import cryptsetup-2.2.0-2.el8
This commit is contained in:
CentOS Sources
parent
1b5c1c1cb9
commit
cc07955f56
@ -1 +1 @@
|
|||||||
a2590635ff89a7c2fdb2fbbaaecfb2a27617efef SOURCES/cryptsetup-2.0.6.tar.xz
|
bb89099b839b962a13efacdd52d6ce6e408ca971 SOURCES/cryptsetup-2.2.0.tar.xz
|
||||||
|
|||||||
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/cryptsetup-2.0.6.tar.xz
|
SOURCES/cryptsetup-2.2.0.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,70 @@
|
|||||||
|
From 4862e22cd0ac9ed8395003c209d048889a009969 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ondrej Kozina <okozina@redhat.com>
|
||||||
|
Date: Fri, 23 Aug 2019 16:34:33 +0200
|
||||||
|
Subject: [PATCH 2/5] Add opt-io size parameter to LUKS2 reencrypt test device.
|
||||||
|
|
||||||
|
So that we can test recovery is not broken for optimal io size
|
||||||
|
optimization added to reencryption code.
|
||||||
|
---
|
||||||
|
tests/luks2-reencryption-test | 21 ++++++++++++---------
|
||||||
|
1 file changed, 12 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tests/luks2-reencryption-test b/tests/luks2-reencryption-test
|
||||||
|
index f88e7f1..558b8dd 100755
|
||||||
|
--- a/tests/luks2-reencryption-test
|
||||||
|
+++ b/tests/luks2-reencryption-test
|
||||||
|
@@ -244,15 +244,16 @@ function fix_writes() { # $1 dmdev, $2 data dev
|
||||||
|
}
|
||||||
|
|
||||||
|
function prepare_linear_dev() {
|
||||||
|
- if [ "$1" -gt 32 ]; then
|
||||||
|
- preparebig $1
|
||||||
|
+ local _sizemb=$1
|
||||||
|
+ shift
|
||||||
|
+
|
||||||
|
+ if [ "$_sizemb" -gt 32 ]; then
|
||||||
|
+ preparebig $_sizemb
|
||||||
|
else
|
||||||
|
- prepare dev_size_mb=$1
|
||||||
|
+ prepare dev_size_mb=$_sizemb $@
|
||||||
|
fi
|
||||||
|
|
||||||
|
- local _size=$(blockdev --getsz $DEV)
|
||||||
|
-
|
||||||
|
- dmsetup create $OVRDEV --table "0 $_size linear $DEV 0" || fail
|
||||||
|
+ dmsetup create $OVRDEV --table "0 $((_sizemb*1024*2)) linear $DEV 0" || fail
|
||||||
|
|
||||||
|
OLD_DEV=$DEV
|
||||||
|
DEV=/dev/mapper/$OVRDEV
|
||||||
|
@@ -875,7 +876,9 @@ if ! dm_delay_features; then
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[6] Reencryption recovery"
|
||||||
|
-prepare_linear_dev 32
|
||||||
|
+# (check opt-io size optimization in reencryption code does not affect recovery)
|
||||||
|
+# device with opt-io size 32k
|
||||||
|
+prepare_linear_dev 32 opt_blks=64 opt_xferlen_exp=6
|
||||||
|
OFFSET=8192
|
||||||
|
|
||||||
|
echo "sector size 512->512"
|
||||||
|
@@ -957,7 +960,7 @@ if [ -n "$DM_SECTOR_SIZE" ]; then
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[8] Reencryption with detached header recovery"
|
||||||
|
-prepare_linear_dev 31
|
||||||
|
+prepare_linear_dev 31 opt_blks=64 opt_xferlen_exp=6
|
||||||
|
|
||||||
|
echo "sector size 512->512"
|
||||||
|
|
||||||
|
@@ -1076,7 +1079,7 @@ if [ -n "$DM_SECTOR_SIZE" ]; then
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[12] Encryption with detached header recovery"
|
||||||
|
-prepare_linear_dev 31
|
||||||
|
+prepare_linear_dev 31 opt_blks=64 opt_xferlen_exp=6
|
||||||
|
|
||||||
|
get_error_offsets 31 0
|
||||||
|
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
@ -0,0 +1,158 @@
|
|||||||
|
From 8f8f0b3258152a260c6a40be89b485f943f81484 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Milan Broz <gmazyland@gmail.com>
|
||||||
|
Date: Mon, 26 Aug 2019 10:01:17 +0200
|
||||||
|
Subject: [PATCH] Fix mapped segments overflow on 32bit architectures.
|
||||||
|
|
||||||
|
All set_segment funcions must use uin64_t everywhere,
|
||||||
|
not size_t that is platform dependent.
|
||||||
|
|
||||||
|
The code later uses it correctly, it is just wrong function
|
||||||
|
prototype definitions.
|
||||||
|
|
||||||
|
Reported in
|
||||||
|
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935702
|
||||||
|
|
||||||
|
(TODO: add a test for other segment types.)
|
||||||
|
---
|
||||||
|
lib/libdevmapper.c | 12 ++++++------
|
||||||
|
lib/utils_dm.h | 12 ++++++------
|
||||||
|
tests/integrity-compat-test | 26 ++++++++++++++++++++++++++
|
||||||
|
3 files changed, 38 insertions(+), 12 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/libdevmapper.c b/lib/libdevmapper.c
|
||||||
|
index e92ceda..9c40bb1 100644
|
||||||
|
--- a/lib/libdevmapper.c
|
||||||
|
+++ b/lib/libdevmapper.c
|
||||||
|
@@ -2759,9 +2759,9 @@ int dm_is_dm_kernel_name(const char *name)
|
||||||
|
return strncmp(name, "dm-", 3) ? 0 : 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
-int dm_crypt_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_crypt_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *data_device, struct volume_key *vk, const char *cipher,
|
||||||
|
- size_t iv_offset, size_t data_offset, const char *integrity, uint32_t tag_size,
|
||||||
|
+ uint64_t iv_offset, uint64_t data_offset, const char *integrity, uint32_t tag_size,
|
||||||
|
uint32_t sector_size)
|
||||||
|
{
|
||||||
|
int r = -EINVAL;
|
||||||
|
@@ -2800,7 +2800,7 @@ err:
|
||||||
|
return r;
|
||||||
|
}
|
||||||
|
|
||||||
|
-int dm_verity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_verity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *data_device, struct device *hash_device, struct device *fec_device,
|
||||||
|
const char *root_hash, uint32_t root_hash_size, uint64_t hash_offset_block,
|
||||||
|
uint64_t hash_blocks, struct crypt_params_verity *vp)
|
||||||
|
@@ -2826,7 +2826,7 @@ int dm_verity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_si
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
-int dm_integrity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_integrity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *meta_device,
|
||||||
|
struct device *data_device, uint64_t tag_size, uint64_t offset,
|
||||||
|
uint32_t sector_size, struct volume_key *vk,
|
||||||
|
@@ -2865,8 +2865,8 @@ int dm_integrity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
-int dm_linear_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
- struct device *data_device, size_t data_offset)
|
||||||
|
+int dm_linear_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
+ struct device *data_device, uint64_t data_offset)
|
||||||
|
{
|
||||||
|
if (!data_device)
|
||||||
|
return -EINVAL;
|
||||||
|
diff --git a/lib/utils_dm.h b/lib/utils_dm.h
|
||||||
|
index 4a1e1d3..124a1c7 100644
|
||||||
|
--- a/lib/utils_dm.h
|
||||||
|
+++ b/lib/utils_dm.h
|
||||||
|
@@ -168,22 +168,22 @@ void dm_backend_exit(struct crypt_device *cd);
|
||||||
|
int dm_targets_allocate(struct dm_target *first, unsigned count);
|
||||||
|
void dm_targets_free(struct crypt_device *cd, struct crypt_dm_active_device *dmd);
|
||||||
|
|
||||||
|
-int dm_crypt_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_crypt_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *data_device, struct volume_key *vk, const char *cipher,
|
||||||
|
- size_t iv_offset, size_t data_offset, const char *integrity,
|
||||||
|
+ uint64_t iv_offset, uint64_t data_offset, const char *integrity,
|
||||||
|
uint32_t tag_size, uint32_t sector_size);
|
||||||
|
