From b3b4ebab02395933cde554b5a5d5c363dae3920d Mon Sep 17 00:00:00 2001
From: Ondrej Kozina <okozina@redhat.com>
Date: Thu, 12 Oct 2017 12:57:25 +0200
Subject: [PATCH 1/2] cryptsetup: support LUKS2 on-disk format

Allow cryptsetup utility to activate LUKS2 devices (with appropriate
libcryptsetup)

The change itself doesn't enforce new libcryptsetup 2.x and is backward
compatible with versions 1.x
---
 src/cryptsetup/cryptsetup.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index 8fc35ad999..785bdff99d 100644
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -38,7 +38,15 @@
 #include "strv.h"
 #include "util.h"
 
-static const char *arg_type = NULL; /* CRYPT_LUKS1, CRYPT_TCRYPT or CRYPT_PLAIN */
+/* libcryptsetup define for any LUKS version, compatible with libcryptsetup 1.x */
+#ifndef CRYPT_LUKS
+#define CRYPT_LUKS NULL
+#endif
+
+/* internal helper */
+#define ANY_LUKS "LUKS"
+
+static const char *arg_type = NULL; /* ANY_LUKS, CRYPT_LUKS1, CRYPT_LUKS2, CRYPT_TCRYPT or CRYPT_PLAIN */
 static char *arg_cipher = NULL;
 static unsigned arg_key_size = 0;
 static int arg_key_slot = CRYPT_ANY_SLOT;
@@ -102,7 +110,7 @@ static int parse_one_option(const char *option) {
 
         } else if ((val = startswith(option, "key-slot="))) {
 
-                arg_type = CRYPT_LUKS1;
+                arg_type = ANY_LUKS;
                 r = safe_atoi(val, &arg_key_slot);
                 if (r < 0) {
                         log_error_errno(r, "Failed to parse %s, ignoring: %m", option);
@@ -140,7 +148,7 @@ static int parse_one_option(const char *option) {
                         return log_oom();
 
         } else if ((val = startswith(option, "header="))) {
-                arg_type = CRYPT_LUKS1;
+                arg_type = ANY_LUKS;
 
                 if (!path_is_absolute(val)) {
                         log_error("Header path \"%s\" is not absolute, refusing.", val);
@@ -171,7 +179,7 @@ static int parse_one_option(const char *option) {
         else if (STR_IN_SET(option, "allow-discards", "discard"))
                 arg_discards = true;
         else if (streq(option, "luks"))
-                arg_type = CRYPT_LUKS1;
+                arg_type = ANY_LUKS;
         else if (streq(option, "tcrypt"))
                 arg_type = CRYPT_TCRYPT;
         else if (streq(option, "tcrypt-hidden")) {
@@ -491,8 +499,8 @@ static int attach_luks_or_plain(struct crypt_device *cd,
         assert(name);
         assert(key_file || passwords);
 
-        if (!arg_type || streq(arg_type, CRYPT_LUKS1)) {
-                r = crypt_load(cd, CRYPT_LUKS1, NULL);
+        if (!arg_type || STR_IN_SET(arg_type, ANY_LUKS, CRYPT_LUKS1)) {
+                r = crypt_load(cd, CRYPT_LUKS, NULL);
                 if (r < 0) {
                         log_error("crypt_load() failed on device %s.\n", crypt_get_device_name(cd));
                         return r;

From dd59868b67de77c619b64fc197f5f0299d9e4064 Mon Sep 17 00:00:00 2001
From: Ondrej Kozina <okozina@redhat.com>
Date: Fri, 13 Oct 2017 15:27:30 +0200
Subject: [PATCH 2/2] shared/dissect-image: adapt to LUKS2 format

Load any LUKS format available (and recognized) by libcryptsetup
---
 src/shared/dissect-image.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 4b59f2ca7d..258e8ca67a 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -19,6 +19,9 @@
 
 #if HAVE_LIBCRYPTSETUP
 #include <libcryptsetup.h>
+#ifndef CRYPT_LUKS
+#define CRYPT_LUKS NULL
+#endif
 #endif
 #include <sys/mount.h>
 
@@ -843,7 +846,7 @@ static int decrypt_partition(
         if (r < 0)
                 return log_debug_errno(r, "Failed to initialize dm-crypt: %m");
 
-        r = crypt_load(cd, CRYPT_LUKS1, NULL);
+        r = crypt_load(cd, CRYPT_LUKS, NULL);
         if (r < 0) {
                 log_debug_errno(r, "Failed to load LUKS metadata: %m");
                 goto fail;