooks Davis printf("Done, using %d iterations.\n", 524e4b0a90eSBrooks Davis md->md_iterations); 525e4b0a90eSBrooks Davis } 526e4b0a90eSBrooks Davis } 527e4b0a90eSBrooks Davis /* 528e4b0a90eSBrooks Davis * If md_iterations is equal to 0, user doesn't want PKCS#5v2. 529e4b0a90eSBrooks Davis */ 530e4b0a90eSBrooks Davis if (md->md_iterations == 0) { 531e4b0a90eSBrooks Davis g_eli_crypto_hmac_update(ctxp, md->md_salt, 532e4b0a90eSBrooks Davis sizeof(md->md_salt)); 533e4b0a90eSBrooks Davis g_eli_crypto_hmac_update(ctxp, passbuf, strlen(passbuf)); 534e4b0a90eSBrooks Davis } else /* if (md->md_iterations > 0) */ { 535e4b0a90eSBrooks Davis unsigned char dkey[G_ELI_USERKEYLEN]; 536e4b0a90eSBrooks Davis 537e4b0a90eSBrooks Davis pkcs5v2_genkey(dkey, sizeof(dkey), md->md_salt, 538e4b0a90eSBrooks Davis sizeof(md->md_salt), passbuf, md->md_iterations); 539e4b0a90eSBrooks Davis g_eli_crypto_hmac_update(ctxp, dkey, sizeof(dkey)); 540e4b0a90eSBrooks Davis bzero(dkey, sizeof(dkey)); 541e4b0a90eSBrooks Davis } 542e4b0a90eSBrooks Davis bzero(passbuf, sizeof(passbuf)); 543e4b0a90eSBrooks Davis 544e4b0a90eSBrooks Davis return (0); 545e4b0a90eSBrooks Davis } 546e4b0a90eSBrooks Davis 547e4b0a90eSBrooks Davis static unsigned char * 548e4b0a90eSBrooks Davis eli_genkey(struct gctl_req *req, struct g_eli_metadata *md, unsigned char *key, 549e4b0a90eSBrooks Davis bool new) 550e4b0a90eSBrooks Davis { 551e4b0a90eSBrooks Davis struct hmac_ctx ctx; 552e4b0a90eSBrooks Davis bool nopassphrase; 553e4b0a90eSBrooks Davis int nfiles; 554e4b0a90eSBrooks Davis 555e4b0a90eSBrooks Davis nopassphrase = 556e4b0a90eSBrooks Davis gctl_get_int(req, new ? "nonewpassphrase" : "nopassphrase"); 557e4b0a90eSBrooks Davis 558e4b0a90eSBrooks Davis g_eli_crypto_hmac_init(&ctx, NULL, 0); 559e4b0a90eSBrooks Davis 560e4b0a90eSBrooks Davis nfiles = eli_genkey_files(req, new, "keyfile", &ctx, NULL, 0); 561e4b0a90eSBrooks Davis if (nfiles == -1) 562e4b0a90eSBrooks Davis return (NULL); 563e4b0a90eSBrooks Davis else if (nfiles == 0 && nopassphrase) { 564e4b0a90eSBrooks Davis gctl_error(req, "No key components given."); 565e4b0a90eSBrooks Davis return (NULL); 566e4b0a90eSBrooks Davis } 567e4b0a90eSBrooks Davis 568e4b0a90eSBrooks Davis if (eli_genkey_passphrase(req, md, new, &ctx) == -1) 569e4b0a90eSBrooks Davis return (NULL); 570e4b0a90eSBrooks Davis 571e4b0a90eSBrooks Davis g_eli_crypto_hmac_final(&ctx, key, 0); 572e4b0a90eSBrooks Davis 573e4b0a90eSBrooks Davis return (key); 574e4b0a90eSBrooks Davis } 575e4b0a90eSBrooks Davis 576e4b0a90eSBrooks Davis static int 577e4b0a90eSBrooks Davis eli_metadata_read(struct gctl_req *req, const char *prov, 578e4b0a90eSBrooks Davis struct g_eli_metadata *md) 579e4b0a90eSBrooks Davis { 580e4b0a90eSBrooks Davis unsigned char sector[sizeof(struct g_eli_metadata)]; 581e4b0a90eSBrooks Davis int error; 582e4b0a90eSBrooks Davis 583e4b0a90eSBrooks Davis if (g_get_sectorsize(prov) == 0) { 584e4b0a90eSBrooks Davis int fd; 585e4b0a90eSBrooks Davis 586e4b0a90eSBrooks Davis /* This is a file probably. */ 587e4b0a90eSBrooks Davis fd = open(prov, O_RDONLY); 588e4b0a90eSBrooks Davis if (fd == -1) { 589e4b0a90eSBrooks Davis gctl_error(req, "Cannot open %s: %s.", prov, 590e4b0a90eSBrooks Davis strerror(errno)); 591e4b0a90eSBrooks Davis return (-1); 592e4b0a90eSBrooks Davis } 593e4b0a90eSBrooks Davis if (read(fd, sector, sizeof(sector)) != sizeof(sector)) { 594e4b0a90eSBrooks Davis gctl_error(req, "Cannot read metadata from %s: %s.", 595e4b0a90eSBrooks Davis prov, strerror(errno)); 596e4b0a90eSBrooks Davis close(fd); 597e4b0a90eSBrooks Davis return (-1); 598e4b0a90eSBrooks Davis } 599e4b0a90eSBrooks Davis close(fd); 600e4b0a90eSBrooks Davis } else { 601e4b0a90eSBrooks Davis /* This is a GEOM provider. */ 602e4b0a90eSBrooks Davis error = g_metadata_read(prov, sector, sizeof(sector), 603e4b0a90eSBrooks Davis G_ELI_MAGIC); 604e4b0a90eSBrooks Davis if (error != 0) { 605e4b0a90eSBrooks Davis gctl_error(req, "Cannot read metadata from %s: %s.", 606e4b0a90eSBrooks Davis prov, strerror(error)); 607e4b0a90eSBrooks Davis return (-1); 608e4b0a90eSBrooks Davis } 609e4b0a90eSBrooks Davis } 610e4b0a90eSBrooks Davis error = eli_metadata_decode(sector, md); 611e4b0a90eSBrooks Davis switch (error) { 612e4b0a90eSBrooks Davis case 0: 613e4b0a90eSBrooks Davis break; 614e4b0a90eSBrooks Davis case EOPNOTSUPP: 615e4b0a90eSBrooks Davis gctl_error(req, 616e4b0a90eSBrooks Davis "Provider's %s metadata version %u is too new.\n" 617e4b0a90eSBrooks Davis "geli: The highest supported version is %u.", 618e4b0a90eSBrooks Davis prov, (unsigned int)md->md_version, G_ELI_VERSION); 619e4b0a90eSBrooks Davis return (-1); 620e4b0a90eSBrooks Davis case EINVAL: 621e4b0a90eSBrooks Davis gctl_error(req, "Inconsistent provider's %s metadata.", prov); 622e4b0a90eSBrooks Davis return (-1); 623e4b0a90eSBrooks Davis default: 624e4b0a90eSBrooks Davis gctl_error(req, 625e4b0a90eSBrooks Davis "Unexpected error while decoding provider's %s metadata: %s.", 626e4b0a90eSBrooks Davis prov, strerror(error)); 627e4b0a90eSBrooks Davis return (-1); 628e4b0a90eSBrooks Davis } 629e4b0a90eSBrooks Davis return (0); 630e4b0a90eSBrooks Davis } 631e4b0a90eSBrooks Davis 632e4b0a90eSBrooks Davis static int 633e4b0a90eSBrooks Davis eli_metadata_store(struct gctl_req *req, const char *prov, 634e4b0a90eSBrooks Davis struct g_eli_metadata *md) 635e4b0a90eSBrooks Davis { 636e4b0a90eSBrooks Davis unsigned char sector[sizeof(struct g_eli_metadata)]; 637e4b0a90eSBrooks Davis int error; 638e4b0a90eSBrooks Davis 639e4b0a90eSBrooks Davis eli_metadata_encode(md, sector); 640e4b0a90eSBrooks Davis if (g_get_sectorsize(prov) == 0) { 641e4b0a90eSBrooks Davis int fd; 642e4b0a90eSBrooks Davis 643e4b0a90eSBrooks Davis /* This is a file probably. */ 644e4b0a90eSBrooks Davis fd = open(prov, O_WRONLY | O_TRUNC); 645e4b0a90eSBrooks Davis if (fd == -1) { 646e4b0a90eSBrooks Davis gctl_error(req, "Cannot open %s: %s.", prov, 647e4b0a90eSBrooks Davis strerror(errno)); 648e4b0a90eSBrooks Davis bzero(sector, sizeof(sector)); 649e4b0a90eSBrooks Davis return (-1); 650e4b0a90eSBrooks Davis } 651e4b0a90eSBrooks Davis if (write(fd, sector, sizeof(sector)) != sizeof(sector)) { 652e4b0a90eSBrooks Davis gctl_error(req, "Cannot write metadata to %s: %s.", 653e4b0a90eSBrooks Davis prov, strerror(errno)); 654e4b0a90eSBrooks Davis bzero(sector, sizeof(sector)); 655e4b0a90eSBrooks Davis close(fd); 656e4b0a90eSBrooks Davis return (-1); 657e4b0a90eSBrooks Davis } 658e4b0a90eSBrooks Davis close(fd); 659e4b0a90eSBrooks Davis } else { 660e4b0a90eSBrooks Davis /* This is a GEOM provider. */ 661e4b0a90eSBrooks Davis error = g_metadata_store(prov, sector, sizeof(sector)); 662e4b0a90eSBrooks Davis if (error != 0) { 663e4b0a90eSBrooks Davis gctl_error(req, "Cannot write metadata to %s: %s.", 664e4b0a90eSBrooks Davis prov, strerror(errno)); 665e4b0a90eSBrooks Davis bzero(sector, sizeof(sector)); 666e4b0a90eSBrooks Davis return (-1); 667e4b0a90eSBrooks Davis } 668e4b0a90eSBrooks Davis } 669e4b0a90eSBrooks Davis bzero(sector, sizeof(sector)); 670e4b0a90eSBrooks Davis return (0); 671e4b0a90eSBrooks Davis } 672e4b0a90eSBrooks Davis 673e4b0a90eSBrooks Davis static void 674e4b0a90eSBrooks Davis eli_init(struct gctl_req *req) 675e4b0a90eSBrooks Davis { 676e4b0a90eSBrooks Davis struct g_eli_metadata md; 677e4b0a90eSBrooks Davis unsigned char sector[sizeof(struct g_eli_metadata)] __aligned(4); 678e4b0a90eSBrooks Davis unsigned char key[G_ELI_USERKEYLEN]; 679e4b0a90eSBrooks Davis char backfile[MAXPATHLEN]; 680e4b0a90eSBrooks Davis