[systemd-devel] [PATCH] cryptsetup: Retry indefinitely if tries=0 option has been set.

[Thomas Bächler]

When running from initrd, entering a wrong passphrase usually means that
you cannot boot. Therefore, we allow trying indefinitely.
---

This is useful together with Tom's latest patch. On my system, I use
 rd.luks.options=allow-discards,tries=0
so unless booting succeeds, I will be prompted for a passphrase
indefinitely.

 man/crypttab.xml            | 4 +++-
 src/cryptsetup/cryptsetup.c | 7 +++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/man/crypttab.xml b/man/crypttab.xml
index 15c86d3..90d8ce9 100644
--- a/man/crypttab.xml
+++ b/man/crypttab.xml
@@ -330,7 +330,9 @@
                                 <term><varname>tries=</varname></term>
 
                                 <listitem><para>Specifies the maximum number of
-                                times the user is queried for a password.</para></listitem>
+                                times the user is queried for a password.
+                                The default is 3. If set to 0, the user is
+                                queried for a password indefinitely.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index ba0fdbc..22b5eea 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -41,7 +41,7 @@ static unsigned opt_key_size = 0;
 static unsigned opt_keyfile_size = 0;
 static unsigned opt_keyfile_offset = 0;
 static char *opt_hash = NULL;
-static unsigned opt_tries = 0;
+static unsigned opt_tries = 3;
 static bool opt_readonly = false;
 static bool opt_verify = false;
 static bool opt_discards = false;
@@ -576,7 +576,6 @@ int main(int argc, char *argv[]) {
                 else
                         until = 0;
 
-                opt_tries = opt_tries > 0 ? opt_tries : 3;
                 opt_key_size = (opt_key_size > 0 ? opt_key_size : 256);
 
                 if (key_file) {
@@ -588,7 +587,7 @@ int main(int argc, char *argv[]) {
                                 log_warning("Key file %s is world-readable. This is not a good idea!", key_file);
                 }
 
-                for (tries = 0; tries < opt_tries; tries++) {
+                for (tries = 0; opt_tries == 0 || tries < opt_tries; tries++) {
                         _cleanup_strv_free_ char **passwords = NULL;
 
                         if (!key_file) {
@@ -616,7 +615,7 @@ int main(int argc, char *argv[]) {
                         log_warning("Invalid passphrase.");
                 }
 
-                if (tries >= opt_tries) {
+                if (opt_tries != 0 && tries >= opt_tries) {
                         log_error("Too many attempts; giving up.");
                         r = EXIT_FAILURE;
                         goto finish;
-- 
1.8.3.4