-int dm_verity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_verity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *data_device, struct device *hash_device, struct device *fec_device,
|
||||||
|
const char *root_hash, uint32_t root_hash_size, uint64_t hash_offset_block,
|
||||||
|
uint64_t hash_blocks, struct crypt_params_verity *vp);
|
||||||
|
-int dm_integrity_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
+int dm_integrity_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
struct device *meta_device,
|
||||||
|
struct device *data_device, uint64_t tag_size, uint64_t offset, uint32_t sector_size,
|
||||||
|
struct volume_key *vk,
|
||||||
|
struct volume_key *journal_crypt_key, struct volume_key *journal_mac_key,
|
||||||
|
const struct crypt_params_integrity *ip);
|
||||||
|
-int dm_linear_target_set(struct dm_target *tgt, size_t seg_offset, size_t seg_size,
|
||||||
|
- struct device *data_device, size_t data_offset);
|
||||||
|
+int dm_linear_target_set(struct dm_target *tgt, uint64_t seg_offset, uint64_t seg_size,
|
||||||
|
+ struct device *data_device, uint64_t data_offset);
|
||||||
|
|
||||||
|
int dm_remove_device(struct crypt_device *cd, const char *name, uint32_t flags);
|
||||||
|
int dm_status_device(struct crypt_device *cd, const char *name);
|
||||||
|
diff --git a/tests/integrity-compat-test b/tests/integrity-compat-test
|
||||||
|
index 5f2c14e..836975d 100755
|
||||||
|
--- a/tests/integrity-compat-test
|
||||||
|
+++ b/tests/integrity-compat-test
|
||||||
|
@@ -9,6 +9,8 @@ INTSETUP_VALGRIND=../.libs/integritysetup
|
||||||
|
INTSETUP_LIB_VALGRIND=../.libs
|
||||||
|
|
||||||
|
DEV_NAME=dmc_test
|
||||||
|
+DEV_NAME_BIG=dmc_fake
|
||||||
|
+DEV_LOOP=""
|
||||||
|
DEV=test123.img
|
||||||
|
DEV2=test124.img
|
||||||
|
KEY_FILE=key.img
|
||||||
|
@@ -20,6 +22,9 @@ dmremove() { # device
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
[ -b /dev/mapper/$DEV_NAME ] && dmremove $DEV_NAME
|
||||||
|
+ [ -b /dev/mapper/$DEV_NAME_BIG ] && dmremove $DEV_NAME_BIG
|
||||||
|
+ [ -n "$DEV_LOOP" ] && losetup -d "$DEV_LOOP"
|
||||||
|
+ DEV_LOOP=""
|
||||||
|
rm -f $DEV $DEV2 $KEY_FILE >/dev/null 2>&1
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -292,6 +297,7 @@ int_mode() # alg tag_size sector_size [keyfile keysize]
|
||||||
|
|
||||||
|
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
||||||
|
[ ! -x "$INTSETUP" ] && skip "Cannot find $INTSETUP, test skipped."
|
||||||
|
+which blockdev >/dev/null || skip "Cannot find blockdev utility, test skipped."
|
||||||
|
|
||||||
|
[ -n "$VALG" ] && valgrind_setup && INTSETUP=valgrind_run
|
||||||
|
which hexdump >/dev/null 2>&1 || skip "WARNING: hexdump tool required."
|
||||||
|
@@ -389,4 +395,24 @@ else
|
||||||
|
echo "[N/A]"
|
||||||
|
fi
|
||||||
|
|
||||||
|
+echo -n "Big device:"
|
||||||
|
+add_device
|
||||||
|
+DEV_LOOP=$(losetup -f $DEV --show)
|
||||||
|
+if [ -n "$DEV_LOOP" ] ; then
|
||||||
|
+dmsetup create $DEV_NAME_BIG <<EOF
|
||||||
|
+0 16284 linear $DEV_LOOP 0
|
||||||
|
+16284 80000000000 zero
|
||||||
|
+EOF
|
||||||
|
+ [ ! -b /dev/mapper/$DEV_NAME_BIG ] && fail
|
||||||
|
+ $INTSETUP format -q -s 512 --no-wipe /dev/mapper/$DEV_NAME_BIG
|
||||||
|
+ $INTSETUP open /dev/mapper/$DEV_NAME_BIG $DEV_NAME || fail
|
||||||
|
+ D_SIZE=$($INTSETUP dump /dev/mapper/$DEV_NAME_BIG | grep provided_data_sectors | sed -e 's/.*provided_data_sectors\ \+//g')
|
||||||
|
+ A_SIZE=$(blockdev --getsz /dev/mapper/$DEV_NAME)
|
||||||
|
+ # Compare strings (to avoid 64bit integers), not integers
|
||||||
|
+ [ -n "$A_SIZE" -a "$D_SIZE" != "$A_SIZE" ] && fail
|
||||||
|
+ echo "[OK]"
|
||||||
|
+else
|
||||||
|
+ echo "[N/A]"
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
cleanup
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
@ -0,0 +1,65 @@
|
|||||||
|
From d13a6f7487eb7519bc1e4302085b21ca98afabc0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ondrej Kozina <okozina@redhat.com>
|
||||||
|
Date: Thu, 22 Aug 2019 17:05:43 +0200
|
||||||
|
Subject: [PATCH 1/5] Take optimal io size in account with LUKS2 reencryption.
|
||||||
|
|
||||||
|
If device properly exposes optimal io size, let's align
|
||||||
|
reencryption hotzone to it. Otherwise device-mapper driver
|
||||||
|
complaints about misaligned tables and reencryption performance
|
||||||
|
is not optimal.
|
||||||
|
---
|
||||||
|
lib/luks2/luks2_reencrypt.c | 23 +++++++++++++++++++++--
|
||||||
|
1 file changed, 21 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/luks2/luks2_reencrypt.c b/lib/luks2/luks2_reencrypt.c
|
||||||
|
index 1d70aaf..1f5eb5f 100644
|
||||||
|
--- a/lib/luks2/luks2_reencrypt.c
|
||||||
|
+++ b/lib/luks2/luks2_reencrypt.c
|
||||||
|
@@ -817,8 +817,13 @@ static int reencrypt_offset(struct luks2_hdr *hdr,
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static uint64_t reencrypt_length(struct luks2_hdr *hdr, struct luks2_reenc_context *rh, uint64_t keyslot_area_length, uint64_t length_max)
|
||||||
|
+static uint64_t reencrypt_length(struct crypt_device *cd,
|
||||||
|
+ struct luks2_hdr *hdr,
|
||||||
|
+ struct luks2_reenc_context *rh,
|
||||||
|
+ uint64_t keyslot_area_length,
|
||||||
|
+ uint64_t length_max)
|
||||||
|
{
|
||||||
|
+ unsigned long dummy, optimal_alignment;
|
||||||
|
uint64_t length;
|
||||||
|
|
||||||
|
if (rh->rp.type == REENC_PROTECTION_NONE)
|
||||||
|
@@ -835,6 +840,20 @@ static uint64_t reencrypt_length(struct luks2_hdr *hdr, struct luks2_reenc_conte
|
||||||
|
|
||||||
|
length -= (length % rh->alignment);
|
||||||
|
|
||||||
|
+ /* Emits error later */
|
||||||
|
+ if (!length)
|
||||||
|
+ return length;
|
||||||
|
+
|
||||||
|
+ device_topology_alignment(cd, crypt_data_device(cd), &optimal_alignment, &dummy, length);
|
||||||
|
+
|
||||||
|
+ /* we have to stick with encryption sector size alignment */
|
||||||
|
+ if (optimal_alignment % rh->alignment)
|
||||||
|
+ return length;
|
||||||
|
+
|
||||||
|
+ /* align to opt-io size only if remaining size allows it */
|
||||||
|
+ if (length > optimal_alignment)
|
||||||
|
+ length -= (length % optimal_alignment);
|
||||||
|
+
|
||||||
|
return length;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -920,7 +939,7 @@ static int reencrypt_context_init(struct crypt_device *cd, struct luks2_hdr *hdr
|
||||||
|
} else
|
||||||
|
rh->fixed_length = false;
|
||||||
|
|
||||||
|
- rh->length = reencrypt_length(hdr, rh, area_length, params->max_hotzone_size << SECTOR_SHIFT);
|
||||||
|
+ rh->length = reencrypt_length(cd, hdr, rh, area_length, params->max_hotzone_size << SECTOR_SHIFT);
|
||||||
|
if (reencrypt_offset(hdr, rh->direction, device_size, &rh->length, &rh->offset)) {
|
||||||
|
log_dbg(cd, "Failed to get reencryption offset.");
|
||||||
|
return -EINVAL;
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
From 620f0cc8c0b69f9c9c56b5d13f3411f217ae9925 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ondrej Kozina <okozina@redhat.com>
|
|
||||||
Date: Wed, 8 Aug 2018 11:40:55 +0200
|
|
||||||
Subject: [PATCH 6/7] Disable luks2-integrity-test until next usptream release.
