luks/lib.rs
1//! # luks-core — pure-Rust LUKS reader and decryptor
2//!
3//! Parse a LUKS container's on-disk header, recover the master key from a
4//! passphrase, and decrypt the payload. Panic-free and `forbid(unsafe)`: every
5//! integer is read bounds-checked, every crypto primitive is an audited
6//! RustCrypto crate.
7//!
8//! ```no_run
9//! use std::fs::File;
10//! let mut vol = luks::LuksVolume::unlock1_with_passphrase(
11//! File::open("container.luks")?,
12//! b"passphrase",
13//! )?;
14//! let mut first = [0u8; 512];
15//! vol.read_at(0, &mut first)?;
16//! # Ok::<(), Box<dyn std::error::Error>>(())
17//! ```
18//!
19//! Correctness is validated against `cryptsetup` on real containers (Tier-2);
20//! see `docs/validation.md`.
21
22#![forbid(unsafe_code)]
23#![cfg_attr(test, allow(clippy::unwrap_used, clippy::expect_used))]
24
25mod af;
26mod bytes;
27mod crypto;
28mod error;
29mod header;
30mod header2;
31#[cfg(feature = "vfs")]
32pub mod vfs;
33#[cfg(feature = "vfs")]
34pub use vfs::LuksLayer;
35mod volume;
36
37pub use error::{LuksError, Result};
38pub use header::{Keyslot, Luks1Header};
39pub use header2::{Luks2Digest, Luks2Header, Luks2Kdf, Luks2Keyslot, Luks2Segment};
40pub use volume::{DecryptedPayload, LuksVolume, VolumeInfo};
41
42/// Fuzz-only re-export (hidden from docs). Kept `pub` so the `core/fuzz` crate
43/// can drive the anti-forensic merge over arbitrary bytes directly, alongside
44/// the header parsers and the full unlock pipeline.
45#[doc(hidden)]
46pub use af::merge as af_merge;