Skip to content

Commit bdc6c37

Browse files
manuelh-devmanuelh-dev
committed
feedback confidential-containers#1 (to squash)
1 parent 78da546 commit bdc6c37

5 files changed

Lines changed: 140 additions & 124 deletions

File tree

‎confidential-data-hub/hub/src/auth/kbs.rs‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,8 @@ use kms::{plugins::kbs::KbcClient, Annotations, Getter};
1212
use log::debug;
1313
use tokio::fs;
1414

15-
use crate::{hub::Hub, Error, Result};
15+
use crate::{config::KBS_RESOURCE_STORAGE_DIR, hub::Hub, Error, Result};
1616

17-
/// This directory is used to store all the kbs resources get by CDH's init
18-
/// function, s.t. `[[Credential]]` sections in the config.toml file.
19-
pub const KBS_RESOURCE_STORAGE_DIR: &str = "/run/confidential-containers/cdh";
2017

2118
impl Hub {
2219
pub(crate) async fn init_kbs_resources(&self) -> Result<()> {

‎confidential-data-hub/hub/src/config.rs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ cfg_if::cfg_if! {
2020
}
2121
}
2222

23+
/// This directory is used to store all the kbs resources get by CDH's init
24+
/// function, s.t. `[[Credential]]` sections in the config.toml file.
25+
pub const KBS_RESOURCE_STORAGE_DIR: &str = "/run/confidential-containers/cdh";
26+
2327
const CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS: &str =
2428
"CDH_DEFAULT_IMAGE_AUTHENTICATED_REGISTRY_CREDENTIALS";
2529

‎confidential-data-hub/hub/src/storage/drivers/luks2.rs‎

Lines changed: 21 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,7 @@
1010
//!
1111
//! It requires to install dependency `libcryptsetup-dev` for ubuntu.
1212
13-
use std::{
14-
fs::{self, OpenOptions},
15-
path::Path,
16-
};
13+
use std::path::Path;
1714

1815
use anyhow::{bail, Context};
1916
use libcryptsetup_rs::consts::flags::{CryptActivate, CryptDeactivate, CryptVolumeKey};
@@ -32,7 +29,6 @@ const LUKS2_VOLUME_KEY_SIZE_BIT_WITH_INTEGRITY: usize = 768;
3229
const LUKS2_VOLUME_KEY_SIZE_BIT_WITHOUT_INTEGRITY: usize = 256;
3330

3431
const SECTOR_SIZE: u32 = 4096;
35-
const LUKS2_HEADER_MIN_SIZE_BYTES: u64 = 16 * 1024 * 1024;
3632

3733
#[derive(Default)]
3834
pub struct Luks2Formatter {
@@ -51,7 +47,7 @@ impl Luks2Formatter {
5147
header_path: Option<&str>,
5248
passphrase: Zeroizing<Vec<u8>>,
5349
) -> anyhow::Result<()> {
54-
let mut device = init_device(device_path, header_path, true)?;
50+
let mut device = init_device(device_path, header_path)?;
5551
let mut volume_key_length = LUKS2_VOLUME_KEY_SIZE_BIT_WITHOUT_INTEGRITY / 8;
5652
let mut params = CryptParamsLuks2 {
5753
pbkdf: None,
@@ -90,7 +86,7 @@ impl Luks2Formatter {
9086
name: &str,
9187
passphrase: Zeroizing<Vec<u8>>,
9288
) -> anyhow::Result<()> {
93-
let mut device = init_device(device_path, header_path, false)?;
89+
let mut device = init_device(device_path, header_path)?;
9490

9591
let mut params = CryptParamsLuks2 {
9692
pbkdf: None,
@@ -137,15 +133,12 @@ impl Luks2Formatter {
137133
fn init_device(
138134
device_path: &str,
139135
header_path: Option<&str>,
140-
create_header: bool,
141136
) -> anyhow::Result<libcryptsetup_rs::CryptDevice> {
142137
let data_path = Path::new(device_path);
143138
let device_paths = match header_path {
144139
Some(header_path) => {
145140
let header_path = Path::new(header_path);
146-
if create_header {
147-
ensure_header_file(header_path)?;
148-
} else if !header_path.exists() {
141+
if !header_path.exists() {
149142
bail!(
150143
"LUKS header file not found: {}",
151144
header_path.display()
@@ -159,49 +152,14 @@ fn init_device(
159152
Ok(CryptInit::init_with_data_device(device_paths)?)
160153
}
161154