|
|
||||||
|
|
||||||
---
|
|
||||||
tests/luks2-integrity-test | 1 +
|
|
||||||
1 file changed, 1 insertion(+)
|
|
||||||
|
|
||||||
diff --git a/tests/luks2-integrity-test b/tests/luks2-integrity-test
|
|
||||||
index 0b7ddf0..d69df1c 100755
|
|
||||||
--- a/tests/luks2-integrity-test
|
|
||||||
+++ b/tests/luks2-integrity-test
|
|
||||||
@@ -114,6 +114,7 @@ intformat() # alg integrity integrity_out key_size int_key_size sector_size csum
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
+skip "WARNING: This test can't be run with current build due to some hard coded values bound to old LUKS2 header size."
|
|
||||||
[ $(id -u) != 0 ] && skip "WARNING: You must be root to run this test, test skipped."
|
|
||||||
[ ! -x "$CRYPTSETUP" ] && skip "Cannot find $CRYPTSETUP, test skipped."
|
|
||||||
modprobe dm-integrity >/dev/null 2>&1
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
13
SOURCES/cryptsetup-disable-verity-compat-test.patch
Normal file
13
SOURCES/cryptsetup-disable-verity-compat-test.patch
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
diff --git a/tests/Makefile.localtest b/tests/Makefile.localtest
|
||||||
|
index 29a62f3..da2183e 100644
|
||||||
|
--- a/tests/Makefile.localtest
|
||||||
|
+++ b/tests/Makefile.localtest
|
||||||
|
@@ -5,7 +5,7 @@
|
||||||
|
CPPFLAGS=-I../lib/ -I../lib/luks1 -DHAVE_DECL_DM_TASK_RETRY_REMOVE -DKERNEL_KEYRING -DHAVE_SYS_SYSMACROS_H -DNO_CRYPTSETUP_PATH
|
||||||
|
CFLAGS=-O2 -g -Wall
|
||||||
|
LDLIBS=-lcryptsetup -ldevmapper
|
||||||
|
-TESTS=$(wildcard *-test *-test2) api-test api-test-2
|
||||||
|
+TESTS=$(filter-out verity-compat-test, $(wildcard *-test *-test2)) api-test api-test-2
|
||||||
|
|
||||||
|
differ: differ.o
|
||||||
|
$(CC) -o $@ $^
|
||||||
@ -1,25 +0,0 @@
|
|||||||
From 18ec689f77a66f4d0632ee2829efccb542ba5f3b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ondrej Kozina <okozina@redhat.com>
|
|
||||||
Date: Fri, 3 Aug 2018 15:42:00 +0200
|
|
||||||
Subject: [PATCH 7/7] Increase default LUKS2 header size to 8MiBs.
|
|
||||||
|
|
||||||
---
|
|
||||||
lib/luks2/luks2.h | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/lib/luks2/luks2.h b/lib/luks2/luks2.h
|
|
||||||
index 2a49618..892e847 100644
|
|
||||||
--- a/lib/luks2/luks2.h
|
|
||||||
+++ b/lib/luks2/luks2.h
|
|
||||||
@@ -124,7 +124,7 @@ struct luks2_keyslot_params {
|
|
||||||
|
|
||||||
#define LUKS2_HDR_BIN_LEN sizeof(struct luks2_hdr_disk)
|
|
||||||
|
|
||||||
-#define LUKS2_HDR_DEFAULT_LEN 0x400000 /* 4 MiB */
|
|
||||||
+#define LUKS2_HDR_DEFAULT_LEN 0x800000 /* 8 MiB */
|
|
||||||
|
|
||||||
#define LUKS2_MAX_KEYSLOTS_SIZE 0x8000000 /* 128 MiB */
|
|
||||||
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
diff -rupN cryptsetup-2.0.6.old/tests/align-test2 cryptsetup-2.0.6/tests/align-test2
|
|
||||||
--- cryptsetup-2.0.6.old/tests/align-test2 2018-12-03 12:53:41.293185399 +0100
|
|
||||||
+++ cryptsetup-2.0.6/tests/align-test2 2018-12-03 12:54:27.821936718 +0100
|
|
||||||
@@ -9,7 +9,9 @@ PWD1="93R4P4pIqAH8"
|
|
||||||
PWD2="mymJeD8ivEhE"
|
|
||||||
FAST_PBKDF="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
-EXPCT=8192
|
|
||||||
+# FIXME: we need some sane API to get this information. This is hack.
|
|
||||||
+LUKS2_HDR_DEFAULT_LEN=$(grep -e "#define LUKS2_HDR_DEFAULT_LEN" ../lib/luks2/luks2.h | cut -d ' ' -f 3)
|
|
||||||
+EXPCT=$((LUKS2_HDR_DEFAULT_LEN/512))
|
|
||||||
|
|
||||||
cleanup() {
|
|
||||||
udevadm settle >/dev/null 2>&1
|
|
||||||
@ -1,439 +0,0 @@
|
|||||||
diff -rupN cryptsetup-2.0.4.old/tests/api-test-2.c cryptsetup-2.0.4/tests/api-test-2.c
|
|
||||||
--- cryptsetup-2.0.4.old/tests/api-test-2.c 2018-08-08 14:05:02.000387826 +0200
|
|
||||||
+++ cryptsetup-2.0.4/tests/api-test-2.c 2018-08-08 14:05:35.946311814 +0200
|
|
||||||
@@ -41,6 +41,7 @@ typedef int32_t key_serial_t;
|
|
||||||
|
|
||||||
#include "api_test.h"
|
|
||||||
#include "luks.h"
|
|
||||||
+#include "luks2.h"
|
|
||||||
#include "libcryptsetup.h"
|
|
||||||
|
|
||||||
#define DMDIR "/dev/mapper/"
|
|
||||||
@@ -165,31 +166,18 @@ static unsigned _min(unsigned a, unsigne
|
|
||||||
return a < b ? a : b;
|
|
||||||
}
|
|
||||||
|
|
||||||
-/* FIXME: will fail with various LUKS2 header sizes */
|
|
||||||
-static int get_luks2_offsets(int metadata_device,
|
|
||||||
- unsigned int alignpayload_sec,
|
|
||||||
- unsigned int alignoffset_sec, /* unused in LUKS2, bug? */
|
|
||||||
- unsigned int sector_size,
|
|
||||||
+static int get_luks2_offsets(unsigned int alignpayload_sec,
|
|
||||||
uint64_t *r_header_size,
|
|
||||||
uint64_t *r_payload_offset)
|
|
||||||
{
|
|
||||||
- if (!sector_size)
|
|
||||||
- sector_size = 512; /* default? */
|
|
||||||
-
|
|
||||||
- if ((sector_size % 512) && (sector_size % 4096))
|
|
||||||
- return -1;
|
|
||||||
-
|
|
||||||
if (r_payload_offset) {
|
|
||||||
- if (metadata_device)
|
|
||||||
- *r_payload_offset = DIV_ROUND_UP_MODULO(4*1024*1024, (alignpayload_sec ?: 1) * sector_size);
|
|
||||||
- else
|
|
||||||
- *r_payload_offset = alignpayload_sec * sector_size;
|
|
||||||
+ *r_payload_offset = DIV_ROUND_UP_MODULO(LUKS2_HDR_DEFAULT_LEN, (alignpayload_sec ?: 1) * SECTOR_SIZE);
|
|
||||||
|
|
||||||
- *r_payload_offset /= sector_size;
|
|
||||||
+ *r_payload_offset >>= SECTOR_SHIFT;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (r_header_size)
|
|
||||||
- *r_header_size = (4*1024*1024) / sector_size;
|
|
||||||
+ *r_header_size = LUKS2_HDR_DEFAULT_LEN >> SECTOR_SHIFT;
|
|
||||||
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@@ -585,7 +573,7 @@ static void AddDeviceLuks2(void)
|
|
||||||
crypt_decode_key(key3, mk_hex2, key_size);
|
|
||||||
|
|
||||||
// init test devices
|
|
||||||
- OK_(get_luks2_offsets(1, 0, 0, 0, &r_header_size, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(0, &r_header_size, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(H_DEVICE, r_header_size));
|
|
||||||
OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_header_size - 1));
|
|
||||||
|
|
||||||
@@ -613,8 +601,8 @@ static void AddDeviceLuks2(void)
|
|
||||||
/*
|
|
||||||
* test limit values for backing device size
|
|
||||||
*/
|
|
||||||
- params.data_alignment = 8192;
|
|
||||||
- OK_(get_luks2_offsets(0, params.data_alignment, 0, 0, NULL, &r_payload_offset));
|
|
||||||
+ params.data_alignment = LUKS2_HDR_DEFAULT_LEN >> SECTOR_SHIFT;
|
|
||||||
+ OK_(get_luks2_offsets(params.data_alignment, NULL, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_0S, r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_1S, r_payload_offset + 1));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_WRONG, r_payload_offset - 1));
