cgdconfig.c revision 1.12
1 /* $NetBSD: cgdconfig.c,v 1.12 2004/08/13 15:03:57 tv Exp $ */ 2 3 /*- 4 * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Roland C. Dowdeswell. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by the NetBSD 21 * Foundation, Inc. and its contributors. 22 * 4. Neither the name of The NetBSD Foundation nor the names of its 23 * contributors may be used to endorse or promote products derived 24 * from this software without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 27 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 28 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 29 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 30 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 31 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 36 * POSSIBILITY OF SUCH DAMAGE. 37 */ 38 39 #include <sys/cdefs.h> 40 #ifndef lint 41 __COPYRIGHT( 42 "@(#) Copyright (c) 2002, 2003\ 43 The NetBSD Foundation, Inc. All rights reserved."); 44 __RCSID("$NetBSD: cgdconfig.c,v 1.12 2004/08/13 15:03:57 tv Exp $"); 45 #endif 46 47 #include <err.h> 48 #include <errno.h> 49 #include <fcntl.h> 50 #include <libgen.h> 51 #include <stdio.h> 52 #include <stdlib.h> 53 #include <string.h> 54 #include <unistd.h> 55 #include <util.h> 56 57 #include <sys/ioctl.h> 58 #include <sys/disklabel.h> 59 #include <sys/param.h> 60 61 #include <dev/cgdvar.h> 62 63 #include <ufs/ffs/fs.h> 64 65 #include "params.h" 66 #include "pkcs5_pbkdf2.h" 67 #include "utils.h" 68 69 #define CGDCONFIG_DIR "/etc/cgd" 70 #define CGDCONFIG_CFILE CGDCONFIG_DIR "/cgd.conf" 71 72 #define ACTION_CONFIGURE 0x1 /* configure, with paramsfile */ 73 #define ACTION_UNCONFIGURE 0x2 /* unconfigure */ 74 #define ACTION_GENERATE 0x3 /* generate a paramsfile */ 75 #define ACTION_GENERATE_CONVERT 0x4 /* generate a ``dup'' paramsfile */ 76 #define ACTION_CONFIGALL 0x5 /* configure all from config file */ 77 #define ACTION_UNCONFIGALL 0x6 /* unconfigure all from config file */ 78 #define ACTION_CONFIGSTDIN 0x7 /* configure, key from stdin */ 79 80 /* if nflag is set, do not configure/unconfigure the cgd's */ 81 82 int nflag = 0; 83 84 static int configure(int, char **, struct params *, int); 85 static int configure_stdin(struct params *, int argc, char **); 86 static int generate(struct params *, int, char **, const char *); 87 static int generate_convert(struct params *, int, char **, const char *); 88 static int unconfigure(int, char **, struct params *, int); 89 static int do_all(const char *, int, char **, 90 int (*)(int, char **, struct params *, int)); 91 92 #define CONFIG_FLAGS_FROMALL 1 /* called from configure_all() */ 93 #define CONFIG_FLAGS_FROMMAIN 2 /* called from main() */ 94 95 static int configure_params(int, const char *, const char *, 96 struct params *); 97 static bits_t *getkey(const char *, struct keygen *, int); 98 static bits_t *getkey_storedkey(const char *, struct keygen *, int); 99 static bits_t *getkey_randomkey(const char *, struct keygen *, int, int); 100 static bits_t *getkey_pkcs5_pbkdf2(const char *, struct keygen *, int, int); 101 static int opendisk_werror(const char *, char *, int); 102 static int unconfigure_fd(int); 103 static int verify(struct params *, int); 104 static int verify_disklabel(int); 105 static int verify_ffs(int); 106 static int verify_reenter(struct params *); 107 108 static void usage(void); 109 110 /* Verbose Framework */ 111 int verbose = 0; 112 113 #define VERBOSE(x,y) if (verbose >= x) y 114 #define VPRINTF(x,y) if (verbose >= x) printf y 115 116 static void 117 usage(void) 118 { 119 120 fprintf(stderr, "usage: %s [-nv] [-V vmeth] cgd dev [paramsfile]\n", 121 getprogname()); 122 fprintf(stderr, " %s -C [-nv] [-f configfile]\n", getprogname()); 123 fprintf(stderr, " %s -U [-nv] [-f configfile]\n", getprogname()); 124 fprintf(stderr, " %s -G [-nv] [-i ivmeth] [-k kgmeth] " 125 "[-o outfile] paramsfile\n", getprogname()); 126 fprintf(stderr, " %s -g [-nv] [-i ivmeth] [-k kgmeth] " 127 "[-o outfile] alg [keylen]\n", getprogname()); 128 fprintf(stderr, " %s -s [-nv] [-i ivmeth] cgd dev alg " 129 "[keylen]\n", getprogname()); 130 fprintf(stderr, " %s -u [-nv] cgd\n", getprogname()); 131 exit(1); 132 } 133 134 int 135 main(int argc, char **argv) 136 { 137 struct params *p; 138 struct params *tp; 139 struct keygen *kg; 140 int action = ACTION_CONFIGURE; 141 int actions = 0; 142 int ch; 143 char cfile[FILENAME_MAX] = ""; 144 char outfile[FILENAME_MAX] = ""; 145 146 setprogname(*argv); 147 p = params_new(); 148 kg = NULL; 149 150 while ((ch = getopt(argc, argv, "CGUV:b:f:gi:k:no:usv")) != -1) 151 switch (ch) { 152 case 'C': 153 action = ACTION_CONFIGALL; 154 actions++; 155 break; 156 case 'G': 157 action = ACTION_GENERATE_CONVERT; 158 actions++; 159 break; 160 case 'U': 161 action = ACTION_UNCONFIGALL; 162 actions++; 163 break; 164 case 'V': 165 tp = params_verify_method(string_fromcharstar(optarg)); 166 if (!tp) 167 usage(); 168 p = params_combine(p, tp); 169 break; 170 case 'b': 171 tp = params_bsize(atoi(optarg)); 172 if (!tp) 173 usage(); 174 p = params_combine(p, tp); 175 break; 176 case 'f': 177 strlcpy(cfile, optarg, sizeof(cfile)); 178 break; 179 case 'g': 180 action = ACTION_GENERATE; 181 actions++; 182 break; 183 case 'i': 184 tp = params_ivmeth(string_fromcharstar(optarg)); 185 p = params_combine(p, tp); 186 break; 187 case 'k': 188 kg = keygen_method(string_fromcharstar(optarg)); 189 if (!kg) 190 usage(); 191 keygen_addlist(&p->keygen, kg); 192 break; 193 case 'n': 194 nflag = 1; 195 break; 196 case 'o': 197 strlcpy(outfile, optarg, sizeof(outfile)); 198 break; 199 case 's': 200 action = ACTION_CONFIGSTDIN; 201 actions++; 202 break; 203 204 case 'u': 205 action = ACTION_UNCONFIGURE; 206 actions++; 207 break; 208 case 'v': 209 verbose++; 210 break; 211 default: 212 usage(); 213 /* NOTREACHED */ 214 } 215 216 argc -= optind; 217 argv += optind; 218 219 /* validate the consistency of the arguments */ 220 221 if (actions > 1) 222 usage(); 223 224 switch (action) { 225 case ACTION_CONFIGURE: 226 return configure(argc, argv, p, CONFIG_FLAGS_FROMMAIN); 227 case ACTION_UNCONFIGURE: 228 return unconfigure(argc, argv, NULL, CONFIG_FLAGS_FROMMAIN); 229 case ACTION_GENERATE: 230 return generate(p, argc, argv, outfile); 231 case ACTION_GENERATE_CONVERT: 232 return generate_convert(p, argc, argv, outfile); 233 case ACTION_CONFIGALL: 234 return do_all(cfile, argc, argv, configure); 235 case ACTION_UNCONFIGALL: 236 return do_all(cfile, argc, argv, unconfigure); 237 case ACTION_CONFIGSTDIN: 238 return configure_stdin(p, argc, argv); 239 default: 240 errx(EXIT_FAILURE, "undefined action"); 241 } 242 /* NOTREACHED */ 243 } 244 