Hide Forgot
Description of problem: Cryptsetup-reencrypt utility can't reencrypt device with last keyslot being active. Version-Release number of selected component (if applicable): cryptsetup-1.6.2-2.el7 (even upstream 1.6.2) How reproducible: always Steps to Reproduce: 1. fallocate -l $[8*1024*1024] /tmp/test_file 2. losetup -f /tmp/test_file 3. echo aaa | cryptsetup --force-password luksFormat -S 7 /dev/loop0 4. cryptsetup-reencrypt /dev/loop0 Actual results: reencrypt fails with retval 1 and message about /dev/loopX (temporary helper device) being too small. Expected results: device is reencrypted
backtrace: #0 LUKS_endec_template (src=0x6108e8 "", srcLength=128000, cipher=0x60f518 "aes", cipher_mode=0x60f538 "xts-plain64", vk=0x610510, sector=1800, func=0x7ffff7bbdd88 <read_blockwise>, mode=0, ctx=0x60f4d0) at keyencryption.c:81 #1 0x00007ffff7bcac11 in LUKS_decrypt_from_storage (dst=0x6108e8 "", dstLength=128000, cipher=0x60f518 "aes", cipher_mode=0x60f538 "xts-plain64", vk=0x610510, sector=1800, ctx=0x60f4d0) at keyencryption.c:139 #2 0x00007ffff7bc9e5b in LUKS_open_key (keyIndex=7, password=0x6106c8 "aaa", passwordLen=3, hdr=0x60f510, vk=0x60f460, ctx=0x60f4d0) at keymanage.c:923 #3 0x00007ffff7bc9fd8 in LUKS_open_key_with_hdr (keyIndex=-1, password=0x6106c8 "aaa", passwordLen=3, hdr=0x60f510, vk=0x7fffffff9060, ctx=0x60f4d0) at keymanage.c:963 #4 0x00007ffff7bbb982 in crypt_activate_by_passphrase (cd=0x60f4d0, name=0x7fffffff9108 "LUKS-a98c8ec3-9d98-4b1b-97db-b9a267da2a8f.org", keyslot=-1, passphrase=0x6106c8 "aaa", passphrase_size=3, flags=17) at setup.c:1933 #5 0x0000000000404cb9 in activate_luks_headers (rc=0x7fffffff90d0) at cryptsetup_reencrypt.c:394 #6 0x00000000004070d9 in run_reencrypt (device=0x7fffffffe5f4 "/dev/loop1") at cryptsetup_reencrypt.c:1083 #7 0x00000000004077b6 in main (argc=2, argv=0x7fffffffe328) at cryptsetup_reencrypt.c:1237 failing function is: lib/luk1/keyencryption.c:79 r = device_block_adjust(ctx, dmd.data_device, DEV_OK, dmd.u.crypt.offset, &dmd.size, &dmd.flags);
Seems to me like a rounding or alignment issue: 1) in LUKS_hdr_backup() I get necessary header size 2050 sectors (512 B) 2) in LUKS_endec_template() I get necessary header size 2056 sectors (512 B) In 1) we get alignment from block device (512B sectors) In 2) we get alignment from regular file, alignement is page_size
just for the record (it's obvious): it also affects cryptsetup (and library) when trying to load key from external header file. But the bug doesn't trigger when you try to use the backup header from another block device. (even when I dd-ed header from file to block device of same size). So the header is fine, keyslot materials are fine, it's just failing alignment expectation: creating header backup from block device with sector size = 512B and trying to read header from file where sector size is replaced implicitly by page size (4K).
Got fix in upstream. Next build will include the fix: http://code.google.com/p/cryptsetup/source/detail?r=f30bbbffe75b8d561c202839d26fe40be06d09b6
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.