Make sure that the sym_xyz function pointers have the types that the functions we'll assign them have. And of course, this found a number of incompatibilities right-away, in particular in the bpf hookup. (Doing this will trigger deprecation warnings from libbpf. I simply turned them off locally now, since we are well aware of what we are doing in that regard.) There's one return type fix (bool → int), that actually matters I think, as it might have created an incompatibility on some archs.
Offline encryption can be done without mounting the luks device. For now we still use loop devices to split out the partition we want to write to but in a later commit we'll replace this with a regular file. For offline encryption, we need to keep 2x the luks header size space free at the end of the partition, so this means our encrypted partitions will be 16M larger than before.
This splits out the JSON parser used by the systemd-cryptsetup code. This is preparation for later work to reuse it in the tpm2 cryptsetup token module, which currently uses a separate but very similar parser for the same data. No change in behaviour.
We warn when the operation fails, not when it succeeds. Hence this should be "<do>_or_<handle failure>", not "<do>_and_<handle failure>". We *could* use whatever convention we want, but rust and perl are rather consistent in using the logical convention. We don't care about perl that much, but having a naming convention inverted wrt. rust would be rather confusing. Also, pretty much every implementation does similar steps, so add a nice wrapper which combines opening of the library and loading of the symbols. Also add missing sentinel attribute in dlopen_or_warn().
homed: catch up with FIDO2 features in cryptsetup + other fixes
No need to benchmark pbkdf when asking for minimal values anyway. 1000 iterations count is minimum for both LUKS1 and LUKS2 pbkdf2 keyslot parameters according to NIST SP 800-132, ch. 5.2. Iterations count can not be lower than recommended minimum when benchmark is disabled. The time_ms member is ignored with benchmark disabled.