makefreepto

#!/bin/bash
#uncomment the line below if you want to do heavy debug
#set -x

makefreepto_usage() {
cat <<EOF

$0 [ -b ] [ -r ] [-f file_system_type ] [ -s ] [ -p luks_password ] [ -i image_path ] DEVICE

Options:
    -b         skip badblocks check
    -r         skip random filling (use only if you know what you are doing)
    -R DEV     use DEV as random source instead of urandom (i.e.: /dev/frandom)
    -i IMAGE   put IMAGE on DEVICE (default is binary.img)
    -p         set password (defaul is "freepto")
    -s         set secure random password (default is "freepto")
    -f         set filesystem type: ext4 or btrfs (with lzo) (default is "ext4")

Example:
    sudo ./makefreepto -f ext4 -i freepto-lb_vX.X.X.img -p password /dev/sdX

EOF
}
### Output primitives {{{

# set color:
export LRED="\e[1;31m"
export LGREEN="\e[1;32m"
export Z="\e[0m"
_fatal() {
    echo -e "$LRED[!]$1 $Z" >&2
    exit 1
}
_error() {
    echo -e "$LRED[-]$1 $Z" >&2
}
_ok() {
    echo -e "$LGREEN[+]$Z $1" >&2
}
### }}}
### Misc utils {{{
nphase=0
phasestart=
phasetitle=
nphases=5
_phase() {
    if [[ -n "$phasestart" ]]; then
        _ok "$phasetitle SUCCESS (in $(($(date '+%s') - $phasestart)) seconds)"
    fi
    phasestart=$(date '+%s')
    nphase=$((nphase + 1))
    phasetitle="$1"
    echo -e "${LGREEN}[$nphase/$nphases]$Z $phasetitle"
}

_check_dep() {
    #$1 is the binary to check, $2 is the debian package
    if ! which "$1" &> /dev/null; then
        if ! which apt-get &> /dev/null; then
            _fatal "$1 is missing; please install and retry"
        fi
        apt-get --force-yes --yes install $2 2>&1
    fi
}

_write_monitor() {
    ddpid="$1"
    while kill -0 $ddpid &> /dev/null; do
        wchar=$(egrep '^wchar:' /proc/$ddpid/io | awk '{ print $2 }')
        echo -en "\rWriting $((wchar / 1024 / 1024))MB"
        sleep 5
    done
}
### }}}
### Phases {{{
randomfill() {
    #$1 is partition/device to fill
    dd if=/dev/urandom of="$1" &
    ddpid=$!
    _write_monitor "$ddpid"
    wait
}

persistence_partition() {
    ### $1 is device, $2 is offset
    ### assume that it is partition "2"
    local device=$1
    local img_bytes=$2

    partprobe 
    parted "${device}" -- mkpart primary "${img_bytes}B" -1
    sleep 1
    partprobe 

    if ! [[ -b "${device}2" ]]; then
        _fatal "Encrypted partition not found"
    fi
}

persistence_create() {
    # $1 is partition, $2 is passphrase
    local partition="$1"
    local passphrase="$2"
    # encrypt partition
    cryptsetup --verbose --batch-mode --key-size 512 --hash sha512 --cipher aes-xts-plain --use-random luksFormat "$1" <<<${passphrase} || exit 1

    local mapname="my_usb.$$"
    local mapper="/dev/mapper/$mapname"
    local mountpoint="/mnt/freepto.$$"
    # open LUKS
    cryptsetup luksOpen "$1" "$mapname" <<<${passphrase} || exit 1

    mkdir -p "$mountpoint"
    if [[ $fs == "btrfs" ]]; then
        # make btrfs fs with label: "persistence"
        mkfs.btrfs -L persistence "$mapper" 2>&1 || exit 1
        # mount the partition with lzo compression
        mount "$mapper" "$mountpoint" -o noatime,nodiratime,compress=lzo
    elif [[ $fs == "ext4" ]]; then
        # make ext4 fs with label: "persistence"
        mkfs.ext4 -L persistence "$mapper" 2>&1 || exit 1
        # mount the partition
        mount "$mapper" "$mountpoint" -o noatime,nodiratime
    elif [[ $fs == "reiserfs" ]]; then
        # make reiserfs fs with label: "persistence"
        mkfs.reiserfs -f -l persistence "$mapper" 2>&1 || exit 1
        # mount the partition
        mount "$mapper" "$mountpoint" -o noatime,nodiratime
    fi