const char *str, *prov; 681e4b0a90eSBrooks Davis unsigned int secsize, version; 682e4b0a90eSBrooks Davis off_t mediasize; 683e4b0a90eSBrooks Davis intmax_t val; 684e4b0a90eSBrooks Davis int error, nargs; 685e4b0a90eSBrooks Davis 686e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 687e4b0a90eSBrooks Davis if (nargs != 1) { 688e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 689e4b0a90eSBrooks Davis return; 690e4b0a90eSBrooks Davis } 691e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 692e4b0a90eSBrooks Davis mediasize = g_get_mediasize(prov); 693e4b0a90eSBrooks Davis secsize = g_get_sectorsize(prov); 694e4b0a90eSBrooks Davis if (mediasize == 0 || secsize == 0) { 695e4b0a90eSBrooks Davis gctl_error(req, "Cannot get informations about %s: %s.", prov, 696e4b0a90eSBrooks Davis strerror(errno)); 697e4b0a90eSBrooks Davis return; 698e4b0a90eSBrooks Davis } 699e4b0a90eSBrooks Davis 700e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 701e4b0a90eSBrooks Davis strlcpy(md.md_magic, G_ELI_MAGIC, sizeof(md.md_magic)); 702e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "mdversion"); 703e4b0a90eSBrooks Davis if (val == -1) { 704e4b0a90eSBrooks Davis version = G_ELI_VERSION; 705e4b0a90eSBrooks Davis } else if (val < 0 || val > G_ELI_VERSION) { 706e4b0a90eSBrooks Davis gctl_error(req, 707e4b0a90eSBrooks Davis "Invalid version specified should be between %u and %u.", 708e4b0a90eSBrooks Davis G_ELI_VERSION_00, G_ELI_VERSION); 709e4b0a90eSBrooks Davis return; 710e4b0a90eSBrooks Davis } else { 711e4b0a90eSBrooks Davis version = val; 712e4b0a90eSBrooks Davis } 713e4b0a90eSBrooks Davis md.md_version = version; 714e4b0a90eSBrooks Davis md.md_flags = 0; 715e4b0a90eSBrooks Davis if (gctl_get_int(req, "boot")) 716e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_BOOT; 717e4b0a90eSBrooks Davis if (gctl_get_int(req, "geliboot")) 718e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_GELIBOOT; 719e4b0a90eSBrooks Davis if (gctl_get_int(req, "displaypass")) 720e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_GELIDISPLAYPASS; 721e4b0a90eSBrooks Davis if (gctl_get_int(req, "notrim")) 722e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_NODELETE; 723e4b0a90eSBrooks Davis md.md_ealgo = CRYPTO_ALGORITHM_MIN - 1; 724e4b0a90eSBrooks Davis str = gctl_get_ascii(req, "aalgo"); 725e4b0a90eSBrooks Davis if (*str != '\0') { 726e4b0a90eSBrooks Davis if (version < G_ELI_VERSION_01) { 727e4b0a90eSBrooks Davis gctl_error(req, 728e4b0a90eSBrooks Davis "Data authentication is supported starting from version %u.", 729e4b0a90eSBrooks Davis G_ELI_VERSION_01); 730e4b0a90eSBrooks Davis return; 731e4b0a90eSBrooks Davis } 732e4b0a90eSBrooks Davis md.md_aalgo = g_eli_str2aalgo(str); 733e4b0a90eSBrooks Davis if (md.md_aalgo >= CRYPTO_ALGORITHM_MIN && 734e4b0a90eSBrooks Davis md.md_aalgo <= CRYPTO_ALGORITHM_MAX) { 735e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_AUTH; 736e4b0a90eSBrooks Davis } else { 737e4b0a90eSBrooks Davis /* 738e4b0a90eSBrooks Davis * For backward compatibility, check if the -a option 739e4b0a90eSBrooks Davis * was used to provide encryption algorithm. 740e4b0a90eSBrooks Davis */ 741e4b0a90eSBrooks Davis md.md_ealgo = g_eli_str2ealgo(str); 742e4b0a90eSBrooks Davis if (md.md_ealgo < CRYPTO_ALGORITHM_MIN || 743e4b0a90eSBrooks Davis md.md_ealgo > CRYPTO_ALGORITHM_MAX) { 744e4b0a90eSBrooks Davis gctl_error(req, 745e4b0a90eSBrooks Davis "Invalid authentication algorithm."); 746e4b0a90eSBrooks Davis return; 747e4b0a90eSBrooks Davis } else { 748e4b0a90eSBrooks Davis fprintf(stderr, "warning: The -e option, not " 749e4b0a90eSBrooks Davis "the -a option is now used to specify " 750e4b0a90eSBrooks Davis "encryption algorithm to use.\n"); 751e4b0a90eSBrooks Davis } 752e4b0a90eSBrooks Davis } 753e4b0a90eSBrooks Davis } 754e4b0a90eSBrooks Davis if (md.md_ealgo < CRYPTO_ALGORITHM_MIN || 755e4b0a90eSBrooks Davis md.md_ealgo > CRYPTO_ALGORITHM_MAX) { 756e4b0a90eSBrooks Davis str = gctl_get_ascii(req, "ealgo"); 757e4b0a90eSBrooks Davis if (*str == '\0') { 758e4b0a90eSBrooks Davis if (version < G_ELI_VERSION_05) 759e4b0a90eSBrooks Davis str = "aes-cbc"; 760e4b0a90eSBrooks Davis else 761e4b0a90eSBrooks Davis str = GELI_ENC_ALGO; 762e4b0a90eSBrooks Davis } 763e4b0a90eSBrooks Davis md.md_ealgo = g_eli_str2ealgo(str); 764e4b0a90eSBrooks Davis if (md.md_ealgo < CRYPTO_ALGORITHM_MIN || 765e4b0a90eSBrooks Davis md.md_ealgo > CRYPTO_ALGORITHM_MAX) { 766e4b0a90eSBrooks Davis gctl_error(req, "Invalid encryption algorithm."); 767e4b0a90eSBrooks Davis return; 768e4b0a90eSBrooks Davis } 769e4b0a90eSBrooks Davis if (md.md_ealgo == CRYPTO_CAMELLIA_CBC && 770e4b0a90eSBrooks Davis version < G_ELI_VERSION_04) { 771e4b0a90eSBrooks Davis gctl_error(req, 772e4b0a90eSBrooks Davis "Camellia-CBC algorithm is supported starting from version %u.", 773e4b0a90eSBrooks Davis G_ELI_VERSION_04); 774e4b0a90eSBrooks Davis return; 775e4b0a90eSBrooks Davis } 776e4b0a90eSBrooks Davis if (md.md_ealgo == CRYPTO_AES_XTS && 777e4b0a90eSBrooks Davis version < G_ELI_VERSION_05) { 778e4b0a90eSBrooks Davis gctl_error(req, 779e4b0a90eSBrooks Davis "AES-XTS algorithm is supported starting from version %u.", 780e4b0a90eSBrooks Davis G_ELI_VERSION_05); 781e4b0a90eSBrooks Davis return; 782e4b0a90eSBrooks Davis } 783e4b0a90eSBrooks Davis } 784e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "keylen"); 785e4b0a90eSBrooks Davis md.md_keylen = val; 786e4b0a90eSBrooks Davis md.md_keylen = g_eli_keylen(md.md_ealgo, md.md_keylen); 787e4b0a90eSBrooks Davis if (md.md_keylen == 0) { 788e4b0a90eSBrooks Davis gctl_error(req, "Invalid key length."); 789e4b0a90eSBrooks Davis return; 790e4b0a90eSBrooks Davis } 791e4b0a90eSBrooks Davis md.md_provsize = mediasize; 792e4b0a90eSBrooks Davis 793e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "iterations"); 794e4b0a90eSBrooks Davis if (val != -1) { 795e4b0a90eSBrooks Davis int nonewpassphrase; 796e4b0a90eSBrooks Davis 797e4b0a90eSBrooks Davis /* 798e4b0a90eSBrooks Davis * Don't allow to set iterations when there will be no 799e4b0a90eSBrooks Davis * passphrase. 800e4b0a90eSBrooks Davis */ 801e4b0a90eSBrooks Davis nonewpassphrase = gctl_get_int(req, "nonewpassphrase"); 802e4b0a90eSBrooks Davis if (nonewpassphrase) { 803e4b0a90eSBrooks Davis gctl_error(req, 804e4b0a90eSBrooks Davis "Options -i and -P are mutually exclusive."); 805e4b0a90eSBrooks Davis return; 806e4b0a90eSBrooks Davis } 807e4b0a90eSBrooks Davis } 808e4b0a90eSBrooks Davis md.md_iterations = val; 809e4b0a90eSBrooks Davis 810e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "sectorsize"); 811e4b0a90eSBrooks Davis if (val == 0) 812e4b0a90eSBrooks Davis md.md_sectorsize = secsize; 813e4b0a90eSBrooks Davis else { 814e4b0a90eSBrooks Davis if (val < 0 || (val % secsize) != 0 || !powerof2(val)) { 815e4b0a90eSBrooks Davis gctl_error(req, "Invalid sector size."); 816e4b0a90eSBrooks Davis return; 817e4b0a90eSBrooks Davis } 818e4b0a90eSBrooks Davis if (val > sysconf(_SC_PAGE_SIZE)) { 819e4b0a90eSBrooks Davis fprintf(stderr, 820e4b0a90eSBrooks Davis "warning: Using sectorsize bigger than the page size!