dropbear_initrd_encrypt/encryptssh_hook

   1 # vim: set ft=sh:
   2 # TODO this one needs some work to work with lots of different
   3 #       encryption schemes
   4 run_hook ()
   5 {
   6   /sbin/modprobe -a -q dm-crypt >/dev/null 2>&1
   7   if [ -e "/sys/class/misc/device-mapper" ]; then
   8     if [ ! -e "/dev/mapper/control" ]; then
   9       /bin/mknod "/dev/mapper/control" c $(cat /sys/class/misc/device-mapper/dev | sed 's|:| |')
  10     fi
  11     [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
  12
  13     # Get keyfile if specified
  14     ckeyfile="/crypto_keyfile.bin"
  15     if [ "x${cryptkey}" != "x" ]; then
  16       ckdev="$(echo "${cryptkey}" | cut -d: -f1)"
  17       ckarg1="$(echo "${cryptkey}" | cut -d: -f2)"
  18       ckarg2="$(echo "${cryptkey}" | cut -d: -f3)"
  19
  20       if poll_device "${ckdev}" ${rootdelay}; then
  21         case ${ckarg1} in
  22           *[!0-9]*)
  23             # Use a file on the device
  24             # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
  25             mkdir /ckey
  26             mount -r -t ${ckarg1} ${ckdev} /ckey
  27             dd if=/ckey/${ckarg2} of=${ckeyfile} >/dev/null 2>&1
  28             umount /ckey
  29           ;;
  30           *)
  31             # Read raw data from the block device
  32             # ckarg1 is numeric: ckarg1=offset, ckarg2=length
  33             dd if=${ckdev} of=${ckeyfile} bs=1 skip=${ckarg1} count=${ckarg2} >/dev/null 2>&1
  34           ;;
  35         esac
  36       fi
  37
  38       [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
  39     fi
  40
  41     if [ -n "${cryptdevice}" ]; then
  42       DEPRECATED_CRYPT=0
  43       cryptdev="$(echo "${cryptdevice}" | cut -d: -f1)"
  44       cryptname="$(echo "${cryptdevice}" | cut -d: -f2)"
  45     else
  46       DEPRECATED_CRYPT=1
  47       cryptdev="${root}"
  48       cryptname="root"
  49     fi
  50
  51     echo ${cryptdev} > /.cryptdev
  52     echo ${cryptname} > /.cryptname
  53
  54     warn_deprecated() {
  55       echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
  56       echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
  57     }
  58
  59     if  poll_device "${cryptdev}" ${rootdelay}; then
  60       if /sbin/cryptsetup isLuks ${cryptdev} >/dev/null 2>&1; then
  61         [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
  62         dopassphrase=1
  63         # If keyfile exists, try to use that
  64         if [ -f ${ckeyfile} ]; then
  65           if eval /sbin/cryptsetup --key-file ${ckeyfile} luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; then
  66             dopassphrase=0
  67           else
  68             echo "Invalid keyfile. Reverting to passphrase."
  69           fi
  70         fi
  71         # Ask for a passphrase
  72         if [ ${dopassphrase} -gt 0 ]; then
  73           echo ""
  74           echo "A password is required to access the ${cryptname} volume:"
  75
  76           #loop until we get a real password
  77           while ! eval /sbin/cryptsetup luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; do
  78            if [ -f /.done ]; then
  79              break
  80            fi
  81
  82            sleep 2;
  83           done
  84
  85           killall dropbear
  86           . /ip_opts
  87           /sbin/ip addr flush dev "$device"
  88           /sbin/ip link set down "$device"
  89
  90           if [ -f /.done ]; then
  91             rm /.done
  92           fi
  93
  94           if [ -f /.cryptdev ]; then
  95             rm /.cryptdev
  96           fi
  97
  98           if [ -f /.cryptname ]; then
  99             rm /.cryptname
 100           fi
 101
 102           umount /dev/pts
 103           rm -R /dev/pts
 104
 105           if [ -f /var/log/lastlog ]; then
 106             rm /var/log/lastlog
 107           fi
 108
 109           if [ -f /var/run/dropbear.pid ]; then
 110             rm /var/run/dropbear.pid
 111           fi
 112         fi
 113
 114         if [ -e "/dev/mapper/${cryptname}" ]; then
 115           if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 116             export root="/dev/mapper/root"
 117           fi
 118         else
 119           err "Password succeeded, but ${cryptname} creation failed, aborting..."
 120           exit 1
 121         fi
 122       elif [ -n "${crypto}" ]; then
 123         [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
 124         msg "Non-LUKS encrypted device found..."
 125
 126         if [ $# -ne 5 ]; then
 127           err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
 128           err "Non-LUKS decryption not attempted..."
 129           return 1
 130         fi
 131
 132         exe="/sbin/cryptsetup create ${cryptname} ${cryptdev}"
 133         tmp=$(echo "${crypto}" | cut -d: -f1)
 134         [ -n "${tmp}" ] && exe="${exe} --hash \"${tmp}\""
 135         tmp=$(echo "${crypto}" | cut -d: -f2)
 136         [ -n "${tmp}" ] && exe="${exe} --cipher \"${tmp}\""
 137         tmp=$(echo "${crypto}" | cut -d: -f3)
 138         [ -n "${tmp}" ] && exe="${exe} --key-size \"${tmp}\""
 139         tmp=$(echo "${crypto}" | cut -d: -f4)
 140         [ -n "${tmp}" ] && exe="${exe} --offset \"${tmp}\""
 141         tmp=$(echo "${crypto}" | cut -d: -f5)
 142         [ -n "${tmp}" ] && exe="${exe} --skip \"${tmp}\""
 143
 144         if [ -f ${ckeyfile} ]; then
 145           exe="${exe} --key-file ${ckeyfile}"
 146         else
 147           exe="${exe} --verify-passphrase"
 148           echo ""
 149           echo "A password is required to access the ${cryptname} volume:"
 150         fi
 151
 152         eval "${exe} ${CSQUIET}"
 153
 154         if [ $? -ne 0 ]; then
 155           err "Non-LUKS device decryption failed. verify format: "
 156           err "      crypto=hash:cipher:keysize:offset:skip"
 157           exit 1
 158         fi
 159
 160         if [ -e "/dev/mapper/${cryptname}" ]; then
 161           if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 162             export root="/dev/mapper/root"
 163           fi
 164         else
 165           err "Password succeeded, but ${cryptname} creation failed, aborting..."
 166           exit 1
 167         fi
 168       else
 169         err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
 170       fi
 171     fi
 172
 173     rm -f ${ckeyfile}
 174   fi
 175 }