eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-06 00:10:04 +01:00
Code Issues Packages Projects Releases Wiki Activity

More typo and spelling fixes.

Browse Source 
Reported by `git ls-tree -rz --name-only | grep -Evz -e '\.(pdf|xz)$' -e
^po/ | xargs -r0 spellintian --`.  All changes are
documentation-related (comments, manuals, etc.) except for s/fial/fail/
in tests/unit-wipe-test.

The remaining entry are AFAICT all false positives, mostly annotations
such as `@param name name of xyz` or `struct foo foo`:

	$ git ls-tree -rz HEAD --name-only | grep -Evz -e '\.(pdf|xz)$' -e ^po/ | xargs -r0 spellintian --
	COPYING.LGPL: "GNU Library Public License" -> "GNU Library General Public License"
	autogen.sh: echo echo (duplicate word) -> echo
	configure.ac: fi fi (duplicate word) -> fi
	docs/v1.7.2-ReleaseNotes: option option (duplicate word) -> option
	lib/crypto_backend/cipher_check.c: block block (duplicate word) -> block
	lib/libcryptsetup.h: name name (duplicate word) -> name
	lib/libcryptsetup.h: type type (duplicate word) -> type
	lib/libcryptsetup.h: passphrase passphrase (duplicate word) -> passphrase
	lib/libcryptsetup.h: flags flags (duplicate word) -> flags
	lib/libcryptsetup.h: password password (duplicate word) -> password
	lib/libcryptsetup.h: salt salt (duplicate word) -> salt
	lib/libcryptsetup.h: keyslot keyslot (duplicate word) -> keyslot
	lib/libcryptsetup.h: priority priority (duplicate word) -> priority
	lib/libcryptsetup.h: offset offset (duplicate word) -> offset
	lib/libcryptsetup.h: length length (duplicate word) -> length
	lib/libcryptsetup.h: keyfile keyfile (duplicate word) -> keyfile
	lib/libcryptsetup.h: token token (duplicate word) -> token
	lib/libcryptsetup.h: cipher cipher (duplicate word) -> cipher
	lib/libcryptsetup.h: size size (duplicate word) -> size
	lib/luks2/luks2_json_metadata.c: long long (duplicate word) -> long
	lib/luks2/luks2_keyslot_luks2.c: AFEKSize AFEKSize (duplicate word) -> AFEKSize
	lib/luks2/luks2_reencrypt.c: alignment alignment (duplicate word) -> alignment
	lib/luks2/luks2_reencrypt_digest.c: ptr ptr (duplicate word) -> ptr
	lib/luks2/luks2_reencrypt_digest.c: buffer buffer (duplicate word) -> buffer
	lib/luks2/luks2_segment.c: min min (duplicate word) -> min
	lib/verity/verity_fec.c: blocks blocks (duplicate word) -> blocks
	man/cryptsetup.8.adoc: LUKS LUKS (duplicate word) -> LUKS
	scripts/cryptsetup.conf.in: root root (duplicate word) -> root
	src/Makemodule.am: endif endif (duplicate word) -> endif
	src/cryptsetup.c: long long (duplicate word) -> long
	src/utils_args.c: long long (duplicate word) -> long
	tests/compat-test2: fi fi (duplicate word) -> fi
	tests/device-test: echo echo (duplicate word) -> echo
	tests/differ.c: long long (duplicate word) -> long
	tests/loopaes-test: done done (duplicate word) -> done
	tests/luks2-integrity-test: aead aead (duplicate word) -> aead
	tests/luks2-reencryption-test: fi fi (duplicate word) -> fi
	tests/mode-test: done done (duplicate word) -> done
	tests/password-hash-test: cat cat (duplicate word) -> cat
	tests/password-hash-test: fi fi (duplicate word) -> fi
	tests/unit-wipe.c: long long (duplicate word) -> long
	tests/verity-compat-test: done done (duplicate word) -> done
	tests/verity-compat-test: fi fi (duplicate word) -> fi
	tokens/ssh/cryptsetup-ssh.c: argp argp (duplicate word) -> argp
	tokens/ssh/cryptsetup-ssh.c: arguments arguments (duplicate word) -> arguments

