LUKSUS.functions

#### FUNCTIONS ######

exithousekeeping()
{
rm *.$$
set >luksus.environment #REMOVE WHEN DONE - USED FOR DEBUGGING PURPOSES
}

DEVICESET()
{
device=$($dialogapp --inputbox "Enter the device to create volume on. E.g. /dev/sdd1 or /dev/loop0" $dialogsize 3>&1 1>&2 2>&3)
}

NAMESET()
{
name=$($dialogapp --inputbox "Enter the volume name (nickname of the volume). E.g. Mystuff. Note no special characters or spaces" $dialogsize 3>&1 1>&2 2>&3)
}

LUKSFILESET()
{
luksfile=$($dialogapp --inputbox "Full path of encrypted volume. No spaces or special characters. E.g. /home/mystuff.archive" $dialogsize 3>&1 1>&2 2>&3)
}

LUKSFILESIZESET()
{
luksfilesize=$($dialogapp --inputbox "What is the desired size of the container. E.g. 100M or 25G" $dialogsize 3>&1 1>&2 2>&3)
}

SECURITYMODE()
{
echo set security mode
}

NEXT()
{
NEXT=true
echo CONTINUING
}

WELCOMEINFORMATION()
{
"$dialogapp" --msgbox "Welcome to $programname $version. \n\n
This program lets you create an encrypted volume on a physical media such
as a hardrive or usb stick, or it can be in the form of a file
container. The program will now ask you to specify which device you
wish to create the volume on. If you are creating a file container
then you must choose a loopback device as device. You can also choose
between using a password or a keyfile if the encryption mechanism
supports it. The default is to use a password.\n\n
When you click OK the wizard will start and ask you which device you
wish to proceed with. You can re-run the wizard and you can exit the
program before $programname does any heavywork." 0 0
}

WIZARD()
{
# RUN THROUGH THE LUKSUS-WIZARD
DEVICESET
NAMESET
LUKSFILESET
LUKSFILESIZESET
SECURITYMODE
}



MENUSYSTEM()
{
while [ $NEXT == false ] ;
do

# Dialog utility to display options list

    dialog --cancel-label "EXIT LUKSUS" --clear --backtitle "$programname $version" --title "" \
    --menu "Choose next or run the wizard again" $dialogsize 9 \
    "NEXT" "CONTINUE LUKSUS, REVIEW AND BEGIN VOLUME CREATION" \
    "WIZARD" "RUN THE WIZARD AGAIN TO SET UP LUKSUS" \
    "-"  "" \
    "-" "" \
    "DEVICE" "ENTER DEVICE TO USE (PHYSICAL OR LOOPBACK)" \
    "NAME"  "NICK NAME FOR ENCRYPTED CONTAINER" \
    "LOCATION" "SPECIFY WHERE TO STORE ENCRYPTED VOLUME (FIXED SIZE)" \
    "SIZE" "SPECIFY HOW LARGE THE CONTAINER SHOULD BE" \
    "SECURITYMODE"    "CHOOSE TO USE PASSPHRASE OR KEYFILE" 2> menuchoices.$$

    retopt=$?
    choice=`cat menuchoices.$$`

    case $retopt in

           0) case $choice in

                  WIZARD)         WIZARD ;;
                  DEVICE)         DEVICESET ;;
                  NAME)           NAMESET ;;
                  LOCATION)       LUKSFILESET ;;
                  SIZE)           LUKSFILESIZESET;;
                  SECURITYMODE)   SECURITYMODE ;;
                  SUMMARY)        SUMMARY ;;
                  NEXT)           NEXT ;;

              esac ;;

          *)clear ; exit ;;
    esac

done 
        keyfile=/keys/$name.key
        headerbackup=/keys/$name.header
        mountpoint=/mnt/$name
}


