archboot/usr/lib/initcpio/hooks/arch_encrypt

# Created by Tobias Powalowski <tpowa@archlinux.org>
#
# TODO this one needs some work to work with lots of different
#       encryption schemes
run_hook ()
{
    if ! [ "$ENCRYPTRUN" = "1" ]; then
        modprobe -a -q dm-crypt >/dev/null 2>&1
        # fix if udev initialises /dev/mapper/control
        udevadm settle
        if [ -e "/sys/class/misc/device-mapper" ]; then
            if [ ! -e "/dev/mapper/control" ]; then
                mknod "/dev/mapper/control" c $(cat /sys/class/misc/device-mapper/dev | sed 's|:| |')
            fi
            [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

            # Get keyfile if specified
            ckeyfile="/crypto_keyfile.bin"
            if [ "x${cryptkey}" != "x" ]; then
                ckdev="$(echo "${cryptkey}" | cut -d: -f1)"
                ckarg1="$(echo "${cryptkey}" | cut -d: -f2)"
                ckarg2="$(echo "${cryptkey}" | cut -d: -f3)"
                if poll_device "${ckdev}" ${rootdelay}; then
                    case ${ckarg1} in
                        *[!0-9]*)
                            # Use a file on the device
                            # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
                            mkdir /ckey
                            mount -r -t ${ckarg1} ${ckdev} /ckey
                            dd if=/ckey/${ckarg2} of=${ckeyfile} >/dev/null 2>&1
                            umount /ckey
                            ;;
                        *)
                            # Read raw data from the block device
                            # ckarg1 is numeric: ckarg1=offset, ckarg2=length
                            dd if=${ckdev} of=${ckeyfile} bs=1 skip=${ckarg1} count=${ckarg2} >/dev/null 2>&1
                            ;;
                    esac
                fi
                [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
            fi

            if [ -n "${cryptdevice}" ]; then
                DEPRECATED_CRYPT=0
                cryptdev="$(echo "${cryptdevice}" | cut -d: -f1)"
                cryptname="$(echo "${cryptdevice}" | cut -d: -f2)"
            else
                DEPRECATED_CRYPT=1
                cryptdev="${root}"
                cryptname="root"
            fi

            warn_deprecated() {
                echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
                echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
            }

            if  poll_device "${cryptdev}" ${rootdelay}; then
                if cryptsetup isLuks ${cryptdev} >/dev/null 2>&1; then
                    [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
                    dopassphrase=1
                    # If keyfile exists, try to use that
                    if [ -f ${ckeyfile} ]; then
                        if eval cryptsetup --key-file ${ckeyfile} luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; then
                            dopassphrase=0
                        else
                            echo "Invalid keyfile. Reverting to passphrase."
                        fi
                    fi
                    # Ask for a passphrase
                    if [ ${dopassphrase} -gt 0 ]; then
                        echo ""
                        echo "A password is required to access the ${cryptname} volume:"

                        #loop until we get a real password
                        while ! eval cryptsetup luksOpen ${cryptdev} ${cryptname} ${CSQUIET}; do
                            sleep 2;
                        done
                    fi
                    if [ -e "/dev/mapper/${cryptname}" ]; then
                        if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                            export root="/dev/mapper/root"
                        fi
                    else
                        err "Password succeeded, but ${cryptname} creation failed, aborting..."
                        exit 1
                    fi
                elif [ -n "${crypto}" ]; then
                    [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
                    msg "Non-LUKS encrypted device found..."
                    if [ $# -ne 5 ]; then
                        err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
                        err "Non-LUKS decryption not attempted..."
                        return 1
                    fi
                    exe="cryptsetup create ${cryptname} ${cryptdev}"
                    tmp=$(echo "${crypto}" | cut -d: -f1)
                    [ -n "${tmp}" ] && exe="${exe} --hash \"${tmp}\""
                    tmp=$(echo "${crypto}" | cut -d: -f2)
                    [ -n "${tmp}" ] && exe="${exe} --cipher \"${tmp}\""
                    tmp=$(echo "${crypto}" | cut -d: -f3)
                    [ -n "${tmp}" ] && exe="${exe} --key-size \"${tmp}\""
                    tmp=$(echo "${crypto}" | cut -d: -f4)
                    [ -n "${tmp}" ] && exe="${exe} --offset \"${tmp}\""
                    tmp=$(echo "${crypto}" | cut -d: -f5)
                    [ -n "${tmp}" ] && exe="${exe} --skip \"${tmp}\""
                    if [ -f ${ckeyfile} ]; then
                        exe="${exe} --key-file ${ckeyfile}"
                    else
                        exe="${exe} --verify-passphrase"
                        echo ""
                        echo "A password is required to access the ${cryptname} volume:"
                    fi
                    eval "${exe} ${CSQUIET}"

                    if [ $? -ne 0 ]; then
                        err "Non-LUKS device decryption failed. verify format: "
                        err "      crypto=hash:cipher:keysize:offset:skip"
                        exit 1
                    fi
                    if [ -e "/dev/mapper/${cryptname}" ]; then
                        if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                            export root="/dev/mapper/root"
                        fi
                    else
                        err "Password succeeded, but ${cryptname} creation failed, aborting..."
                        exit 1
                    fi
                else
                    err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
                fi
            fi
            rm -f ${ckeyfile}
        fi
    else
        msg ":: Skipping already run by arch_root_advanced hook..."
    fi
}