#!/bin/sh

PREREQ=""

prereqs()
{
	echo "$PREREQ"
}

case $1 in
prereqs)
	prereqs
	exit 0
	;;
esac

. /usr/share/initramfs-tools/hook-functions

get_crypt_devices() {
	local device opt count devices

	[ -r /etc/crypttab ] || return 0

	# Get a list of all crypted devices
	devices=$(sed -rn 's,[[:space:]].*,,;/^[^#]/s,^,/dev/mapper/, p' /etc/crypttab)
	[ -n "$devices" ] || return 0

	echo "cryptsetup: Found $(echo $devices | wc -w) crypted device(s):" >&2
	for device in $devices; do
		echo "                     $device" >&2
	done
	echo $devices

	return 0
}

get_device_opts() {
	local target source link extraopts rootopts opt
	target="$1"
	extraopts="$2"
	KEYSCRIPT=""
	OPTIONS=""

	if [ -z "$target" ]; then
		echo "cryptsetup: WARNING: get_device_opts - invalid arguments" >&2
		return 1
	fi

	opt=$( grep ^$target /etc/crypttab | head -1 | sed 's/[[:space:]]\+/ /g' )
	source=$( echo $opt | cut -d " " -f2 )
	key=$( echo $opt | cut -d " " -f3 )
	rootopts=$( echo $opt | cut -d " " -f4- )

	if [ -z "$opt" ] || [ -z "$source" ] || [ -z "$key" ] || [ -z "$rootopts" ]; then
		echo "cryptsetup: WARNING: invalid line in /etc/crypttab - $opt" >&2
		return 1
	fi

	# Sanity checks for $source
	if [ -h "$source" ]; then
		link=$(readlink -nqe "$source")
		if [ -z "$link" ]; then
			echo "cryptsetup: WARNING: $source is a dangling symlink" >&2
			return 1
		fi

		if [ "$link" != "${link#/dev/mapper/}" ]; then
			echo "cryptsetup: NOTE: using $link instead of $source for $target" >&2
			source="$link"
		fi
	fi

	# Sanity checks for $key
	if [ "$key" = "/dev/random" ] || [ "$key" = "/dev/urandom" ]; then
		echo "cryptsetup: WARNING: target $target has a random key, skipped" >&2
		return 1
	fi

	if [ -n "$extraopts" ]; then
		rootopts="$extraopts,$rootopts"
	fi

	# We have all the basic options, let's go trough them
	OPTIONS="target=$target,source=$source,key=$key"
	local IFS=", "
	unset HASH_FOUND
	unset LUKS_FOUND
	for opt in $rootopts; do
		case $opt in
			cipher=*)
				OPTIONS="$OPTIONS,$opt"
				;;
			hash=*)
				OPTIONS="$OPTIONS,$opt"
				HASH_FOUND=1
				;;
			size=*)
				OPTIONS="$OPTIONS,$opt"
				;;
			lvm=*)
				OPTIONS="$OPTIONS,$opt"
				;;
			keyscript=*)
				opt=${opt#keyscript=}
				if [ ! -x "/lib/cryptsetup/scripts/$opt" ] && [ ! -x "$opt" ]; then
					echo "cryptsetup: WARNING: target $target has an invalid keyscript, skipped" >&2
					return 1
				fi
				KEYSCRIPT="$opt"
				OPTIONS="$OPTIONS,keyscript=/keyscripts/$(basename "$opt")"
				;;
			tries=*)
				OPTIONS="$OPTIONS,$opt"
				;;
			luks)
				LUKS_FOUND=1
				;;
			*)
				# Presumably a non-supported option
				;;
		esac
	done

	# Warn for missing hash option, unless we have a LUKS partition
	if [ -z "$HASH_FOUND" ] && [ -z "$LUKS_FOUND" ]; then
		echo "WARNING: Option hash missing in crypttab for target $target, assuming ripemd160." >&2
		echo "         If this is wrong, this initramfs image will not boot." >&2
		echo "         Please read /usr/share/doc/cryptsetup/README.initramfs.gz and add" >&2
		echo "         the correct hash option to your /etc/crypttab."  >&2
	fi

	# If keyscript is set, the "key" is just an argument to the script
	if [ "$key" != "none" ] && [ -z "$KEYSCRIPT" ]; then
		echo "cryptsetup: WARNING: target $target uses a key file, skipped" >&2
		return 1
	fi
}

get_device_modules() {
	local node value cipher blockcipher ivhash
	node="$1"

	# Check the ciphers used by the active root mapping
	value=$(dmsetup table "$node" | cut -d " " -f4)
	cipher=$(echo "$value" | cut -d ":" -f1 | cut -d "-" -f1)
	blockcipher=$(echo "$value" | cut -d ":" -f1 | cut -d "-" -f2)
	ivhash=$(echo "$value" | cut -d ":" -s -f2)

	if [ -n "$cipher" ]; then
		echo "$cipher"
	else
		return 1
	fi

	if [ -n "$blockcipher" ] && [ "$blockcipher" != "plain" ]; then
		echo "$blockcipher"
	fi

	if [ -n "$ivhash" ] && [ "$ivhash" != "plain" ]; then
		echo "$ivhash"
	fi
	return 0
}

canonical_device() {
	local dev altdev original
	dev="$1"

