Blame SOURCES/0010-Add-clevis-luks-edit-command.patch

95204d
From 46dc5904a9a6b0f1dcdb2511cc3f09671ef54b2a Mon Sep 17 00:00:00 2001
95204d
From: Sergio Correia <scorreia@redhat.com>
95204d
Date: Wed, 20 May 2020 21:09:15 -0300
95204d
Subject: [PATCH] Add clevis luks edit command
95204d
95204d
---
95204d
 src/luks/clevis-luks-common-functions    |  65 ++++--
95204d
 src/luks/clevis-luks-edit                | 242 +++++++++++++++++++++++
95204d
 src/luks/clevis-luks-edit.1.adoc         |  69 +++++++
95204d
 src/luks/clevis-luks-regen               | 125 ++----------
95204d
 src/luks/meson.build                     |   3 +
95204d
 src/luks/tests/edit-tang-luks1           | 106 ++++++++++
95204d
 src/luks/tests/edit-tang-luks2           | 106 ++++++++++
95204d
 src/luks/tests/meson.build               |  28 ++-
95204d
 src/luks/tests/regen-inplace-luks1       |   2 +-
95204d
 src/luks/tests/regen-inplace-luks2       |   2 +-
95204d
 src/luks/tests/regen-not-inplace-luks1   |   2 +-
95204d
 src/luks/tests/regen-not-inplace-luks2   |   2 +-
95204d
 src/luks/tests/tests-common-functions.in |  26 ---
95204d
 src/luks/tests/unlock-tang-luks1         |   7 +-
95204d
 src/luks/tests/unlock-tang-luks2         |   8 +-
95204d
 15 files changed, 606 insertions(+), 187 deletions(-)
95204d
 create mode 100755 src/luks/clevis-luks-edit
95204d
 create mode 100644 src/luks/clevis-luks-edit.1.adoc
95204d
 create mode 100755 src/luks/tests/edit-tang-luks1
95204d
 create mode 100755 src/luks/tests/edit-tang-luks2
95204d
95204d
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
95204d
index c9d712a..f3a875c 100644
95204d
--- a/src/luks/clevis-luks-common-functions
95204d
+++ b/src/luks/clevis-luks-common-functions
95204d
@@ -141,11 +141,7 @@ clevis_luks_decode_jwe() {
95204d
     local jwe="${1}"
95204d
 
95204d
     local coded
95204d
-    if ! coded=$(jose jwe fmt -i- <<< "${jwe}"); then
95204d
-        return 1
95204d
-    fi
95204d
-
95204d
-    coded=$(jose fmt -j- -g protected -u- <<< "${coded}" | tr -d '"')
95204d
+    read -r -d . coded <<< "${jwe}"
95204d
     jose b64 dec -i- <<< "${coded}"
95204d
 }
95204d
 
95204d
@@ -291,6 +287,46 @@ clevis_luks_read_pins_from_slot() {
95204d
     printf "%s: %s\n" "${SLOT}" "${cfg}"
95204d
 }
95204d
 
95204d
+# clevis_luks_is_key_valid() checks whether the given key is valid to unlock
95204d
+# the given device.
95204d
+clevis_luks_is_key_valid() {
95204d
+    local DEV="${1}"
95204d
+    local KEY="${2}"
95204d
+
95204d
+    if ! cryptsetup open --test-passphrase "${DEV}" \
95204d
+                         --key-file <(echo -n "${KEY}") 2>/dev/null; then
95204d
+        return 1
95204d
+    fi
95204d
+    return 0
95204d
+}
95204d
+
95204d
+# clevis_luks_unlock_device_by_slot() does the unlock of the device and slot
95204d
+# passed as parameters and returns the decoded passphrase.
95204d
+clevis_luks_unlock_device_by_slot() {
95204d
+    local DEV="${1}"
95204d
+    local SLT="${2}"
95204d
+
95204d
+    [ -z "${DEV}" ] && return 1
95204d
+    [ -z "${SLT}" ] && return 1
95204d
+
95204d
+    local jwe passphrase
95204d
+    if ! jwe="$(clevis_luks_read_slot "${DEV}" "${SLT}" 2>/dev/null)" \
95204d
+                || [ -z "${jwe}" ]; then
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}") 2>/dev/null)" \
95204d
+                       || [ -z "${passphrase}" ]; then
95204d
+        return 1
95204d
+    fi
95204d
+
95204d
+    if ! clevis_luks_is_key_valid "${DEV}" "${passphrase}"; then
95204d
+        return 1
95204d
+    fi
95204d
+    echo -n "${passphrase}"
95204d
+    return 0
95204d
+}
95204d
+
95204d
 # clevis_luks_unlock_device() does the unlock of the device passed as
95204d
 # parameter and returns the decoded passphrase.
95204d
 clevis_luks_unlock_device() {
95204d
@@ -303,26 +339,15 @@ clevis_luks_unlock_device() {
95204d
         return 1
95204d
     fi
95204d
 
95204d
-    local slt jwe passphrase
95204d
+    local slt pt
95204d
     for slt in ${used_slots}; do
95204d
-        if ! jwe="$(clevis_luks_read_slot "${DEV}" "${slt}" 2>/dev/null)" \
95204d
-                   || [ -z "${jwe}" ]; then
95204d
-            continue
95204d
-        fi
95204d
-
95204d
-        if ! passphrase="$(clevis decrypt < <(echo -n "${jwe}"))" \
95204d
-                           || [ -z "${passphrase}" ]; then
95204d
+        if ! pt=$(clevis_luks_unlock_device_by_slot "${DEV}" "${slt}") \
95204d
+                  || [ -z "${pt}" ]; then
95204d
             continue
95204d
         fi
95204d
-
95204d
-        if ! cryptsetup luksOpen --test-passphrase "${DEV}" \
95204d
-             --key-file <(echo -n "${passphrase}"); then
95204d
-            continue
95204d
-        fi
95204d
-        echo -n "${passphrase}"
95204d
+        echo -n "${pt}"
95204d
         return 0
95204d
     done
95204d
-
95204d
     return 1
95204d
 }
95204d
 