\n"); 821e4b0a90eSBrooks Davis } 822e4b0a90eSBrooks Davis md.md_sectorsize = val; 823e4b0a90eSBrooks Davis } 824e4b0a90eSBrooks Davis 825e4b0a90eSBrooks Davis md.md_keys = 0x01; 826e4b0a90eSBrooks Davis arc4random_buf(md.md_salt, sizeof(md.md_salt)); 827e4b0a90eSBrooks Davis arc4random_buf(md.md_mkeys, sizeof(md.md_mkeys)); 828e4b0a90eSBrooks Davis 829e4b0a90eSBrooks Davis /* Generate user key. */ 830e4b0a90eSBrooks Davis if (eli_genkey(req, &md, key, true) == NULL) { 831e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 832e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 833e4b0a90eSBrooks Davis return; 834e4b0a90eSBrooks Davis } 835e4b0a90eSBrooks Davis 836e4b0a90eSBrooks Davis /* Encrypt the first and the only Master Key. */ 837e4b0a90eSBrooks Davis error = g_eli_mkey_encrypt(md.md_ealgo, key, md.md_keylen, md.md_mkeys); 838e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 839e4b0a90eSBrooks Davis if (error != 0) { 840e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 841e4b0a90eSBrooks Davis gctl_error(req, "Cannot encrypt Master Key: %s.", 842e4b0a90eSBrooks Davis strerror(error)); 843e4b0a90eSBrooks Davis return; 844e4b0a90eSBrooks Davis } 845e4b0a90eSBrooks Davis 846e4b0a90eSBrooks Davis eli_metadata_encode(&md, sector); 847e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 848e4b0a90eSBrooks Davis error = g_metadata_store(prov, sector, sizeof(sector)); 849e4b0a90eSBrooks Davis bzero(sector, sizeof(sector)); 850e4b0a90eSBrooks Davis if (error != 0) { 851e4b0a90eSBrooks Davis gctl_error(req, "Cannot store metadata on %s: %s.", prov, 852e4b0a90eSBrooks Davis strerror(error)); 853e4b0a90eSBrooks Davis return; 854e4b0a90eSBrooks Davis } 855e4b0a90eSBrooks Davis if (verbose) 856e4b0a90eSBrooks Davis printf("Metadata value stored on %s.\n", prov); 857e4b0a90eSBrooks Davis /* Backup metadata to a file. */ 858e4b0a90eSBrooks Davis str = gctl_get_ascii(req, "backupfile"); 859e4b0a90eSBrooks Davis if (str[0] != '\0') { 860e4b0a90eSBrooks Davis /* Backupfile given be the user, just copy it. */ 861e4b0a90eSBrooks Davis strlcpy(backfile, str, sizeof(backfile)); 862e4b0a90eSBrooks Davis } else { 863e4b0a90eSBrooks Davis /* Generate file name automatically. */ 864e4b0a90eSBrooks Davis const char *p = prov; 865e4b0a90eSBrooks Davis unsigned int i; 866e4b0a90eSBrooks Davis 867e4b0a90eSBrooks Davis if (strncmp(p, _PATH_DEV, sizeof(_PATH_DEV) - 1) == 0) 868e4b0a90eSBrooks Davis p += sizeof(_PATH_DEV) - 1; 869e4b0a90eSBrooks Davis snprintf(backfile, sizeof(backfile), "%s%s.eli", 870e4b0a90eSBrooks Davis GELI_BACKUP_DIR, p); 871e4b0a90eSBrooks Davis /* Replace all / with _. */ 872e4b0a90eSBrooks Davis for (i = strlen(GELI_BACKUP_DIR); backfile[i] != '\0'; i++) { 873e4b0a90eSBrooks Davis if (backfile[i] == '/') 874e4b0a90eSBrooks Davis backfile[i] = '_'; 875e4b0a90eSBrooks Davis } 876e4b0a90eSBrooks Davis } 877e4b0a90eSBrooks Davis if (strcmp(backfile, "none") != 0 && 878e4b0a90eSBrooks Davis eli_backup_create(req, prov, backfile) == 0) { 879e4b0a90eSBrooks Davis printf("\nMetadata backup can be found in %s and\n", backfile); 880e4b0a90eSBrooks Davis printf("can be restored with the following command:\n"); 881e4b0a90eSBrooks Davis printf("\n\t# geli restore %s %s\n\n", backfile, prov); 882e4b0a90eSBrooks Davis } 883e4b0a90eSBrooks Davis } 884e4b0a90eSBrooks Davis 885e4b0a90eSBrooks Davis static void 886e4b0a90eSBrooks Davis eli_attach(struct gctl_req *req) 887e4b0a90eSBrooks Davis { 888e4b0a90eSBrooks Davis struct g_eli_metadata md; 889e4b0a90eSBrooks Davis unsigned char key[G_ELI_USERKEYLEN]; 890e4b0a90eSBrooks Davis const char *prov; 891e4b0a90eSBrooks Davis off_t mediasize; 892e4b0a90eSBrooks Davis int nargs; 893e4b0a90eSBrooks Davis 894e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 895e4b0a90eSBrooks Davis if (nargs != 1) { 896e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 897e4b0a90eSBrooks Davis return; 898e4b0a90eSBrooks Davis } 899e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 900e4b0a90eSBrooks Davis 901e4b0a90eSBrooks Davis if (eli_metadata_read(req, prov, &md) == -1) 902e4b0a90eSBrooks Davis return; 903e4b0a90eSBrooks Davis 904e4b0a90eSBrooks Davis mediasize = g_get_mediasize(prov); 905e4b0a90eSBrooks Davis if (md.md_provsize != (uint64_t)mediasize) { 906e4b0a90eSBrooks Davis gctl_error(req, "Provider size mismatch."); 907e4b0a90eSBrooks Davis return; 908e4b0a90eSBrooks Davis } 909e4b0a90eSBrooks Davis 910e4b0a90eSBrooks Davis if (eli_genkey(req, &md, key, false) == NULL) { 911e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 912e4b0a90eSBrooks Davis return; 913e4b0a90eSBrooks Davis } 914e4b0a90eSBrooks Davis 915e4b0a90eSBrooks Davis gctl_ro_param(req, "key", sizeof(key), key); 916e4b0a90eSBrooks Davis if (gctl_issue(req) == NULL) { 917e4b0a90eSBrooks Davis if (verbose) 918e4b0a90eSBrooks Davis printf("Attached to %s.\n", prov); 919e4b0a90eSBrooks Davis } 920e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 921e4b0a90eSBrooks Davis } 922e4b0a90eSBrooks Davis 923e4b0a90eSBrooks Davis static void 924e4b0a90eSBrooks Davis eli_configure_detached(struct gctl_req *req, const char *prov, int boot, 925e4b0a90eSBrooks Davis int geliboot, int displaypass, int trim) 926e4b0a90eSBrooks Davis { 927e4b0a90eSBrooks Davis struct g_eli_metadata md; 928e4b0a90eSBrooks Davis bool changed = 0; 929e4b0a90eSBrooks Davis 930e4b0a90eSBrooks Davis if (eli_metadata_read(req, prov, &md) == -1) 931e4b0a90eSBrooks Davis return; 932e4b0a90eSBrooks Davis 933e4b0a90eSBrooks Davis if (boot == 1 && (md.md_flags & G_ELI_FLAG_BOOT)) { 934e4b0a90eSBrooks Davis if (verbose) 935e4b0a90eSBrooks Davis printf("BOOT flag already configured for %s.\n", prov); 936e4b0a90eSBrooks Davis } else if (boot == 0 && !(md.md_flags & G_ELI_FLAG_BOOT)) { 937e4b0a90eSBrooks Davis if (verbose) 938e4b0a90eSBrooks Davis printf("BOOT flag not configured for %s.\n", prov); 939e4b0a90eSBrooks Davis } else if (boot >= 0) { 940e4b0a90eSBrooks Davis if (boot) 941e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_BOOT; 942e4b0a90eSBrooks Davis else 943e4b0a90eSBrooks Davis md.md_flags &= ~G_ELI_FLAG_BOOT; 944e4b0a90eSBrooks Davis changed = 1; 945e4b0a90eSBrooks Davis } 946e4b0a90eSBrooks Davis 947e4b0a90eSBrooks Davis if (geliboot == 1 && (md.md_flags & G_ELI_FLAG_GELIBOOT)) { 948e4b0a90eSBrooks Davis if (verbose) 949e4b0a90eSBrooks Davis printf("GELIBOOT flag already configured for %s.\n", prov); 950e4b0a90eSBrooks Davis } else if (geliboot == 0 && !(md.md_flags & G_ELI_FLAG_GELIBOOT)) { 951e4b0a90eSBrooks Davis if (verbose) 952e4b0a90eSBrooks Davis printf("GELIBOOT flag not configured for %s.\n", prov); 953e4b0a90eSBrooks Davis } else if (geliboot >= 0) { 954e4b0a90eSBrooks Davis if (geliboot) 955e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_GELIBOOT; 956e4b0a90eSBrooks Davis else 957e4b0a90eSBrooks Davis md.md_flags &= ~G_ELI_FLAG_GELIBOOT; 958e4b0a90eSBrooks Davis changed = 1; 959e4b0a90eSBrooks Davis } 960e4b0a90eSBrooks Davis 961e4b0a90eSBrooks Davis if (displaypass == 1 && (md.md_flags & G_ELI_FLAG_GELIDISPLAYPASS)) { 962e4b0a90eSBrooks Davis if (verbose) 963e4b0a90eSBrooks Davis printf("GELIDISPLAYPASS flag already configured for %s.\n", prov); 964e4b0a90eSBrooks Davis } else if (displaypass == 0 && 965e4b0a90eSBrooks Davis !(md.md_flags & G_ELI_FLAG_GELIDISPLAYPASS)) { 966e4b0a90eSBrooks Davis if (verbose) 967e4b0a90eSBrooks Davis printf("GELIDISPLAYPASS flag not configured for %s.\n", prov); 968e4b0a90eSBrooks Davis } else if (displaypass >= 0) { 969e4b0a90eSBrooks Davis if (displaypass) 970e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_GELIDISPLAYPASS; 971e4b0a90eSBrooks Davis else 972e4b0a90eSBrooks Davis md.md_flags &= ~G_ELI_FLAG_GELIDISPLAYPASS; 973e4b0a90eSBrooks Davis changed = 1; 974e4b0a90eSBrooks Davis } 975e4b0a90eSBrooks Davis 976e4b0a90eSBrooks Davis if (trim == 0 && (md.md_flags & G_ELI_FLAG_NODELETE)) { 977e4b0a90eSBrooks Davis if (verbose) 978e4b0a90eSBrooks Davis printf("TRIM disable flag already configured for %s.