(Treated COPYING.LGPL as a false positive too since it's the exact text
from https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html .)
This commit is contained in:
Guilhem Moulin
2022-07-15 15:46:44 +02:00
parent 5d711c000f
commit 3106b4e2c1
26 changed files with 44 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
FAQ.md
View File

@@ -1192,7 +1192,7 @@
More references can be found at the end of this document. Note that More references can be found at the end of this document. Note that
these are estimates from the defender side, so assuming something is these are estimates from the defender side, so assuming something is
easier than it actually is is fine. An attacker may still have easier than it actually is fine. An attacker may still have
significantly higher cost than estimated here. significantly higher cost than estimated here.
LUKS1 used SHA1 (since version 1.7.0 it uses SHA256) for hashing per LUKS1 used SHA1 (since version 1.7.0 it uses SHA256) for hashing per
@@ -1864,11 +1864,11 @@
This basically means that if you already have a slot-key, and you have This basically means that if you already have a slot-key, and you have
set the PBKDF2 iteration count to 1 (it is > 10'000 normally), you could set the PBKDF2 iteration count to 1 (it is > 10'000 normally), you could
(maybe) derive a different passphrase that gives you the the same (maybe) derive a different passphrase that gives you the same slot-key.
slot-key. But if you have the slot-key, you can already unlock the But if you have the slot-key, you can already unlock the key-slot and
key-slot and get the volume key, breaking everything. So basically, get the volume key, breaking everything. So basically, this SHA-1
this SHA-1 vulnerability allows you to open a LUKS1 container with high vulnerability allows you to open a LUKS1 container with high effort when
effort when you already have it open. you already have it open.
The real problem here is people that do not understand crypto and claim The real problem here is people that do not understand crypto and claim
things are broken just because some mechanism is used that has been things are broken just because some mechanism is used that has been
@@ -3014,9 +3014,9 @@ offset length name data type description
currently associated with any data/crypt segment (encrypted area) in the currently associated with any data/crypt segment (encrypted area) in the
LUKS2 'Segments' section (displayed by luksDump). LUKS2 'Segments' section (displayed by luksDump).
This is a bit of a more general idea. It basically allows to use a keyslot This is a bit of a more general idea. It basically allows one to use a
as a container for a key to be used in other things than decrypting a keyslot as a container for a key to be used in other things than decrypting
data segment. a data segment.
As of April 2020, the following uses are defined: As of April 2020, the following uses are defined:

4
docs/ChangeLog.old
View File

@@ -74,7 +74,7 @@
2012-03-16 Milan Broz <gmazyland@gmail.com> 2012-03-16 Milan Broz <gmazyland@gmail.com>
* Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI. * Add --keyfile-offset and --new-keyfile-offset parameters to API and CLI.
* Add repair command and crypt_repair() for known LUKS metadata problems repair. * Add repair command and crypt_repair() for known LUKS metadata problems repair.
* Allow to specify --align-payload only for luksFormat. * Allow one to specify --align-payload only for luksFormat.
2012-03-16 Milan Broz <mbroz@redhat.com> 2012-03-16 Milan Broz <mbroz@redhat.com>
* Unify password verification option. * Unify password verification option.
@@ -228,7 +228,7 @@
* Fix password callback call. * Fix password callback call.
* Fix default plain password entry from terminal in activate_by_passphrase. * Fix default plain password entry from terminal in activate_by_passphrase.
* Add --dump-master-key option for luksDump to allow volume key dump. * Add --dump-master-key option for luksDump to allow volume key dump.
* Allow to activate by internally cached volume key * Allow one to activate by internally cached volume key
(format/activate without keyslots active - used for temporary devices). (format/activate without keyslots active - used for temporary devices).
* Initialize volume key from active device in crypt_init_by_name() * Initialize volume key from active device in crypt_init_by_name()
* Fix cryptsetup binary exitcodes. * Fix cryptsetup binary exitcodes.