245 static bits_t * 246 getkey(const char *dev, struct keygen *kg, int len) 247 { 248 bits_t *ret = NULL; 249 bits_t *tmp; 250 251 VPRINTF(3, ("getkey(\"%s\", %p, %d) called\n", dev, kg, len)); 252 for (; kg; kg=kg->next) { 253 switch (kg->kg_method) { 254 case KEYGEN_STOREDKEY: 255 tmp = getkey_storedkey(dev, kg, len); 256 break; 257 case KEYGEN_RANDOMKEY: 258 tmp = getkey_randomkey(dev, kg, len, 1); 259 break; 260 case KEYGEN_URANDOMKEY: 261 tmp = getkey_randomkey(dev, kg, len, 0); 262 break; 263 case KEYGEN_PKCS5_PBKDF2_SHA1: 264 tmp = getkey_pkcs5_pbkdf2(dev, kg, len, 0); 265 break; 266 /* provide backwards compatibility for old config files */ 267 case KEYGEN_PKCS5_PBKDF2_OLD: 268 tmp = getkey_pkcs5_pbkdf2(dev, kg, len, 1); 269 break; 270 default: 271 warnx("unrecognised keygen method %d in getkey()", 272 kg->kg_method); 273 if (ret) 274 bits_free(ret); 275 return NULL; 276 } 277 278 if (ret) 279 ret = bits_xor_d(tmp, ret); 280 else 281 ret = tmp; 282 } 283 284 return ret; 285 } 286 287 /*ARGSUSED*/ 288 static bits_t * 289 getkey_storedkey(const char *target, struct keygen *kg, int keylen) 290 { 291 292 return bits_dup(kg->kg_key); 293 } 294 295 /*ARGSUSED*/ 296 static bits_t * 297 getkey_randomkey(const char *target, struct keygen *kg, int keylen, int hard) 298 { 299 300 return bits_getrandombits(keylen, hard); 301 } 302 303 /*ARGSUSED*/ 304 /* 305 * XXX take, and pass through, a compat flag that indicates whether we 306 * provide backwards compatibility with a previous bug. The previous 307 * behaviour is indicated by the keygen method pkcs5_pbkdf2, and a 308 * non-zero compat flag. The new default, and correct keygen method is 309 * called pcks5_pbkdf2/sha1. When the old method is removed, so will 310 * be the compat argument. 311 */ 312 static bits_t * 313 getkey_pkcs5_pbkdf2(const char *target, struct keygen *kg, int keylen, int compat) 314 { 315 bits_t *ret; 316 char *passp; 317 char buf[1024]; 318 u_int8_t *tmp; 319 320 snprintf(buf, sizeof(buf), "%s's passphrase:", target); 321 passp = getpass(buf); 322 if (pkcs5_pbkdf2(&tmp, BITS2BYTES(keylen), passp, strlen(passp), 323 bits_getbuf(kg->kg_salt), BITS2BYTES(bits_len(kg->kg_salt)), 324 kg->kg_iterations, compat)) { 325 warnx("failed to generate PKCS#5 PBKDF2 key"); 326 return NULL; 327 } 328 329 ret = bits_new(tmp, keylen); 330 kg->kg_key = bits_dup(ret); 331 free(tmp); 332 return ret; 333 } 334 335 /*ARGSUSED*/ 336 static int 337 unconfigure(int argc, char **argv, struct params *inparams, int flags) 338 { 339 int fd; 340 int ret; 341 char buf[MAXPATHLEN] = ""; 342 343 /* only complain about additional arguments, if called from main() */ 344 if (flags == CONFIG_FLAGS_FROMMAIN && argc != 1) 345 usage(); 346 347 /* if called from do_all(), then ensure that 2 or 3 args exist */ 348 if (flags == CONFIG_FLAGS_FROMALL && (argc < 2 || argc > 3)) 349 return -1; 350 351 fd = opendisk(*argv, O_RDWR, buf, sizeof(buf), 1); 352 if (fd == -1) { 353 warn("can't open cgd \"%s\", \"%s\"", *argv, buf); 354 355 /* this isn't fatal with nflag != 0 */ 356 if (!nflag) 357 return errno; 358 } 359 360 VPRINTF(1, ("%s (%s): clearing\n", *argv, buf)); 361 362 if (nflag) 363 return 0; 364 365 ret = unconfigure_fd(fd); 366 close(fd); 367 return ret; 368 } 369 370 static int 371 unconfigure_fd(int fd) 372 { 373 struct cgd_ioctl ci; 374 int