\n", prov); 979e4b0a90eSBrooks Davis } else if (trim == 1 && !(md.md_flags & G_ELI_FLAG_NODELETE)) { 980e4b0a90eSBrooks Davis if (verbose) 981e4b0a90eSBrooks Davis printf("TRIM disable flag not configured for %s.\n", prov); 982e4b0a90eSBrooks Davis } else if (trim >= 0) { 983e4b0a90eSBrooks Davis if (trim) 984e4b0a90eSBrooks Davis md.md_flags &= ~G_ELI_FLAG_NODELETE; 985e4b0a90eSBrooks Davis else 986e4b0a90eSBrooks Davis md.md_flags |= G_ELI_FLAG_NODELETE; 987e4b0a90eSBrooks Davis changed = 1; 988e4b0a90eSBrooks Davis } 989e4b0a90eSBrooks Davis 990e4b0a90eSBrooks Davis if (changed) 991e4b0a90eSBrooks Davis eli_metadata_store(req, prov, &md); 992e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 993e4b0a90eSBrooks Davis } 994e4b0a90eSBrooks Davis 995e4b0a90eSBrooks Davis static void 996e4b0a90eSBrooks Davis eli_configure(struct gctl_req *req) 997e4b0a90eSBrooks Davis { 998e4b0a90eSBrooks Davis const char *prov; 999e4b0a90eSBrooks Davis bool boot, noboot, geliboot, nogeliboot, displaypass, nodisplaypass; 1000e4b0a90eSBrooks Davis bool trim, notrim; 1001e4b0a90eSBrooks Davis int doboot, dogeliboot, dodisplaypass, dotrim; 1002e4b0a90eSBrooks Davis int i, nargs; 1003e4b0a90eSBrooks Davis 1004e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1005e4b0a90eSBrooks Davis if (nargs == 0) { 1006e4b0a90eSBrooks Davis gctl_error(req, "Too few arguments."); 1007e4b0a90eSBrooks Davis return; 1008e4b0a90eSBrooks Davis } 1009e4b0a90eSBrooks Davis 1010e4b0a90eSBrooks Davis boot = gctl_get_int(req, "boot"); 1011e4b0a90eSBrooks Davis noboot = gctl_get_int(req, "noboot"); 1012e4b0a90eSBrooks Davis geliboot = gctl_get_int(req, "geliboot"); 1013e4b0a90eSBrooks Davis nogeliboot = gctl_get_int(req, "nogeliboot"); 1014e4b0a90eSBrooks Davis displaypass = gctl_get_int(req, "displaypass"); 1015e4b0a90eSBrooks Davis nodisplaypass = gctl_get_int(req, "nodisplaypass"); 1016e4b0a90eSBrooks Davis trim = gctl_get_int(req, "trim"); 1017e4b0a90eSBrooks Davis notrim = gctl_get_int(req, "notrim"); 1018e4b0a90eSBrooks Davis 1019e4b0a90eSBrooks Davis doboot = -1; 1020e4b0a90eSBrooks Davis if (boot && noboot) { 1021e4b0a90eSBrooks Davis gctl_error(req, "Options -b and -B are mutually exclusive."); 1022e4b0a90eSBrooks Davis return; 1023e4b0a90eSBrooks Davis } 1024e4b0a90eSBrooks Davis if (boot) 1025e4b0a90eSBrooks Davis doboot = 1; 1026e4b0a90eSBrooks Davis else if (noboot) 1027e4b0a90eSBrooks Davis doboot = 0; 1028e4b0a90eSBrooks Davis 1029e4b0a90eSBrooks Davis dogeliboot = -1; 1030e4b0a90eSBrooks Davis if (geliboot && nogeliboot) { 1031e4b0a90eSBrooks Davis gctl_error(req, "Options -g and -G are mutually exclusive."); 1032e4b0a90eSBrooks Davis return; 1033e4b0a90eSBrooks Davis } 1034e4b0a90eSBrooks Davis if (geliboot) 1035e4b0a90eSBrooks Davis dogeliboot = 1; 1036e4b0a90eSBrooks Davis else if (nogeliboot) 1037e4b0a90eSBrooks Davis dogeliboot = 0; 1038e4b0a90eSBrooks Davis 1039e4b0a90eSBrooks Davis dodisplaypass = -1; 1040e4b0a90eSBrooks Davis if (displaypass && nodisplaypass) { 1041e4b0a90eSBrooks Davis gctl_error(req, "Options -d and -D are mutually exclusive."); 1042e4b0a90eSBrooks Davis return; 1043e4b0a90eSBrooks Davis } 1044e4b0a90eSBrooks Davis if (displaypass) 1045e4b0a90eSBrooks Davis dodisplaypass = 1; 1046e4b0a90eSBrooks Davis else if (nodisplaypass) 1047e4b0a90eSBrooks Davis dodisplaypass = 0; 1048e4b0a90eSBrooks Davis 1049e4b0a90eSBrooks Davis dotrim = -1; 1050e4b0a90eSBrooks Davis if (trim && notrim) { 1051e4b0a90eSBrooks Davis gctl_error(req, "Options -t and -T are mutually exclusive."); 1052e4b0a90eSBrooks Davis return; 1053e4b0a90eSBrooks Davis } 1054e4b0a90eSBrooks Davis if (trim) 1055e4b0a90eSBrooks Davis dotrim = 1; 1056e4b0a90eSBrooks Davis else if (notrim) 1057e4b0a90eSBrooks Davis dotrim = 0; 1058e4b0a90eSBrooks Davis 1059e4b0a90eSBrooks Davis if (doboot == -1 && dogeliboot == -1 && dodisplaypass == -1 && 1060e4b0a90eSBrooks Davis dotrim == -1) { 1061e4b0a90eSBrooks Davis gctl_error(req, "No option given."); 1062e4b0a90eSBrooks Davis return; 1063e4b0a90eSBrooks Davis } 1064e4b0a90eSBrooks Davis 1065e4b0a90eSBrooks Davis /* First attached providers. */ 1066e4b0a90eSBrooks Davis gctl_issue(req); 1067e4b0a90eSBrooks Davis /* Now the rest. */ 1068e4b0a90eSBrooks Davis for (i = 0; i < nargs; i++) { 1069e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg%d", i); 1070e4b0a90eSBrooks Davis if (!eli_is_attached(prov)) { 1071e4b0a90eSBrooks Davis eli_configure_detached(req, prov, doboot, dogeliboot, 1072e4b0a90eSBrooks Davis dodisplaypass, dotrim); 1073e4b0a90eSBrooks Davis } 1074e4b0a90eSBrooks Davis } 1075e4b0a90eSBrooks Davis } 1076e4b0a90eSBrooks Davis 1077e4b0a90eSBrooks Davis static void 1078e4b0a90eSBrooks Davis eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md) 1079e4b0a90eSBrooks Davis { 1080e4b0a90eSBrooks Davis unsigned char key[G_ELI_USERKEYLEN]; 1081e4b0a90eSBrooks Davis intmax_t val, old = 0; 1082e4b0a90eSBrooks Davis int error; 1083e4b0a90eSBrooks Davis 1084e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "iterations"); 1085e4b0a90eSBrooks Davis /* Check if iterations number should be changed. */ 1086e4b0a90eSBrooks Davis if (val != -1) 1087e4b0a90eSBrooks Davis md->md_iterations = val; 1088e4b0a90eSBrooks Davis else 1089e4b0a90eSBrooks Davis old = md->md_iterations; 1090e4b0a90eSBrooks Davis 1091e4b0a90eSBrooks Davis /* Generate key for Master Key encryption. */ 1092e4b0a90eSBrooks Davis if (eli_genkey(req, md, key, true) == NULL) { 1093e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1094e4b0a90eSBrooks Davis return; 1095e4b0a90eSBrooks Davis } 1096e4b0a90eSBrooks Davis /* 1097e4b0a90eSBrooks Davis * If number of iterations has changed, but wasn't given as a 1098e4b0a90eSBrooks Davis * command-line argument, update the request. 1099e4b0a90eSBrooks Davis */ 1100e4b0a90eSBrooks Davis if (val == -1 && md->md_iterations != old) { 1101e4b0a90eSBrooks Davis error = gctl_change_param(req, "iterations", sizeof(intmax_t), 1102e4b0a90eSBrooks Davis &md->md_iterations); 1103e4b0a90eSBrooks Davis assert(error == 0); 1104e4b0a90eSBrooks Davis } 1105e4b0a90eSBrooks Davis 1106e4b0a90eSBrooks Davis gctl_ro_param(req, "key", sizeof(key), key); 1107e4b0a90eSBrooks Davis gctl_issue(req); 1108e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1109e4b0a90eSBrooks Davis } 1110e4b0a90eSBrooks Davis 1111e4b0a90eSBrooks Davis static void 1112e4b0a90eSBrooks Davis eli_setkey_detached(struct gctl_req *req, const char *prov, 1113e4b0a90eSBrooks Davis struct g_eli_metadata *md) 1114e4b0a90eSBrooks Davis { 1115e4b0a90eSBrooks Davis unsigned char key[G_ELI_USERKEYLEN], mkey[G_ELI_DATAIVKEYLEN]; 1116e4b0a90eSBrooks Davis unsigned char *mkeydst; 1117e4b0a90eSBrooks Davis unsigned int nkey; 1118e4b0a90eSBrooks Davis intmax_t val; 1119e4b0a90eSBrooks Davis int error; 1120e4b0a90eSBrooks Davis 1121e4b0a90eSBrooks Davis if (md->md_keys == 0) { 1122e4b0a90eSBrooks Davis gctl_error(req, "No valid keys on %s.", prov); 1123e4b0a90eSBrooks Davis return; 1124e4b0a90eSBrooks Davis } 1125e4b0a90eSBrooks Davis 1126e4b0a90eSBrooks Davis /* Generate key for Master Key decryption. */ 1127e4b0a90eSBrooks Davis if (eli_genkey(req, md, key, false) == NULL) { 1128e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1129e4b0a90eSBrooks Davis return; 1130e4b0a90eSBrooks Davis } 1131e4b0a90eSBrooks Davis 1132e4b0a90eSBrooks Davis /* Decrypt Master Key. */ 1133e4b0a90eSBrooks Davis error = g_eli_mkey_decrypt_any(md, key, mkey, &nkey); 1134e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1135e4b0a90eSBrooks Davis if (error != 0) { 1136e4b0a90eSBrooks Davis bzero(md, sizeof(*md)); 1137e4b0a90eSBrooks Davis if (error == -1) 1138e4b0a90eSBrooks Davis gctl_error(req, "Wrong key for %s.", prov); 1139e4b0a90eSBrooks Davis else /* if (error > 0) */ { 1140e4b0a90eSBrooks Davis gctl_error(req, "Cannot decrypt Master Key: %s.", 1141e4b0a90eSBrooks Davis strerror(error)); 1142e4b0a90eSBrooks Davis } 1143e4b0a90eSBrooks Davis return; 1144e4b0a90eSBrooks Davis } 1145e4b0a90eSBrooks Davis if (verbose) 1146e4b0a90eSBrooks Davis printf("Decrypted Master Key %u.