95204d
diff --git a/src/luks/clevis-luks-edit b/src/luks/clevis-luks-edit
95204d
new file mode 100755
95204d
index 0000000..fc95f75
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-edit
95204d
@@ -0,0 +1,242 @@
95204d
+#!/bin/bash -e
95204d
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2020 Red Hat, Inc.
95204d
+# Author: Sergio Correia <scorreia@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+#
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+SUMMARY="Edit a binding from a clevis-bound slot in a LUKS device"
95204d
+
95204d
+usage() {
95204d
+    echo >&2
95204d
+    echo "Usage: clevis luks edit [-f] -d DEV -s SLT [-c CONFIG]" >&2
95204d
+    echo >&2
95204d
+    echo "$SUMMARY": >&2
95204d
+    echo >&2
95204d
+    echo "  -d DEV     The LUKS device to edit clevis-bound pins" >&2
95204d
+    echo >&2
95204d
+    echo "  -s SLOT    The slot to use when editing the clevis binding" >&2
95204d
+    echo >&2
95204d
+    echo "  -f         Proceed with the edit operation even if the configuration is the same" >&2
95204d
+    echo >&2
95204d
+    echo "  -c CONFIG  The updated config to use" >&2
95204d
+    echo >&2
95204d
+    exit 1
95204d
+}
95204d
+
95204d
+on_exit() {
95204d
+    [ -d "$TMP" ] && rm -rf "${TMP}"
95204d
+}
95204d
+
95204d
+validate_cfg() {
95204d
+    local json="${1}"
95204d
+    jose fmt -j- -O <<< "${json}" 2>/dev/null
95204d
+}
95204d
+
95204d
+edit_cfg() {
95204d
+    local cfg_file="${1}"
95204d
+    local editor="${EDITOR:-vi}"
95204d
+
95204d
+    "${editor}" "${cfg_file}" || true
95204d
+    if ! validate_cfg "$(<"${cfg_file}")"; then
95204d
+        local ans=
95204d
+        while true; do
95204d
+            read -r -p \
95204d
+              "Malformed configuration. Would you like to edit again? [ynYN] " \
95204d
+             ans < /dev/tty
95204d
+
95204d
+            [[ "${ans}" =~ ^[nN]$ ]] && return 1
95204d
+            [[ "${ans}" =~ ^[yY]$ ]] && break
95204d
+        done
95204d
+        edit_cfg "${cfg_file}"
95204d
+    fi
95204d
+    return 0
95204d
+}
95204d
+
95204d
+if [ "${#}" -eq 1 ] && [ "${1}" = "--summary" ]; then
95204d
+    echo "${SUMMARY}"
95204d
+    exit 0
95204d
+fi
95204d
+
95204d
+CFG=
95204d
+FRC=
95204d
+while getopts ":fd:s:c:" o; do
95204d
+    case "$o" in
95204d
+    d) DEV=${OPTARG};;
95204d
+    s) SLT=${OPTARG};;
95204d
+    c) CFG=${OPTARG};;
95204d
+    f) FRC=-f;;
95204d
+    *) usage;;
95204d
+    esac
95204d
+done
95204d
+
95204d
+if [ -z "${DEV}" ]; then
95204d
+    echo "Did not specify a device!" >&2
95204d
+    usage
95204d
+fi
95204d
+
95204d
+if [ -z "${SLT}" ]; then
95204d
+    echo "Did not specify a slot!" >&2
95204d
+    usage
95204d
+fi
95204d
+
95204d
+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \
95204d
+                || [ -z "${binding}" ]; then
95204d
+    echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+read -r _ pin cfg <<< "${binding}"
95204d
+# Remove single quotes.
95204d
+cfg=${cfg//\'}
95204d
+if ! pretty_cfg="$(jq . <<< "${cfg}")" || [ -z "${pretty_cfg}" ]; then
95204d
+    echo "Error reading the configuration from ${DEV}:${SLT}" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! TMP="$(mktemp -d)" || [ -z "${TMP}" ]; then
95204d
+    echo "Creating a temporary dir for editing binding failed" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+trap 'on_exit' EXIT
95204d
+trap 'on_exit' ERR
95204d
+
95204d
+if [ -z "${CFG}" ]; then
95204d
+   CFG_FILE="${TMP}/cfg"
95204d
+    echo "${pretty_cfg}" > "${CFG_FILE}"
95204d
+    if ! edit_cfg "${CFG_FILE}"; then
95204d
+        exit 1
95204d
+    fi
95204d
+
95204d
+    if ! new_cfg="$(jq . -S < "${CFG_FILE}")" || [ -z "${new_cfg}" ]; then
95204d
+        echo "Error reading the updated config for ${DEV}:${SLT}" >&2
95204d
+        exit 1
95204d
+    fi
95204d
+else
95204d
+    if ! validate_cfg "${CFG}"; then
95204d
+        echo "Invalid configuration given as parameter with -c" >&2
95204d
+        exit 1
95204d
+    fi
95204d
+    new_cfg="$(jq . -S <<< "${CFG}")"
95204d
+fi
95204d
+
95204d
+if [ "${new_cfg}" = "$(jq -S . <<< "${pretty_cfg}")" ] && [ -z "${FRC}" ]; then
95204d
+    echo "No changes detected; exiting" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if ! jcfg="$(jose fmt -j- -Oo- <<< "${new_cfg}" 2>/dev/null)" \
95204d
+             || [ -z "${jcfg}" ]; then
95204d
+    echo "Error preparing the configuration for the binding update" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+if [ -z "${CFG}" ]; then
95204d
+    printf "Pin: %s\nNew config:\n%s\n" "${pin}" "${new_cfg}"
95204d
+    while true; do
95204d
+        read -r -p \
95204d
+          "Would you like to proceed with the updated configuration? [ynYN] " \
95204d
+         ans < /dev/tty
95204d
+        [[ "${ans}" =~ ^[nN]$ ]] && exit 0
95204d
+        [[ "${ans}" =~ ^[yY]$ ]] && break
95204d
+    done
95204d
+fi
95204d
+
95204d
+echo "Updating binding..."
95204d
+
95204d
+# Create new key.
95204d
+if ! new_pass=$(generate_key "${DEV}"); then
95204d
+    echo "Error generating new key for device ${DEV}" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+# Reencrypt the new password.
95204d
+if ! jwe="$(clevis encrypt "${pin}" "${jcfg}" -y <<< "${new_pass}")"; then
95204d
+    echo "Error using pin '${pin}' with config '${jcfg}'" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+# Backup LUKS header.
95204d
+if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then
95204d
+    echo "Error while trying to back up LUKS header from ${DEV}" >&2
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+# Get passphrase.
95204d
+if ! pt="$(clevis_luks_unlock_device "${DEV}")" \