ASKUSERVERIFYCONSOLE () 
{ 
    echo;
    echo DRIVE ENCRYPTION;
    echo THIS SCRIPT ASSUMES YOU WANT TO COMPLETELY ERASE;
    echo THE DEVICE YOU HAVE SPECIFIED;
    echo;
    echo;
    echo DETAILS AS SUBMITTED BY THE USER;
    echo PLEASE VERIFY THAT THESE ARE CORRECT;
    echo ENCRYPTION USED: $ENCRYPTION;
    echo DRIVE: $device;
    echo NAME: $name;
    echo MOUNTPOINT: $mountpoint;
    echo HEADER BACKUP: $headerbackup;
    echo USING KEYFILE: $USEKEY;
    echo KEYFILE: $keyfile;
    echo LOOPBACK: $loopbackdevice;
    echo OS: $UNAME;
    echo;
    echo JUST TO MAKE DOUBLY SURE THAT YOU ARE FORMATTING THE CORRECT DRIVE;
    echo WE ASK AGAIN. IS THIS THE CORRECT DEVICE TO FORMAT AND ENCRYPT?;
    echo YOU WILL NUKE YOUR DRIVE: $device;
    echo HIT CTRL+C NOW TO QUIT, OR HIT ANY KEY TO CONTINUE;
    echo "";
    echo SERIOUSLY - LAST CHANCE;
    read || exit
}

CGD () 
{ 
    if [[ $ENCRYPTION == CGD ]] && [[ $USEKEY == false ]]; then
        echo Initializing $device with $ENCRYPTION;
        cgdconfig -g -V $name -o $keydir/$name aes-cbc 256;
        cgdconfig -g -o $keydir/$name aes-cbc 256;
        cgdconfig $name $device;
        cgdconfig -V re-enter $name $device;
    else
        echo "";
    fi
}

CREATEANDMOUNTFS () 
{ 
    mkdir -p $mountpoint;
    mkdir -p $keydir;
    if [[ $UNAME == DragonFly ]]; then
        echo DragonFlyBSD mode;
        newfs /dev/mapper/$name;
        mount /dev/mapper/$name /mnt/$name;
        mounthelp="mount /dev/mapper/$name /mnt/$name";
    else
        if [[ $UNAME == FreeBSD ]]; then
            newfs $device.eli;
            mount $device.eli /mnt/$name;
            mounthelp="mount $device.eli /mnt/$name";
        else
            if [[ $UNAME == NetBSD ]]; then
                newfs -O 2 $device;
                mount $device /mnt/$name;
                mounthelp="mount $device /mnt/$name";
            else
                if [[ $UNAME == Linux ]]; then
                    mkfs.ext4 /dev/mapper/$name;
                    e2label /dev/mapper/$name $name;
                    mount -t ext4 /dev/mapper/$name $mountpoint > /dev/null 2>&1;
                    mounthelp="mount -t ext4 /dev/mapper/$name $mountpoint";
                else
                    echo No Idea What To Do;
                fi;
            fi;
        fi;
    fi
}
CREATEKEYFILE () 
{ 
    if [[ $USEKEY == true ]]; then
        echo Creating key;
        dd if=/dev/urandom of=$keyfile bs=512 count=256;
    else
        echo ...;
    fi
}
DEVICEEXISTS () 
{ 
    if [ -e "$device" ]; then
        echo "OK, $device exists";
    else
        echo "$device was not found. $programname is now exiting";
        exit 1;
    fi
}
DISPLAYLOGO () 
{ 
    if [ $width -gt 119 ]; then
        gtail -n 12 LUKSUS.logo 2> /dev/null || tail -n 12 LUKSUS.logo;
	gtail -n 12 LUKSUS.logo 1>welcomelogo.$$ 2> /dev/null || tail -n 12 LUKSUS.logo >welcomelogo.$$
	dialogsize="17 123"
   else
        ghead -n 6 LUKSUS.logo 2> /dev/null || head -n 6 LUKSUS.logo;
        ghead -n 6 LUKSUS.logo 1>welcomelogo.$$ 2> /dev/null || head -n 6 LUKSUS.logo >welcomelogo.$$
        dialogsize="12 60"
   fi
}


