cdh: Expose headerPath parameter

This change exposes the headerPath parameter to the luks2 block
device encryption type. This way, users can supply the header path
explicitly in both cases where ephemeral and persistent storages are
being utilized. In case of persistent storages, the end user is
responsible for ensuring the header path cannot be tampered with, for
instance by sealing the header with a key backed by trustee.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>

Author: manuelh-dev

confidential-data-hub/hub/src/storage/volume_type/blockdevice/mod.rs

@@ -47,6 +47,18 @@ pub enum BlockDeviceEncryptType {
         /// Optional name for /dev/mapper/<name>
         #[serde(rename = "mapperName")]
         mapper_name: Option<String>,
+
+        /// Optional path to the LUKS header file (detached header).
+        /// When creating (source empty): use this path for the header file; if
+        /// not set, a path is generated and removed on umount.
+        /// When opening (source encrypted): use this path to open the device;
+        /// if not set, the header is read from the device.
+        #[serde(
+            default,
+            skip_serializing_if = "Option::is_none",
+            rename = "headerPath"
+        )]
+        header_path: Option<String>,
     },
 }
 
@@ -212,21 +224,29 @@ impl BlockDevice {
             BlockDeviceEncryptType::Luks2 {
                 data_integrity,
                 mapper_name,
+                header_path: user_header_path,
             } => {
                 let integrity = data_integrity.map_or(false, |e| e.parse().unwrap_or(false));
                 let formatter = Luks2Formatter::default().with_integrity(integrity);
                 // 3.1 if the source type is empty, encrypt the device and create detached header
                 let header_path = if parameters.source_type == SourceType::Empty {
                     warn!("encrypting the device. This will wipe original data on the disk.");
-                    let header_path = luks2::luks_header_path(&device_path);
-                    luks2::prepare_luks_header_file(&header_path)?;
-                    self.temp_paths.push(header_path.clone());
+                    let path = if user_header_path.is_none() {
+                        let path = luks2::luks_header_path(&device_path);
+                        // Remove header on umount when we generated it (not user-provided)
+                        self.temp_paths.push(path.clone());
+                        path
+                    } else {
+                        user_header_path.clone().unwrap()
+                    };
+                    luks2::prepare_luks_header_file(&path)?;
                     formatter
-                        .encrypt_device(&device_path, Some(&header_path), key.clone())
+                        .encrypt_device(&device_path, Some(&path), key.clone())
                         .map_err(|source| BlockDeviceError::Luks2Error { source })?;
-                    Some(header_path)
+                    Some(path)
                 } else {
-                    None
+                    // Re-opening: use user-provided header path, or None to read header from device
+                    user_header_path.clone()
                 };
 
                 let devmapper_name = mapper_name.unwrap_or_else(|| {
@@ -476,6 +496,15 @@ mod tests {
         let mut bd = BlockDevice::default();
         let device_path = temp_device_file.path().to_string_lossy().to_string();
 
+        // Header file cleaned up automatically when header_dir is dropped at
+        // the end of the test function.
+        let header_dir = tempfile::TempDir::new().unwrap();
+        let header_path = header_dir
+            .path()
+            .join("luks-header")
+            .to_string_lossy()
+            .to_string();
+
         let options = HashMap::from([
             ("sourceType".to_string(), "empty".to_string()),
             ("targetType".to_string(), "fileSystem".to_string()),
@@ -487,6 +516,7 @@ mod tests {
             ),
             ("dataIntegrity".to_string(), integrity.to_string()),
             ("filesystemType".to_string(), "ext4".to_string()),
+            ("headerPath".to_string(), header_path.clone()),
         ]);
 
         let tempdir = tempfile::TempDir::new().unwrap();
@@ -500,6 +530,36 @@ mod tests {
             .unwrap();
 
         bd.umount().await.unwrap();
+        drop(bd);
+
+        // Re-open the encrypted device using the same header path (create-then-open)
+        let tempdir2 = tempfile::TempDir::new().unwrap();
+        let mut bd2 = BlockDevice::default();
+        let options_open = HashMap::from([
+            ("sourceType".to_string(), "encrypted".to_string()),
+            ("targetType".to_string(), "fileSystem".to_string()),
+            ("devicePath".to_string(), device_path.clone()),
+            ("encryptionType".to_string(), "luks2".to_string()),
+            ("dataIntegrity".to_string(), integrity.to_string()),
+            (
+                "key".to_string(),
+                "file://./test_files/luks2-disk-passphrase".to_string(),
+            ),
+            ("filesystemType".to_string(), "ext4".to_string()),
+            ("headerPath".to_string(), header_path),
+        ]);
+
+        bd2.real_mount(&options_open, &[], tempdir2.path().to_str().unwrap())
+            .await
+            .unwrap();
+
+        assert!(tempdir2.path().join("test-file").exists());
+        let content = tokio::fs::read_to_string(tempdir2.path().join("test-file"))
+            .await
+            .unwrap();
+        assert_eq!(content, "some data");
+
+        bd2.umount().await.unwrap();
     }
 
     #[cfg(feature = "luks2")]