95204d
+           || [ -z "${pt}" ]; then
95204d
+    # Unable to retrieve a passphrase from the bindings, so let's query
95204d
+    # the user.
95204d
+    read -r -s -p "Enter existing LUKS password: " pt; echo
95204d
+    # Check if the key is valid.
95204d
+    if ! clevis_luks_is_key_valid "${DEV}" "${pt}"; then
95204d
+        echo "The key provided is not valid for ${DEV}" >&2
95204d
+        exit 1
95204d
+    fi
95204d
+fi
95204d
+
95204d
+# Check if we can do the update in-place, i.e., if the key we got is the one
95204d
+# for the slot we are interested in.
95204d
+in_place=
95204d
+if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \
95204d
+        <<< "${pt}"; then
95204d
+    in_place=true
95204d
+fi
95204d
+
95204d
+# Update the key slot with the new key. If we have the key for this slot,
95204d
+# the change happens in-place. Otherwise, we kill the slot and re-add it.
95204d
+if [ -n "${in_place}" ]; then
95204d
+    if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \
95204d
+            <(echo -n "${new_pass}") <<< "${pt}"; then
95204d
+        echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2
95204d
+        clevis_luks_restore_dev "${DEV}" "${TMP}"
95204d
+        exit 1
95204d
+    fi
95204d
+else
95204d
+    if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then
95204d
+        echo "Error wiping slot ${SLT} from ${DEV}" >&2
95204d
+        clevis_luks_restore_dev "${DEV}" "${TMP}"
95204d
+        exit 1
95204d
+    fi
95204d
+
95204d
+    if ! echo -n "${new_pass}" \
95204d
+            | cryptsetup luksAddKey --key-slot "${SLT}" \
95204d
+                         --key-file <(echo -n "${pt}") "${DEV}"; then
95204d
+        echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2
95204d
+        clevis_luks_restore_dev "${DEV}" "${TMP}"
95204d
+        exit 1
95204d
+    fi
95204d
+fi
95204d
+
95204d
+# Update the metadata.
95204d
+if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then
95204d
+    echo "Error updating metadata in ${DEV}:${SLT}" >&2
95204d
+    clevis_luks_restore_dev "${DEV}" "${TMP}"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+# Make sure we can unlock the device with this keyslot.
95204d
+if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}" >/dev/null \
95204d
+                                       2>/dev/null; then
95204d
+    echo "Invalid configuration detected. Reverting changes." >&2
95204d
+    clevis_luks_restore_dev "${DEV}" "${TMP}"
95204d
+    exit 1
95204d
+fi
95204d
+
95204d
+echo "Binding edited successfully."
95204d
diff --git a/src/luks/clevis-luks-edit.1.adoc b/src/luks/clevis-luks-edit.1.adoc
95204d
new file mode 100644
95204d
index 0000000..454de89
95204d
--- /dev/null
95204d
+++ b/src/luks/clevis-luks-edit.1.adoc
95204d
@@ -0,0 +1,69 @@
95204d
+CLEVIS-LUKS-EDIT(1)
95204d
+===================
95204d
+:doctype: manpage
95204d
+
95204d
+
95204d
+== NAME
95204d
+
95204d
+clevis-luks-edit - Edit a binding from a clevis-bound slot in a LUKS device
95204d
+
95204d
+== SYNOPSIS
95204d
+
95204d
+*clevis luks edit* -d DEV -s SLT [-c CONFIG]
95204d
+
95204d
+== OVERVIEW
95204d
+
95204d
+The *clevis luks edit* command edits clevis bindings from a LUKS device.
95204d
+For example:
95204d
+
95204d
+    clevis luks edit -d /dev/sda1 -s 1
95204d
+
95204d
+== OPTIONS
95204d
+
95204d
+* *-d* _DEV_ :
95204d
+  The LUKS device to edit clevis-bound pins
95204d
+
95204d
+* *-s* _SLT_ :
95204d
+  The slot to use when editing the clevis binding
95204d
+
95204d
+* *-f* :
95204d
+  Proceed with the edit operation even if the config is the same as the current one
95204d
+
95204d
+* *-c* _CONFIG_ :
95204d
+  The updated config to use
95204d
+
95204d
+
95204d
+== EXAMPLES
95204d
+
95204d
+    clevis luks list -d /dev/sda1
95204d
+    1: tang '{"url":"addr"}'
95204d
+
95204d
+As we can see in the example above, */dev/sda1* has one slots bound, in this case, to a _tang_ pin.
95204d
+
95204d
+We can edit this binding by issuing the following command:
95204d
+
95204d
+    clevis luks edit -d /dev/sda1 -s 1
95204d
+
95204d
+This will open a text editor -- the one set in the $EDITOR environment variable, or _vi_, as a fallback -- with the current
95204d
+configuration of this binding to be edited. In this case, we should have the following:
95204d
+
95204d
+    {
95204d
+        "url": "addr"
95204d
+    }
95204d
+
95204d
+Once at the editor, we can edit the pin configuration. For _tang_, we could edit the _url_, for instance. After completing the change,
95204d
+save the file and exit. The updated configuration will be validated for JSON, and if there are no errors, you will be shown the
95204d
+updated configuration and prompted whether to proceed.
95204d
+
95204d
+By proceeding, the binding will be updated. There may be required to provide a valid LUKS passphrase for the device.
95204d
+
95204d
+In the second example, we will update the same device and slot, but we will be providing the updated configuration as well:
95204d
+
95204d
+    clevis luks edit -d /dev/sda1 -s 1 -c '{"url":"new-addr-here"}'
95204d
+
95204d
+In this case, the binding update will be done in non-interactive mode, however it also may be required to provide a valud LUKS
95204d
+passphrase for the device.
95204d
+
95204d
+== SEE ALSO
95204d
+
95204d
+link:clevis-luks-list.1.adoc[*clevis-luks-list*(1)],
95204d
diff --git a/src/luks/clevis-luks-regen b/src/luks/clevis-luks-regen
95204d
index 6071d85..8f32e08 100755
95204d
--- a/src/luks/clevis-luks-regen
95204d
+++ b/src/luks/clevis-luks-regen
95204d
@@ -41,15 +41,7 @@ function usage_and_exit () {
95204d
     exit "${1}"
95204d
 }
95204d
 
