podman

1
package mkcw
2

3
import (
4
	"crypto/rand"
5
	"encoding/hex"
6
	"fmt"
7
	"os"
8

9
	"github.com/containers/luksy"
10
)
11

12
// CheckLUKSPassphrase checks that the specified LUKS-encrypted file can be
13
// decrypted using the specified passphrase.
14
func CheckLUKSPassphrase(path, decryptionPassphrase string) error {
15
	f, err := os.Open(path)
16
	if err != nil {
17
		return err
18
	}
19
	defer f.Close()
20
	v1header, v2headerA, v2headerB, v2json, err := luksy.ReadHeaders(f, luksy.ReadHeaderOptions{})
21
	if err != nil {
22
		return err
23
	}
24
	if v1header != nil {
25
		_, _, _, _, err = v1header.Decrypt(decryptionPassphrase, f)
26
		return err
27
	}
28
	if v2headerA == nil && v2headerB == nil {
29
		return fmt.Errorf("no LUKS headers read from %q", path)
30
	}
31
	if v2headerA != nil {
32
		if _, _, _, _, err = v2headerA.Decrypt(decryptionPassphrase, f, *v2json); err != nil {
33
			return err
34
		}
35
	}
36
	if v2headerB != nil {
37
		if _, _, _, _, err = v2headerB.Decrypt(decryptionPassphrase, f, *v2json); err != nil {
38
			return err
39
		}
40
	}
41
	return nil
42
}
43

44
// GenerateDiskEncryptionPassphrase generates a random disk encryption password
45
func GenerateDiskEncryptionPassphrase() (string, error) {
46
	randomizedBytes := make([]byte, 32)
47
	if _, err := rand.Read(randomizedBytes); err != nil {
48
		return "", err
49
	}
50
	return hex.EncodeToString(randomizedBytes), nil
51
}
52