DISPLAYSUMMARY () 
{ 
    echo;
    date;
    echo Results of LUKSUS:;
    echo DRIVE: $device;
    echo NAME: $name;
    echo USED KEYFILE: $USEKEY;
    echo KEYFILE: $keyfile;
    echo MOUNTPOINT: $mountpoint;
    echo HEADER BACKUP: $headerbackup;
    echo ENCRYPTION USED: $ENCRYPTION;
    echo CONTAINER $luksfile $luksfilesize;
    echo MOUNTPOINT: `mount | grep $name`;
    echo `df -h | head -n 1`;
    echo `df -h | grep $name`;
    echo "";
    echo Volumestatus:;
    echo $VOLUMESTATUS >> $keydir/$name.information 2>> $keydir/$name.information;
    echo "################################################";
    time2="$(date +%s.%N)";
    ls -l $device
}
DONTSHREDIFLOOPBACK () 
{ 
    if [[ $loopbackdevice == false ]] && [[ $UNAME == Linux ]]; then
        echo "Okay we are using $device ...";
        echo Shredding ...;
        shred -f -v -n1 $device || gshred -f -v -n1 $device;
    else
        if [[ $loopbackdevice == false ]] && [[ UNAME == DragonFly ]]; then
            echo On DragonFlyBSD. Okay cool.;
            echo in the middle of the shredding.place;
            gshred -f -v -n1 $device;
        else
            if [[ $loopbackdevice == false ]] && [[ $UNAME == FreeBSD ]]; then
                echo On FreeBSD. Okay cool.;
                echo in the middle of the shredding.place;
                gshred -f -v -n1 $device;
            else
                echo "$device is a loopback device. OK.";
            fi;
        fi;
    fi
}
DRAGONFLYHOUSEKEEPING () 
{ 
    if [[ $UNAME == DragonFly ]]; then
        echo We are on DragonFlyBSD here.;
        alias ghead=head;
        alias gshred=shred;
        kldload dm;
        vnconfig > /dev/null 2> /dev/null;
    else
        echo "";
    fi
}
FREEBSDHOUSEKEEPING () 
{ 
    if [ $UNAME == FreeBSD ]; then
        echo We are on FreeBSD here. Cool.;
        alias ghead=head;
        alias gshred=shred;
        kldload geom_eli;
    else
        echo "";
    fi
}
GELI () 
{ 
    if [[ $ENCRYPTION == GELI ]] && [[ $USEKEY == false ]]; then
        echo Initializing $device with $ENCRYPTION;
        geli init -B $headerbackup -s 4096 $device;
    else
        echo "";
    fi
}
GELIKEYFILE () 
{ 
    if [[ ENCRYPTION == GELI ]] && [[ $USEKEY == true ]]; then
        echo Initializing $device with $ENCRYPTION with a keyfile;
        geli init -B $headerbackup -p -s 4096 -K $keyfile $device;
    else
        echo "";
    fi
}
GELIOPEN () 
{ 
    if [[ $ENCRYPTION == GELI ]] && [[ $USEKEY == true ]]; then
        echo Attempting to open the newly created $ENCRYPTION volume $name with $keyfile;
        geli attach -k $keyfile $device;
        cryptoinithelp="geli attach -k $keyfile $device";
        VOLUMESTATUS=$(geli dump $name);
    else
        if [[ $ENCRYPTION == GELI ]] && [[ $USEKEY == false ]]; then
            echo Attempting to open the newly created $ENCRYPTION volume $name;
            geli attach $device;
            cryptoinithelp="geli attach $device";
            VOLUMESTATUS=$(geli dump $device);
        else
            echo "";
        fi;
    fi
}
GRAPHICAL () 
{ 
    if [[ $GOGRAPHICAL = 1 ]]; then
        device=$($dialogapp --inputbox "Enter the device to create volume on. E.g. /dev/sdd1 or /dev/loop0" $dialogsize 3>&1 1>&2 2>&3);
        name=$($dialogapp --inputbox "Enter the volume name (nickname of the volume). E.g. Mystuff. Note no special characters or spaces" $dialogsize 3>&1 1>&2 2>&3);
        luksfile=$($dialogapp --inputbox "Full path of encrypted volume. No spaces or special characters. E.g. /home/mystuff.archive" $dialogsize 3>&1 1>&2 2>&3);
        luksfilesize=$($dialogapp --inputbox "What is the desired size of the container. E.g. 100M or 25G" $dialogsize 3>&1 1>&2 2>&3);
        keyfile=/keys/$name.key
        headerbackup=/keys/$name.header
        mountpoint=/mnt/$name
fi

$dialogapp --menu "Choose method to lock the encrypted volume" $dialogsize 2 \
               KEYFILE "Use a keyfile. This will be generated for you." off  \
               TRUECRYPT "Use a password. Popular choice."   on   \
               2>SECUREMODE.$$