\n", nkey); 1147e4b0a90eSBrooks Davis 1148e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "keyno"); 1149e4b0a90eSBrooks Davis if (val != -1) 1150e4b0a90eSBrooks Davis nkey = val; 1151e4b0a90eSBrooks Davis #if 0 1152e4b0a90eSBrooks Davis else 1153e4b0a90eSBrooks Davis ; /* Use the key number which was found during decryption. */ 1154e4b0a90eSBrooks Davis #endif 1155e4b0a90eSBrooks Davis if (nkey >= G_ELI_MAXMKEYS) { 1156e4b0a90eSBrooks Davis gctl_error(req, "Invalid '%s' argument.", "keyno"); 1157e4b0a90eSBrooks Davis return; 1158e4b0a90eSBrooks Davis } 1159e4b0a90eSBrooks Davis 1160e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "iterations"); 1161e4b0a90eSBrooks Davis /* Check if iterations number should and can be changed. */ 1162e4b0a90eSBrooks Davis if (val != -1 && md->md_iterations == -1) { 1163e4b0a90eSBrooks Davis md->md_iterations = val; 1164e4b0a90eSBrooks Davis } else if (val != -1 && val != md->md_iterations) { 1165e4b0a90eSBrooks Davis if (bitcount32(md->md_keys) != 1) { 1166e4b0a90eSBrooks Davis gctl_error(req, "To be able to use '-i' option, only " 1167e4b0a90eSBrooks Davis "one key can be defined."); 1168e4b0a90eSBrooks Davis return; 1169e4b0a90eSBrooks Davis } 1170e4b0a90eSBrooks Davis if (md->md_keys != (1 << nkey)) { 1171e4b0a90eSBrooks Davis gctl_error(req, "Only already defined key can be " 1172e4b0a90eSBrooks Davis "changed when '-i' option is used."); 1173e4b0a90eSBrooks Davis return; 1174e4b0a90eSBrooks Davis } 1175e4b0a90eSBrooks Davis md->md_iterations = val; 1176e4b0a90eSBrooks Davis } 1177e4b0a90eSBrooks Davis 1178e4b0a90eSBrooks Davis mkeydst = md->md_mkeys + nkey * G_ELI_MKEYLEN; 1179e4b0a90eSBrooks Davis md->md_keys |= (1 << nkey); 1180e4b0a90eSBrooks Davis 1181e4b0a90eSBrooks Davis bcopy(mkey, mkeydst, sizeof(mkey)); 1182e4b0a90eSBrooks Davis bzero(mkey, sizeof(mkey)); 1183e4b0a90eSBrooks Davis 1184e4b0a90eSBrooks Davis /* Generate key for Master Key encryption. */ 1185e4b0a90eSBrooks Davis if (eli_genkey(req, md, key, true) == NULL) { 1186e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1187e4b0a90eSBrooks Davis bzero(md, sizeof(*md)); 1188e4b0a90eSBrooks Davis return; 1189e4b0a90eSBrooks Davis } 1190e4b0a90eSBrooks Davis 1191e4b0a90eSBrooks Davis /* Encrypt the Master-Key with the new key. */ 1192e4b0a90eSBrooks Davis error = g_eli_mkey_encrypt(md->md_ealgo, key, md->md_keylen, mkeydst); 1193e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1194e4b0a90eSBrooks Davis if (error != 0) { 1195e4b0a90eSBrooks Davis bzero(md, sizeof(*md)); 1196e4b0a90eSBrooks Davis gctl_error(req, "Cannot encrypt Master Key: %s.", 1197e4b0a90eSBrooks Davis strerror(error)); 1198e4b0a90eSBrooks Davis return; 1199e4b0a90eSBrooks Davis } 1200e4b0a90eSBrooks Davis 1201e4b0a90eSBrooks Davis /* Store metadata with fresh key. */ 1202e4b0a90eSBrooks Davis eli_metadata_store(req, prov, md); 1203e4b0a90eSBrooks Davis bzero(md, sizeof(*md)); 1204e4b0a90eSBrooks Davis } 1205e4b0a90eSBrooks Davis 1206e4b0a90eSBrooks Davis static void 1207e4b0a90eSBrooks Davis eli_setkey(struct gctl_req *req) 1208e4b0a90eSBrooks Davis { 1209e4b0a90eSBrooks Davis struct g_eli_metadata md; 1210e4b0a90eSBrooks Davis const char *prov; 1211e4b0a90eSBrooks Davis int nargs; 1212e4b0a90eSBrooks Davis 1213e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1214e4b0a90eSBrooks Davis if (nargs != 1) { 1215e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1216e4b0a90eSBrooks Davis return; 1217e4b0a90eSBrooks Davis } 1218e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 1219e4b0a90eSBrooks Davis 1220e4b0a90eSBrooks Davis if (eli_metadata_read(req, prov, &md) == -1) 1221e4b0a90eSBrooks Davis return; 1222e4b0a90eSBrooks Davis 1223e4b0a90eSBrooks Davis if (eli_is_attached(prov)) 1224e4b0a90eSBrooks Davis eli_setkey_attached(req, &md); 1225e4b0a90eSBrooks Davis else 1226e4b0a90eSBrooks Davis eli_setkey_detached(req, prov, &md); 1227e4b0a90eSBrooks Davis 1228e4b0a90eSBrooks Davis if (req->error == NULL || req->error[0] == '\0') { 1229e4b0a90eSBrooks Davis printf("Note, that the master key encrypted with old keys " 1230e4b0a90eSBrooks Davis "and/or passphrase may still exists in a metadata backup " 1231e4b0a90eSBrooks Davis "file.\n"); 1232e4b0a90eSBrooks Davis } 1233e4b0a90eSBrooks Davis } 1234e4b0a90eSBrooks Davis 1235e4b0a90eSBrooks Davis static void 1236e4b0a90eSBrooks Davis eli_delkey_attached(struct gctl_req *req, const char *prov __unused) 1237e4b0a90eSBrooks Davis { 1238e4b0a90eSBrooks Davis 1239e4b0a90eSBrooks Davis gctl_issue(req); 1240e4b0a90eSBrooks Davis } 1241e4b0a90eSBrooks Davis 1242e4b0a90eSBrooks Davis static void 1243e4b0a90eSBrooks Davis eli_delkey_detached(struct gctl_req *req, const char *prov) 1244e4b0a90eSBrooks Davis { 1245e4b0a90eSBrooks Davis struct g_eli_metadata md; 1246e4b0a90eSBrooks Davis unsigned char *mkeydst; 1247e4b0a90eSBrooks Davis unsigned int nkey; 1248e4b0a90eSBrooks Davis intmax_t val; 1249e4b0a90eSBrooks Davis bool all, force; 1250e4b0a90eSBrooks Davis 1251e4b0a90eSBrooks Davis if (eli_metadata_read(req, prov, &md) == -1) 1252e4b0a90eSBrooks Davis return; 1253e4b0a90eSBrooks Davis 1254e4b0a90eSBrooks Davis all = gctl_get_int(req, "all"); 1255e4b0a90eSBrooks Davis if (all) 1256e4b0a90eSBrooks Davis arc4random_buf(md.md_mkeys, sizeof(md.md_mkeys)); 1257e4b0a90eSBrooks Davis else { 1258e4b0a90eSBrooks Davis force = gctl_get_int(req, "force"); 1259e4b0a90eSBrooks Davis val = gctl_get_intmax(req, "keyno"); 1260e4b0a90eSBrooks Davis if (val == -1) { 1261e4b0a90eSBrooks Davis gctl_error(req, "Key number has to be specified."); 1262e4b0a90eSBrooks Davis return; 1263e4b0a90eSBrooks Davis } 1264e4b0a90eSBrooks Davis nkey = val; 1265e4b0a90eSBrooks Davis if (nkey >= G_ELI_MAXMKEYS) { 1266e4b0a90eSBrooks Davis gctl_error(req, "Invalid '%s' argument.", "keyno"); 1267e4b0a90eSBrooks Davis return; 1268e4b0a90eSBrooks Davis } 1269e4b0a90eSBrooks Davis if (!