ArchLinux: encrypt_resume initrd hook

#!/usr/bin/ash

run_hook() {
    local passw resumedev resumefile swapname

    modprobe -a -q dm-crypt >/dev/null 2>&1
    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

    # Get keyfile if specified
    ckeyfile="/crypto_keyfile.bin"
    if [ -n "$cryptkey" ]; then
        IFS=: read ckdev ckarg1 ckarg2 <<EOF
$cryptkey
EOF

        if [ "$ckdev" = "rootfs" ]; then
            ckeyfile=$ckarg1
        elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
            case ${ckarg1} in
                *[!0-9]*)
                    # Use a file on the device
                    # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
                    mkdir /ckey
                    mount -r -t "$ckarg1" "$resolved" /ckey
                    dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
                    umount /ckey
                    ;;
                *)
                    # Read raw data from the block device
                    # ckarg1 is numeric: ckarg1=offset, ckarg2=length
                    dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
                    ;;
            esac
        fi
        [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
    fi

    if [ -n "${cryptdevice}" ]; then
        DEPRECATED_CRYPT=0
        IFS=: read cryptdev cryptname cryptoptions <<EOF
$cryptdevice
EOF
    else
        DEPRECATED_CRYPT=1
        cryptdev="${root}"
        cryptname="root"
    fi

    warn_deprecated() {
        echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
        echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
    }

    for cryptopt in ${cryptoptions//,/ }; do
        case ${cryptopt} in
            allow-discards)
                cryptargs="${cryptargs} --allow-discards"
                ;;
            *)
                echo "Encryption option '${cryptopt}' not known, ignoring." >&2
                ;;
        esac
    done

    case $resume in
        swap:*|file:*)
            resumedev=$(cut -d ':' -f 2 << EOF
$resume
EOF
)
            ;;
        *)
            resumedev=$resume
            ;;
    esac
    resumedev=$(resolve_device "$resumedev" ${rootdelay} 2>/dev/null)

    passw=""
    #decrypt swap if necessary:
    swapname=enc_swap
    if [ -n $resumedev ] && cryptsetup isLuks $resumedev 2>&1 ; then
        [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
        dopassphrase=1
        # If keyfile exists, try to use that
        if [ -f ${ckeyfile} ]; then
            if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resumedev} ${swapname} ${cryptargs} ${CSQUIET}; then
                dopassphrase=0
            else
                echo "Invalid keyfile. Reverting to passphrase."
            fi
        fi
        # Ask for a passphrase
        if [ ${dopassphrase} -gt 0 ]; then
            echo ""
            echo "A password is required to access the ${cryptname} volume:"
            read -s passw

            # loop until we get a real password.
            # save the password so that we use the same for the root device.
            while ! eval cryptsetup open --type luks ${resumedev} ${swapname} ${cryptargs} ${CSQUIET} << EOF
$passw
EOF
do
                sleep 2;
                echo "A password is required to access the ${cryptname} volume:"
                read -s passw
            done
        fi
        if [ ! -e "/dev/mapper/${swapname}" ]; then
            err "Password succeeded, but ${swapname} device creation failed, aborting..."
            resume=""
        else
            echo "Swap successfully decrypted"
        fi
        case $resume in
            '')
                ;;
            swap:*)
                resume="swap:/dev/mapper/$swapname"
                ;;
            file:*)
                resume="file:/dev/mapper/$swapname:$(cut -d ':' -f 3 << EOF
$resume
EOF
)"
                ;;
            *)
                resume="/dev/mapper/$swapname"
                ;;
        esac
    fi

    case $resume in
        '')
            err "resume: no device specified for hibernation"
            ;;
        swap:*|file:*)
            # is it even possible for files?
            # tux-on-ice syntax: swap:/dev/sda2 or file:/dev/sda2:0xdeadbeef
            if [ -d /sys/power/tuxonice  ]; then
                echo "$resume" >/sys/power/tuxonice/resume
                echo > /sys/power/tuxonice/do_resume
            else
                err "resume: tux-on-ice syntax detected, but no support found"
            fi
            ;;
        *)
            # standard hibernation
            if resumedev=$(resolve_device "$resume" "$rootdelay" 2>/dev/null ); then
                if [ -e /sys/power/resume ]; then
                    printf "%d:%d" $(stat -Lc "0x%t 0x%T" "$resume") > /sys/power/resume
                else
                    err "resume: no hibernation support found"
                fi
            fi
            ;;
    esac


    if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
        if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            dopassphrase=1
            # If keyfile exists, try to use that
            if [ -f ${ckeyfile} ]; then
                if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
                    dopassphrase=0
                else
                    echo "Invalid keyfile. Reverting to passphrase."
                fi
            fi
            # Ask for a passphrase
            if [ ${dopassphrase} -gt 0 ]; then
                if [ -z "$passw" ]; then
                    echo ""
                    echo "A password is required to access the ${cryptname} volume:"
                fi

                # loop until we get a real password.
                # try the swap password as the first thing.
                if [ -z "$passw" ]; then
                    read -s passw
                fi
                while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET} << EOF
$passw
EOF
do
                    sleep 2
                    echo "A password is required to access the ${cryptname} volume:"
                    read -s passw
                done
                unset passw
            fi
            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                fi
            else
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                exit 1
            fi
        elif [ -n "${crypto}" ]; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            msg "Non-LUKS encrypted device found..."
            if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
                err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
                err "Non-LUKS decryption not attempted..."
                return 1
            fi
            test="cryptsetup isLuks $resolved "
            exe="cryptsetup open --type plain $resolved $cryptname $cryptargs "
            IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
$crypto
EOF
            args=""
            [ -n "$c_hash" ]    && args="$args --hash '$c_hash'"
            [ -n "$c_cipher" ]  && args="$args --cipher '$c_cipher'"
            [ -n "$c_keysize" ] && args="$args --key-size '$c_keysize'"
            [ -n "$c_offset" ]  && args="$args --offset '$c_offset'"
            [ -n "$c_skip" ]    && args="$args --skip '$c_skip'"
            exe="$exe $args"
            test="$test $args $CSQUIET"
            if ! eval "$test"; then
                err "Can't find anything to decrypt."
                return 1
            fi
            devopened=0
            if [ -f "$ckeyfile" ]; then
                if ! eval "$exe --key-file $ckeyfile $CSQUIET"; then
                    err "Wrong keyfile specified. Falling back to passphrase..."
                    exe="$exe --verify-passphrase $CSQUIET"
                    if [ -z "$passw" ]; then
                        echo ""
                        echo "A password is required to access the ${cryptname} volume:"
                    fi
                else
                    devopened=1
                fi
            else
                exe="$exe --verify-passphrase $CSQUIET"
                if [ -z "$passw" ]; then
                    echo ""
                    echo "A password is required to access the ${cryptname} volume:"
                fi
            fi
            if [ $devopened -eq 0 ]; then
                if [ -z "$passw" ]; then
                    read -s passw
                fi
                while ! eval "$exe << EOF
$passw
EOF
"; do
                    err "Non-LUKS device decryption failed. retry passphrase or verify format: "
                    err "      crypto=hash:cipher:keysize:offset:skip"
                    sleep 2
                    echo "A password is required to access the ${cryptname} volume:"
                    read -s passw
                done
            fi
            unset passw

            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                fi
            else
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                return 1
            fi
        else
            err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
        fi
    fi
    rm -f ${ckeyfile} 2>/dev/null
}

# vim: set ft=sh ts=4 sw=4 et: