mirror of
https://github.com/libguestfs/libguestfs.git
synced 2026-03-21 22:53:37 +00:00
c456ea0332
This commit deprecates luks-open/luks-open-ro/luks-close for the more generic sounding names cryptsetup-open/cryptsetup-close, which also correspond directly to the cryptsetup commands. The optional cryptsetup-open readonly flag is used to replace the functionality of luks-open-ro. The optional cryptsetup-open crypttype parameter can be used to select the type (corresponding to cryptsetup open --type), which allows us to open BitLocker-encrypted disks with no extra effort. As a convenience the crypttype parameter may be omitted, and libguestfs will use a heuristic (based on vfs-type output) to try to determine the correct type to use. The deprecated functions and the new functions are all (re-)written in OCaml. There is no new test here, unfortunately. It would be nice to test Windows BitLocker support in this new API, however the Linux tools do not support creating BitLocker disks, and while it is possible to create one under Windows, the smallest compressed disk I could create is 37M because of a mixture of the minimum support size for BitLocker disks and the fact that encrypted parts of NTFS cannot be compressed. Also synchronise with common module.
79 lines
2.7 KiB
OCaml
79 lines
2.7 KiB
OCaml
(* guestfs-inspection
|
|
* Copyright (C) 2009-2020 Red Hat Inc.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License along
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*)
|
|
|
|
open Printf
|
|
open Unix
|
|
|
|
open Std_utils
|
|
|
|
open Utils
|
|
|
|
let cryptsetup_open ?(readonly = false) ?crypttype device key mapname =
|
|
(* Sanity check: /dev/mapper/mapname must not exist already. Note
|
|
* that the device-mapper control device (/dev/mapper/control) is
|
|
* always there, so you can't ever have mapname == "control".
|
|
*)
|
|
let devmapper = sprintf "/dev/mapper/%s" mapname in
|
|
if is_block_device devmapper then
|
|
failwithf "%s: device already exists" devmapper;
|
|
|
|
(* Heuristically determine the encryption type. *)
|
|
let crypttype =
|
|
match crypttype with
|
|
| Some s -> s
|
|
| None ->
|
|
let t = Blkid.vfs_type (Mountable.of_device device) in
|
|
match t with
|
|
| "crypto_LUKS" -> "luks"
|
|
| "BitLocker" -> "bitlk"
|
|
| _ ->
|
|
failwithf "%s: unknown encrypted device type" t in
|
|
|
|
(* Write the key to a temporary file. *)
|
|
let keyfile, chan = Filename.open_temp_file "crypt" ".key" in
|
|
output_string chan key;
|
|
close_out chan;
|
|
|
|
let args = ref [] in
|
|
List.push_back_list args ["-d"; keyfile];
|
|
if readonly then List.push_back args "--readonly";
|
|
List.push_back_list args ["open"; device; mapname; "--type"; crypttype];
|
|
|
|
(* Make sure we always remove the temporary file. *)
|
|
protect ~f:(fun () -> ignore (command "cryptsetup" !args))
|
|
~finally:(fun () -> unlink keyfile);
|
|
|
|
udev_settle ()
|
|
|
|
let cryptsetup_close device =
|
|
(* Must be /dev/mapper/... *)
|
|
if not (String.is_prefix device "/dev/mapper/") then
|
|
failwithf "%s: you must call this on the /dev/mapper device created by cryptsetup-open" device;
|
|
|
|
let mapname = String.sub device 12 (String.length device - 12) in
|
|
ignore (command "cryptsetup" ["close"; mapname]);
|
|
|
|
udev_settle ()
|
|
|
|
(* Deprecated APIs for backwards compatibility. *)
|
|
let luks_open device key mapname =
|
|
cryptsetup_open ~crypttype:"luks" device key mapname
|
|
let luks_open_ro device key mapname =
|
|
cryptsetup_open ~crypttype:"luks" ~readonly:true device key mapname
|
|
let luks_close = cryptsetup_close
|