|
 |
0f7e16 |
diff -rupN cryptsetup-2.4.3.old/man/cryptsetup.8 cryptsetup-2.4.3/man/cryptsetup.8
|
|
|
0f7e16 |
--- cryptsetup-2.4.3.old/man/cryptsetup.8 2022-02-23 16:33:42.449525744 +0100
|
|
|
0f7e16 |
+++ cryptsetup-2.4.3/man/cryptsetup.8 2022-02-24 08:57:43.036396289 +0100
|
|
|
0f7e16 |
@@ -321,7 +321,8 @@ the command prompts for it interactively
|
|
|
0f7e16 |
\-\-keyfile\-size, \-\-readonly, \-\-test\-passphrase,
|
|
|
0f7e16 |
\-\-allow\-discards, \-\-header, \-\-key-slot, \-\-master\-key\-file, \-\-token\-id,
|
|
|
0f7e16 |
\-\-token\-only, \-\-token-type, \-\-disable\-external\-tokens, \-\-disable\-keyring,
|
|
|
0f7e16 |
-\-\-disable\-locks, \-\-type, \-\-refresh, \-\-serialize\-memory\-hard\-pbkdf].
|
|
|
0f7e16 |
+\-\-disable\-locks, \-\-type, \-\-refresh, \-\-serialize\-memory\-hard\-pbkdf,
|
|
|
0f7e16 |
+\-\-unbound].
|
|
|
0f7e16 |
.PP
|
|
|
0f7e16 |
\fIluksSuspend\fR <name>
|
|
|
0f7e16 |
.IP
|
|
|
0f7e16 |
@@ -1465,10 +1466,14 @@ aligned to page size and page-cache init
|
|
|
0f7e16 |
integrity tag.
|
|
|
0f7e16 |
.TP
|
|
|
0f7e16 |
.B "\-\-unbound"
|
|
|
0f7e16 |
-
|
|
|
0f7e16 |
Creates new or dumps existing LUKS2 unbound keyslot. See \fIluksAddKey\fR or
|
|
|
0f7e16 |
\fIluksDump\fR actions for more details.
|
|
|
0f7e16 |
|
|
|
0f7e16 |
+When used in \fIluksOpen\fR action (allowed only together with
|
|
|
0f7e16 |
+\-\-test\-passphrase parameter), it allows to test passphrase for unbound LUKS2
|
|
|
0f7e16 |
+keyslot. Otherwise, unbound keyslot passphrase can be tested only when specific
|
|
|
0f7e16 |
+keyslot is selected via \-\-key\-slot parameter.
|
|
|
0f7e16 |
+
|
|
|
0f7e16 |
.TP
|
|
|
0f7e16 |
.B "\-\-tcrypt\-hidden"
|
|
|
0f7e16 |
.B "\-\-tcrypt\-system"
|
|
|
0f7e16 |
diff -rupN cryptsetup-2.4.3.old/src/cryptsetup_args.h cryptsetup-2.4.3/src/cryptsetup_args.h
|
|
|
0f7e16 |
--- cryptsetup-2.4.3.old/src/cryptsetup_args.h 2022-02-23 16:33:42.450525749 +0100
|
|
|
0f7e16 |
+++ cryptsetup-2.4.3/src/cryptsetup_args.h 2022-02-24 08:57:43.036396289 +0100
|
|
|
0f7e16 |
@@ -75,7 +75,7 @@
|
|
|
0f7e16 |
#define OPT_TCRYPT_HIDDEN_ACTIONS { OPEN_ACTION, TCRYPTDUMP_ACTION }
|
|
|
0f7e16 |
#define OPT_TCRYPT_SYSTEM_ACTIONS { OPEN_ACTION, TCRYPTDUMP_ACTION }
|
|
|
0f7e16 |
#define OPT_TEST_PASSPHRASE_ACTIONS { OPEN_ACTION }
|
|
|
0f7e16 |
-#define OPT_UNBOUND_ACTIONS { ADDKEY_ACTION, LUKSDUMP_ACTION }
|
|
|
0f7e16 |
+#define OPT_UNBOUND_ACTIONS { ADDKEY_ACTION, LUKSDUMP_ACTION, OPEN_ACTION }
|
|
|
0f7e16 |
#define OPT_USE_RANDOM_ACTIONS { FORMAT_ACTION }
|
|
|
0f7e16 |
#define OPT_USE_URANDOM_ACTIONS { FORMAT_ACTION }
|
|
|
0f7e16 |
#define OPT_UUID_ACTIONS { FORMAT_ACTION, UUID_ACTION }
|
|
|
0f7e16 |
diff -rupN cryptsetup-2.4.3.old/src/cryptsetup.c cryptsetup-2.4.3/src/cryptsetup.c
|
|
|
0f7e16 |
--- cryptsetup-2.4.3.old/src/cryptsetup.c 2022-02-23 16:33:42.450525749 +0100
|
|
|
0f7e16 |
+++ cryptsetup-2.4.3/src/cryptsetup.c 2022-02-24 08:57:43.036396289 +0100
|
|
|
0f7e16 |
@@ -140,7 +140,8 @@ static void _set_activation_flags(uint32
|
|
|
0f7e16 |
*flags |= CRYPT_ACTIVATE_IGNORE_PERSISTENT;
|
|
|
0f7e16 |
|
|
|
0f7e16 |
/* Only for LUKS2 but ignored elsewhere */
|
|
|
0f7e16 |
- if (ARG_SET(OPT_TEST_PASSPHRASE_ID))
|
|
|
0f7e16 |
+ if (ARG_SET(OPT_TEST_PASSPHRASE_ID) &&
|
|
|
0f7e16 |
+ (ARG_SET(OPT_KEY_SLOT_ID) || ARG_SET(OPT_UNBOUND_ID)))
|
|
|
0f7e16 |
*flags |= CRYPT_ACTIVATE_ALLOW_UNBOUND_KEY;
|
|
|
0f7e16 |
|
|
|
0f7e16 |
if (ARG_SET(OPT_SERIALIZE_MEMORY_HARD_PBKDF_ID))
|
|
|
0f7e16 |
@@ -3982,6 +3983,18 @@ int main(int argc, const char **argv)
|
|
|
0f7e16 |
