cryptsetup: fix Argon2 with OpenWrt's OpenSSL, update to 2.8.8 - #30499
Merged
Conversation
OpenWrt builds OpenSSL with no-blake2, which OpenSSL's Configure turns into no-argon2 because Argon2 is built on BLAKE2b. The cryptsetup configure script only looks for the OSSL_KDF_PARAM_ARGON2_VERSION macro, which such a build still installs, so it drops the bundled Argon2 and EVP_KDF_fetch() fails at runtime. Every LUKS2 keyslot using Argon2 then fails instantly with "Keyslot open failed", and cryptsetup benchmark reports argon2id as N/A. Add a patch that also checks OPENSSL_NO_ARGON2 so the bundled implementation is used again. Fixes: fbac2e7 ("cryptsetup: update to 2.8.7") Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Stable bug-fix release. It avoids a TOCTOU issue in LUKS header restore by opening the header file only once, hardens BITLK metadata validation against crafted images, fixes an integer overflow in the anti-forensic data size calculation on 32-bit systems and a memory corruption in reencrypt init with more than 16 active LUKS2 keyslots or tokens, and adds keyed discards to integritysetup (--allow-discards-keyed, Linux 7.3 or later). Link: https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.8/docs/v2.8.8-ReleaseNotes Signed-off-by: Daniel Golle <daniel@makrotopia.org>
openwrt-ai
reviewed
Sep 10, 2026
| Argon2 fails to open. Check OPENSSL_NO_ARGON2 as well and fall back to | ||
| the internal Argon2 implementation. | ||
|
|
||
| Signed-off-by: Daniel Golle <daniel@makrotopia.org> |
Collaborator
There was a problem hiding this comment.
nit: no upstream reference in the patch, although the PR body says it is meant for upstream. Please add the cryptsetup MR link (or an Upstream-Status: line saying submission is pending) above the sign-off.
Generated by Claude Code
neheb
approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Package Details
Maintainer: @dangowrt
(You can find this by checking the history of the package
Makefile.)Description:
Since fbac2e7 cryptsetup is built with the OpenSSL crypto backend. OpenWrt's
libopensslis configured withno-blake2, which OpenSSL'sConfigurecascades intono-argon2because Argon2 is implemented on top of BLAKE2b, so the shipped library has no Argon2 KDF at all (openssl list -disabledshowsARGON2). cryptsetup's configure script detects OpenSSL Argon2 solely through theOSSL_KDF_PARAM_ARGON2_VERSIONmacro incore_names.h, which every OpenSSL 3.2+ build installs regardless of that option, so it drops its bundled Argon2 implementation. At runtimeEVP_KDF_fetch("argon2id")fails and every LUKS2 keyslot using Argon2 (the default) fails immediately withKeyslot open failed;cryptsetup benchmarkreportsargon2id N/A.The first commit adds a patch that makes the configure check (and its meson equivalent) also honour
OPENSSL_NO_ARGON2, so the bundled Argon2 implementation is used again with OpenWrt's OpenSSL. The patch is written to be submitted upstream; the detection is unchanged in cryptsetup 2.8.8 and in the upstreammainbranch.The second commit updates cryptsetup to 2.8.8, a stable bug-fix release (TOCTOU in header restore, BITLK metadata hardening, a 32-bit integer overflow in the anti-forensic size calculation, a memory corruption in reencrypt init, keyed discards for integritysetup). Release notes: https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.8/docs/v2.8.8-ReleaseNotes
🧪 Run Testing Details
Built with the matching mt7623 SDK. The fixed package was installed on the device and opened an existing LUKS2 argon2id volume on
/dev/md/pfusch:0that failed to open with the unpatched 2.8.7-r1 package;cryptsetup --debug benchmark --pbkdf argon2idnow reports the[cryptsetup libargon2]backend and a working argon2id benchmark instead ofN/A. The 2.8.8 build was additionally exercised under qemu-arm user emulation: argon2id and PBKDF2 benchmarks,luksFormat --type luks2 --pbkdf argon2idon a file image andopen --test-passphraseof that image.✅ Formalities
If your PR contains a patch:
git am(e.g., subject line, commit description, etc.)
We must try to upstream patches to reduce maintenance burden.