95204d
-on_exit() {
95204d
-    if [ ! -d "${TMP}" ] || ! rm -rf "${TMP}"; then
95204d
-        echo "Delete temporary files failed!" >&2
95204d
-        echo "You need to clean up: ${TMP}" >&2
95204d
-        exit 1
95204d
-    fi
95204d
-}
95204d
-
95204d
-while getopts ":hfd:s:" o; do
95204d
+while getopts ":hd:s:" o; do
95204d
     case "$o" in
95204d
     d) DEV="$OPTARG";;
95204d
     h) usage_and_exit 0;;
95204d
@@ -68,117 +60,22 @@ if [ -z "$SLT" ]; then
95204d
     exit 1
95204d
 fi
95204d
 
95204d
-### ----------------------------------------------------------------------
95204d
-if ! pin_cfg=$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null); then
95204d
-    echo "Error obtaining current configuration of device ${DEV}:${SLT}" >&2
95204d
+if ! binding="$(clevis luks list -d "${DEV}" -s "${SLT}" 2>/dev/null)" \
95204d
+                || [ -z "${binding}" ]; then
95204d
+    echo "Error retrieving current configuration from ${DEV}:${SLT}" >&2
95204d
     exit 1
95204d
 fi
95204d
 
95204d
-PIN=$(echo "${pin_cfg}" | awk '{ print $2 }')
95204d
-CFG=$(echo "${pin_cfg}" | awk '{ print $3 }' | tr -d "'")
95204d
+read -r _ pin cfg <<< "${binding}"
95204d
 
