eessppeelllloo/cryptsetup
1
0
Fork 0
mirror of https://gitlab.com/cryptsetup/cryptsetup.git synced 2025-12-16 21:29:59 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add support for --master-key-file to luksOpen.

Browse Source
This commit is contained in:
Milan Broz
2012-02-11 11:24:58 +01:00
parent 2199076fef
commit d542045645
4 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@@ -1,3 +1,6 @@
2012-02-11 Milan Broz <mbroz@redhat.com>
* Add --master-key-file option to luksOpen (open using volume key).
2012-01-12 Milan Broz <mbroz@redhat.com> 2012-01-12 Milan Broz <mbroz@redhat.com>
* Fix use of empty keyfile. * Fix use of empty keyfile.

10
man/cryptsetup.8
View File

@@ -51,7 +51,7 @@ initializes a LUKS partition and sets the initial key, either via prompting or v
\fB<options>\fR can be [\-\-cipher, \-\-verify-passphrase, \-\-key-size, \fB<options>\fR can be [\-\-cipher, \-\-verify-passphrase, \-\-key-size,
\-\-key-slot, \-\-key-file (takes precedence over optional second argument), \-\-key-slot, \-\-key-file (takes precedence over optional second argument),
\-\-keyfile-size, \-\-use-random | \-\-use-urandom, \-\-uuid]. \-\-keyfile-size, \-\-use-random | \-\-use-urandom, \-\-uuid, \-\-master-key-file].
.PP .PP
\fIluksOpen\fR <device> <name> \fIluksOpen\fR <device> <name>
.IP .IP
@@ -60,7 +60,7 @@ successful verification of the supplied key material
(either via key file by \-\-key-file, or via prompting). (either via key file by \-\-key-file, or via prompting).
\fB<options>\fR can be [\-\-key-file, \-\-keyfile-size, \-\-readonly, \-\-allow-discards, \fB<options>\fR can be [\-\-key-file, \-\-keyfile-size, \-\-readonly, \-\-allow-discards,
\-\-header, \-\-key-slot]. \-\-header, \-\-key-slot, \-\-master-key-file].
.PP .PP
\fIluksClose\fR <name> \fIluksClose\fR <name>
.IP .IP
@@ -91,7 +91,8 @@ add a new key file/passphrase. An existing passphrase or key file
(via \-\-key-file) must be supplied. (via \-\-key-file) must be supplied.
The key file with the new material is supplied as a positional argument. The key file with the new material is supplied as a positional argument.
\fB<options>\fR can be [\-\-key-file, \-\-keyfile-size, \-\-new-keyfile-size, \-\-key-slot]. \fB<options>\fR can be [\-\-key-file, \-\-keyfile-size, \-\-new-keyfile-size, \-\-key-slot,
\-\-master-key-file].
.PP .PP
\fIluksRemoveKey\fR <device> [<key file>] \fIluksRemoveKey\fR <device> [<key file>]
.IP .IP
@@ -276,6 +277,9 @@ LUKS header reformatting with the same master key (if all other parameters
are the same existing encrypted data remains intact). are the same existing encrypted data remains intact).
For \fIluksAddKey\fR it allows adding new passphrase with only master key knowledge. For \fIluksAddKey\fR it allows adding new passphrase with only master key knowledge.
For \fIluksOpen\fR it allows to open the LUKS device with only master key knowledge.
.TP .TP
.B "\-\-dump-master-key" .B "\-\-dump-master-key"
For \fIluksDump\fR it allows LUKS header dump including volume (master) key. For \fIluksDump\fR it allows LUKS header dump including volume (master) key.

13
src/cryptsetup.c
View File

@@ -552,8 +552,9 @@ static int action_luksOpen(int arg __attribute__((unused)))
{ {
struct crypt_device *cd = NULL; struct crypt_device *cd = NULL;
const char *data_device, *header_device; const char *data_device, *header_device;
char *key = NULL;
uint32_t flags = 0; uint32_t flags = 0;
int r; int r, keysize;
if (opt_header_device) { if (opt_header_device) {
header_device = opt_header_device; header_device = opt_header_device;
@@ -591,7 +592,14 @@ static int action_luksOpen(int arg __attribute__((unused)))
if (opt_allow_discards) if (opt_allow_discards)
flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS; flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
if (opt_key_file) { if (opt_master_key_file) {
keysize = crypt_get_volume_key_size(cd);
r = _read_mk(opt_master_key_file, &key, keysize);
if (r < 0)
goto out;
r = crypt_activate_by_volume_key(cd, action_argv[1],
key, keysize, flags);
} else if (opt_key_file) {
crypt_set_password_retry(cd, 1); crypt_set_password_retry(cd, 1);
r = crypt_activate_by_keyfile(cd, action_argv[1], r = crypt_activate_by_keyfile(cd, action_argv[1],
opt_key_slot, opt_key_file, opt_keyfile_size, opt_key_slot, opt_key_file, opt_keyfile_size,
@@ -600,6 +608,7 @@ static int action_luksOpen(int arg __attribute__((unused)))
r = crypt_activate_by_passphrase(cd, action_argv[1], r = crypt_activate_by_passphrase(cd, action_argv[1],
opt_key_slot, NULL, 0, flags); opt_key_slot, NULL, 0, flags);
out: out:
crypt_safe_free(key);
crypt_free(cd); crypt_free(cd);
return r; return r;
} }

4
tests/compat-test
View File

@@ -246,6 +246,10 @@ $CRYPTSETUP -q luksClose $DEV_NAME || fail
$CRYPTSETUP -q luksFormat $LOOPDEV $KEYE || fail $CRYPTSETUP -q luksFormat $LOOPDEV $KEYE || fail
$CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail $CRYPTSETUP luksOpen -d $KEYE $LOOPDEV $DEV_NAME || fail
$CRYPTSETUP -q luksClose $DEV_NAME || fail $CRYPTSETUP -q luksClose $DEV_NAME || fail
# open by volume key
echo "key0" | $CRYPTSETUP -q luksFormat -s 256 --master-key-file $KEY1 $LOOPDEV || fail
$CRYPTSETUP luksOpen --master-key-file $KEY1 $LOOPDEV $DEV_NAME || fail
$CRYPTSETUP -q luksClose $DEV_NAME || fail
prepare "[17] AddKey volume key, passphrase and keyfile" wipe prepare "[17] AddKey volume key, passphrase and keyfile" wipe
# masterkey # masterkey