}
GRAPHICALVERIFYCHOICES () 
{ 
    if [[ $GOGRAPHICAL = 1 ]]; then
        $dialogapp --title "$name $version" --yesno "\nDETAILS AS SUBMITTED BY THE USER
\n \n \n
ENCRYPTION USED: $ENCRYPTION
\n
NAME: 	        $name \n
DRIVE:         $device \n
MOUNTPOINT:    $mountpoint \n
KEYFILE:       $keyfile \n
HEADER BACKUP: $headerbackup\n
FILECONTAINER LOCATION: $luksfile\n
FILECONTAINER SIZE: $luksfilesize\n
USING KEYFILE: $USEKEY\n
LOOPBACKDEVICE: $loopbackdevice\n
OS: $UNAME\n\n
ARE THESE VALUES CORRECT? \n\nIF UNSURE SAY NO.
" 30 50;
        case $? in 
            0)

            ;;
            1)
                echo "You have pressed NO. LUKSUS will now close.";
                exit 1
            ;;
            255)
                echo "Box closed"
            ;;
        esac;
    else
        echo "";
    fi
}
GRAPHICALWELCOME () 
{ 
    if [[ $dialog == true ]]; then
       $dialogapp --backtitle "$programname $version" \
       --title "" \
       --exit-label "BEGIN" --textbox welcomelogo.$$ $dialogsize;

#        $dialogapp --title "WELCOME TO $programname" --msgbox "\n$programname $version $date on $UNAME\n\n
#Written by \n
#$author \n
#" 10 30;
    fi
}