|
|
||||||
@@ -767,7 +755,7 @@ static void AddDeviceLuks2(void)
|
|
||||||
OK_(strcmp(cipher, crypt_get_cipher(cd)));
|
|
||||||
OK_(strcmp(cipher_mode, crypt_get_cipher_mode(cd)));
|
|
||||||
EQ_((int)key_size, crypt_get_volume_key_size(cd));
|
|
||||||
- EQ_(8192, crypt_get_data_offset(cd));
|
|
||||||
+ EQ_((LUKS2_HDR_DEFAULT_LEN >> SECTOR_SHIFT), crypt_get_data_offset(cd));
|
|
||||||
OK_(strcmp(DEVICE_2, crypt_get_device_name(cd)));
|
|
||||||
|
|
||||||
reset_log();
|
|
||||||
@@ -809,7 +797,7 @@ static void AddDeviceLuks2(void)
|
|
||||||
FAIL_(crypt_keyslot_add_by_volume_key(cd, 1, key, key_size, PASSPHRASE, strlen(PASSPHRASE)), "VK doesn't match any digest");
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
- OK_(create_dmdevice_over_loop(L_DEVICE_1S, 8193));
|
|
||||||
+ OK_(create_dmdevice_over_loop(L_DEVICE_1S, (LUKS2_HDR_DEFAULT_LEN >> SECTOR_SHIFT) + 1));
|
|
||||||
OK_(crypt_init(&cd, DMDIR L_DEVICE_1S));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, key, key_size, NULL));
|
|
||||||
@@ -900,7 +888,7 @@ static void Luks2HeaderRestore(void)
|
|
||||||
|
|
||||||
crypt_decode_key(key, mk_hex, key_size);
|
|
||||||
|
|
||||||
- OK_(get_luks2_offsets(0, params.data_alignment, 0, 0, NULL, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(params.data_alignment, NULL, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 5000));
|
|
||||||
|
|
||||||
// do not restore header over plain device
|
|
||||||
@@ -976,18 +964,20 @@ static void Luks2HeaderLoad(void)
|
|
||||||
size_t key_size = strlen(mk_hex) / 2;
|
|
||||||
const char *cipher = "aes";
|
|
||||||
const char *cipher_mode = "cbc-essiv:sha256";
|
|
||||||
- uint64_t r_payload_offset, r_header_size;
|
|
||||||
+ uint64_t r_payload_offset, r_header_size, r_header_size_compat;
|
|
||||||
|
|
||||||
crypt_decode_key(key, mk_hex, key_size);
|
|
||||||
|
|
||||||
// prepare test env
|
|
||||||
- OK_(get_luks2_offsets(0, params.data_alignment, 0, 0, &r_header_size, &r_payload_offset));
|
|
||||||
+ OK_(t_device_size(IMAGE1, &r_header_size_compat));
|
|
||||||
+ r_header_size_compat >>= SECTOR_SHIFT;
|
|
||||||
+ OK_(get_luks2_offsets(params.data_alignment, &r_header_size, &r_payload_offset));
|
|
||||||
// external header device
|
|
||||||
OK_(create_dmdevice_over_loop(H_DEVICE, r_header_size));
|
|
||||||
// prepared header on a device too small to contain header and payload
|
|
||||||
- //OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_payload_offset - 1));
|
|
||||||
- OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_header_size - 1));
|
|
||||||
- snprintf(cmd, sizeof(cmd), "dd if=" IMAGE1 " of=" DMDIR H_DEVICE_WRONG " bs=%" PRIu32 " count=%" PRIu64 " 2>/dev/null", params.sector_size, r_header_size - 1);
|
|
||||||
+ // compatimage2.img contains one sector of data. to create wrong device we need one sector less than the header size
|
|
||||||
+ OK_(create_dmdevice_over_loop(H_DEVICE_WRONG, r_header_size_compat - 2));
|
|
||||||
+ snprintf(cmd, sizeof(cmd), "dd if=" IMAGE1 " of=" DMDIR H_DEVICE_WRONG " bs=%" PRIu32 " count=%" PRIu64 " 2>/dev/null", params.sector_size, r_header_size_compat - 2);
|
|
||||||
OK_(_system(cmd, 1));
|
|
||||||
// some device
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 1000));
|
|
||||||
@@ -1092,7 +1082,7 @@ static void Luks2HeaderBackup(void)
|
|
||||||
|
|
||||||
crypt_decode_key(key, mk_hex, key_size);
|
|
||||||
|
|
||||||
- OK_(get_luks2_offsets(0, params.data_alignment, 0, 0, NULL, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(params.data_alignment, NULL, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 1));
|
|
||||||
|
|
||||||
// create LUKS device and backup the header
|
|
||||||
@@ -1180,8 +1170,8 @@ static void ResizeDeviceLuks2(void)
|
|
||||||
crypt_decode_key(key, mk_hex, key_size);
|
|
||||||
|
|
||||||
// prepare env
|
|
||||||
- OK_(get_luks2_offsets(0, params.data_alignment, 0, 0, NULL, &r_payload_offset));
|
|
||||||
- OK_(get_luks2_offsets(1, 0, 0, 0, &r_header_size, NULL));
|
|
||||||
+ OK_(get_luks2_offsets(params.data_alignment, NULL, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(0, &r_header_size, NULL));
|
|
||||||
OK_(create_dmdevice_over_loop(H_DEVICE, r_header_size));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 1000));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_0S, 1000));
|
|
||||||
@@ -1303,7 +1293,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
}
|
|
||||||
|
|
||||||
// prepare the device
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
@@ -1312,7 +1302,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// test thread keyring key in token 0
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, 3, NULL, 0), 0);
|
|
||||||
FAIL_(crypt_activate_by_token(cd, CDEVICE_1, 3, NULL, 0), "already open");
|
|
||||||
@@ -1331,7 +1321,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
}
|
|
||||||
|
|
||||||
// add token 1 with process keyring key
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_token_json_set(cd, 3, NULL), 3);
|
|
||||||
EQ_(crypt_token_luks2_keyring_set(cd, 1, ¶ms), 1);
|
|
||||||
@@ -1339,7 +1329,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// test process keyring key in token 1
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, 1, NULL, 0), 0);
|
|
||||||
FAIL_(crypt_activate_by_token(cd, CDEVICE_1, 1, NULL, 0), "already open");
|
|
||||||
@@ -1364,7 +1354,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_token_luks2_keyring_set(cd, 0, ¶ms), 0);
|
|
||||||
EQ_(crypt_token_assign_keyslot(cd, 0, 0), 0);
|
|
||||||
@@ -1376,7 +1366,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// activate by specific token
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, 0, NULL, 0), 0);
|
|
||||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
|
||||||
@@ -1390,7 +1380,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
}
|
|
||||||
|
|
||||||
// activate by any token with token 0 having absent pass from keyring
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, CRYPT_ANY_TOKEN, NULL, 0), 1);
|
|
||||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
|
||||||
@@ -1403,7 +1393,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
}
|
|
||||||
|
|
||||||
// replace pass for keyslot 0 making token 0 invalid
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
OK_(crypt_keyslot_destroy(cd, 0));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
@@ -1411,7 +1401,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// activate by any token with token 0 having wrong pass for keyslot 0
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, CRYPT_ANY_TOKEN, NULL, 0), 1);