(md.md_keys & (1 << nkey)) && !force) { 1270e4b0a90eSBrooks Davis gctl_error(req, "Master Key %u is not set.", nkey); 1271e4b0a90eSBrooks Davis return; 1272e4b0a90eSBrooks Davis } 1273e4b0a90eSBrooks Davis md.md_keys &= ~(1 << nkey); 1274e4b0a90eSBrooks Davis if (md.md_keys == 0 && !force) { 1275e4b0a90eSBrooks Davis gctl_error(req, "This is the last Master Key. Use '-f' " 1276e4b0a90eSBrooks Davis "option if you really want to remove it."); 1277e4b0a90eSBrooks Davis return; 1278e4b0a90eSBrooks Davis } 1279e4b0a90eSBrooks Davis mkeydst = md.md_mkeys + nkey * G_ELI_MKEYLEN; 1280e4b0a90eSBrooks Davis arc4random_buf(mkeydst, G_ELI_MKEYLEN); 1281e4b0a90eSBrooks Davis } 1282e4b0a90eSBrooks Davis 1283e4b0a90eSBrooks Davis eli_metadata_store(req, prov, &md); 1284e4b0a90eSBrooks Davis bzero(&md, sizeof(md)); 1285e4b0a90eSBrooks Davis } 1286e4b0a90eSBrooks Davis 1287e4b0a90eSBrooks Davis static void 1288e4b0a90eSBrooks Davis eli_delkey(struct gctl_req *req) 1289e4b0a90eSBrooks Davis { 1290e4b0a90eSBrooks Davis const char *prov; 1291e4b0a90eSBrooks Davis int nargs; 1292e4b0a90eSBrooks Davis 1293e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1294e4b0a90eSBrooks Davis if (nargs != 1) { 1295e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1296e4b0a90eSBrooks Davis return; 1297e4b0a90eSBrooks Davis } 1298e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 1299e4b0a90eSBrooks Davis 1300e4b0a90eSBrooks Davis if (eli_is_attached(prov)) 1301e4b0a90eSBrooks Davis eli_delkey_attached(req, prov); 1302e4b0a90eSBrooks Davis else 1303e4b0a90eSBrooks Davis eli_delkey_detached(req, prov); 1304e4b0a90eSBrooks Davis } 1305e4b0a90eSBrooks Davis 1306e4b0a90eSBrooks Davis static void 1307e4b0a90eSBrooks Davis eli_resume(struct gctl_req *req) 1308e4b0a90eSBrooks Davis { 1309e4b0a90eSBrooks Davis struct g_eli_metadata md; 1310e4b0a90eSBrooks Davis unsigned char key[G_ELI_USERKEYLEN]; 1311e4b0a90eSBrooks Davis const char *prov; 1312e4b0a90eSBrooks Davis off_t mediasize; 1313e4b0a90eSBrooks Davis int nargs; 1314e4b0a90eSBrooks Davis 1315e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1316e4b0a90eSBrooks Davis if (nargs != 1) { 1317e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1318e4b0a90eSBrooks Davis return; 1319e4b0a90eSBrooks Davis } 1320e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 1321e4b0a90eSBrooks Davis 1322e4b0a90eSBrooks Davis if (eli_metadata_read(req, prov, &md) == -1) 1323e4b0a90eSBrooks Davis return; 1324e4b0a90eSBrooks Davis 1325e4b0a90eSBrooks Davis mediasize = g_get_mediasize(prov); 1326e4b0a90eSBrooks Davis if (md.md_provsize != (uint64_t)mediasize) { 1327e4b0a90eSBrooks Davis gctl_error(req, "Provider size mismatch."); 1328e4b0a90eSBrooks Davis return; 1329e4b0a90eSBrooks Davis } 1330e4b0a90eSBrooks Davis 1331e4b0a90eSBrooks Davis if (eli_genkey(req, &md, key, false) == NULL) { 1332e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1333e4b0a90eSBrooks Davis return; 1334e4b0a90eSBrooks Davis } 1335e4b0a90eSBrooks Davis 1336e4b0a90eSBrooks Davis gctl_ro_param(req, "key", sizeof(key), key); 1337e4b0a90eSBrooks Davis if (gctl_issue(req) == NULL) { 1338e4b0a90eSBrooks Davis if (verbose) 1339e4b0a90eSBrooks Davis printf("Resumed %s.\n", prov); 1340e4b0a90eSBrooks Davis } 1341e4b0a90eSBrooks Davis bzero(key, sizeof(key)); 1342e4b0a90eSBrooks Davis } 1343e4b0a90eSBrooks Davis 1344e4b0a90eSBrooks Davis static int 1345e4b0a90eSBrooks Davis eli_trash_metadata(struct gctl_req *req, const char *prov, int fd, off_t offset) 1346e4b0a90eSBrooks Davis { 1347e4b0a90eSBrooks Davis unsigned int overwrites; 1348e4b0a90eSBrooks Davis unsigned char *sector; 1349e4b0a90eSBrooks Davis ssize_t size; 1350e4b0a90eSBrooks Davis int error; 1351e4b0a90eSBrooks Davis 1352e4b0a90eSBrooks Davis size = sizeof(overwrites); 1353e4b0a90eSBrooks Davis if (sysctlbyname("kern.geom.eli.overwrites", &overwrites, &size, 1354e4b0a90eSBrooks Davis NULL, 0) == -1 || overwrites == 0) { 1355e4b0a90eSBrooks Davis overwrites = G_ELI_OVERWRITES; 1356e4b0a90eSBrooks Davis } 1357e4b0a90eSBrooks Davis 1358e4b0a90eSBrooks Davis size = g_sectorsize(fd); 1359e4b0a90eSBrooks Davis if (size <= 0) { 1360e4b0a90eSBrooks Davis gctl_error(req, "Cannot obtain provider sector size %s: %s.", 1361e4b0a90eSBrooks Davis prov, strerror(errno)); 1362e4b0a90eSBrooks Davis return (-1); 1363e4b0a90eSBrooks Davis } 1364e4b0a90eSBrooks Davis sector = malloc(size); 1365e4b0a90eSBrooks Davis if (sector == NULL) { 1366e4b0a90eSBrooks Davis gctl_error(req, "Cannot allocate %zd bytes of memory.", size); 1367e4b0a90eSBrooks Davis return (-1); 1368e4b0a90eSBrooks Davis } 1369e4b0a90eSBrooks Davis 1370e4b0a90eSBrooks Davis error = 0; 1371e4b0a90eSBrooks Davis do { 1372e4b0a90eSBrooks Davis arc4random_buf(sector, size); 1373e4b0a90eSBrooks Davis if (pwrite(fd, sector, size, offset) != size) { 1374e4b0a90eSBrooks Davis if (error == 0) 1375e4b0a90eSBrooks Davis error = errno; 1376e4b0a90eSBrooks Davis } 1377e4b0a90eSBrooks Davis (void)g_flush(fd); 1378e4b0a90eSBrooks Davis } while (--overwrites > 0); 1379e4b0a90eSBrooks Davis free(sector); 1380e4b0a90eSBrooks Davis if (error != 0) { 1381e4b0a90eSBrooks Davis gctl_error(req, "Cannot trash metadata on provider %s: %s.", 1382e4b0a90eSBrooks Davis prov, strerror(error)); 1383e4b0a90eSBrooks Davis return (-1); 1384e4b0a90eSBrooks Davis } 1385e4b0a90eSBrooks Davis return (0); 1386e4b0a90eSBrooks Davis } 1387e4b0a90eSBrooks Davis 1388e4b0a90eSBrooks Davis static void 1389e4b0a90eSBrooks Davis eli_kill_detached(struct gctl_req *req, const char *prov) 1390e4b0a90eSBrooks Davis { 1391e4b0a90eSBrooks Davis off_t offset; 1392e4b0a90eSBrooks Davis int fd; 1393e4b0a90eSBrooks Davis 1394e4b0a90eSBrooks Davis /* 1395e4b0a90eSBrooks Davis * NOTE: Maybe we should verify if this is geli provider first, 1396e4b0a90eSBrooks Davis * but 'kill' command is quite critical so better don't waste 1397e4b0a90eSBrooks Davis * the time. 1398e4b0a90eSBrooks Davis */ 1399e4b0a90eSBrooks Davis #if 0 1400e4b0a90eSBrooks Davis error = g_metadata_read(prov, (unsigned char *)&md, sizeof(md), 1401e4b0a90eSBrooks Davis G_ELI_MAGIC); 1402e4b0a90eSBrooks Davis if (error != 0) { 1403e4b0a90eSBrooks Davis gctl_error(req, "Cannot read metadata from %s: %s.", prov, 1404e4b0a90eSBrooks Davis strerror(error)); 1405e4b0a90eSBrooks Davis return; 1406e4b0a90eSBrooks Davis } 1407e4b0a90eSBrooks Davis #endif 1408e4b0a90eSBrooks Davis 1409e4b0a90eSBrooks Davis fd = g_open(prov, 1); 1410e4b0a90eSBrooks Davis if (fd == -1) { 1411e4b0a90eSBrooks Davis gctl_error(req, "Cannot open provider %s: %s.", prov, 1412e4b0a90eSBrooks Davis strerror(errno)); 1413e4b0a90eSBrooks Davis return; 1414e4b0a90eSBrooks Davis } 1415e4b0a90eSBrooks Davis offset = g_mediasize(fd) - g_sectorsize(fd); 1416e4b0a90eSBrooks Davis if (offset <= 0) { 1417e4b0a90eSBrooks Davis gctl_error(req, 1418e4b0a90eSBrooks Davis "Cannot obtain media size or sector size for provider %s: %s.", 1419e4b0a90eSBrooks Davis prov, strerror(errno)); 1420e4b0a90eSBrooks Davis (void)g_close(fd); 1421e4b0a90eSBrooks Davis return; 1422e4b0a90eSBrooks Davis } 1423e4b0a90eSBrooks Davis (void)eli_trash_metadata(req, prov, fd, offset); 1424e4b0a90eSBrooks Davis (void)g_close(fd); 1425e4b0a90eSBrooks Davis } 1426e4b0a90eSBrooks Davis 1427e4b0a90eSBrooks Davis static void 1428e4b0a90eSBrooks Davis eli_kill(struct gctl_req *req) 1429e4b0a90eSBrooks Davis { 1430e4b0a90eSBrooks Davis const char *prov; 1431e4b0a90eSBrooks Davis int i, nargs, all; 1432e4b0a90eSBrooks Davis 1433e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1434e4b0a90eSBrooks Davis all = gctl_get_int(req, "all"); 1435e4b0a90eSBrooks Davis if (!all && nargs == 0) { 1436e4b0a90eSBrooks Davis gctl_error(req, "Too few arguments."); 1437e4b0a90eSBrooks Davis return; 1438e4b0a90eSBrooks Davis } 1439e4b0a90eSBrooks Davis /* 1440e4b0a90eSBrooks Davis * How '-a' option combine with a list of providers: 1441e4b0a90eSBrooks Davis * Delete Master Keys from all attached providers: 1442e4b0a90eSBrooks Davis * geli kill -a 1443e4b0a90eSBrooks Davis * Delete Master Keys from all attached providers and from 1444e4b0a90eSBrooks Davis * detached da0 and da1: 1445e4b0a90eSBrooks Davis * geli kill -a da0 da1 1446e4b0a90eSBrooks Davis * Delete Master Keys from (attached or detached) da0 and da1: 1447e4b0a90eSBrooks Davis * geli kill da0 da1 1448e4b0a90eSBrooks Davis */ 1449e4b0a90eSBrooks Davis 1450e4b0a90eSBrooks Davis /* First detached providers. */ 1451e4b0a90eSBrooks