LOOPBACKMETHOD () 
{ 
    if [[ $loopbackdevice == true ]] && [[ $UNAME == Linux ]]; then
        echo Beginning loopbackmethod on $device;
        head -c $luksfilesize /dev/zero > $luksfile;
        losetup -f 1>/dev/null 2> /dev/null;
        losetup $device $luksfile;
        loopbackhelp="losetup $device $luksfile";
    else
        if [[ $loopbackdevice == true ]] && [[ $UNAME == DragonFly ]]; then
            echo DragonFlyBSD - Nice...;
            echo Beginning loopbackmethod on $device;
            ghead -c $luksfilesize /dev/zero > $luksfile;
            vnconfig > /dev/null 2> /dev/null;
            vnconfig $device $luksfile;
            loopbackhelp="vnconfig $device $luksfile";
        else
            if [[ $loopbackdevice == true ]] && [[ $UNAME == FreeBSD ]]; then
                echo FreeBSD - Nice...;
                ghead /dev/zero -c $luksfilesize > $luksfile;
                mdconfig -a -t vnode -f $luksfile -u $freebsdloopnumber;
                loopbackhelp="mdconfig -a -t vnode -f $luksfile -u $freebsdloopnumber";
            else
                echo "Okay, not using a loopback device, proceeding in normal mode";
            fi;
        fi;
    fi
}
LOOPBACKTEST () 
{ 
    if [[ $device == *loop* ]]; then
        loopbackdevice=true;
    else
        if [[ $device == *vn* ]]; then
            loopbackdevice=true;
        else
            if [[ $device == *md* ]]; then
                loopbackdevice=true;
            else
                if [[ $device == *vnd* ]]; then
                    loopbackdevice=true;
                else
                    loopbackdevice=false;
                fi;
            fi;
        fi;
    fi
}
LUKS () 
{ 
    if [[ $ENCRYPTION == LUKS ]] && [[ $USEKEY == false ]]; then
        echo LUKS with passphrase;
        echo You will only be prompted for a password once. Type carefully.;
        cryptsetup --batch-mode --verbose --cipher=aes-xts-plain64 luksFormat $device;
    else
        echo "";
    fi
}
LUKSKEYFILE () 
{ 
    if [[ $ENCRYPTION == LUKS ]] && [[ $USEKEY = true ]]; then
        echo LUKS mode;
        cryptsetup --batch-mode --verbose --key-size=512 --cipher=aes-xts-plain64 luksFormat $device $keyfile;
    else
        echo "";
    fi
}
LUKSOPEN () 
{ 
    if [[ $ENCRYPTION == LUKS ]] && [[ $USEKEY == true ]]; then
        echo Attempting to open the newly created $ENCRYPTION volume $name with $keyfile;
        cryptsetup luksOpen $device $name --key-file=$keyfile;
        cryptoinithelp="cryptsetup luksOpen $device $name --key-file=$keyfile";
        VOLUMESTATUS=$(cryptsetup status $name);
    else
        if [[ $ENCRYPTION == LUKS ]] && [[ $USEKEY == false ]]; then
            echo Attempting to open the newly created $ENCRYPTION volume $name;
            cryptsetup luksOpen $device $name;
            cryptoinithelp="cryptsetup luksOpen $device $name";
            VOLUMESTATUS=$(cryptsetup status $name);
        else
            echo "";
        fi;
    fi
}
LUKSVERIFY () 
{ 
    if [[ $ENCRYPTION = LUKS ]]; then
        echo "Verifying LUKS volume";
        cryptsetup isLuks $device || "echo "The device does not contain a LUKS volume. This is a problem since it should have a LUKS volume by now. Please check commandline arguments and try again" && exit 1";
        echo "The device positively contains a LUKS volume.";
        echo "Great!";
        echo "Taking a backup of the LUKS container header";
        cryptsetup luksHeaderBackup --header-backup-file=$headerbackup $device --verbose || "echo Something went wrong and LUKSUS failed to backup the LUKS header. Please check commandline arguments and try again. && exit 1";
        echo "The LUKS container header has been backed up successfully";
        echo "Great!";
    else
        echo "";
    fi
}
NETBSDHOUSEKEEPING () 
{ 
    if [ $UNAME == NetBSD ]; then
        echo We are on NetBSD here. Cool.;
        alias ghead=head;
        alias gshred=shred;
    else
        echo "";
    fi
}
OSTEST () 
{ 
    if [[ $UNAME = Linux ]]; then
        ENCRYPTION=LUKS;
        echo On $UNAME, defaulting to $ENCRYPTION;
    else
        if [[ $UNAME = DragonFly ]]; then
            ENCRYPTION=LUKS;
            echo On $UNAME, defaulting to $ENCRYPTION;
        else
            if [[ $UNAME = FreeBSD ]]; then
                ENCRYPTION=GELI;
                echo On $UNAME, Encryption set to $ENCRYPTION;
            else
                if [[ $UNAME = NetBSD ]]; then
                    ENCRYPTION=CGD;
                else
                    ENCRYPTION=LUKSUS;
                    echo No idea what I am running on $UNAME, defaulting to $ENCRYPTION;
                fi;
            fi;
        fi;
    fi
}
TRUECRYPT () 
{ 
    if [[ $ENCRYPTION == TRUECRYPT ]] && [[ $USEKEY == false ]]; then
        echo TrueCrypt mode;
        tcplay --create --device=$device --cipher=AES-256-XTS;
    else
        echo "";
    fi
}
TRUECRYPTKEYFILE () 
{ 
    if [[ $ENCRYPTION == TRUECRYPT ]] && [[ $USEKEY == true ]]; then
        echo TrueCrypt mode and adding a keyfile;
        tcplay --create --device=$device --cipher=AES-256-XTS --keyfile=$keyfile;
    else
        echo "";
    fi
}
TRUECRYPTOPEN () 
{ 
    if [[ $ENCRYPTION == TRUECRYPT ]] && [[ $USEKEY == false ]]; then
        echo Attempting to open and mount the newly created Truecrypt encrypted volume;
        tcplay -m $name -d $device;
        cryptoinithelp="tcplay -m $name -d $device";
        VOLUMESTATUS=$(cryptsetup status $name);
    else
        if [[ $ENCRYPTION == TRUECRYPT ]] && [[ $USEKEY == true ]]; then
            echo Attempting to open newly created Truecrypt volume $name;
            tcplay -m $name -d $device -k $keyfile;
            cryptoinithelp="tcplay -m $name -d $device -k $keyfile";
            VOLUMESTATUS=$(cryptsetup status $name);
        else
            echo "";
        fi;
    fi
}
WRITEINFORMATIONFILE () 
{ 
    DISPLAYLOGO > $keydir/$name.information 2> $keydir/$name.information;
    DISPLAYSUMMARY >> $keydir/$name.information 2>> $keydir/$name.information;
    ls -l $keydir/$name* >> $keydir/$name.information 2>> $keydir/$name.information;
    echo "" >> $keydir/$name.information 2>> $keydir/$name.information;
    echo "In order to mount your newly encrypted volume, run the following:" >> $keydir/$name.information 2>> $keydir/$name.information;
    echo "###" >> $keydir/$name.information 2>> $keydir/$name.information;
    echo $loopbackhelp >> $keydir/$name.information 2>> $keydir/$name.information;
    echo $cryptoinithelp >> $keydir/$name.information 2>> $keydir/$name.information;
    echo $mounthelp >> $keydir/$name.information 2>> $keydir/$name.information;
    echo "###" >> $keydir/$name.information 2>> $keydir/$name.information;
    cp $keydir/$name.information $mountpoint
}