95204d
 echo "Regenerating with:"
95204d
-echo "PIN: $PIN"
95204d
-echo "CONFIG: $CFG"
95204d
-
95204d
-trap 'echo "Ignoring CONTROL-C!"' INT TERM
95204d
-
95204d
-# Get the existing key.
95204d
-if ! existing_key=$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null); then
95204d
-    # We failed to obtain the passphrase for the slot -- perhaps
95204d
-    # it was rotated? --, so let's request user input.
95204d
-    read -r -s -p "Enter existing LUKS password: " existing_key; echo
95204d
-fi
95204d
-
95204d
-# Check if the key is valid.
95204d
-if ! cryptsetup open --test-passphrase "${DEV}" <<< "${existing_key}"; then
95204d
-    exit 1
95204d
-fi
95204d
-
95204d
-# Check if we can do the update in-place, i.e., if the key we got is the one
95204d
-# for the slot we are interested in.
95204d
-in_place=
95204d
-if cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" \
95204d
-        <<< "${existing_key}"; then
95204d
-    in_place=true
95204d
-fi
95204d
-
95204d
-# Create new key.
95204d
-if ! new_passphrase=$(generate_key "${DEV}"); then
95204d
-    echo "Error generating new key for device ${DEV}" >&2
95204d
-    exit 1
95204d
-fi
95204d
-
95204d
-# Reencrypt the new password.
95204d
-if ! jwe="$(clevis encrypt "${PIN}" "${CFG}" <<< "${new_passphrase}")"; then
95204d
-    echo "Error using pin '${PIN}' with config '${CFG}'" >&2
95204d
-    exit 1
95204d
-fi
95204d
-
95204d
-# Updating the metadata and the actual passphrase are destructive operations,
95204d
-# hence we will do a backup of the LUKS header and restore it later in case
95204d
-# we have issues performing these operations.
95204d
-if ! TMP="$(mktemp -d)"; then
95204d
-    echo "Creating a temporary dir for device backup/restore failed!" >&2
95204d
-    exit 1
95204d
-fi
95204d
-trap 'on_exit' EXIT
95204d
-
95204d
-# Backup LUKS header.
95204d
-if ! clevis_luks_backup_dev "${DEV}" "${TMP}"; then
95204d
-    echo "Error while trying to back up LUKS header from ${DEV}" >&2
95204d
-    exit 1
95204d
-fi
95204d
-
95204d
-restore_device() {
95204d
-    local DEV="${1}"
95204d
-    local TMP="${2}"
95204d
-
95204d
-    if ! clevis_luks_restore_dev "${DEV}" "${TMP}"; then
95204d
-        echo "Error while trying to restore LUKS header from ${DEV}." >&2
95204d
-    else
95204d
-        echo "LUKS header restored successfully." >&2
95204d
-    fi
95204d
-}
95204d
-
95204d
-# Update the key slot with the new key. If we have the key for this slot,
95204d
-# the change happens in-place. Otherwise, we kill the slot and re-add it.
95204d
-if [ -n "${in_place}" ]; then
95204d
-    if ! cryptsetup luksChangeKey "${DEV}" --key-slot "${SLT}" \
95204d
-            <(echo -n "${new_passphrase}") <<< "${existing_key}"; then
95204d
-        echo "Error updating LUKS passphrase in ${DEV}:${SLT}" >&2
95204d
-        restore_device "${DEV}" "${TMP}"
95204d
-        exit 1
95204d
-    fi
95204d
-else
95204d
-    if ! cryptsetup luksKillSlot --batch-mode "${DEV}" "${SLT}"; then
95204d
-        echo "Error wiping slot ${SLT} from ${DEV}" >&2
95204d
-        restore_device "${DEV}" "${TMP}"
95204d
-        exit 1
95204d
-    fi
95204d
-
95204d
-    if ! echo -n "${new_passphrase}" \
95204d
-            | cryptsetup luksAddKey --key-slot "${SLT}" \
95204d
-                         --key-file <(echo -n "${existing_key}") "${DEV}"; then
95204d
-        echo "Error updating LUKS passphrase in ${DEV}:${SLT}." >&2
95204d
-        restore_device "${DEV}" "${TMP}"
95204d
-        exit 1
95204d
-    fi
95204d
-fi
95204d
-
95204d
-# Update the metadata.
95204d
-if ! clevis_luks_save_slot "${DEV}" "${SLT}" "${jwe}" "overwrite"; then
95204d
-    echo "Error updating metadata in ${DEV}:${SLT}" >&2
95204d
-    restore_device "${DEV}" "${TMP}"
95204d
-    exit 1
95204d
-fi
95204d
+echo "PIN: ${pin}"
95204d
+echo "CONFIG: ${cfg}"
95204d
 
95204d
-# Now make sure that we can unlock this device after the change.
95204d
-# If we can't, undo the changes.
95204d
-if ! cryptsetup open --test-passphrase --key-slot "${SLT}" "${DEV}" 2>/dev/null \
95204d
-        <<< "$(clevis luks pass -d "${DEV}" -s "${SLT}" 2>/dev/null)"; then
95204d
-    echo "Invalid configuration detected after rebinding. Reverting changes."
95204d
-    restore_device "${DEV}" "${TMP}"
95204d
+# Remove single quotes.
95204d
+cfg=${cfg//\'}
95204d
+if ! clevis luks edit -f -d "${DEV}" -s "${SLT}" -c "${cfg}" >/dev/null; then
95204d
+    echo "Error rotating keys in ${DEV}:${SLT}" >&2
95204d
     exit 1
95204d
 fi
95204d
 