2
docs/v1.2.0-ReleaseNotes
View File

@@ -85,7 +85,7 @@ Libcryptsetup API additions:
* Fix optional password callback handling. * Fix optional password callback handling.
* Allow to activate by internally cached volume key immediately after * Allow one to activate by internally cached volume key immediately after
crypt_format() without active slot (for temporary devices with crypt_format() without active slot (for temporary devices with
on-disk metadata) on-disk metadata)

2
docs/v1.4.2-ReleaseNotes
View File

@@ -24,7 +24,7 @@ Changes since version 1.4.1
* Fix header check to support old (cryptsetup 1.0.0) header alignment. * Fix header check to support old (cryptsetup 1.0.0) header alignment.
(Regression in 1.4.0) (Regression in 1.4.0)
* Allow to specify --align-payload only for luksFormat. * Allow one to specify --align-payload only for luksFormat.
* Add --master-key-file option to luksOpen (open using volume key). * Add --master-key-file option to luksOpen (open using volume key).

2
docs/v1.4.3-ReleaseNotes
View File

@@ -32,7 +32,7 @@ Changes since version 1.4.2
Device-mapper now retry removal if device is busy. Device-mapper now retry removal if device is busy.
* Allow "private" activation (skip some udev global rules) flag. * Allow "private" activation (skip some udev global rules) flag.
Cryptsetup library API now allows to specify CRYPT_ACTIVATE_PRIVATE, Cryptsetup library API now allows one to specify CRYPT_ACTIVATE_PRIVATE,
which means that some udev rules are not processed. which means that some udev rules are not processed.
(Used for temporary devices, like internal keyslot mappings where (Used for temporary devices, like internal keyslot mappings where
it is not desirable to run any device scans.) it is not desirable to run any device scans.)

4
docs/v1.6.0-ReleaseNotes
View File

@@ -4,7 +4,7 @@ Cryptsetup 1.6.0 Release Notes
Changes since version 1.6.0-rc1 Changes since version 1.6.0-rc1
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Change LUKS default cipher to to use XTS encryption mode, * Change LUKS default cipher to use XTS encryption mode,
aes-xts-plain64 (i.e. using AES128-XTS). aes-xts-plain64 (i.e. using AES128-XTS).
XTS mode becomes standard in hard disk encryption. XTS mode becomes standard in hard disk encryption.
@@ -209,7 +209,7 @@ Important changes
WARNING: these tests do not use dmcrypt, only crypto API. WARNING: these tests do not use dmcrypt, only crypto API.
You have to benchmark the whole device stack and you can get completely You have to benchmark the whole device stack and you can get completely
different results. But is is usable for basic comparison. different results. But it is usable for basic comparison.
(Note for example AES-NI decryption optimization effect in example above.) (Note for example AES-NI decryption optimization effect in example above.)
Features Features

2
docs/v1.6.2-ReleaseNotes
View File

@@ -8,7 +8,7 @@ Changes since version 1.6.1
* Fix cipher specification string parsing (found by gcc -fsanitize=address option). * Fix cipher specification string parsing (found by gcc -fsanitize=address option).
* Try to map TCRYPT system encryption through partition * Try to map TCRYPT system encryption through partition
(allows to activate mapping when other partition on the same device is mounted). (allows one to activate mapping when other partition on the same device is mounted).
* Print a warning if system encryption is used and device is a partition. * Print a warning if system encryption is used and device is a partition.
(TCRYPT system encryption uses whole device argument.) (TCRYPT system encryption uses whole device argument.)

2
docs/v1.6.4-ReleaseNotes
View File

@@ -25,7 +25,7 @@ Changes since version 1.6.3
Please refer to cryptsetup FAQ for detail how to fix this situation. Please refer to cryptsetup FAQ for detail how to fix this situation.
* Allow to use --disable-gcrypt-pbkdf2 during configuration * Allow one to use --disable-gcrypt-pbkdf2 during configuration
to force use internal PBKDF2 code. to force use internal PBKDF2 code.
* Require gcrypt 1.6.1 for imported implementation of PBKDF2 * Require gcrypt 1.6.1 for imported implementation of PBKDF2