|
|
||||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
|
||||||
@@ -1420,7 +1410,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
// create new device, with two tokens:
|
|
||||||
// 1st token being invalid (missing key in keyring)
|
|
||||||
// 2nd token can activate keyslot 1 after failing to do so w/ keyslot 0 (wrong pass)
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
@@ -1442,7 +1432,7 @@ static void TokenActivationByKeyring(voi
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_token(cd, CDEVICE_1, CRYPT_ANY_TOKEN, NULL, 0), 1);
|
|
||||||
OK_(crypt_deactivate(cd, CDEVICE_1));
|
|
||||||
@@ -1507,7 +1497,7 @@ static void Tokens(void)
|
|
||||||
FAIL_(crypt_token_register(&th_reserved), "luks2- is reserved prefix");
|
|
||||||
|
|
||||||
// basic token API tests
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
EQ_(crypt_token_status(cd, -1, NULL), CRYPT_TOKEN_INVALID);
|
|
||||||
@@ -1706,7 +1696,7 @@ static void LuksConvert(void)
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// exercice non-pbkdf2 LUKSv2 conversion
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
OK_(crypt_set_pbkdf_type(cd, &argon));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
@@ -1714,7 +1704,7 @@ static void LuksConvert(void)
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// exercice non LUKS1 compatible keyslot
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, &luks2));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
EQ_(crypt_keyslot_add_by_key(cd, 1, NULL, 32, PASSPHRASE1, strlen(PASSPHRASE1), CRYPT_VOLUME_KEY_NO_SEGMENT), 1);
|
|
||||||
@@ -1723,7 +1713,7 @@ static void LuksConvert(void)
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// exercice LUKSv2 conversion with single pbkdf2 keyslot being active
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
offset = crypt_get_data_offset(cd);
|
|
||||||
OK_(crypt_set_pbkdf_type(cd, &pbkdf2));
|
|
||||||
@@ -1731,13 +1721,13 @@ static void LuksConvert(void)
|
|
||||||
OK_(crypt_convert(cd, CRYPT_LUKS1, NULL));
|
|
||||||
EQ_(crypt_get_data_offset(cd), offset);
|
|
||||||
crypt_free(cd);
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS, NULL));
|
|
||||||
EQ_(crypt_get_data_offset(cd), offset);
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// do not allow conversion on keyslot No > 7
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, &luks2));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 8, NULL, 32, PASSPHRASE1, strlen(PASSPHRASE1)), 8);
|
|
||||||
@@ -1745,14 +1735,14 @@ static void LuksConvert(void)
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// do not allow conversion with token
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, &luks2));
|
|
||||||
OK_(crypt_token_json_set(cd, CRYPT_ANY_TOKEN, json));
|
|
||||||
FAIL_(crypt_convert(cd, CRYPT_LUKS1, NULL), "Can't convert header with token.");
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// should be enough for both luks1 and luks2 devices with all vk lengths
|
|
||||||
- OK_(get_luks2_offsets(1, 0, 0, 0, NULL, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(0, NULL, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_1S, r_payload_offset + 1));
|
|
||||||
|
|
||||||
// do not allow conversion for legacy luks1 device (non-aligned keyslot offset)
|
|
||||||
@@ -2202,7 +2192,7 @@ static void Pbkdf(void)
|
|
||||||
|
|
||||||
// test LUKSv2 device
|
|
||||||
// test default values are set
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, mode, NULL, NULL, 32, NULL));
|
|
||||||
NOTNULL_(pbkdf = crypt_get_pbkdf_type(cd));
|
|
||||||
OK_(strcmp(pbkdf->type, DEFAULT_LUKS2_PBKDF));
|
|
||||||
@@ -2259,7 +2249,7 @@ static void Pbkdf(void)
|
|
||||||
FAIL_(crypt_set_pbkdf_type(cd, &pbkdf2), "Unknown hash member");
|
|
||||||
crypt_free(cd);
|
|
||||||
// test whether crypt_get_pbkdf_type() behaves accordingly after second crypt_load() call
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS, NULL));
|
|
||||||
NOTNULL_(pbkdf = crypt_get_pbkdf_type(cd));
|
|
||||||
OK_(strcmp(pbkdf->type, DEFAULT_LUKS2_PBKDF));
|
|
||||||
@@ -2277,7 +2267,7 @@ static void Pbkdf(void)
|
|
||||||
crypt_free(cd);
|
|
||||||
|
|
||||||
// test crypt_set_pbkdf_type() overwrites invalid value set by crypt_set_iteration_time()
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 0);
|
|
||||||
OK_(crypt_set_pbkdf_type(cd, &argon2));
|
|
||||||
NOTNULL_(pbkdf = crypt_get_pbkdf_type(cd));
|
|
||||||
@@ -2352,7 +2342,7 @@ static void Luks2KeyslotAdd(void)
|
|
||||||
crypt_decode_key(key2, mk_hex2, key_size);
|
|
||||||
|
|
||||||
/* test crypt_keyslot_add_by_key */
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, key, key_size, NULL));
|
|
||||||
EQ_(crypt_keyslot_add_by_key(cd, 1, key2, key_size, PASSPHRASE1, strlen(PASSPHRASE1), CRYPT_VOLUME_KEY_NO_SEGMENT), 1);
|
|
||||||
@@ -2432,7 +2422,7 @@ static void Luks2ActivateByKeyring(void)
|
|
||||||
}
|
|
||||||
|
|
||||||
// prepare the device
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
crypt_set_iteration_time(cd, 1);
|
|
||||||
OK_(crypt_format(cd, CRYPT_LUKS2, cipher, cipher_mode, NULL, NULL, 32, NULL));
|
|
||||||
EQ_(crypt_keyslot_add_by_volume_key(cd, 0, NULL, 32, PASSPHRASE, strlen(PASSPHRASE)), 0);
|
|
||||||
@@ -2442,7 +2432,7 @@ static void Luks2ActivateByKeyring(void)
|
|
||||||
|
|
||||||
// FIXME: all following tests work as expected but most error messages are missing
|
|
||||||
// check activate by keyring works exactly same as by passphrase
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
EQ_(crypt_activate_by_keyring(cd, NULL, KEY_DESC_TEST0, 0, 0), 0);
|
|
||||||
EQ_(crypt_activate_by_keyring(cd, CDEVICE_1, KEY_DESC_TEST0, 0, 0), 0);
|
|
||||||
@@ -2472,7 +2462,7 @@ static void Luks2ActivateByKeyring(void)
|
|
||||||
exit(1);
|
|
||||||
}
|
|
||||||
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
FAIL_(crypt_activate_by_keyring(cd, NULL, KEY_DESC_TEST0, CRYPT_ANY_SLOT, 0), "no such key in keyring");
|
|
||||||
FAIL_(crypt_activate_by_keyring(cd, CDEVICE_1, KEY_DESC_TEST0, CRYPT_ANY_SLOT, 0), "no such key in keyring");
|
|
||||||
@@ -2718,7 +2708,7 @@ static void Luks2Requirements(void)
|
|
||||||
OK_(crypt_activate_by_token(cd, NULL, 1, NULL, 0));
|
|
||||||
OK_(crypt_activate_by_token(cd, NULL, 1, NULL, t_dm_crypt_keyring_support() ? CRYPT_ACTIVATE_KEYRING_KEY : 0));
|
|
||||||
#endif
|
|
||||||
- OK_(get_luks2_offsets(1, 8192, 0, 0, NULL, &r_payload_offset));
|
|
||||||
+ OK_(get_luks2_offsets(8192, NULL, &r_payload_offset));
|
|
||||||
OK_(create_dmdevice_over_loop(L_DEVICE_OK, r_payload_offset + 2));
