mirror of
https://github.com/containers/podman.git
synced 2025-12-01 02:27:13 +08:00
2c2299ad85
Also includes a small change to make us of https://github.com/containers/buildah/pull/5039 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package mkcw
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/containers/luksy"
|
|
)
|
|
|
|
// CheckLUKSPassphrase checks that the specified LUKS-encrypted file can be
|
|
// decrypted using the specified passphrase.
|
|
func CheckLUKSPassphrase(path, decryptionPassphrase string) error {
|
|
f, err := os.Open(path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer f.Close()
|
|
v1header, v2headerA, v2headerB, v2json, err := luksy.ReadHeaders(f, luksy.ReadHeaderOptions{})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if v1header != nil {
|
|
_, _, _, _, err = v1header.Decrypt(decryptionPassphrase, f)
|
|
return err
|
|
}
|
|
if v2headerA == nil && v2headerB == nil {
|
|
return fmt.Errorf("no LUKS headers read from %q", path)
|
|
}
|
|
if v2headerA != nil {
|
|
if _, _, _, _, err = v2headerA.Decrypt(decryptionPassphrase, f, *v2json); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if v2headerB != nil {
|
|
if _, _, _, _, err = v2headerB.Decrypt(decryptionPassphrase, f, *v2json); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GenerateDiskEncryptionPassphrase generates a random disk encryption password
|
|
func GenerateDiskEncryptionPassphrase() (string, error) {
|
|
randomizedBytes := make([]byte, 32)
|
|
if _, err := rand.Read(randomizedBytes); err != nil {
|
|
return "", err
|
|
}
|
|
return hex.EncodeToString(randomizedBytes), nil
|
|
}
|