Davis for (i = 0; i < nargs; i++) { 1452e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg%d", i); 1453e4b0a90eSBrooks Davis if (!eli_is_attached(prov)) 1454e4b0a90eSBrooks Davis eli_kill_detached(req, prov); 1455e4b0a90eSBrooks Davis } 1456e4b0a90eSBrooks Davis /* Now attached providers. */ 1457e4b0a90eSBrooks Davis gctl_issue(req); 1458e4b0a90eSBrooks Davis } 1459e4b0a90eSBrooks Davis 1460e4b0a90eSBrooks Davis static int 1461e4b0a90eSBrooks Davis eli_backup_create(struct gctl_req *req, const char *prov, const char *file) 1462e4b0a90eSBrooks Davis { 1463e4b0a90eSBrooks Davis unsigned char *sector; 1464e4b0a90eSBrooks Davis ssize_t secsize; 1465e4b0a90eSBrooks Davis int error, filefd, ret; 1466e4b0a90eSBrooks Davis 1467e4b0a90eSBrooks Davis ret = -1; 1468e4b0a90eSBrooks Davis filefd = -1; 1469e4b0a90eSBrooks Davis sector = NULL; 1470e4b0a90eSBrooks Davis secsize = 0; 1471e4b0a90eSBrooks Davis 1472e4b0a90eSBrooks Davis secsize = g_get_sectorsize(prov); 1473e4b0a90eSBrooks Davis if (secsize == 0) { 1474e4b0a90eSBrooks Davis gctl_error(req, "Cannot get informations about %s: %s.", prov, 1475e4b0a90eSBrooks Davis strerror(errno)); 1476e4b0a90eSBrooks Davis goto out; 1477e4b0a90eSBrooks Davis } 1478e4b0a90eSBrooks Davis sector = malloc(secsize); 1479e4b0a90eSBrooks Davis if (sector == NULL) { 1480e4b0a90eSBrooks Davis gctl_error(req, "Cannot allocate memory."); 1481e4b0a90eSBrooks Davis goto out; 1482e4b0a90eSBrooks Davis } 1483e4b0a90eSBrooks Davis /* Read metadata from the provider. */ 1484e4b0a90eSBrooks Davis error = g_metadata_read(prov, sector, secsize, G_ELI_MAGIC); 1485e4b0a90eSBrooks Davis if (error != 0) { 1486e4b0a90eSBrooks Davis gctl_error(req, "Unable to read metadata from %s: %s.", prov, 1487e4b0a90eSBrooks Davis strerror(error)); 1488e4b0a90eSBrooks Davis goto out; 1489e4b0a90eSBrooks Davis } 1490e4b0a90eSBrooks Davis 1491e4b0a90eSBrooks Davis filefd = open(file, O_WRONLY | O_TRUNC | O_CREAT, 0600); 1492e4b0a90eSBrooks Davis if (filefd == -1) { 1493e4b0a90eSBrooks Davis gctl_error(req, "Unable to open %s: %s.", file, 1494e4b0a90eSBrooks Davis strerror(errno)); 1495e4b0a90eSBrooks Davis goto out; 1496e4b0a90eSBrooks Davis } 1497e4b0a90eSBrooks Davis /* Write metadata to the destination file. */ 1498e4b0a90eSBrooks Davis if (write(filefd, sector, secsize) != secsize) { 1499e4b0a90eSBrooks Davis gctl_error(req, "Unable to write to %s: %s.", file, 1500e4b0a90eSBrooks Davis strerror(errno)); 1501e4b0a90eSBrooks Davis (void)close(filefd); 1502e4b0a90eSBrooks Davis (void)unlink(file); 1503e4b0a90eSBrooks Davis goto out; 1504e4b0a90eSBrooks Davis } 1505e4b0a90eSBrooks Davis (void)fsync(filefd); 1506e4b0a90eSBrooks Davis (void)close(filefd); 1507e4b0a90eSBrooks Davis /* Success. */ 1508e4b0a90eSBrooks Davis ret = 0; 1509e4b0a90eSBrooks Davis out: 1510e4b0a90eSBrooks Davis if (sector != NULL) { 1511e4b0a90eSBrooks Davis bzero(sector, secsize); 1512e4b0a90eSBrooks Davis free(sector); 1513e4b0a90eSBrooks Davis } 1514e4b0a90eSBrooks Davis return (ret); 1515e4b0a90eSBrooks Davis } 1516e4b0a90eSBrooks Davis 1517e4b0a90eSBrooks Davis static void 1518e4b0a90eSBrooks Davis eli_backup(struct gctl_req *req) 1519e4b0a90eSBrooks Davis { 1520e4b0a90eSBrooks Davis const char *file, *prov; 1521e4b0a90eSBrooks Davis int nargs; 1522e4b0a90eSBrooks Davis 1523e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1524e4b0a90eSBrooks Davis if (nargs != 2) { 1525e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1526e4b0a90eSBrooks Davis return; 1527e4b0a90eSBrooks Davis } 1528e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 1529e4b0a90eSBrooks Davis file = gctl_get_ascii(req, "arg1"); 1530e4b0a90eSBrooks Davis 1531e4b0a90eSBrooks Davis eli_backup_create(req, prov, file); 1532e4b0a90eSBrooks Davis } 1533e4b0a90eSBrooks Davis 1534e4b0a90eSBrooks Davis static void 1535e4b0a90eSBrooks Davis eli_restore(struct gctl_req *req) 1536e4b0a90eSBrooks Davis { 1537e4b0a90eSBrooks Davis struct g_eli_metadata md; 1538e4b0a90eSBrooks Davis const char *file, *prov; 1539e4b0a90eSBrooks Davis off_t mediasize; 1540e4b0a90eSBrooks Davis int nargs; 1541e4b0a90eSBrooks Davis 1542e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1543e4b0a90eSBrooks Davis if (nargs != 2) { 1544e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1545e4b0a90eSBrooks Davis return; 1546e4b0a90eSBrooks Davis } 1547e4b0a90eSBrooks Davis file = gctl_get_ascii(req, "arg0"); 1548e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg1"); 1549e4b0a90eSBrooks Davis 1550e4b0a90eSBrooks Davis /* Read metadata from the backup file. */ 1551e4b0a90eSBrooks Davis if (eli_metadata_read(req, file, &md) == -1) 1552e4b0a90eSBrooks Davis return; 1553e4b0a90eSBrooks Davis /* Obtain provider's mediasize. */ 1554e4b0a90eSBrooks Davis mediasize = g_get_mediasize(prov); 1555e4b0a90eSBrooks Davis if (mediasize == 0) { 1556e4b0a90eSBrooks Davis gctl_error(req, "Cannot get informations about %s: %s.", prov, 1557e4b0a90eSBrooks Davis strerror(errno)); 1558e4b0a90eSBrooks Davis return; 1559e4b0a90eSBrooks Davis } 1560e4b0a90eSBrooks Davis /* Check if the provider size has changed since we did the backup. */ 1561e4b0a90eSBrooks Davis if (md.md_provsize != (uint64_t)mediasize) { 1562e4b0a90eSBrooks Davis if (gctl_get_int(req, "force")) { 1563e4b0a90eSBrooks Davis md.md_provsize = mediasize; 1564e4b0a90eSBrooks Davis } else { 1565e4b0a90eSBrooks Davis gctl_error(req, "Provider size mismatch: " 1566e4b0a90eSBrooks Davis "wrong backup file?"); 1567e4b0a90eSBrooks Davis return; 1568e4b0a90eSBrooks Davis } 1569e4b0a90eSBrooks Davis } 1570e4b0a90eSBrooks Davis /* Write metadata to the provider. */ 1571e4b0a90eSBrooks Davis (void)eli_metadata_store(req, prov, &md); 1572e4b0a90eSBrooks Davis } 1573e4b0a90eSBrooks Davis 1574e4b0a90eSBrooks Davis static void 1575e4b0a90eSBrooks Davis eli_resize(struct gctl_req *req) 1576e4b0a90eSBrooks Davis { 1577e4b0a90eSBrooks Davis struct g_eli_metadata md; 1578e4b0a90eSBrooks Davis const char *prov; 1579e4b0a90eSBrooks Davis unsigned char *sector; 1580e4b0a90eSBrooks Davis ssize_t secsize; 1581e4b0a90eSBrooks Davis off_t mediasize, oldsize; 1582e4b0a90eSBrooks Davis int error, nargs, provfd; 1583e4b0a90eSBrooks Davis 1584e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1585e4b0a90eSBrooks Davis if (nargs != 1) { 1586e4b0a90eSBrooks Davis gctl_error(req, "Invalid number of arguments."); 1587e4b0a90eSBrooks Davis return; 1588e4b0a90eSBrooks Davis } 1589e4b0a90eSBrooks Davis prov = gctl_get_ascii(req, "arg0"); 1590e4b0a90eSBrooks Davis 1591e4b0a90eSBrooks Davis provfd = -1; 1592e4b0a90eSBrooks Davis sector = NULL; 1593e4b0a90eSBrooks Davis secsize = 0; 1594e4b0a90eSBrooks Davis 1595e4b0a90eSBrooks Davis provfd = g_open(prov, 1); 1596e4b0a90eSBrooks Davis if (provfd == -1) { 1597e4b0a90eSBrooks Davis gctl_error(req, "Cannot open %s: %s.", prov, strerror(errno)); 1598e4b0a90eSBrooks Davis goto out; 1599e4b0a90eSBrooks Davis } 1600e4b0a90eSBrooks Davis 1601e4b0a90eSBrooks Davis mediasize = g_mediasize(provfd); 1602e4b0a90eSBrooks Davis secsize = g_sectorsize(provfd); 1603e4b0a90eSBrooks Davis if (mediasize == -1 || secsize == -1) { 1604e4b0a90eSBrooks Davis gctl_error(req, "Cannot get information about %s: %s.", prov, 1605e4b0a90eSBrooks Davis strerror(errno)); 1606e4b0a90eSBrooks Davis goto out; 1607e4b0a90eSBrooks Davis } 1608e4b0a90eSBrooks Davis 1609e4b0a90eSBrooks Davis sector = malloc(secsize); 1610e4b0a90eSBrooks Davis if (sector == NULL) { 1611e4b0a90eSBrooks Davis gctl_error(req, "Cannot