95204d
diff --git a/src/luks/meson.build b/src/luks/meson.build
95204d
index ee588c3..ba02bd9 100644
95204d
--- a/src/luks/meson.build
95204d
+++ b/src/luks/meson.build
95204d
@@ -54,6 +54,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-sss')
95204d
   bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-tang')
95204d
   mans += join_paths(meson.current_source_dir(), 'clevis-luks-report.1')
95204d
+
95204d
+  bins += join_paths(meson.current_source_dir(), 'clevis-luks-edit')
95204d
+  mans += join_paths(meson.current_source_dir(), 'clevis-luks-edit.1')
95204d
 else
95204d
   warning('Will not install LUKS support due to missing dependencies!')
95204d
 endif
95204d
diff --git a/src/luks/tests/edit-tang-luks1 b/src/luks/tests/edit-tang-luks1
95204d
new file mode 100755
95204d
index 0000000..3d42d68
95204d
--- /dev/null
95204d
+++ b/src/luks/tests/edit-tang-luks1
95204d
@@ -0,0 +1,106 @@
95204d
+#!/bin/bash -ex
95204d
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2020 Red Hat, Inc.
95204d
+# Author: Sergio Correia <scorreia@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+
95204d
+TEST=$(basename "${0}")
95204d
+. tests-common-functions
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+on_exit() {
95204d
+    local d
95204d
+    for d in "${TMP}" "${TMP2}"; do
95204d
+        [ ! -d "${d}" ] && continue
95204d
+        tang_stop "${d}"
95204d
+        rm -rf "${d}"
95204d
+    done
95204d
+}
95204d
+
95204d
+trap 'on_exit' EXIT
95204d
+trap 'on_exit' ERR
95204d
+
95204d
+TMP="$(mktemp -d)"
95204d
+
95204d
+port=$(get_random_port)
95204d
+tang_run "${TMP}" "${port}" &
95204d
+tang_wait_until_ready "${port}"
95204d
+
95204d
+url="http://${TANG_HOST}:${port}"
95204d
+
95204d
+cfg=$(printf '{"url":"%s"}' "${url}")
95204d
+
95204d
+# LUKS1.
95204d
+DEV="${TMP}/luks1-device"
95204d
+new_device "luks1" "${DEV}"
95204d
+
95204d
+if ! clevis luks bind -y -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+# Now let's try to change the config but using the same one we already have.
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${cfg}"; then
95204d
+    error "${TEST}: edit should not have succeeded because the config is the same."
95204d
+fi
95204d
+
95204d
+# And now, just a broken config.
95204d
+new_cfg=$(printf '{"url&:"%s"}' "${url}")
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have failed because of invalid JSON"
95204d
+fi
95204d
+
95204d
+# Now let's have another tang instance running and change the config to use
95204d
+# the new one.
95204d
+port2=$(get_random_port)
95204d
+TMP2="$(mktemp -d)"
95204d
+tang_run "${TMP2}" "${port2}" &
95204d
+tang_wait_until_ready "${port2}"
95204d
+new_url="http://${TANG_HOST}:${port2}"
95204d
+new_cfg=$(printf '{"url":"%s"}' "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded."
95204d
+fi
95204d
+
95204d
+# And now let's use sss and start with a single tang server, then add a second
95204d
+# one.
95204d
+new_device "luks1" "${DEV}"
95204d
+cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"}]}}' "${url}")
95204d
+if ! clevis luks bind -y -d "${DEV}" sss "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+new_cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded and added a new tang server"
95204d
+fi
95204d
+
95204d
+# Now let's change the threshold to 2.
95204d
+new_cfg=$(printf '{"t":2,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded and added a new tang server"
95204d
+fi
95204d
+
95204d
+# And finally, let's try a broken config, with a wrong threshold.
95204d
+new_cfg=$(printf '{"t":3,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have failed because threshold > number of servers"
95204d
+fi
95204d
diff --git a/src/luks/tests/edit-tang-luks2 b/src/luks/tests/edit-tang-luks2
95204d
new file mode 100755
95204d
index 0000000..9000053
95204d
--- /dev/null
95204d
+++ b/src/luks/tests/edit-tang-luks2
95204d
@@ -0,0 +1,106 @@
95204d
+#!/bin/bash -ex
95204d
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
95204d
+#
95204d
+# Copyright (c) 2020 Red Hat, Inc.
95204d
+# Author: Sergio Correia <scorreia@redhat.com>
95204d
+#
95204d
+# This program is free software: you can redistribute it and/or modify
95204d
+# it under the terms of the GNU General Public License as published by
95204d
+# the Free Software Foundation, either version 3 of the License, or
95204d
+# (at your option) any later version.
95204d
+#
95204d
+# This program is distributed in the hope that it will be useful,
95204d
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
95204d
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
95204d
+# GNU General Public License for more details.
95204d
+#
95204d
+# You should have received a copy of the GNU General Public License
95204d
+# along with this program.  If not, see <http: www.gnu.org="" licenses=""/>.
95204d
+
95204d
+TEST=$(basename "${0}")
95204d
+. tests-common-functions
95204d
+
95204d
+. clevis-luks-common-functions
95204d
+
95204d
+on_exit() {
95204d
+    local d
95204d
+    for d in "${TMP}" "${TMP2}"; do
95204d
+        [ ! -d "${d}" ] && continue
95204d
+        tang_stop "${d}"
95204d
+        rm -rf "${d}"
95204d
+    done
95204d
+}
95204d
+
95204d
+trap 'on_exit' EXIT
95204d
+trap 'on_exit' ERR
95204d
+
95204d
+TMP="$(mktemp -d)"
95204d
+
95204d
+port=$(get_random_port)
95204d
+tang_run "${TMP}" "${port}" &
95204d
+tang_wait_until_ready "${port}"
95204d
+
95204d
+url="http://${TANG_HOST}:${port}"
95204d
+
95204d
+cfg=$(printf '{"url":"%s"}' "${url}")
95204d
+
95204d
+# LUKS2.
95204d
+DEV="${TMP}/luks2-device"
95204d
+new_device "luks2" "${DEV}"
95204d
+
95204d
+if ! clevis luks bind -y -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+
95204d
+# Now let's try to change the config but using the same one we already have.
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${cfg}"; then
95204d
+    error "${TEST}: edit should not have succeeded because the config is the same."
95204d
+fi
95204d
+
95204d
+# And now, just a broken config.
95204d
+new_cfg=$(printf '{"url&:"%s"}' "${url}")
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have failed because of invalid JSON"
95204d
+fi
95204d
+
95204d
+# Now let's have another tang instance running and change the config to use
95204d
+# the new one.
95204d
+port2=$(get_random_port)
95204d
+TMP2="$(mktemp -d)"
95204d
+tang_run "${TMP2}" "${port2}" &
95204d
+tang_wait_until_ready "${port2}"
95204d
+new_url="http://${TANG_HOST}:${port2}"
95204d
+new_cfg=$(printf '{"url":"%s"}' "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded."
95204d
+fi
95204d
+
95204d
+# And now let's use sss and start with a single tang server, then add a second
95204d
+# one.
95204d
+new_device "luks2" "${DEV}"
95204d
+cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"}]}}' "${url}")
95204d
+if ! clevis luks bind -y -d "${DEV}" sss "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
+    error "${TEST}: Bind should have succeeded."
95204d
+fi
95204d
+new_cfg=$(printf '{"t":1,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded and added a new tang server"
95204d
+fi
95204d
+
95204d
+# Now let's change the threshold to 2.
95204d
+new_cfg=$(printf '{"t":2,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+
95204d
+if ! clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have succeeded and added a new tang server"
95204d
+fi
95204d
+
95204d
+# And finally, let's try a broken config, with a wrong threshold.
95204d
+new_cfg=$(printf '{"t":3,"pins":{"tang":[{"url":"%s"},{"url":"%s"}]}}' \
95204d
+          "${url}" "${new_url}")
95204d
+if clevis luks edit -d "${DEV}" -s 1 -c "${new_cfg}"; then
95204d
+    error "${TEST}: edit should have failed because threshold > number of servers"
95204d
+fi
95204d
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
95204d
index 4795488..67fa597 100644
95204d
--- a/src/luks/tests/meson.build
95204d
+++ b/src/luks/tests/meson.build
95204d
@@ -4,8 +4,9 @@ actv = find_program(
95204d
   required: false
95204d
 )
95204d
 