ret; 375 376 ret = ioctl(fd, CGDIOCCLR, &ci); 377 if (ret == -1) { 378 perror("ioctl"); 379 return -1; 380 } 381 382 return 0; 383 } 384 385 /*ARGSUSED*/ 386 static int 387 configure(int argc, char **argv, struct params *inparams, int flags) 388 { 389 struct params *p; 390 int fd; 391 int ret; 392 char pfile[FILENAME_MAX]; 393 char cgdname[PATH_MAX]; 394 395 switch (argc) { 396 case 2: 397 strlcpy(pfile, CGDCONFIG_DIR, FILENAME_MAX); 398 strlcat(pfile, "/", FILENAME_MAX); 399 strlcat(pfile, basename(argv[1]), FILENAME_MAX); 400 break; 401 case 3: 402 strlcpy(pfile, argv[2], FILENAME_MAX); 403 break; 404 default: 405 /* print usage and exit, only if called from main() */ 406 if (flags == CONFIG_FLAGS_FROMMAIN) { 407 warnx("wrong number of args"); 408 usage(); 409 } 410 return -1; 411 /* NOTREACHED */ 412 } 413 414 p = params_cget(pfile); 415 if (!p) 416 return -1; 417 418 /* 419 * over-ride with command line specifications and fill in default 420 * values. 421 */ 422 423 p = params_combine(p, inparams); 424 ret = params_filldefaults(p); 425 if (ret) { 426 params_free(p); 427 return ret; 428 } 429 430 if (!params_verify(p)) { 431 warnx("params invalid"); 432 return -1; 433 } 434 435 /* 436 * loop over configuring the disk and checking to see if it 437 * verifies properly. We open and close the disk device each 438 * time, because if the user passes us the block device we 439 * need to flush the buffer cache. 440 */ 441 442 for (;;) { 443 fd = opendisk_werror(argv[0], cgdname, sizeof(cgdname)); 444 if (fd == -1) 445 return -1; 446 447 if (p->key) 448 bits_free(p->key); 449 450 p->key = getkey(argv[1], p->keygen, p->keylen); 451 if (!p->key) 452 goto bail_err; 453 454 ret = configure_params(fd, cgdname, argv[1], p); 455 if (ret) 456 goto bail_err; 457 458 ret = verify(p, fd); 459 if (ret == -1) 460 goto bail_err; 461 if (!ret) 462 break; 463 464 fprintf(stderr, "verification failed, please reenter " 465 "passphrase\n"); 466 467 unconfigure_fd(fd); 468 close(fd); 469 } 470 471 params_free(p); 472 close(fd); 473 return 0; 474 bail_err: 475 params_free(p); 476 close(fd); 477 return -1; 478 } 479 480 static int 481 configure_stdin(struct params *p, int argc, char **argv) 482 { 483 int fd; 484 int ret; 485 char cgdname[PATH_MAX]; 486 487 if (argc < 3 || argc > 4) 488 usage(); 489 490 p->algorithm = string_fromcharstar(argv[2]); 491 if (argc > 3) 492 p->keylen = atoi(argv[3]); 493 494 ret = params_filldefaults(p); 495 if (ret) 496 return ret; 497 498 fd = opendisk_werror(argv[0], cgdname, sizeof(cgdname)); 499 if (fd == -1) 500 return -1; 501 502 p->key = bits_fget(stdin, p->keylen); 503 if (!p->key) { 504 warnx("failed to read key from stdin"); 505 return -1; 506 } 507 508 return configure_params(fd, cgdname, argv[1], p); 509 } 510 511 static int 512 opendisk_werror(const char *cgd, char *buf, int buflen) 513 { 514 int fd; 515 516 VPRINTF(3, ("opendisk_werror(%s, %s, %d) called.