allocate memory."); 1612e4b0a90eSBrooks Davis goto out; 1613e4b0a90eSBrooks Davis } 1614e4b0a90eSBrooks Davis 1615e4b0a90eSBrooks Davis oldsize = gctl_get_intmax(req, "oldsize"); 1616e4b0a90eSBrooks Davis if (oldsize < 0 || oldsize > mediasize) { 1617e4b0a90eSBrooks Davis gctl_error(req, "Invalid oldsize: Out of range."); 1618e4b0a90eSBrooks Davis goto out; 1619e4b0a90eSBrooks Davis } 1620e4b0a90eSBrooks Davis if (oldsize == mediasize) { 1621e4b0a90eSBrooks Davis gctl_error(req, "Size hasn't changed."); 1622e4b0a90eSBrooks Davis goto out; 1623e4b0a90eSBrooks Davis } 1624e4b0a90eSBrooks Davis 1625e4b0a90eSBrooks Davis /* Read metadata from the 'oldsize' offset. */ 1626e4b0a90eSBrooks Davis if (pread(provfd, sector, secsize, oldsize - secsize) != secsize) { 1627e4b0a90eSBrooks Davis gctl_error(req, "Cannot read old metadata: %s.", 1628e4b0a90eSBrooks Davis strerror(errno)); 1629e4b0a90eSBrooks Davis goto out; 1630e4b0a90eSBrooks Davis } 1631e4b0a90eSBrooks Davis 1632e4b0a90eSBrooks Davis /* Check if this sector contains geli metadata. */ 1633e4b0a90eSBrooks Davis error = eli_metadata_decode(sector, &md); 1634e4b0a90eSBrooks Davis switch (error) { 1635e4b0a90eSBrooks Davis case 0: 1636e4b0a90eSBrooks Davis break; 1637e4b0a90eSBrooks Davis case EOPNOTSUPP: 1638e4b0a90eSBrooks Davis gctl_error(req, 1639e4b0a90eSBrooks Davis "Provider's %s metadata version %u is too new.\n" 1640e4b0a90eSBrooks Davis "geli: The highest supported version is %u.", 1641e4b0a90eSBrooks Davis prov, (unsigned int)md.md_version, G_ELI_VERSION); 1642e4b0a90eSBrooks Davis goto out; 1643e4b0a90eSBrooks Davis case EINVAL: 1644e4b0a90eSBrooks Davis gctl_error(req, "Inconsistent provider's %s metadata.", prov); 1645e4b0a90eSBrooks Davis goto out; 1646e4b0a90eSBrooks Davis default: 1647e4b0a90eSBrooks Davis gctl_error(req, 1648e4b0a90eSBrooks Davis "Unexpected error while decoding provider's %s metadata: %s.", 1649e4b0a90eSBrooks Davis prov, strerror(error)); 1650e4b0a90eSBrooks Davis goto out; 1651e4b0a90eSBrooks Davis } 1652e4b0a90eSBrooks Davis 1653e4b0a90eSBrooks Davis /* 1654e4b0a90eSBrooks Davis * If the old metadata doesn't have a correct provider size, refuse 1655e4b0a90eSBrooks Davis * to resize. 1656e4b0a90eSBrooks Davis */ 1657e4b0a90eSBrooks Davis if (md.md_provsize != (uint64_t)oldsize) { 1658e4b0a90eSBrooks Davis gctl_error(req, "Provider size mismatch at oldsize."); 1659e4b0a90eSBrooks Davis goto out; 1660e4b0a90eSBrooks Davis } 1661e4b0a90eSBrooks Davis 1662e4b0a90eSBrooks Davis /* 1663e4b0a90eSBrooks Davis * Update the old metadata with the current provider size and write 1664e4b0a90eSBrooks Davis * it back to the correct place on the provider. 1665e4b0a90eSBrooks Davis */ 1666e4b0a90eSBrooks Davis md.md_provsize = mediasize; 1667e4b0a90eSBrooks Davis /* Write metadata to the provider. */ 1668e4b0a90eSBrooks Davis (void)eli_metadata_store(req, prov, &md); 1669e4b0a90eSBrooks Davis /* Now trash the old metadata. */ 1670e4b0a90eSBrooks Davis (void)eli_trash_metadata(req, prov, provfd, oldsize - secsize); 1671e4b0a90eSBrooks Davis out: 1672e4b0a90eSBrooks Davis if (provfd != -1) 1673e4b0a90eSBrooks Davis (void)g_close(provfd); 1674e4b0a90eSBrooks Davis if (sector != NULL) { 1675e4b0a90eSBrooks Davis bzero(sector, secsize); 1676e4b0a90eSBrooks Davis free(sector); 1677e4b0a90eSBrooks Davis } 1678e4b0a90eSBrooks Davis } 1679e4b0a90eSBrooks Davis 1680e4b0a90eSBrooks Davis static void 1681e4b0a90eSBrooks Davis eli_version(struct gctl_req *req) 1682e4b0a90eSBrooks Davis { 1683e4b0a90eSBrooks Davis struct g_eli_metadata md; 1684e4b0a90eSBrooks Davis const char *name; 1685e4b0a90eSBrooks Davis unsigned int version; 1686e4b0a90eSBrooks Davis int error, i, nargs; 1687e4b0a90eSBrooks Davis 1688e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1689e4b0a90eSBrooks Davis 1690e4b0a90eSBrooks Davis if (nargs == 0) { 1691e4b0a90eSBrooks Davis unsigned int kernver; 1692e4b0a90eSBrooks Davis ssize_t size; 1693e4b0a90eSBrooks Davis 1694e4b0a90eSBrooks Davis size = sizeof(kernver); 1695e4b0a90eSBrooks Davis if (sysctlbyname("kern.geom.eli.version", &kernver, &size, 1696e4b0a90eSBrooks Davis NULL, 0) == -1) { 1697e4b0a90eSBrooks Davis warn("Unable to obtain GELI kernel version"); 1698e4b0a90eSBrooks Davis } else { 1699e4b0a90eSBrooks Davis printf("kernel: %u\n", kernver); 1700e4b0a90eSBrooks Davis } 1701e4b0a90eSBrooks Davis printf("userland: %u\n", G_ELI_VERSION); 1702e4b0a90eSBrooks Davis return; 1703e4b0a90eSBrooks Davis } 1704e4b0a90eSBrooks Davis 1705e4b0a90eSBrooks Davis for (i = 0; i < nargs; i++) { 1706e4b0a90eSBrooks Davis name = gctl_get_ascii(req, "arg%d", i); 1707e4b0a90eSBrooks Davis error = g_metadata_read(name, (unsigned char *)&md, 1708e4b0a90eSBrooks Davis sizeof(md), G_ELI_MAGIC); 1709e4b0a90eSBrooks Davis if (error != 0) { 1710e4b0a90eSBrooks Davis warn("%s: Unable to read metadata: %s.", name, 1711e4b0a90eSBrooks Davis strerror(error)); 1712e4b0a90eSBrooks Davis gctl_error(req, "Not fully done."); 1713e4b0a90eSBrooks Davis continue; 1714e4b0a90eSBrooks Davis } 1715e4b0a90eSBrooks Davis version = le32dec(&md.md_version); 1716e4b0a90eSBrooks Davis printf("%s: %u\n", name, version); 1717e4b0a90eSBrooks Davis } 1718e4b0a90eSBrooks Davis } 1719e4b0a90eSBrooks Davis 1720e4b0a90eSBrooks Davis static void 1721e4b0a90eSBrooks Davis eli_clear(struct gctl_req *req) 1722e4b0a90eSBrooks Davis { 1723e4b0a90eSBrooks Davis const char *name; 1724e4b0a90eSBrooks Davis int error, i, nargs; 1725e4b0a90eSBrooks Davis 1726e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1727e4b0a90eSBrooks Davis if (nargs < 1) { 1728e4b0a90eSBrooks Davis gctl_error(req, "Too few arguments."); 1729e4b0a90eSBrooks Davis return; 1730e4b0a90eSBrooks Davis } 1731e4b0a90eSBrooks Davis 1732e4b0a90eSBrooks Davis for (i = 0; i < nargs; i++) { 1733e4b0a90eSBrooks Davis name = gctl_get_ascii(req, "arg%d", i); 1734e4b0a90eSBrooks Davis error = g_metadata_clear(name, G_ELI_MAGIC); 1735e4b0a90eSBrooks Davis if (error != 0) { 1736e4b0a90eSBrooks Davis fprintf(stderr, "Cannot clear metadata on %s: %s.\n", 1737e4b0a90eSBrooks Davis name, strerror(error)); 1738e4b0a90eSBrooks Davis gctl_error(req, "Not fully done."); 1739e4b0a90eSBrooks Davis continue; 1740e4b0a90eSBrooks Davis } 1741e4b0a90eSBrooks Davis if (verbose) 1742e4b0a90eSBrooks Davis printf("Metadata cleared on %s.\n", name); 1743e4b0a90eSBrooks Davis } 1744e4b0a90eSBrooks Davis } 1745e4b0a90eSBrooks Davis 1746e4b0a90eSBrooks Davis static void 1747e4b0a90eSBrooks Davis eli_dump(struct gctl_req *req) 1748e4b0a90eSBrooks Davis { 1749e4b0a90eSBrooks Davis struct g_eli_metadata md; 1750e4b0a90eSBrooks Davis const char *name; 1751e4b0a90eSBrooks Davis int i, nargs; 1752e4b0a90eSBrooks Davis 1753e4b0a90eSBrooks Davis nargs = gctl_get_int(req, "nargs"); 1754e4b0a90eSBrooks Davis if (nargs < 1) { 1755e4b0a90eSBrooks Davis gctl_error(req, "Too few arguments."); 1756e4b0a90eSBrooks Davis return; 1757e4b0a90eSBrooks Davis } 1758e4b0a90eSBrooks Davis 1759e4b0a90eSBrooks Davis for (i = 0; i < nargs; i++) { 1760e4b0a90eSBrooks Davis name = gctl_get_ascii(req, "arg%d", i); 1761e4b0a90eSBrooks Davis if (eli_metadata_read(NULL, name, &md) == -1) { 1762e4b0a90eSBrooks Davis gctl_error(req, "Not fully done."); 1763e4b0a90eSBrooks Davis continue; 1764e4b0a90eSBrooks Davis } 1765e4b0a90eSBrooks Davis printf("Metadata on %s:\n", name); 1766e4b0a90eSBrooks Davis eli_metadata_dump(&md); 1767e4b0a90eSBrooks Davis printf("\n"); 1768e4b0a90eSBrooks Davis } 1769e4b0a90eSBrooks Davis } 1770