|
|
||||||
//OK_(_system("dd if=" NO_REQS_LUKS2_HEADER " of=" NO_REQS_LUKS2_HEADER " bs=4096 2>/dev/null", 1));
|
|
||||||
OK_(_system("dd if=" NO_REQS_LUKS2_HEADER " of=" DMDIR L_DEVICE_OK " bs=1M count=4 oflag=direct 2>/dev/null", 1));
|
|
||||||
@@ -2863,7 +2853,7 @@ static void Luks2Flags(void)
|
|
||||||
struct crypt_device *cd;
|
|
||||||
uint32_t flags = 42;
|
|
||||||
|
|
||||||
- OK_(crypt_init(&cd, DEVICE_1));
|
|
||||||
+ OK_(crypt_init(&cd, DEVICE_2));
|
|
||||||
OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
||||||
|
|
||||||
/* check library erase passed variable on success when no flags set */
|
|
||||||
diff -rupN cryptsetup-2.0.4.old/tests/Makefile.am cryptsetup-2.0.4/tests/Makefile.am
|
|
||||||
--- cryptsetup-2.0.4.old/tests/Makefile.am 2018-08-08 14:05:02.008387808 +0200
|
|
||||||
+++ cryptsetup-2.0.4/tests/Makefile.am 2018-08-08 14:05:35.944311818 +0200
|
|
||||||
@@ -80,7 +80,7 @@ api_test_CPPFLAGS = $(AM_CPPFLAGS) -incl
|
|
||||||
api_test_2_SOURCES = api-test-2.c api_test.h test_utils.c
|
|
||||||
api_test_2_LDADD = ../libcryptsetup.la
|
|
||||||
api_test_2_LDFLAGS = $(AM_LDFLAGS) -static
|
|
||||||
-api_test_2_CFLAGS = -g -Wall -O0 $(AM_CFLAGS) -I$(top_srcdir)/lib/ -I$(top_srcdir)/lib/luks1
|
|
||||||
+api_test_2_CFLAGS = -g -Wall -O0 $(AM_CFLAGS) -I$(top_srcdir)/lib/ -I$(top_srcdir)/lib/luks1 -I$(top_srcdir)/lib/luks2
|
|
||||||
api_test_2_CPPFLAGS = $(AM_CPPFLAGS) -include config.h
|
|
||||||
|
|
||||||
vectors_test_SOURCES = crypto-vectors.c
|
|
||||||
diff -rupN cryptsetup-2.0.4.old/tests/Makefile.in cryptsetup-2.0.4/tests/Makefile.in
|
|
||||||
--- cryptsetup-2.0.4.old/tests/Makefile.in 2018-08-08 14:05:02.000387826 +0200
|
|
||||||
+++ cryptsetup-2.0.4/tests/Makefile.in 2018-08-08 14:08:28.749924872 +0200
|
|
||||||
@@ -466,7 +466,7 @@ api_test_CPPFLAGS = $(AM_CPPFLAGS) -incl
|
|
||||||
api_test_2_SOURCES = api-test-2.c api_test.h test_utils.c
|
|
||||||
api_test_2_LDADD = ../libcryptsetup.la
|
|
||||||
api_test_2_LDFLAGS = $(AM_LDFLAGS) -static
|
|
||||||
-api_test_2_CFLAGS = -g -Wall -O0 $(AM_CFLAGS) -I$(top_srcdir)/lib/ -I$(top_srcdir)/lib/luks1
|
|
||||||
+api_test_2_CFLAGS = -g -Wall -O0 $(AM_CFLAGS) -I$(top_srcdir)/lib/ -I$(top_srcdir)/lib/luks1 -I$(top_srcdir)/lib/luks2
|
|
||||||
api_test_2_CPPFLAGS = $(AM_CPPFLAGS) -include config.h
|
|
||||||
vectors_test_SOURCES = crypto-vectors.c
|
|
||||||
vectors_test_LDADD = ../libcrypto_backend.la @CRYPTO_LIBS@ @LIBARGON2_LIBS@
|
|
||||||
diff -rupN cryptsetup-2.0.4.old/tests/test_utils.c cryptsetup-2.0.4/tests/test_utils.c
|
|
||||||
--- cryptsetup-2.0.4.old/tests/test_utils.c 2018-08-08 14:05:02.008387808 +0200
|
|
||||||
+++ cryptsetup-2.0.4/tests/test_utils.c 2018-08-08 14:05:35.947311812 +0200
|
|
||||||
@@ -118,13 +118,21 @@ void xlog(const char *msg, const char *t
|
|
||||||
|
|
||||||
int t_device_size(const char *device, uint64_t *size)
|
|
||||||
{
|
|
||||||
+ struct stat st;
|
|
||||||
int devfd, r = 0;
|
|
||||||
|
|
||||||
devfd = open(device, O_RDONLY);
|
|
||||||
if(devfd == -1)
|
|
||||||
return -EINVAL;
|
|
||||||
|
|
||||||
- if (ioctl(devfd, BLKGETSIZE64, size) < 0)
|
|
||||||
+ if (fstat(devfd, &st) < 0) {
|
|
||||||
+ close(devfd);
|
|
||||||
+ return -EINVAL;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (S_ISREG(st.st_mode))
|
|
||||||
+ *size = (uint64_t)st.st_size;
|
|
||||||
+ else if (ioctl(devfd, BLKGETSIZE64, size) < 0)
|
|
||||||
r = -EINVAL;
|
|
||||||
close(devfd);
|
|
||||||
return r;
|
|
||||||
@ -1,123 +0,0 @@
|
|||||||
From 619b533bfbb8e6782687eda9e2ba16fc2f73bd15 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ondrej Kozina <okozina@redhat.com>
|
|
||||||
Date: Tue, 7 Aug 2018 10:17:31 +0200
|
|
||||||
Subject: [PATCH 5/7] Make reencryption-compat-test2 ready for different LUKS2
|
|
||||||
hdr size.
|
|
||||||
|
|
||||||
---
|
|
||||||
tests/reencryption-compat-test2 | 40 +++++++++++++++++++++++++++++-----------
|
|
||||||
1 file changed, 29 insertions(+), 11 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/tests/reencryption-compat-test2 b/tests/reencryption-compat-test2
|
|
||||||
index 411df1f..9656c7b 100755
|
|
||||||
--- a/tests/reencryption-compat-test2
|
|
||||||
+++ b/tests/reencryption-compat-test2
|
|
||||||
@@ -19,6 +19,10 @@ PWD3="1-9Qu5Ejfnqv"
|
|
||||||
MNT_DIR=./mnt_luks
|
|
||||||
START_DIR=$(pwd)
|
|
||||||
|
|
||||||
+# FIXME: we need some sane API to get this information. This is hack.
|
|
||||||
+LUKS2_HDR_DEFAULT_LEN=$(grep -e "#define LUKS2_HDR_DEFAULT_LEN" ../lib/luks2/luks2.h | cut -d ' ' -f 3)
|
|
||||||
+LUKS2_HDR_DEFAULT_LEN_SECTORS=$((LUKS2_HDR_DEFAULT_LEN/512))
|
|
||||||
+
|
|
||||||
function dm_crypt_features()
|
|
||||||
{
|
|
||||||
local VER_STR=$(dmsetup targets | grep crypt | cut -f2 -dv)
|
|
||||||
@@ -48,6 +52,7 @@ function remove_mapping()
|
|
||||||
umount $MNT_DIR > /dev/null 2>&1
|
|
||||||
rmdir $MNT_DIR > /dev/null 2>&1
|
|
||||||
del_scsi_device
|
|
||||||
+ test -z "$TMP_LOOP" || losetup -d "$TMP_LOOP"
|
|
||||||
}
|
|
||||||
|
|
||||||
function fail()
|
|
||||||
@@ -113,9 +118,21 @@ function prepare() # $1 dev1_siz
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
-function check_hash_dev() # $1 dev, $2 hash
|
|
||||||
+function check_hash_dev() # $1 dev, $2 hash, [$3 optional max size in KiBs]
|
|
||||||
{
|
|
||||||
- HASH=$(sha256sum $1 | cut -d' ' -f 1)
|
|
||||||
+ local _dev=$1
|
|
||||||
+ if [ $# -gt 2 ]; then
|
|
||||||
+ _dev=$(losetup -f)
|
|
||||||
+ losetup -f --sizelimit $3K $1 || fail
|
|
||||||
+ TMP_LOOP=$_dev
|
|
||||||
+ test -b $TMP_LOOP || fail
|
|
||||||
+ fi
|
|
||||||
+
|
|
||||||
+ HASH=$(sha256sum $_dev | cut -d' ' -f 1)
|
|
||||||
+ test -b "$TMP_LOOP" && {
|
|
||||||
+ losetup -d "$TMP_LOOP"
|
|
||||||
+ unset TMP_LOOP
|
|
||||||
+ }
|
|
||||||
[ $HASH != "$2" ] && fail "HASH differs ($HASH)"
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -218,7 +235,7 @@ HASH5=bb9f8df61474d25e71fa00722318cd387396ca1736605e1248821cc0de3d3af8
|
|
||||||
HASH6=4d9cbaf3aa0935a8c113f139691b3daf9c94c8d6c278aedc8eec66a4b9f6c8ae
|
|
||||||
|
|
||||||
echo "[1] Reencryption"
|
|
||||||
-prepare 8192
|
|
||||||
+prepare $((4096+LUKS2_HDR_DEFAULT_LEN_SECTORS/2))
|
|
||||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 -s 128 -c aes-cbc-plain $FAST_PBKDF_ARGON --align-payload 4096 $IMG || fail
|
|
||||||
wipe $PWD1
|
|
||||||
check_hash $PWD1 $HASH5
|
|
||||||
@@ -260,9 +277,9 @@ $CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
|
|
||||||
|
|
||||||
echo "[4] Encryption of not yet encrypted device"
|
|
||||||
# well, movin' zeroes :-)
|
|
||||||
