* luks_device: allow passphrases to contain newlines
This is useful when passing binary keyfiles from an ansible vault, as
it removes the restriction that the binary data cannot contain newlines.
The only exception is adding a new key to an existing container, as in
that case the two passphrases are separated by a new line.
* add integration tests and a changelog fragment
* attempt to also make luks_add_key work with passphrases containing
newlines
* use a deterministic method to generate keyfile 3, improve changelog
formatting
* add licence and copyright to keyfile3.txt to satisfy CI
* luks_device: fix remove_keyslot not working when set to 0
* luks_device: fix module outputting 'ok' when trying to add a key that is already present in another keyslot
* luks_device: fix breaking unit tests
* luks_device: Duplicate key test case code cleanup
* luks_device: Fix testing of LUKS passphrases when only testing one key slot
* luks_device: Fix testing of LUKS passphrases when only testing one key slot
* luks_device: Add changelog fragment for PR #710
* luks_device: Update changlog fragment
* add allow discard option for luks devices
* Add allow_discards to perfomance tests
* Fix version for luks devices doc
* Update plugins/modules/luks_device.py
Co-authored-by: Felix Fontein <felix@fontein.de>
* add changelog fragment
* Update changelogs/fragments/693-allow-discards.yaml
Co-authored-by: Felix Fontein <felix@fontein.de>
* added allow_discards to the persistently stored option list
* allow_discards works with not only luks2 containers
* Update plugins/modules/luks_device.py
Co-authored-by: Felix Fontein <felix@fontein.de>
---------
Co-authored-by: Felix Fontein <felix@fontein.de>
* luks_device: add support for keyslots
* luks_device: replace python3 format strings with python2 format strings, remove print statements
* luks_device: add missing copyright information in keyslot integration test files
* luks_device: updated failing unit tests for keyslot support
* luks_device: improve detection of luks version
* luks_device: Update documentation on keyslot parameters, minor code improvements
* luks_device: improve validation of keyslot parameters, fix tests for systems that do not support luks2
* luks_device: correct spelling and errors in documentation and output, check all possible locations for LUKS2 header
Read and write work queue significantly degrades performance on
SSD/NVME devices[1].
In Debian 11 crypttab does not support no-read-workqueue and
no-write-workqueue flags, so the persistent flag is workaround: once
opened with perf parameters persists forever.
[1] https://blog.cloudflare.com/speeding-up-linux-disk-encryption/
Signed-off-by: Yauhen Artsiukhou <jsirex@gmail.com>
* Allow to configure PBKDF.
* Also add PBKDF options to key add operation.
* Simplify code.
* Update plugins/modules/luks_device.py
Co-authored-by: Andrew Klychkov <aaklychkov@mail.ru>
* Fix indent.
* Use more of the options.
* Bump iteration count.
* Increase memory limit.
* Fall back to default PBKDF.
* Apply suggestions from code review
Co-authored-by: Andrew Klychkov <aaklychkov@mail.ru>
Co-authored-by: Andrew Klychkov <aaklychkov@mail.ru>
ilia-kats
Felix Fontein
Steffen Gufler
0x00ace
Yauhen
Arnoways
Andrew Klychkov
Ansible Core Team