summaryrefslogtreecommitdiff
path: root/cmd_key.c
diff options
context:
space:
mode:
Diffstat (limited to 'cmd_key.c')
-rw-r--r--cmd_key.c81
1 files changed, 77 insertions, 4 deletions
diff --git a/cmd_key.c b/cmd_key.c
index b22de815..b5bacf1c 100644
--- a/cmd_key.c
+++ b/cmd_key.c
@@ -9,19 +9,92 @@
int cmd_unlock(int argc, char *argv[])
{
- struct bch_sb *sb;
+ struct bch_sb_handle sb;
+ const char *err;
char *passphrase;
if (argc != 2)
- die("please supply a single device");
+ die("Please supply a single device");
- sb = bch2_super_read(argv[1]);
+ err = bch2_read_super(argv[1], bch2_opts_empty(), &sb);
+ if (err)
+ die("Error opening %s: %s", argv[1], err);
passphrase = read_passphrase("Enter passphrase: ");
- bch2_add_key(sb, passphrase);
+ bch2_add_key(sb.sb, passphrase);
memzero_explicit(passphrase, strlen(passphrase));
free(passphrase);
return 0;
}
+
+int cmd_set_passphrase(int argc, char *argv[])
+{
+ struct bch_opts opts = bch2_opts_empty();
+ struct bch_fs *c = NULL;
+ const char *err;
+
+ if (argc < 2)
+ die("Please supply one or more devices");
+
+ opt_set(opts, nostart, true);
+ err = bch2_fs_open(argv + 1, argc - 1, opts, &c);
+ if (err)
+ die("Error opening %s: %s", argv[1], err);
+
+ struct bch_sb_field_crypt *crypt = bch2_sb_get_crypt(c->disk_sb);
+ if (!crypt)
+ die("Filesystem does not have encryption enabled");
+
+ struct bch_encrypted_key new_key;
+ new_key.magic = BCH_KEY_MAGIC;
+
+ int ret = bch2_decrypt_sb_key(c, crypt, &new_key.key);
+ if (ret)
+ die("Error getting current key");
+
+ char *new_passphrase = read_passphrase_twice("Enter new passphrase: ");
+ struct bch_key passphrase_key = derive_passphrase(crypt, new_passphrase);
+
+ if (bch2_chacha_encrypt_key(&passphrase_key, __bch2_sb_key_nonce(c->disk_sb),
+ &new_key, sizeof(new_key)))
+ die("error encrypting key");
+ crypt->key = new_key;
+
+ bch2_write_super(c);
+ bch2_fs_stop(c);
+ return 0;
+}
+
+int cmd_remove_passphrase(int argc, char *argv[])
+{
+ struct bch_opts opts = bch2_opts_empty();
+ struct bch_fs *c = NULL;
+ const char *err;
+
+ if (argc < 2)
+ die("Please supply one or more devices");
+
+ opt_set(opts, nostart, true);
+ err = bch2_fs_open(argv + 1, argc - 1, opts, &c);
+ if (err)
+ die("Error opening %s: %s", argv[1], err);
+
+ struct bch_sb_field_crypt *crypt = bch2_sb_get_crypt(c->disk_sb);
+ if (!crypt)
+ die("Filesystem does not have encryption enabled");
+
+ struct bch_encrypted_key new_key;
+ new_key.magic = BCH_KEY_MAGIC;
+
+ int ret = bch2_decrypt_sb_key(c, crypt, &new_key.key);
+ if (ret)
+ die("Error getting current key");
+
+ crypt->key = new_key;
+
+ bch2_write_super(c);
+ bch2_fs_stop(c);
+ return 0;
+}