\n", cgd, buf, buflen)); 517 518 /* sanity */ 519 if (!cgd || !buf) 520 return -1; 521 522 if (nflag) { 523 strlcpy(buf, cgd, buflen); 524 return 0; 525 } 526 527 fd = opendisk(cgd, O_RDWR, buf, buflen, 0); 528 if (fd == -1) 529 warnx("can't open cgd \"%s\", \"%s\"", cgd, buf); 530 531 return fd; 532 } 533 534 static int 535 configure_params(int fd, const char *cgd, const char *dev, struct params *p) 536 { 537 struct cgd_ioctl ci; 538 int ret; 539 540 /* sanity */ 541 if (!cgd || !dev) 542 return -1; 543 544 memset(&ci, 0x0, sizeof(ci)); 545 ci.ci_disk = (char *)dev; 546 ci.ci_alg = (char *)string_tocharstar(p->algorithm); 547 ci.ci_ivmethod = (char *)string_tocharstar(p->ivmeth); 548 ci.ci_key = (char *)bits_getbuf(p->key); 549 ci.ci_keylen = p->keylen; 550 ci.ci_blocksize = p->bsize; 551 552 VPRINTF(1, (" with alg %s keylen %d blocksize %d ivmethod %s\n", 553 string_tocharstar(p->algorithm), p->keylen, p->bsize, 554 string_tocharstar(p->ivmeth))); 555 VPRINTF(2, ("key: ")); 556 VERBOSE(2, bits_fprint(stdout, p->key)); 557 VPRINTF(2, ("\n")); 558 559 if (nflag) 560 return 0; 561 562 ret = ioctl(fd, CGDIOCSET, &ci); 563 if (ret == -1) { 564 perror("ioctl"); 565 return errno; 566 } 567 568 return 0; 569 } 570 571 /* 572 * verify returns 0 for success, -1 for unrecoverable error, or 1 for retry. 573 */ 574 575 #define SCANSIZE 8192 576 577 static int 578 verify(struct params *p, int fd) 579 { 580 581 switch (p->verify_method) { 582 case VERIFY_NONE: 583 return 0; 584 case VERIFY_DISKLABEL: 585 return verify_disklabel(fd); 586 case VERIFY_FFS: 587 return verify_ffs(fd); 588 case VERIFY_REENTER: 589 return verify_reenter(p); 590 default: 591 warnx("unimplemented verification method"); 592 return -1; 593 } 594 } 595 596 static int 597 verify_disklabel(int fd) 598 { 599 struct disklabel l; 600 int ret; 601 char buf[SCANSIZE]; 602 603 /* 604 * we simply scan the first few blocks for a disklabel, ignoring 605 * any MBR/filecore sorts of logic. MSDOS and RiscOS can't read 606 * a cgd, anyway, so it is unlikely that there will be non-native 607 * partition information. 608 */ 609 610 ret = pread(fd, buf, 8192, 0); 611 if (ret == -1) { 612 warn("can't read disklabel area"); 613 return -1; 614 } 615 616 /* now scan for the disklabel */ 617 618 return disklabel_scan(&l, buf, sizeof(buf)); 619 } 620 621 static off_t sblock_try[] = SBLOCKSEARCH; 622 623 static int 624 verify_ffs(int fd) 625 { 626 struct fs *fs; 627 int ret, i; 628 char buf[SBLOCKSIZE]; 629 630 for (i = 0; sblock_try[i] != -1; i++) { 631 ret = pread(fd, buf, sizeof(buf), sblock_try[i]); 632 if (ret == -1) { 633 warn("pread"); 634 return 0; 635 } 636 fs = (struct fs *)buf; 637 switch (fs->fs_magic) { 638 case FS_UFS1_MAGIC: 639 case FS_UFS2_MAGIC: 640 case FS_UFS1_MAGIC_SWAPPED: 641 case FS_UFS2_MAGIC_SWAPPED: 642 return 0; 643 default: 644 continue; 645 } 646 } 647 return 1; 648 } 649 650 static int 651 verify_reenter(struct params *p) 652 { 653 struct keygen *kg; 654 bits_t *orig_key, *key; 655 int ret; 656 657 ret = 0; 658 for (kg = p->keygen; kg && !ret; kg = kg->next) { 659 if ((kg->kg_method != KEYGEN_PKCS5_PBKDF2_SHA1) && 660 (kg->kg_method != KEYGEN_PKCS5_PBKDF2_OLD )) 661 continue; 662 663 orig_key = kg->kg_key; 664 kg->kg_key = NULL; 665 666 /* add a compat flag till the _OLD method goes away */ 667 key = getkey_pkcs5_pbkdf2("re-enter device", kg, 668 bits_len(orig_key), kg->kg_method == KEYGEN_PKCS5_PBKDF2_OLD); 669 ret = !bits_match(key, orig_key); 670 671 bits_free(key); 672 bits_free(kg->kg_key); 673 kg->kg_key = orig_key; 674 } 675 676 return ret; 677 } 678 679 static int 680 generate(struct params *p, int argc, char **argv, const char *outfile) 681 { 682 int ret; 683 684 if (argc < 1 || argc > 2) 685 usage(); 