[systemd-devel] [PATCH] cryptsetup: add keyfile-offset= support

[Paul Menzel]

Dear Tom,


Am Freitag, den 29.06.2012, 13:40 +0200 schrieb Tom Gundersen:
> This is useful if your keyfile is a block device, and you want to
> use a specific part of it, such as an area between the MBR and the
> first partition.
> 
> This feature is documented in the Arch wiki[0], and has been supported
> by the Arch initscripts, so would be nice to get this into systemd.

please document that libcryptsetup ≥ 1.4.2 is needed in the commit
message.

> [0]:
> <https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS#Storing_the_key_between_MBR_and_1st_partition>

Please no line break here.

> ---
>  configure.ac                |  2 +-
>  man/crypttab.xml            | 13 +++++++++++++
>  src/cryptsetup/cryptsetup.c | 11 ++++++++++-
>  3 files changed, 24 insertions(+), 2 deletions(-)
> 
> diff --git a/configure.ac b/configure.ac
> index e0a2526..e1876cc 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -333,7 +333,7 @@ AC_SUBST(AUDIT_LIBS)
>  have_libcryptsetup=no
>  AC_ARG_ENABLE(libcryptsetup, AS_HELP_STRING([--disable-libcryptsetup], [disable libcryptsetup tools]))
>  if test "x$enable_libcryptsetup" != "xno"; then
> -        PKG_CHECK_MODULES(LIBCRYPTSETUP, [ libcryptsetup ],
> +        PKG_CHECK_MODULES(LIBCRYPTSETUP, [ libcryptsetup >= 1.4.2 ],
>                  [AC_DEFINE(HAVE_LIBCRYPTSETUP, 1, [Define if libcryptsetup is available]) have_libcryptsetup=yes], have_libcryptsetup=no)
>          if test "x$have_libcryptsetup" = xno -a "x$enable_libcryptsetup" = xyes; then
>                  AC_MSG_ERROR([*** libcryptsetup support requested but libraries not found])
> diff --git a/man/crypttab.xml b/man/crypttab.xml
> index f3bde71..e54f78c 100644
> --- a/man/crypttab.xml
> +++ b/man/crypttab.xml
> @@ -131,6 +131,19 @@
>  
> 
>                          <varlistentry>
> +                                <term><varname>keyfile-offset=</varname></term>

Wrong indentation?

> +
> +				<listitem><para>Specifies the number
> +                                of bytes to skip at the start of
> +                                the keyfile; see
> +                                <citerefentry><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>
> +                                for possible values and the default
> +                                value of this
> +                                option. </para></listitem>

No space after full stop and merge with line before?

> +                        </varlistentry>
> +
> +
> +                        <varlistentry>
>                                  <term><varname>hash=</varname></term>
>  
>                                  <listitem><para>Specifies the hash to
> diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
> index b26fcca..f570724 100644
> --- a/src/cryptsetup/cryptsetup.c
> +++ b/src/cryptsetup/cryptsetup.c
> @@ -37,6 +37,7 @@
>  static const char *opt_type = NULL; /* LUKS1 or PLAIN */
>  static char *opt_cipher = NULL;
>  static unsigned opt_key_size = 0;
> +static unsigned opt_keyfile_offset = 0;
>  static char *opt_hash = NULL;
>  static unsigned opt_tries = 0;
>  static bool opt_readonly = false;
> @@ -79,6 +80,13 @@ static int parse_one_option(const char *option) {
>                          return 0;
>                  }
>  
> +        } else if (startswith(option, "keyfile-offset=")) {
> +
> +                if (safe_atou(option+15, &opt_keyfile_offset) < 0) {
> +                        log_error("keyfile-offset= parse failure, ignoring.");
> +                        return 0;
> +                }
> +
>          } else if (startswith(option, "hash=")) {
>                  char *t;
>  
> @@ -462,7 +470,8 @@ int main(int argc, char *argv[]) {
>                                   argv[3]);
>  
>                          if (key_file)
> -                                k = crypt_activate_by_keyfile(cd, argv[2], CRYPT_ANY_SLOT, key_file, keyfile_size, flags);
> +                                k = crypt_activate_by_keyfile_offset(cd, argv[2], CRYPT_ANY_SLOT, key_file, keyfile_size,
> +                                            opt_keyfile_offset, flags);
>                          else {
>                                  char **p;

Otherwise this looks good.

Acked-by: Paul Menzel <paulepanter at users.sourceforge.net>


Thanks,

Paul

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <http://lists.freedesktop.org/archives/systemd-devel/attachments/20120629/3d9923b6/attachment-0001.pgp>