95204d
-# We use jq for comparing the pin config in the clevis luks list tests.
95204d
-jq = find_program('jq', required: false)
95204d
+# We use jq for comparing the pin config in the clevis luks list tests
95204d
+# and also in clevis luks edit.
95204d
+jq = find_program('jq', required: true)
95204d
 
95204d
 # we use systemd-socket-activate for running test tang servers.
95204d
 actv = find_program(
95204d
@@ -74,19 +75,16 @@ test('bind-pass-with-newline', find_program('bind-pass-with-newline-luks1'), env
95204d
 test('bind-pass-with-newline-keyfile', find_program('bind-pass-with-newline-keyfile-luks1'), env: env)
95204d
 # Bug #70.
95204d
 test('bind-already-used-luksmeta-slot', find_program('bind-already-used-luksmeta-slot'), env: env, timeout: 60)
95204d
-
95204d
-if jq.found()
95204d
-  test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env)
95204d
-  test('list-tang-luks1', find_program('list-tang-luks1'), env: env)
95204d
-  test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env)
95204d
-else
95204d
-  warning('Will not run "clevis luks list" tests due to missing jq dependency')
95204d
-endif
95204d
+test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env)
95204d
+test('list-tang-luks1', find_program('list-tang-luks1'), env: env)
95204d
+test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env)
95204d
 
95204d
 if has_tang
95204d
   test('unlock-tang-luks1', find_program('unlock-tang-luks1'), env: env, timeout: 90)
95204d
   test('assume-yes-luks1', find_program('assume-yes-luks1'), env: env)
95204d
+  test('edit-tang-luks1', find_program('edit-tang-luks1'), env: env, timeout: 90)
95204d
 endif
95204d
+
95204d
 test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env)
95204d
 test('backup-restore-luks1', find_program('backup-restore-luks1'), env: env)
95204d
 test('regen-inplace-luks1', find_program('regen-inplace-luks1'), env: env, timeout: 90)
95204d
@@ -100,16 +98,14 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
95204d
   test('bind-luks2', find_program('bind-luks2'), env: env, timeout: 60)
95204d
   test('unbind-unbound-slot-luks2', find_program('unbind-unbound-slot-luks2'), env: env)
95204d
   test('unbind-luks2', find_program('unbind-luks2'), env: env, timeout: 60)
95204d
-
95204d
-  if jq.found()
95204d
-    test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
95204d
-    test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
95204d
-    test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
95204d
-  endif
95204d
+  test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
95204d
+  test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
95204d
+  test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
95204d
 
95204d
   if has_tang
95204d
     test('unlock-tang-luks2', find_program('unlock-tang-luks2'), env: env, timeout: 120)
95204d
     test('assume-yes-luks2', find_program('assume-yes-luks2'), env: env, timeout: 60)
95204d
+    test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 120)
95204d
   endif
95204d
   test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
95204d
   test('backup-restore-luks2', find_program('backup-restore-luks2'), env:env, timeout: 90)
95204d
diff --git a/src/luks/tests/regen-inplace-luks1 b/src/luks/tests/regen-inplace-luks1
95204d
index 3a42ced..32072c4 100755
95204d
--- a/src/luks/tests/regen-inplace-luks1
95204d
+++ b/src/luks/tests/regen-inplace-luks1
95204d
@@ -76,7 +76,7 @@ fi
95204d
 old_key=$(clevis luks pass -d "${DEV}" -s "${SLT}")
95204d
 
95204d
 # Now let's try regen.
95204d
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
95204d
+if ! clevis luks regen -d "${DEV}" -s "${SLT}"; then
95204d
     error "${TEST}: clevis luks regen failed"
95204d
 fi
95204d
 
95204d
diff --git a/src/luks/tests/regen-inplace-luks2 b/src/luks/tests/regen-inplace-luks2
95204d
index 1cb7a29..d1bc182 100755
95204d
--- a/src/luks/tests/regen-inplace-luks2
95204d
+++ b/src/luks/tests/regen-inplace-luks2
95204d
@@ -77,7 +77,7 @@ fi
95204d
 old_key=$(clevis luks pass -d "${DEV}" -s "${SLT}")
95204d
 