2
docs/v1.6.5-ReleaseNotes
View File

@@ -38,7 +38,7 @@ Changes since version 1.6.4
The command "cryptsetup status" will print basic info, even if you The command "cryptsetup status" will print basic info, even if you
do not provide detached header argument. do not provide detached header argument.
* Allow to specify ECB mode in cryptsetup benchmark. * Allow one to specify ECB mode in cryptsetup benchmark.
* Add some LUKS images for regression testing. * Add some LUKS images for regression testing.
Note that if image with Whirlpool fails, the most probable cause is that Note that if image with Whirlpool fails, the most probable cause is that

4
docs/v1.6.7-ReleaseNotes
View File

@@ -35,14 +35,14 @@ Changes since version 1.6.6
* Support permanent device decryption for cryptsetup-reencrypt. * Support permanent device decryption for cryptsetup-reencrypt.
To remove LUKS encryption from a device, you can now use --decrypt option. To remove LUKS encryption from a device, you can now use --decrypt option.
* Allow to use --header option in all LUKS commands. * Allow one to use --header option in all LUKS commands.
The --header always takes precedence over positional device argument. The --header always takes precedence over positional device argument.
* Allow luksSuspend without need to specify a detached header. * Allow luksSuspend without need to specify a detached header.
* Detect if O_DIRECT is usable on a device allocation. * Detect if O_DIRECT is usable on a device allocation.
There are some strange storage stack configurations which wrongly allows There are some strange storage stack configurations which wrongly allows
to open devices with direct-io but fails on all IO operations later. one to open devices with direct-io but fails on all IO operations later.
Cryptsetup now tries to read the device first sector to ensure it can use Cryptsetup now tries to read the device first sector to ensure it can use
direct-io. direct-io.

2
docs/v1.6.8-ReleaseNotes
View File

@@ -30,7 +30,7 @@ Changes since version 1.6.7
cryptsetup resize will try to resize underlying loop device as well. cryptsetup resize will try to resize underlying loop device as well.
(It can be used to grow up file-backed device in one step.) (It can be used to grow up file-backed device in one step.)
* Cryptsetup now allows to use empty password through stdin pipe. * Cryptsetup now allows one to use empty password through stdin pipe.
(Intended only for testing in scripts.) (Intended only for testing in scripts.)
Cryptsetup API NOTE: Cryptsetup API NOTE:

2
docs/v1.7.4-ReleaseNotes
View File

@@ -3,7 +3,7 @@ Cryptsetup 1.7.4 Release Notes
Changes since version 1.7.3 Changes since version 1.7.3
* Allow to specify LUKS1 hash algorithm in Python luksFormat wrapper. * Allow one to specify LUKS1 hash algorithm in Python luksFormat wrapper.
* Use LUKS1 compiled-in defaults also in Python wrapper. * Use LUKS1 compiled-in defaults also in Python wrapper.

2
docs/v2.0.2-ReleaseNotes
View File

@@ -30,7 +30,7 @@ Changes since version 2.0.1
* Add LUKS2 specific options for cryptsetup-reencrypt. * Add LUKS2 specific options for cryptsetup-reencrypt.
Tokens and persistent flags are now transferred during reencryption; Tokens and persistent flags are now transferred during reencryption;
change of PBKDF keyslot parameters is now supported and allows change of PBKDF keyslot parameters is now supported and allows one
to set precalculated values (no benchmarks). to set precalculated values (no benchmarks).
* Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags * Do not allow LUKS2 --persistent and --test-passphrase cryptsetup flags

2
docs/v2.0.3-ReleaseNotes
View File

@@ -28,7 +28,7 @@ Changes since version 2.0.2
* New API extensions for unbound keyslots (LUKS2 only) * New API extensions for unbound keyslots (LUKS2 only)
crypt_keyslot_get_key_size() and crypt_volume_key_get() crypt_keyslot_get_key_size() and crypt_volume_key_get()
These functions allow to get key and key size for unbound keyslots. These functions allow one to get key and key size for unbound keyslots.
* New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only). * New enum value CRYPT_SLOT_UNBOUND for keyslot status (LUKS2 only).