-OFFSET=8192 # default LUKS2 header size
|
|
||||||
-prepare 8192
|
|
||||||
-check_hash_dev $IMG $HASH4
|
|
||||||
+OFFSET=$LUKS2_HDR_DEFAULT_LEN_SECTORS # default LUKS2 header size
|
|
||||||
+prepare $((4096+$OFFSET/2)) # in KiBs
|
|
||||||
+check_hash_dev $IMG $HASH4 8192
|
|
||||||
echo $PWD1 | $REENC --type luks2 $IMG -c aes-cbc-essiv:sha256 -s 128 --new --reduce-device-size "$OFFSET"S -q $FAST_PBKDF_ARGON
|
|
||||||
check_hash $PWD1 $HASH5
|
|
||||||
$CRYPTSETUP luksDump $IMG | grep -q "luks2" > /dev/null || fail
|
|
||||||
@@ -299,11 +316,11 @@ echo -e "$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD1\n$PWD2\n$PWD3" | $REENC -q $IM
|
|
||||||
check_slot 0 1 2 3 4 5 6 22 || fail "All keyslots expected to be enabled"
|
|
||||||
|
|
||||||
echo "[7] Reencryption of block devices with different block size"
|
|
||||||
-add_scsi_device sector_size=512 dev_size_mb=8
|
|
||||||
+add_scsi_device sector_size=512 dev_size_mb=16
|
|
||||||
simple_scsi_reenc "[512 sector]"
|
|
||||||
-add_scsi_device sector_size=4096 dev_size_mb=8
|
|
||||||
+add_scsi_device sector_size=4096 dev_size_mb=16
|
|
||||||
simple_scsi_reenc "[4096 sector]"
|
|
||||||
-add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=8
|
|
||||||
+add_scsi_device sector_size=512 physblk_exp=3 dev_size_mb=16
|
|
||||||
simple_scsi_reenc "[4096/512 sector]"
|
|
||||||
echo "[OK]"
|
|
||||||
|
|
||||||
@@ -350,7 +367,7 @@ echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG || fa
|
|
||||||
wipe $PWD1
|
|
||||||
check_hash $PWD1 $HASH5
|
|
||||||
echo $PWD1 | $REENC $IMG -q --decrypt
|
|
||||||
-check_hash_dev $IMG $HASH4
|
|
||||||
+check_hash_dev $IMG $HASH4 8192
|
|
||||||
|
|
||||||
echo "[11] Reencryption with tokens"
|
|
||||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG || fail
|
|
||||||
@@ -403,7 +420,7 @@ $CRYPTSETUP isLuks $IMG_HDR || fail
|
|
||||||
$CRYPTSETUP luksDump $IMG_HDR | grep -q "0: luks2" || fail
|
|
||||||
|
|
||||||
echo "[14] Reencryption with unbound keyslot"
|
|
||||||
-prepare 8192
|
|
||||||
+prepare $((4096+LUKS2_HDR_DEFAULT_LEN_SECTORS/2))
|
|
||||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_ARGON $IMG || fail
|
|
||||||
echo $PWD2 | $CRYPTSETUP -q luksAddKey -S 3 --unbound --key-size 64 $FAST_PBKDF_ARGON $IMG || fail
|
|
||||||
wipe $PWD1
|
|
||||||
@@ -421,6 +438,7 @@ check_hash $PWD1 $HASH1
|
|
||||||
$CRYPTSETUP -q convert --type luks2 $IMG || fail
|
|
||||||
echo $PWD1 | $REENC $IMG -q $FAST_PBKDF_PBKDF2 || fail
|
|
||||||
check_hash $PWD1 $HASH1
|
|
||||||
+prepare $((4096+LUKS2_HDR_DEFAULT_LEN_SECTORS/2))
|
|
||||||
echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks2 $FAST_PBKDF_PBKDF2 $IMG || fail
|
|
||||||
wipe $PWD1
|
|
||||||
check_hash $PWD1 $HASH5
|
|
||||||
--
|
|
||||||
1.8.3.1
|
|
||||||
|
|
||||||
@ -1,42 +1,16 @@
|
|||||||
%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
|
|
||||||
|
|
||||||
%if 0%{?fedora}
|
|
||||||
%if 0%{?fedora} >= 29
|
|
||||||
Obsoletes: python2-cryptsetup
|
Obsoletes: python2-cryptsetup
|
||||||
Obsoletes: cryptsetup-python3
|
|
||||||
%global python2_enable 0
|
|
||||||
%global python3_enable 0
|
|
||||||
%else
|
|
||||||
%global python2_enable 1
|
|
||||||
%global python3_enable 1
|
|
||||||
%endif
|
|
||||||
%else
|
|
||||||
Obsoletes: cryptsetup-python3
|
|
||||||
%global python3_enable 0
|
|
||||||
%if 0%{?rhel} == 7
|
|
||||||
%global python2_enable 1
|
|
||||||
%else
|
|
||||||
Obsoletes: cryptsetup-python
|
Obsoletes: cryptsetup-python
|
||||||
Obsoletes: python2-cryptsetup
|
Obsoletes: cryptsetup-python3
|
||||||
%global python2_enable 0
|
|
||||||
%endif
|
|
||||||
%endif
|
|
||||||
|
|
||||||
Summary: A utility for setting up encrypted disks
|
Summary: A utility for setting up encrypted disks
|
||||||
Name: cryptsetup
|
Name: cryptsetup
|
||||||
Version: 2.0.6
|
Version: 2.2.0
|
||||||
Release: 1%{?dist}
|
Release: 2%{?dist}
|
||||||
License: GPLv2+ and LGPLv2+
|
License: GPLv2+ and LGPLv2+
|
||||||
Group: Applications/System
|
Group: Applications/System
|
||||||
URL: https://gitlab.com/cryptsetup/cryptsetup
|
URL: https://gitlab.com/cryptsetup/cryptsetup
|
||||||
BuildRequires: openssl-devel, popt-devel, device-mapper-devel
|
BuildRequires: openssl-devel, popt-devel, device-mapper-devel
|
||||||
BuildRequires: libuuid-devel, gcc, libblkid-devel
|
BuildRequires: libuuid-devel, gcc, libblkid-devel
|
||||||
%if %{python2_enable}
|
|
||||||
BuildRequires: python2-devel
|
|
||||||
%endif
|
|
||||||
%if %{python3_enable}
|
|
||||||
BuildRequires: python3-devel
|
|
||||||
%endif
|
|
||||||
BuildRequires: libpwquality-devel, json-c-devel
|
BuildRequires: libpwquality-devel, json-c-devel
|
||||||
Provides: cryptsetup-luks = %{version}-%{release}
|
Provides: cryptsetup-luks = %{version}-%{release}
|
||||||
Obsoletes: cryptsetup-luks < 1.4.0
|
Obsoletes: cryptsetup-luks < 1.4.0
|
||||||
@ -45,13 +19,13 @@ Requires: libpwquality >= 1.2.0
|
|||||||
|
|
||||||
%global upstream_version %{version}
|
%global upstream_version %{version}
|
||||||
Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{upstream_version}.tar.xz
|
Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{upstream_version}.tar.xz
|
||||||
Patch0: %{name}-make-api-test-2-default-LUKS2-hdr-size-aware.patch
|
|
||||||
Patch1: %{name}-make-reencryption-compat-test2-ready-for-different-L.patch
|
|
||||||
Patch2: %{name}-disable-luks2-integrity-test-until-next-usptream-rel.patch
|
|
||||||
Patch3: %{name}-increase-default-LUKS2-header-size-to-8MiBs.patch
|
|
||||||
Patch4: %{name}-make-align-test-ready-for-larger-LUKS2-hdr.patch
|
|
||||||
# Following patch has to applied last
|
# Following patch has to applied last
|
||||||
Patch5: %{name}-add-system-library-paths.patch
|
Patch0: %{name}-add-system-library-paths.patch
|
||||||
|
# Remove the patch when (if ever) osci infrastructure gets stable enough
|
||||||
|
Patch1: %{name}-disable-verity-compat-test.patch
|
||||||
|
Patch2: %{name}-2.2.1-fix-mapped-segments-overflow-on-32bit-architectures.patch
|
||||||
|
Patch3: %{name}-2.2.1-take-optimal-io-size-in-account-with-LUKS2-reencrypt.patch
|
||||||
|
Patch4: %{name}-2.2.1-add-opt-io-size-parameter-to-LUKS2-reencrypt-test-de.patch
|
||||||
|
|
||||||
%description
|
%description
|
||||||
The cryptsetup package contains a utility for setting up
|
The cryptsetup package contains a utility for setting up
|
||||||
@ -105,76 +79,23 @@ Requires: cryptsetup-libs = %{version}-%{release}
|
|||||||
This package contains cryptsetup-reencrypt utility which
|
This package contains cryptsetup-reencrypt utility which
|
||||||
can be used for offline reencryption of disk in situ.