	altdev="${dev#LABEL=}"
	if [ "$altdev" != "$dev" ]; then
		dev="/dev/disk/by-label/$altdev"
	fi

	altdev="${dev#UUID=}"
	if [ "$altdev" != "$dev" ]; then
		dev="/dev/disk/by-uuid/$altdev"
	fi

	original=$dev
	if [ -h "$dev" ]; then
		dev=$(readlink -e "$dev")
	fi

	altdev="${dev#/dev/mapper/}"
	if [ "$altdev" != "$dev" ]; then
		echo "$altdev"
		return 0
	elif [ "x${original%/dev/disk/by-*/*}" = "x" ]; then
		# support crypttab UUID/LABEL entries
		# this is a /dev/disk/by-*/ path so return just the 'basename'
		echo "${original##/dev/disk/by-*/}"
		return 0
	fi

	return 1
}

add_device() {
	local node nodes opts lastopts i count
	nodes="$1"
	opts=""     # Applied to all nodes
	lastopts="" # Applied to last node

	if [ -z "$nodes" ]; then
		return 0
	fi

	# Check that it is a node under /dev/mapper/
	nodes=$(canonical_device "$nodes") || return 0

	# Prepare to setup each node
	count=$(echo "$nodes" | wc -w)
	i=1
	for node in $nodes; do
		# Prune duplicates
		if [ -r "$DESTDIR/conf/conf.d/cryptroot" ] && \
		   grep -q "^target=$node" "$DESTDIR/conf/conf.d/cryptroot"; then
			continue
		fi

		# Prepare the additional options
		if [ $i -eq $count ]; then
			if [ -z "$opts" ]; then
				opts="$lastopts"
			else
				opts="$opts,$lastopts"
			fi
		fi

		# Get crypttab root options
		if ! get_device_opts "$node" "$opts"; then
			continue
		fi
		echo "$OPTIONS" >> "$DESTDIR/conf/conf.d/cryptroot"

		# If we have a keyscript, make sure it is included
		if [ -n "$KEYSCRIPT" ]; then
			if [ ! -d "$DESTDIR/keyscripts" ]; then
				mkdir "$DESTDIR/keyscripts"
			fi

			if [ -e "/lib/cryptsetup/scripts/$KEYSCRIPT" ]; then
				copy_exec "/lib/cryptsetup/scripts/$KEYSCRIPT" /keyscripts
			elif [ -e "$KEYSCRIPT" ]; then
				copy_exec "$KEYSCRIPT" /keyscripts
			else
				echo "cryptsetup: WARNING: failed to find keyscript $KEYSCRIPT" >&2
				continue
			fi
		fi

		# Calculate needed modules
		modules=$(get_device_modules $node | sort | uniq)
		if [ -z "$modules" ]; then
			echo "cryptsetup: WARNING: failed to determine cipher modules to load for $node" >&2
			continue
		fi
		echo dm_mod
		echo dm_crypt
		echo "$modules"

		i=$(( $i + 1 ))
	done

	return 0
}

add_crypto_modules() {
	local mod file altmod found genericfound
	mod="$1"
	found=""
	genericfound=""

	if [ -z "$mod" ]; then
		return 1
	fi

	# We have several potential sources of modules (in order of preference):
	#
	#   a) /lib/modules/$VERSION/kernel/arch/$ARCH/crypto/$mod-$specific.ko
	#   b) /lib/modules/$VERSION/kernel/crypto/$mod_generic.ko
	#   c) /lib/modules/$VERSION/kernel/crypto/$mod.ko
	#
	# and (currently ignored):
	#
	#   d) /lib/modules/$VERSION/kernel/drivers/crypto/$specific-$mod.ko

	for file in $(find "$MODULESDIR/kernel/arch/" -name "$mod-*.ko"); do
		altmod="${file##*/}"
		altmod="${altmod%.ko}"
		manual_add_modules "$altmod"
		found="yes"
	done

	for file in $(find "$MODULESDIR/kernel/crypto/" -name "${mod}_generic.ko"); do
		altmod="${file##*/}"
		altmod="${altmod%.ko}"
		manual_add_modules "$altmod"
		found="yes"
		genericfound="yes"
	done

	if [ -z "$genericfound" ]; then
		for file in $(find "$MODULESDIR/kernel/crypto/" -name "${mod}.ko"); do
			altmod="${file##*/}"
			altmod="${altmod%.ko}"
			manual_add_modules "$altmod"
			found="yes"
		done
	fi

	if [ -z "$found" ]; then
		return 1
	fi

	return 0
}

#
# Begin real processing
#

setup="no"

# Load the config opts and modules for each crypted device
for dev in $(get_crypt_devices); do
	if ! modules=$(add_device "$dev"); then
		echo "cryptsetup: FAILURE: could not determine configuration for $dev" >&2
		continue
	fi

	setup="yes"
	for mod in $modules; do
		add_crypto_modules $mod
	done
done

# See if we need to add the basic components
if [ "$MODULES" = "dep" ] && [ "$setup" = "yes" ]; then
	for mod in dm_mod dm_crypt; do
		manual_add_modules $mod
	done

	copy_exec /sbin/cryptsetup
	copy_exec /sbin/dmsetup
	copy_exec /lib/cryptsetup/askpass
fi

exit 0