Do not allow null cipher for LUKS2 keyslot even in conversion.

Author: mbroz

lib/luks2/luks2_keyslot.c

@@ -175,6 +175,9 @@ int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd, const char *ciphe
 	if (!strncmp(cipher_spec, "capi:", 5))
 		return 1;
 
+	if (crypt_is_cipher_null(cipher_spec))
+		return 1;
+
 	if (crypt_parse_name_and_mode(cipher_spec, cipher, NULL, cipher_mode) < 0)
 		return 1;
 

lib/luks2/luks2_luks1_convert.c

@@ -596,7 +596,7 @@ int LUKS2_luks1_to_luks2(struct crypt_device *cd, struct luks_phdr *hdr1, struct
 	if (r < 0 || (size_t)r >= sizeof(cipher_spec))
 		return -EINVAL;
 	if (LUKS2_keyslot_cipher_incompatible(cd, cipher_spec)) {
-		log_err(cd, _("Unable to use cipher specification %s-%s for LUKS2."),
+		log_err(cd, _("Unable to use cipher specification %s-%s for LUKS2 keyslot."),
 			hdr1->cipherName, hdr1->cipherMode);
 		return -EINVAL;
 	}

src/cryptsetup.c

@@ -78,6 +78,7 @@ static bool isLUKS(const char *type)
 static int _set_keyslot_encryption_params(struct crypt_device *cd)
 {
 	const char *type = crypt_get_type(cd);
+	int r;
 
 	if (!ARG_SET(OPT_KEYSLOT_KEY_SIZE_ID) && !ARG_SET(OPT_KEYSLOT_CIPHER_ID))
 		return 0;
@@ -87,7 +88,11 @@ static int _set_keyslot_encryption_params(struct crypt_device *cd)
 		return -EINVAL;
 	}
 
-	return crypt_keyslot_set_encryption(cd, ARG_STR(OPT_KEYSLOT_CIPHER_ID), ARG_UINT32(OPT_KEYSLOT_KEY_SIZE_ID) / 8);
+	r = crypt_keyslot_set_encryption(cd, ARG_STR(OPT_KEYSLOT_CIPHER_ID), ARG_UINT32(OPT_KEYSLOT_KEY_SIZE_ID) / 8);
+	if (r < 0)
+		log_err(_("Keyslot encryption parameters are not compatible with LUKS2 keyslot encryption."));
+
+	return r;
 }
 
 static int init_new_keyslot_context(struct crypt_device *cd,

tests/luks2-reencryption-test

@@ -1855,14 +1855,16 @@ if [ $HAVE_KEYRING -gt 0 ]; then
 fi
 $CRYPTSETUP close $DEV_NAME
 
-# simulate LUKS2 device with cipher_null in both keyslot and segment (it can be created only by up conversion from LUKS1)
-echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail
-$CRYPTSETUP convert -q --type luks2 $DEV || fail
-wipe $PWD1
-echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail
-check_hash $PWD1 $HASH1
-# both keyslot and segment cipher must not be null after reencryption with default params
-$CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail
+# FIXME: Add test luks2 image with both keyslot and data using cipher_null and verify LUKS2 reencryption fixes this.
+
+## simulate LUKS2 device with cipher_null in both keyslot and segment (it can be created only by up conversion from LUKS1)
+#echo $PWD1 | $CRYPTSETUP -q luksFormat --type luks1 -s 128 -c cipher_null-ecb --offset 8192 $FAST_PBKDF2 $DEV || fail
+#$CRYPTSETUP convert -q --type luks2 $DEV || fail
+#wipe $PWD1
+#echo $PWD1 | $CRYPTSETUP reencrypt $DEV -q $FAST_PBKDF_ARGON >/dev/null || fail
+#check_hash $PWD1 $HASH1
+## both keyslot and segment cipher must not be null after reencryption with default params
+#$CRYPTSETUP luksDump $DEV | grep -q "cipher_null" && fail
 
 # multistep reencryption with initial cipher_null
 preparebig 64