8
docs/v2.1.0-ReleaseNotes
View File

@@ -170,21 +170,21 @@ These new calls are now exported, for details see libcryptsetup.h:
* crypt_get_metadata_size * crypt_get_metadata_size
* crypt_set_metadata_size * crypt_set_metadata_size
allows to set/get area sizes in LUKS header allows one to set/get area sizes in LUKS header
(according to specification). (according to specification).
* crypt_get_default_type * crypt_get_default_type
get default compiled-in LUKS type (version). get default compiled-in LUKS type (version).
* crypt_get_pbkdf_type_params * crypt_get_pbkdf_type_params
allows to get compiled-in PBKDF parameters. allows one to get compiled-in PBKDF parameters.
* crypt_keyslot_set_encryption * crypt_keyslot_set_encryption
* crypt_keyslot_get_encryption * crypt_keyslot_get_encryption
allows to set/get per-keyslot encryption algorithm for LUKS2. allows one to set/get per-keyslot encryption algorithm for LUKS2.
* crypt_keyslot_get_pbkdf * crypt_keyslot_get_pbkdf
allows to get PBKDF parameters per-keyslot. allows one to get PBKDF parameters per-keyslot.
and these new defines: and these new defines:
* CRYPT_LOG_DEBUG_JSON (message type for JSON debug) * CRYPT_LOG_DEBUG_JSON (message type for JSON debug)

2
docs/v2.3.0-ReleaseNotes
View File

@@ -9,7 +9,7 @@ native read-write access to BitLocker Full Disk Encryption devices.
The BITLK implementation is based on publicly available information The BITLK implementation is based on publicly available information
and it is an independent and opensource implementation that allows and it is an independent and opensource implementation that allows
to access this proprietary disk encryption. one to access this proprietary disk encryption.
Changes since version 2.2.2 Changes since version 2.2.2
~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~

2
docs/v2.3.2-ReleaseNotes
View File

@@ -18,7 +18,7 @@ Changes since version 2.3.1
The slot number --key-slot (-S) option is mandatory here. The slot number --key-slot (-S) option is mandatory here.
An unbound keyslot store a key is that is not assigned to data An unbound keyslot store a key is that is not assigned to data
area on disk (LUKS2 allows to store arbitrary keys). area on disk (LUKS2 allows one to store arbitrary keys).
* Rephrase some error messages and remove redundant end-of-lines. * Rephrase some error messages and remove redundant end-of-lines.

2
lib/libdevmapper.c
View File

@@ -2736,7 +2736,7 @@ static int _dm_query_device(struct crypt_device *cd, const char *name,
goto out; goto out;
} }
/* Never allow to return empty key */ /* Never allow one to return empty key */
if ((get_flags & DM_ACTIVE_CRYPT_KEY) && dmi.suspended) { if ((get_flags & DM_ACTIVE_CRYPT_KEY) && dmi.suspended) {
log_dbg(cd, "Cannot read volume key while suspended."); log_dbg(cd, "Cannot read volume key while suspended.");
r = -EINVAL; r = -EINVAL;

2
lib/luks2/luks2_token.c
View File

@@ -726,7 +726,7 @@ int LUKS2_token_unlock_volume_key(struct crypt_device *cd,
/* /*
* return priorities (ordered form least to most significant): * return priorities (ordered form least to most significant):
* ENOENT - unusable for activation (no token handler, invalid token metadata, not assigned to volume segment, etc) * ENOENT - unusable for activation (no token handler, invalid token metadata, not assigned to volume segment, etc)
* EPERM - usable but token provided passphrase did not not unlock any assigned keyslot * EPERM - usable but token provided passphrase did not unlock any assigned keyslot
* EAGAIN - usable but not ready (token HW is missing) * EAGAIN - usable but not ready (token HW is missing)
* ENOANO - ready, but token pin is wrong or missing * ENOANO - ready, but token pin is wrong or missing
* *

