Allow to verify keys in geli.

[oshogbo]

Summary

Introduce dry run options in geli attach.
This will allow us to verify if passphrase and key is valid without need to decrypt whole device.
This can be useful for example when we changed key and we wan't to verify it.
The device for this can be mounted or not.

Next step will be to introduce an optional flag to say which slot to use.
This can be useful to verify as well as in normal decryption.

[cem]

sbin/geom/class/eli/geli.8

427–428 ↗

(On Diff #41226)

What is the problem with -r -n?

-r just modifies attach to be readonly, and -n uses the device read-only. Right?

Even -d is just a modifier for attach, and dry run overrides. I don't really see a need to enforce exclusive use of these options.

sys/geom/eli/g_eli_ctl.c

96 ↗

(On Diff #41226)

Probably this should be if (*dryrun && (*detach || *readonly)) if we actually want to enforce the constraint.

Maybe an if (*detach && *readonly) check is needed too. But as-is is wrong.

[allanjude]

sbin/geom/class/eli/geli.8

425 ↗

(On Diff #41226)

without decrypting *the* device

427–428 ↗

(On Diff #41226)

If we are going to keep this, it should probably say *or* instead of and

[oshogbo]

Thanks @cem and @allanjude

sbin/geom/class/eli/geli.8

427–428 ↗

(On Diff #41226)

Yea I was unsure about that but because it's just dry-run we should allow any flags.

[allanjude]

Thanks for working on this