_("Option --tcrypt-hidden, --tcrypt-system or --tcrypt-backup is supported only for TCRYPT device."),
|
|
|
0f7e16 |
poptGetInvocationName(popt_context));
|
|
|
0f7e16 |
|
|
|
0f7e16 |
+ if (ARG_SET(OPT_UNBOUND_ID) && !strcmp(aname, OPEN_ACTION) && device_type &&
|
|
|
0f7e16 |
+ strncmp(device_type, "luks", 4))
|
|
|
0f7e16 |
+ usage(popt_context, EXIT_FAILURE,
|
|
|
0f7e16 |
+ _("Option --unbound is allowed only for open of luks device."),
|
|
|
0f7e16 |
+ poptGetInvocationName(popt_context));
|
|
|
0f7e16 |
+
|
|
|
0f7e16 |
+ if (ARG_SET(OPT_UNBOUND_ID) && !ARG_SET(OPT_TEST_PASSPHRASE_ID) &&
|
|
|
0f7e16 |
+ !strcmp(aname, OPEN_ACTION))
|
|
|
0f7e16 |
+ usage(popt_context, EXIT_FAILURE,
|
|
|
0f7e16 |
+ _("Option --unbound cannot be used without --test-passphrase."),
|
|
|
0f7e16 |
+ poptGetInvocationName(popt_context));
|
|
|
0f7e16 |
+
|
|
|
0f7e16 |
if (ARG_SET(OPT_TCRYPT_HIDDEN_ID) && ARG_SET(OPT_ALLOW_DISCARDS_ID))
|
|
|
0f7e16 |
usage(popt_context, EXIT_FAILURE,
|
|
|
0f7e16 |
_("Option --tcrypt-hidden cannot be combined with --allow-discards."),
|
|
|
0f7e16 |
diff -rupN cryptsetup-2.4.3.old/tests/compat-test2 cryptsetup-2.4.3/tests/compat-test2
|
|
|
0f7e16 |
--- cryptsetup-2.4.3.old/tests/compat-test2 2022-02-23 16:33:42.444525716 +0100
|
|
|
0f7e16 |
+++ cryptsetup-2.4.3/tests/compat-test2 2022-02-24 09:05:38.716422307 +0100
|
|
|
0f7e16 |
@@ -699,7 +699,7 @@ $CRYPTSETUP luksOpen -S 5 -d $KEY1 $LOOP
|
|
|
0f7e16 |
# otoh it should be allowed to test for proper passphrase
|
|
|
0f7e16 |
prepare "" new
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
-echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
+echo $PWD1 | $CRYPTSETUP open --unbound --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
|
|
|
0f7e16 |
[ -b /dev/mapper/$DEV_NAME ] && fail
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP open $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
|
|
|
0f7e16 |
@@ -708,7 +708,7 @@ echo $PWD0 | $CRYPTSETUP open -S1 --test
|
|
|
0f7e16 |
$CRYPTSETUP luksKillSlot -q $HEADER_KEYU 0
|
|
|
0f7e16 |
$CRYPTSETUP luksDump $HEADER_KEYU | grep -q "0: luks2" && fail
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP open -S1 --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
-echo $PWD1 | $CRYPTSETUP open --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
+echo $PWD1 | $CRYPTSETUP open --unbound --test-passphrase $HEADER_KEYU || fail
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP open -S1 $HEADER_KEYU $DEV_NAME 2>/dev/null && fail
|
|
|
0f7e16 |
|
|
|
0f7e16 |
prepare "[28] Detached LUKS header" wipe
|
|
|
0f7e16 |
@@ -967,11 +967,9 @@ echo $PWD3 | $CRYPTSETUP -q luksAddKey -
|
|
|
0f7e16 |
# do not allow to replace keyslot by unbound slot
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail
|
|
|
0f7e16 |
echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail
|
|
|
0f7e16 |
-echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail
|
|
|
0f7e16 |
echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail
|
|
|
0f7e16 |
echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV --test-passphrase || fail
|
|
|
0f7e16 |
echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail
|
|
|
0f7e16 |
-echo $PWD1 | $CRYPTSETUP -q open $LOOPDEV --test-passphrase || fail
|
|
|
0f7e16 |
# check we're able to change passphrase for unbound keyslot
|
|
|
0f7e16 |
echo -e "$PWD2\n$PWD3" | $CRYPTSETUP luksChangeKey $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail
|
|
|
0f7e16 |
echo $PWD3 | $CRYPTSETUP open --test-passphrase $FAST_PBKDF_OPT -S 2 $LOOPDEV || fail
|