9
man/common_options.adoc
View File

@@ -350,7 +350,7 @@ endif::[]
+ +
ifndef::ACTION_OPEN[] ifndef::ACTION_OPEN[]
The --offset option sets the data offset (payload) of data The --offset option sets the data offset (payload) of data
device and must be be aligned to 4096-byte sectors (must be multiple of device and must be aligned to 4096-byte sectors (must be multiple of
8). This option cannot be combined with --align-payload option. 8). This option cannot be combined with --align-payload option.
endif::[] endif::[]
endif::[] endif::[]
@@ -935,10 +935,9 @@ Creates new or dumps existing LUKS2 unbound keyslot.
+ +
endif::[] endif::[]
ifdef::ACTION_OPEN[] ifdef::ACTION_OPEN[]
Allowed only only together with --test-passphrase parameter, it allows Allowed only together with --test-passphrase parameter, it allows one to test
to test passphrase for unbound LUKS2 keyslot. Otherwise, unbound keyslot passphrase for unbound LUKS2 keyslot. Otherwise, unbound keyslot passphrase
passphrase can be tested only when specific keyslot is selected via can be tested only when specific keyslot is selected via --key-slot parameter.
--key-slot parameter.
endif::[] endif::[]
endif::[] endif::[]

2
misc/keyslot_checker/chk_luks_keyslots.c
View File

@@ -45,7 +45,7 @@ const char *help =
"\n" "\n"
"This tool checks all keyslots of a LUKS device for \n" "This tool checks all keyslots of a LUKS device for \n"
"low entropy sections. If any are found, they are reported. \n" "low entropy sections. If any are found, they are reported. \n"
"This allows to find areas damaged by things like filesystem \n" "This allows one to find areas damaged by things like filesystem \n"
"creation or RAID superblocks. \n" "creation or RAID superblocks. \n"
"\n" "\n"
"Options: \n" "Options: \n"

2
src/utils_reencrypt.c
View File

@@ -138,7 +138,7 @@ static int get_active_device_name(struct crypt_device *cd,
r = noDialog(msg, _("Operation aborted.\n")) ? 0 : -EINVAL; r = noDialog(msg, _("Operation aborted.\n")) ? 0 : -EINVAL;
free(msg); free(msg);
} else { } else {
/* FIXME: This is temporary message to be replaced in before final relase. */ /* FIXME: This is temporary message to be replaced in before final release. */
log_err("Unable to decide if device %s is activated or not.\n" log_err("Unable to decide if device %s is activated or not.\n"
"Use --force-offline-reencrypt to bypass the check and run in offline mode (dangerous!).", data_device); "Use --force-offline-reencrypt to bypass the check and run in offline mode (dangerous!).", data_device);
} }

2
tests/api-test-2.c
View File

@@ -4606,7 +4606,7 @@ static void Luks2Reencryption(void)
OK_(crypt_init_data_device(&cd, DMDIR H_DEVICE, DMDIR L_DEVICE_OK)); OK_(crypt_init_data_device(&cd, DMDIR H_DEVICE, DMDIR L_DEVICE_OK));
OK_(crypt_load(cd, CRYPT_LUKS2, NULL)); OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
FAIL_(crypt_reencrypt_init_by_passphrase(cd, NULL, PASSPHRASE, strlen(PASSPHRASE), 0, CRYPT_ANY_SLOT, NULL, NULL, &rparams), "Illegal data offset"); FAIL_(crypt_reencrypt_init_by_passphrase(cd, NULL, PASSPHRASE, strlen(PASSPHRASE), 0, CRYPT_ANY_SLOT, NULL, NULL, &rparams), "Illegal data offset");
/* reencryption must not initalize */ /* reencryption must not initialize */
EQ_(crypt_reencrypt_status(cd, NULL), CRYPT_REENCRYPT_NONE); EQ_(crypt_reencrypt_status(cd, NULL), CRYPT_REENCRYPT_NONE);
CRYPT_FREE(cd); CRYPT_FREE(cd);
/* original data device must stay untouched */ /* original data device must stay untouched */