|
can be used for offline reencryption of disk in situ.
|
||||||
|
|
||||||
%if %{python2_enable}
|
|
||||||
%package -n python2-cryptsetup
|
|
||||||
Group: System Environment/Libraries
|
|
||||||
Summary: Python bindings for libcryptsetup
|
|
||||||
Requires: %{name}-libs = %{version}-%{release}
|
|
||||||
%{?python_provide:%python_provide python2-cryptsetup}
|
|
||||||
# Remove before F30
|
|
||||||
Provides: %{name}-python = %{version}-%{release}
|
|
||||||
Provides: %{name}-python%{?_isa} = %{version}-%{release}
|
|
||||||
Obsoletes: %{name}-python < %{version}-%{release}
|
|
||||||
Obsoletes: python-cryptsetup < 1.4.0
|
|
||||||
|
|
||||||
%description -n python2-cryptsetup
|
|
||||||
This package provides Python bindings for libcryptsetup, a library
|
|
||||||
for setting up disk encryption using dm-crypt kernel module.
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if %{python3_enable}
|
|
||||||
%package python3
|
|
||||||
Group: System Environment/Libraries
|
|
||||||
Summary: Python3 bindings for libcryptsetup
|
|
||||||
Requires: %{name}-libs = %{version}-%{release}
|
|
||||||
Provides: python3-cryptsetup = %{version}-%{release}
|
|
||||||
|
|
||||||
%description python3
|
|
||||||
This package provides Python bindings for libcryptsetup, a library
|
|
||||||
for setting up disk encryption using dm-crypt kernel module.
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n cryptsetup-%{upstream_version}
|
%setup -q -n cryptsetup-%{upstream_version}
|
||||||
%patch0 -p1
|
|
||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
%patch3 -p1
|
%patch3 -p1
|
||||||
%patch4 -p1
|
%patch4 -p1
|
||||||
%patch5 -p1
|
%patch0 -p1
|
||||||
chmod -x python/pycryptsetup-test.py
|
|
||||||
chmod -x misc/dracut_90reencrypt/*
|
chmod -x misc/dracut_90reencrypt/*
|
||||||
|
|
||||||
# copy the whole directory for the python3 build
|
|
||||||
%if %{python3_enable}
|
|
||||||
cp -a . %{py3dir}
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%if %{python2_enable} || %{python3_enable}
|
|
||||||
%configure --enable-python --enable-fips --enable-pwquality --enable-internal-sse-argon2 --with-crypto_backend=openssl --with-default-luks-format=LUKS2
|
|
||||||
%else
|
|
||||||
%configure --enable-fips --enable-pwquality --enable-internal-sse-argon2 --with-crypto_backend=openssl --with-default-luks-format=LUKS2
|
%configure --enable-fips --enable-pwquality --enable-internal-sse-argon2 --with-crypto_backend=openssl --with-default-luks-format=LUKS2
|
||||||
%endif
|
|
||||||
make %{?_smp_mflags}
|
make %{?_smp_mflags}
|
||||||
|
|
||||||
%if %{python3_enable}
|
|
||||||
pushd %{py3dir}
|
|
||||||
%configure --enable-python --with-python_version=3 --enable-fips --enable-pwquality --enable-internal-sse-argon2 --with-crypto_backend=openssl --with-default-luks-format=LUKS2
|
|
||||||
make %{?_smp_mflags}
|
|
||||||
popd
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%install
|
%install
|
||||||
make install DESTDIR=%{buildroot}
|
make install DESTDIR=%{buildroot}
|
||||||
rm -rf %{buildroot}/%{_libdir}/*.la
|
rm -rf %{buildroot}/%{_libdir}/*.la
|
||||||
|
|
||||||
%if %{python3_enable}
|
|
||||||
pushd %{py3dir}
|
|
||||||
make install DESTDIR=%{buildroot}
|
|
||||||
rm -rf %{buildroot}/%{_libdir}/*.la
|
|
||||||
popd
|
|
||||||
%endif
|
|
||||||
%find_lang cryptsetup
|
%find_lang cryptsetup
|
||||||
|
|
||||||
%post -n cryptsetup-libs -p /sbin/ldconfig
|
%post -n cryptsetup-libs -p /sbin/ldconfig
|
||||||
@ -220,27 +141,31 @@ popd
|
|||||||
%{_tmpfilesdir}/cryptsetup.conf
|
%{_tmpfilesdir}/cryptsetup.conf
|
||||||
%ghost %attr(700, -, -) %dir /run/cryptsetup
|
%ghost %attr(700, -, -) %dir /run/cryptsetup
|
||||||
|
|
||||||
%if %{python2_enable}
|
|
||||||
%files -n python2-cryptsetup
|
|
||||||
%{!?_licensedir:%global license %%doc}
|
|
||||||
%license COPYING.LGPL
|
|
||||||
%doc python/pycryptsetup-test.py
|
|
||||||
%exclude %{python_sitearch}/pycryptsetup.la
|
|
||||||
%{python_sitearch}/pycryptsetup.so
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if %{python3_enable}
|
|
||||||
%files python3
|
|
||||||
%{!?_licensedir:%global license %%doc}
|
|
||||||
%license COPYING.LGPL
|
|
||||||
%doc python/pycryptsetup-test.py
|
|
||||||
%exclude %{python3_sitearch}/pycryptsetup.la
|
|
||||||
%{python3_sitearch}/pycryptsetup.so
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%clean
|
%clean
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Aug 30 2019 Ondrej Kozina <okozina@redhat.com> - 2.2.0-2
|
||||||
|
- patch: Fix mapped segments overflow on 32bit architectures.
|
||||||
|
- patch: Take optimal io size in account with LUKS2 reencryption.
|
||||||
|
- Resolves: #1742815 #1746532
|
||||||
|
|
||||||
|
* Thu Aug 15 2019 Ondrej Kozina <okozina@redhat.com> - 2.2.0-1
|
||||||
|
- Update to cryptsetup 2.2.0 (final)
|
||||||
|
- Resolves: #1738263 #1740342 #1733391 #1729600 #1733390
|
||||||
|
|
||||||
|
* Fri Jun 14 2019 Ondrej Kozina <okozina@redhat.com> - 2.2.0-0.2
|
||||||
|
- Updates to reencryption feature.
|
||||||
|
- Resolves: #1676622
|
||||||
|
|
||||||
|
* Fri May 03 2019 Ondrej Kozina <okozina@redhat.com> - 2.2.0-0.1
|
||||||
|
- Update to cryptsetup 2.2.0
|
||||||
|
- remove python bits from spec file.
|
||||||
|
- Resolves: #1676622
|
||||||
|
|
||||||
|
* Thu Mar 21 2019 Milan Broz <mbroz@redhat.com> - 2.0.6-2
|
||||||
|
- Add gating tests.
|
||||||
|
- Resolves: #1682539
|
||||||
|
|
||||||
* Mon Dec 03 2018 Ondrej Kozina <okozina@redhat.com> - 2.0.6-1
|
* Mon Dec 03 2018 Ondrej Kozina <okozina@redhat.com> - 2.0.6-1
|
||||||
- Update to cryptsetup 2.0.6
|
- Update to cryptsetup 2.0.6
|
||||||
- Enables all supported metadata sizes in LUKS2 validation code.
|
- Enables all supported metadata sizes in LUKS2 validation code.
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user