95204d
 # Now let's try regen.
95204d
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
95204d
+if ! clevis luks regen -d "${DEV}" -s "${SLT}"; then
95204d
     error "${TEST}: clevis luks regen failed"
95204d
 fi
95204d
 
95204d
diff --git a/src/luks/tests/regen-not-inplace-luks1 b/src/luks/tests/regen-not-inplace-luks1
95204d
index 1b65ca7..fba61dc 100755
95204d
--- a/src/luks/tests/regen-not-inplace-luks1
95204d
+++ b/src/luks/tests/regen-not-inplace-luks1
95204d
@@ -79,7 +79,7 @@ if [ "${enabled}" -ne 2 ]; then
95204d
 fi
95204d
 
95204d
 # Now let's try regen.
95204d
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
95204d
+if ! clevis luks regen -d "${DEV}" -s "${SLT}" <<< "${DEFAULT_PASS}"; then
95204d
     error "${TEST}: clevis luks regen failed"
95204d
 fi
95204d
 
95204d
diff --git a/src/luks/tests/regen-not-inplace-luks2 b/src/luks/tests/regen-not-inplace-luks2
95204d
index dc91449..6e3b012 100755
95204d
--- a/src/luks/tests/regen-not-inplace-luks2
95204d
+++ b/src/luks/tests/regen-not-inplace-luks2
95204d
@@ -80,7 +80,7 @@ if [ "${enabled}" -ne 2 ]; then
95204d
 fi
95204d
 
95204d
 # Now let's try regen.
95204d
-if ! clevis_regen "${DEV}" "${SLT}" "${DEFAULT_PASS}"; then
95204d
+if ! clevis luks regen -d "${DEV}" -s "${SLT}" <<< "${DEFAULT_PASS}"; then
95204d
     error "${TEST}: clevis luks regen failed"
95204d
 fi
95204d
 
95204d
diff --git a/src/luks/tests/tests-common-functions.in b/src/luks/tests/tests-common-functions.in
95204d
index 6101f28..7b3fdad 100755
95204d
--- a/src/luks/tests/tests-common-functions.in
95204d
+++ b/src/luks/tests/tests-common-functions.in
95204d
@@ -229,31 +229,5 @@ tang_get_adv() {
95204d
     curl -o "${adv}" http://"${TANG_HOST}":"${port}"/adv
95204d
 }
95204d
 
95204d
-# Regenerate binding.
95204d
-clevis_regen() {
95204d
-    local DEV="${1}"
95204d
-    local SLT="${2}"
95204d
-    local PASS="${3}"
95204d
-
95204d
-    expect -d << CLEVIS_REGEN
95204d
-        set timeout 120
95204d
-        spawn sh -c "clevis luks regen -d $DEV -s $SLT"
95204d
-        expect {
95204d
-            "Enter existing LUKS password" {
95204d
-                send "$PASS\r"
95204d
-                exp_continue
95204d
-            }
95204d
-            "Do you wish to trust these keys" {
95204d
-                send "y\r"
95204d
-                exp_continue
95204d
-            }
95204d
-            expect eof
95204d
-            wait
95204d
-        }
95204d
-CLEVIS_REGEN
95204d
-    ret=$?
95204d
-    return "${ret}"
95204d
-}
95204d
-
95204d
 export TANG_HOST=127.0.0.1
95204d
 export DEFAULT_PASS='just-some-test-password-here'
95204d
diff --git a/src/luks/tests/unlock-tang-luks1 b/src/luks/tests/unlock-tang-luks1
95204d
index 841ba01..6ede47b 100755
95204d
--- a/src/luks/tests/unlock-tang-luks1
95204d
+++ b/src/luks/tests/unlock-tang-luks1
95204d
@@ -31,6 +31,10 @@ on_exit() {
95204d
 trap 'on_exit' EXIT
95204d
 trap 'on_exit' ERR
95204d
 
95204d
+# LUKS1.
95204d
+DEV="${TMP}/luks1-device"
95204d
+new_device "luks1" "${DEV}"
95204d
+
95204d
 TMP="$(mktemp -d)"
95204d
 
95204d
 port=$(get_random_port)
95204d
@@ -43,9 +47,6 @@ tang_get_adv "${port}" "${adv}"
95204d
 
95204d
 cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
95204d
 
95204d
-# LUKS1.
95204d
-DEV="${TMP}/luks1-device"
95204d
-new_device "luks1" "${DEV}"
95204d
 
95204d
 if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
     error "${TEST}: Bind should have succeeded."
95204d
diff --git a/src/luks/tests/unlock-tang-luks2 b/src/luks/tests/unlock-tang-luks2
95204d
index 81822fb..b32c5aa 100755
95204d
--- a/src/luks/tests/unlock-tang-luks2
95204d
+++ b/src/luks/tests/unlock-tang-luks2
95204d
@@ -31,6 +31,10 @@ on_exit() {
95204d
 trap 'on_exit' EXIT
95204d
 trap 'on_exit' ERR
95204d
 
95204d
+# LUKS2.
95204d
+DEV="${TMP}/luks2-device"
95204d
+new_device "luks2" "${DEV}"
95204d
+
95204d
 TMP="$(mktemp -d)"
95204d
 
95204d
 port=$(get_random_port)
95204d
@@ -43,10 +47,6 @@ tang_get_adv "${port}" "${adv}"
95204d
 
95204d
 cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
95204d
 
95204d
-# LUKS2.
95204d
-DEV="${TMP}/luks2-device"
95204d
-new_device "luks2" "${DEV}"
95204d
-
95204d
 if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
95204d
     error "${TEST}: Bind should have succeeded."
95204d
 fi
95204d
-- 
95204d
2.18.4
95204d