[systemd-devel] [PATCH] cryptsetup: Support key-slot option

[Tom Gundersen]

On Sun, Jan 26, 2014 at 12:02 PM, Christian Seiler <christian at iwakd.de> wrote:
> Debian recently introduced the option key-slot to /etc/crypttab to
> specify the LUKS key slot to be used for decrypting the device. On
> systems where a keyfile is used and the key is not in the first slot,
> this can speed up the boot process quite a bit, since cryptsetup does
> not need to try all of the slots sequentially. (Unsuccessfully testing
> a key slot typically takes up to about 1 second.)
>
> This patch makes systemd aware of this option.
>
> Debian bug that introduced the feature:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=704470
> ---
>  man/crypttab.xml            | 14 ++++++++++++++
>  src/cryptsetup/cryptsetup.c | 13 +++++++++++--
>  2 files changed, 25 insertions(+), 2 deletions(-)
>
> diff --git a/man/crypttab.xml b/man/crypttab.xml
> index 90d8ce9..5f386e5 100644
> --- a/man/crypttab.xml
> +++ b/man/crypttab.xml
> @@ -164,6 +164,20 @@
>                          </varlistentry>
>
>                          <varlistentry>
> +                                <term><varname>key-slot=</varname></term>
> +
> +                                <listitem><para>Specifies the key slot to
> +                                compare the passphrase or key against.
> +                                If the key slot does not match the given
> +                                passphrase or key, but another would, the
> +                                setup of the device will fail regardless.
> +                                This implies <varname>luks</varname>. See
> +                                <citerefentry><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>
> +                                for possible values. The default is to try
> +                                all key slots in sequential order.</para></listitem>
> +                        </varlistentry>
> +
> +                        <varlistentry>
>                                  <term><varname>luks</varname></term>
>
>                                  <listitem><para>Force LUKS mode. When this mode
> diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
> index 0a15b50..033c0cd 100644
> --- a/src/cryptsetup/cryptsetup.c
> +++ b/src/cryptsetup/cryptsetup.c
> @@ -39,6 +39,7 @@
>  static const char *opt_type = NULL; /* CRYPT_LUKS1, CRYPT_TCRYPT or CRYPT_PLAIN */
>  static char *opt_cipher = NULL;
>  static unsigned opt_key_size = 0;
> +static int opt_key_slot = CRYPT_ANY_SLOT;
>  static unsigned opt_keyfile_size = 0;
>  static unsigned opt_keyfile_offset = 0;
>  static char *opt_hash = NULL;
> @@ -87,6 +88,14 @@ static int parse_one_option(const char *option) {
>                          return 0;
>                  }
>
> +        } else if (startswith(option, "key-slot=")) {
> +
> +                opt_type = CRYPT_LUKS1;
> +                if (safe_atoi(option+9, &opt_key_slot) < 0) {
> +                        log_error("key-slot= parse failure, ignoring.");
> +                        return 0;
> +                }
> +
>          } else if (startswith(option, "tcrypt-keyfile=")) {
>
>                  opt_type = CRYPT_TCRYPT;
> @@ -425,7 +434,7 @@ static int attach_luks_or_plain(struct crypt_device *cd,
>                   crypt_get_device_name(cd));
>
>          if (key_file) {
> -                r = crypt_activate_by_keyfile_offset(cd, name, CRYPT_ANY_SLOT,
> +                r = crypt_activate_by_keyfile_offset(cd, name, opt_key_slot,
>                                                       key_file, opt_keyfile_size,
>                                                       opt_keyfile_offset, flags);
>                  if (r < 0) {
> @@ -439,7 +448,7 @@ static int attach_luks_or_plain(struct crypt_device *cd,
>                          if (pass_volume_key)
>                                  r = crypt_activate_by_volume_key(cd, name, *p, opt_key_size, flags);
>                          else
> -                                r = crypt_activate_by_passphrase(cd, name, CRYPT_ANY_SLOT, *p, strlen(*p), flags);
> +                                r = crypt_activate_by_passphrase(cd, name, opt_key_slot, *p, strlen(*p), flags);
>
>                          if (r >= 0)
>                                  break;
> --
> 1.8.3.1

Thanks! Applied.

Cheers,

Tom