2
tests/compat-test2
View File

@@ -991,7 +991,7 @@ $CRYPTSETUP luksDump $LOOPDEV | grep -q "3: luks2 (unbound)" || fail
# unbound key size is required # unbound key size is required
echo $PWD1 | $CRYPTSETUP -q luksAddKey --unbound $LOOPDEV 2>/dev/null && fail echo $PWD1 | $CRYPTSETUP -q luksAddKey --unbound $LOOPDEV 2>/dev/null && fail
echo $PWD3 | $CRYPTSETUP -q luksAddKey --unbound --volume-key-file /dev/urandom $LOOPDEV 2> /dev/null && fail echo $PWD3 | $CRYPTSETUP -q luksAddKey --unbound --volume-key-file /dev/urandom $LOOPDEV 2> /dev/null && fail
# do not allow to replace keyslot by unbound slot # do not allow one to replace keyslot by unbound slot
echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail echo $PWD1 | $CRYPTSETUP -q luksAddKey -S5 --unbound -s 32 $LOOPDEV 2>/dev/null && fail
echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail echo $PWD2 | $CRYPTSETUP -q open $LOOPDEV $DEV_NAME 2> /dev/null && fail
echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail echo $PWD2 | $CRYPTSETUP -q open -S2 $LOOPDEV $DEV_NAME 2> /dev/null && fail

4
tests/luks2-reencryption-test
View File

@@ -1590,14 +1590,14 @@ echo -e "$PWD1\n$PWD2" | $CRYPTSETUP luksAddKey -S2 $DEV -q $FAST_PBKDF_ARGON ||
# there is not enough space in binary area for keyslot id 4 (replacement for id 2) # there is not enough space in binary area for keyslot id 4 (replacement for id 2)
echo -e "$PWD1\n$PWD2\n$PWD2" | $CRYPTSETUP reencrypt $DEV --init-only -q 2>/dev/null && fail echo -e "$PWD1\n$PWD2\n$PWD2" | $CRYPTSETUP reencrypt $DEV --init-only -q 2>/dev/null && fail
$CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" && fail $CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" && fail
# check cli removed all unbound keyslots created in-before reencryption intialization # check cli removed all unbound keyslots created in-before reencryption initialization
$CRYPTSETUP luksDump $DEV | grep -q "unbound" && fail $CRYPTSETUP luksDump $DEV | grep -q "unbound" && fail
echo $PWD1 | $CRYPTSETUP luksKillSlot $DEV 2 || fail echo $PWD1 | $CRYPTSETUP luksKillSlot $DEV 2 || fail
# there is not enough space in binary area for reencryption keyslot # there is not enough space in binary area for reencryption keyslot
echo -e "$PWD1\n$PWD2" | $CRYPTSETUP reencrypt $DEV --init-only -q 2>/dev/null && fail echo -e "$PWD1\n$PWD2" | $CRYPTSETUP reencrypt $DEV --init-only -q 2>/dev/null && fail
$CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" && fail $CRYPTSETUP luksDump $DEV | grep -q "online-reencrypt" && fail
# check cli removed all unbound keyslots created in-before reencryption intialization # check cli removed all unbound keyslots created in-before reencryption initialization
$CRYPTSETUP luksDump $DEV | grep -q "unbound" && fail $CRYPTSETUP luksDump $DEV | grep -q "unbound" && fail
echo "[23] Reencryption with specified new volume key" echo "[23] Reencryption with specified new volume key"

2
tests/unit-wipe-test
View File

@@ -70,7 +70,7 @@ function init_hash_dd() # $1 dev, $dev orig
function add_file() function add_file()
{ {
dd if=/dev/zero of=$FILE bs=1M count=$DEVSIZEMB 2> /dev/null || fial dd if=/dev/zero of=$FILE bs=1M count=$DEVSIZEMB 2> /dev/null || fail
dd if=/dev/zero of=$FILE_RAND bs=1M count=$DEVSIZEMB 2> /dev/null || fail dd if=/dev/zero of=$FILE_RAND bs=1M count=$DEVSIZEMB 2> /dev/null || fail
check_hash $FILE $HASH_EMPTY || fail check_hash $FILE $HASH_EMPTY || fail
check_hash $FILE_RAND $HASH_EMPTY || fail check_hash $FILE_RAND $HASH_EMPTY || fail