SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tcrypt: try all entered passphrases instead of just the first one (#29837)

Browse Source 
Previously only the first entered passphrase would be used.  Add the ability to check all the passwords entered by the user.  The total number of passwords entered is still limited by passphrase entry limit.
This commit is contained in:
jjimbo137
2023-11-06 16:39:01 +00:00
committed by GitHub
parent 4697ee9f43
commit b55ca26f5b
1 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup.c
+22 -16
View File
@@ -1006,31 +1006,37 @@ static int attach_tcrypt(
if (key_data) {
params.passphrase = key_data;
params.passphrase_size = key_data_size;
r = crypt_load(cd, CRYPT_TCRYPT, &params);
} else if (key_file) {
r = read_one_line_file(key_file, &passphrase);
if (r < 0) {
log_error_errno(r, "Failed to read password file '%s': %m", key_file);
return -EAGAIN; /* log with the actual error, but return EAGAIN */
}
params.passphrase = passphrase;
params.passphrase_size = strlen(passphrase);
r = crypt_load(cd, CRYPT_TCRYPT, &params);
} else {
if (key_file) {
r = read_one_line_file(key_file, &passphrase);
if (r < 0) {
log_error_errno(r, "Failed to read password file '%s': %m", key_file);
return -EAGAIN; /* log with the actual error, but return EAGAIN */
}
params.passphrase = passphrase;
} else
params.passphrase = passwords[0];
params.passphrase_size = strlen(params.passphrase);
r = -EINVAL;
STRV_FOREACH(p, passwords){
params.passphrase = *p;
params.passphrase_size = strlen(*p);
r = crypt_load(cd, CRYPT_TCRYPT, &params);
if (r >= 0)
break;
}
}
r = crypt_load(cd, CRYPT_TCRYPT, &params);
if (r < 0) {
if (r == -EPERM) {
if (key_data)
log_error_errno(r, "Failed to activate using discovered key. (Key not correct?)");
if (key_file)
else if (key_file)
log_error_errno(r, "Failed to activate using password file '%s'. (Key data not correct?)", key_file);
else
log_error_errno(r, "Failed to activate using supplied passwords.");
return -EAGAIN; /* log the actual error, but return EAGAIN */
return r;
}
return log_error_errno(r, "Failed to load tcrypt superblock on device %s: %m", crypt_get_device_name(cd));