    # make the persistence.conf file
    sleep 5
    echo "/ union" > "${mountpoint}/persistence.conf"

    sync
    sleep 5
    #cleanup
    umount /mnt/freepto.$$ 2>&1
    cryptsetup luksClose /dev/mapper/my_usb.$$ 2>&1
    rm -rf "$mountpoint" 2>&1
}

### }}}

# check if user is root:
if [ "$(id -u)" != "0" ]; then
   _fatal "Only root can do that!"
fi

if [ "$#" = '1' -a  "$1" = "source" ]; then
    true
else
    # set default:
    skip_badblocks=0
    skip_random=0
    password="freepto"
    random_device="${random_device:-/dev/urandom}"
    img=binary.img
    log="./makefreepto.log"
    #TODO: redirect all output to a log
    fs="ext4"

    while getopts 'brf:R:p:si:' opt; do
        case $opt in
            b)
                skip_badblocks=1
                nphases=$((nphases - 1))
                ;;
            r)
                skip_random=1
                nphases=$((nphases - 1))
                ;;
            f)  
                fs=$OPTARG
                ;;
            i)
                img=$OPTARG
                ;;
            p)
                password=$OPTARG
                ;;
            R)
                random_device=$OPTARG
                ;;
            s)
                password=`tr -dc 'a-zA-H0-9' < /dev/urandom | head -c 12`
                _ok "Your LUKS random passphrase is: $LRED$password$Z"
                ;;
            \?)
                _error "Invalid option: -$OPTARG"
                makefreepto_usage
                exit 1
                ;;
        esac
    done
    shift $((OPTIND-1))

    # some control check
    if ! [[ -f "$img" ]]; then
        _fatal "Image $img not exist or is not valid"
    fi

    if [ $# != 1 ];then
        _error "Wrong argument number"
        makefreepto_usage
        exit 1
    fi

    if ! [[ -b $1 ]]; then
        _fatal "$1 should be a block special device"
    fi
    if [ "${random_device}" != /dev/urandom ]; then
        echo "ATTENZIONE: STAI USANDO UN GENERATORE RANDOM ERETICO" ${random_device}
    fi


    # set device
    device=$1

    # check dependencies
    if [[ "$fs" = "btrfs" ]]; then
        _check_dep mkfs.btrfs btrfs-tools
    fi
    _check_dep cryptsetup cryptsetup
    _check_dep parted parted

    # umount device and clean all partition:
    if mount | egrep -q "^${device}"; then
        _fatal "Device is mounted; please umount"
    fi

    # check for bad block on the device:
    if [[ $skip_badblocks -eq 0 ]]; then
        _phase "Badblock check"
        badblocks -c 10240 -s -w -v "${device}"
    fi


    # copy binay image with dd:
    _phase "Image copy"
    dd "if=$img" of="${device}" &
    ddpid=$!
    echo " with PID $ddpid"
    totchar=$(stat -c '%s' "$img")
    humansize=$(du -h "$img" | cut -f1)
    while kill -0 $ddpid &> /dev/null; do
        wchar=$(egrep '^wchar:' /proc/$ddpid/io | awk '{ print $2 }')
        echo -en "\rWriting $humansize: $((wchar * 100 / totchar))%"
        sleep 10
    done
    wait

    # make the partition:
    _phase "Make encrypted persistent partition"
    persistence_partition "${device}" $(($(stat -c %s "$img")+1))

    # write random data on crypto partition:
    if [[ $skip_random -eq 0 ]]; then
        _phase "Writing random data on crypto partition!"
        randomfill "${device}2"
        sleep 2
    fi

    _phase "Create persistence"
    persistence_create "${device}2" "${password}"

    # stop
    _ok "Freepto is ready for use"
fi
# vim: set ts=4 sw=4 et ft=sh fdm=marker: