Add test option for clevis luks unlock (#296)

* Add test option for clevis luks unlock

Author: jbaublitz

src/luks/clevis-luks-unlock

@@ -24,14 +24,17 @@ SUMMARY="Unlocks a LUKS volume"
 function usage() {
     exec >&2
     echo
-    echo "Usage: clevis luks unlock -d DEV [-n NAME]"
+    echo "Usage: clevis luks unlock -d DEV [-n NAME] [-t SLT]"
     echo
     echo "$SUMMARY":
     echo
     echo "  -d DEV  The LUKS device on which to perform unlocking"
     echo
     echo "  -n NAME The name of the unlocked device node"
     echo
+    echo "  -t SLT Test the passphrase for the given slot without unlocking"
+    echo "         the device"
+    echo
     exit 2
 }
 
@@ -40,10 +43,11 @@ if [ $# -eq 1 ] && [ "$1" == "--summary" ]; then
     exit 0
 fi
 
-while getopts ":d:n:" o; do
+while getopts ":d:n:t:" o; do
     case "$o" in
     d) DEV="$OPTARG";;
     n) NAME="$OPTARG";;
+    t) SLT="$OPTARG";;
     *) usage;;
     esac
 done
@@ -60,9 +64,16 @@ fi
 
 NAME="${NAME:-luks-"$(cryptsetup luksUUID "$DEV")"}"
 
-if ! pt=$(clevis_luks_unlock_device "${DEV}"); then
-    echo "${DEV} could not be opened." >&2
-    exit 1
-fi
+if [ -n "$SLT" ]; then
+    if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}" >/dev/null; then
+        echo "Test for token slot ${SLT} on device ${DEV} failed." >&2
+        exit 1
+    fi
+else
+    if ! pt=$(clevis_luks_unlock_device "${DEV}"); then
+        echo "${DEV} could not be opened." >&2
+        exit 1
+    fi
 
-echo -n "${pt}" | cryptsetup open -d- "${DEV}" "${NAME}"
+    echo -n "${pt}" | cryptsetup open -d- "${DEV}" "${NAME}"
+fi

src/luks/clevis-luks-unlock.1.adoc

@@ -9,7 +9,7 @@ clevis-luks-unlock - Unlocks a LUKS device bound with a Clevis policy
 
 == SYNOPSIS
 
-*clevis luks unlock* -d DEV [-n NAME]
+*clevis luks unlock* -d DEV [-n NAME] [-t SLT]
 
 == OVERVIEW
 
@@ -26,6 +26,9 @@ provisioned Clevis policy. For example:
 * *-n* _NAME_ :
   The name to give the unlocked device node
 
+* *-t* _SLT_ :
+  Test the passphrase for the given slot without unlocking the device
+
 == SEE ALSO
 
 link:clevis-luks-bind.1.adoc[*clevis-luks-bind*(1)]