686 687 p->algorithm = string_fromcharstar(argv[0]); 688 if (argc > 1) 689 p->keylen = atoi(argv[1]); 690 691 ret = params_filldefaults(p); 692 if (ret) 693 return ret; 694 695 if (!p->keygen) { 696 p->keygen = keygen_generate(KEYGEN_PKCS5_PBKDF2_SHA1); 697 if (!p->keygen) 698 return -1; 699 } 700 701 if (keygen_filldefaults(p->keygen, p->keylen)) { 702 warnx("Failed to generate defaults for keygen"); 703 return -1; 704 } 705 706 if (!params_verify(p)) { 707 warnx("invalid parameters generated"); 708 return -1; 709 } 710 711 return params_cput(p, outfile); 712 } 713 714 static int 715 generate_convert(struct params *p, int argc, char **argv, const char *outfile) 716 { 717 struct params *oldp; 718 struct keygen *kg; 719 720 if (argc != 1) 721 usage(); 722 723 oldp = params_cget(*argv); 724 if (!oldp) 725 return -1; 726 727 /* for sanity, we ensure that none of the keygens are randomkey */ 728 for (kg=p->keygen; kg; kg=kg->next) 729 if (kg->kg_method == KEYGEN_RANDOMKEY) 730 goto bail; 731 for (kg=oldp->keygen; kg; kg=kg->next) 732 if (kg->kg_method == KEYGEN_RANDOMKEY) 733 goto bail; 734 735 if (!params_verify(oldp)) { 736 warnx("invalid old parameters file \"%s\"", *argv); 737 return -1; 738 } 739 740 oldp->key = getkey("old file", oldp->keygen, oldp->keylen); 741 742 /* we copy across the non-keygen info, here. */ 743 744 string_free(p->algorithm); 745 string_free(p->ivmeth); 746 747 p->algorithm = string_dup(oldp->algorithm); 748 p->ivmeth = string_dup(oldp->ivmeth); 749 p->keylen = oldp->keylen; 750 p->bsize = oldp->bsize; 751 if (p->verify_method == VERIFY_UNKNOWN) 752 p->verify_method = oldp->verify_method; 753 754 params_free(oldp); 755 756 if (!p->keygen) { 757 p->keygen = keygen_generate(KEYGEN_PKCS5_PBKDF2_SHA1); 758 if (!p->keygen) 759 return -1; 760 } 761 params_filldefaults(p); 762 keygen_filldefaults(p->keygen, p->keylen); 763 p->key = getkey("new file", p->keygen, p->keylen); 764 765 kg = keygen_generate(KEYGEN_STOREDKEY); 766 kg->kg_key = bits_xor(p->key, oldp->key); 767 keygen_addlist(&p->keygen, kg); 768 769 if (!params_verify(p)) { 770 warnx("can't generate new parameters file"); 771 return -1; 772 } 773 774 return params_cput(p, outfile); 775 bail: 776 params_free(oldp); 777 return -1; 778 } 779 780 static int 781 do_all(const char *cfile, int argc, char **argv, 782 int (*conf)(int, char **, struct params *, int)) 783 { 784 FILE *f; 785 size_t len; 786 size_t lineno; 787 int my_argc; 788 int ret; 789 const char *fn; 790 char *line; 791 char **my_argv; 792 793 if (argc > 0) 794 usage(); 795 796 if (!cfile[0]) 797 fn = CGDCONFIG_CFILE; 798 else 799 fn = cfile; 800 801 f = fopen(fn, "r"); 802 if (!f) { 803 warn("could not open config file \"%s\"", fn); 804 return -1; 805 } 806 807 ret = chdir(CGDCONFIG_DIR); 808 if (ret == -1) 809 warn("could not chdir to %s", CGDCONFIG_DIR); 810 811 ret = 0; 812 lineno = 0; 813 for (;;) { 814 line = fparseln(f, &len, &lineno, "\\\\#", FPARSELN_UNESCALL); 815 if (!line) 816 break; 817 if (!*line) 818 continue; 819 820 my_argv = words(line, &my_argc); 821 ret = conf(my_argc, my_argv, NULL, CONFIG_FLAGS_FROMALL); 822 if (ret) { 823 warnx("action failed on \"%s\" line %lu", fn, 824 (u_long)lineno); 825 break; 826 } 827 words_free(my_argv, my_argc); 828 } 829 return ret; 830 } 831
Indexes created Tue Sep 30 11:09:46 GMT 2025