162-
fn ensure_header_file(header_path: &Path) -> anyhow::Result<()> {
163-
if header_path.exists() {
164-
let size = fs::metadata(header_path)
165-
.with_context(|| format!("Failed to read header file {}", header_path.display()))?
166-
.len();
167-
if size < LUKS2_HEADER_MIN_SIZE_BYTES {
168-
bail!(
169-
"LUKS header file too small: {} ({} bytes, need at least {} bytes)",
170-
header_path.display(),
171-
size,
172-
LUKS2_HEADER_MIN_SIZE_BYTES
173-
);
174-
}
175-
return Ok(());
176-
}
177-
178-
if let Some(parent) = header_path.parent() {
179-
std::fs::create_dir_all(parent)
180-
.with_context(|| format!("Failed to create header directory {}", parent.display()))?;
181-
}
182-
183-
let file = OpenOptions::new()
184-
.create(true)
185-
.write(true)
186-
.open(header_path)
187-
.with_context(|| format!("Failed to create header file {}", header_path.display()))?;
188-
file.set_len(LUKS2_HEADER_MIN_SIZE_BYTES).with_context(|| {
189-
format!(
190-
"Failed to size header file {} to {} bytes",
191-
header_path.display(),
192-
LUKS2_HEADER_MIN_SIZE_BYTES
193-
)
194-
})?;
195-
Ok(())
196-
}
197-
198155
#[cfg(test)]
199156
mod tests {
200157
use std::io::Write;
201158

202159
use serial_test::serial;
203160
use zeroize::Zeroizing;
204161

162+
use crate::storage::volume_type::blockdevice::prepare_luks_header_file;
205163
use crate::storage::drivers::luks2::Luks2Formatter;
206164

207165
const TEST_PASSPHRASE: &[u8] = b"test";
@@ -259,101 +217,90 @@ mod tests {
259217
#[serial]
260218
fn encrypt_open_device_no_integrity_with_header() {
261219
let mut bin_file = tempfile::NamedTempFile::new().unwrap();
262-
let header_dir = tempfile::tempdir().unwrap();
263-
let header_path = header_dir.path().join("luks-header");
264-
265220
bin_file
266221
.as_file_mut()
267222
.write_all(&vec![0; 20 * 1024 * 1024])
268223
.unwrap();
269224
let path = bin_file.path().to_str().unwrap();
270-
let header_path = header_path.to_str().unwrap();
225+
let header_path = prepare_luks_header_file(None, path).unwrap();
271226

272227
let passphrase = Zeroizing::new(TEST_PASSPHRASE.to_vec());
273228
let luks2_formatter = Luks2Formatter { integrity: false };
274229
luks2_formatter
275-
.encrypt_device(path, Some(header_path), passphrase.clone())
230+
.encrypt_device(path, Some(&header_path), passphrase.clone())
276231
.unwrap();
277232

278233
luks2_formatter
279-
.open_device(path, Some(header_path), NAME, passphrase)
234+
.open_device(path, Some(&header_path), NAME, passphrase)
280235
.unwrap();
281236

282237
luks2_formatter.close_device(NAME).unwrap();
238+
std::fs::remove_file(&header_path).unwrap();
283239
}
284240

285241
#[test]
286242
#[serial]
287243
fn encrypt_open_device_integrity_with_header() {
288244
let mut bin_file = tempfile::NamedTempFile::new().unwrap();
289-
let header_dir = tempfile::tempdir().unwrap();
290-
let header_path = header_dir.path().join("luks-header");
291-
292245
bin_file
293246
.as_file_mut()
294247
.write_all(&vec![0; 20 * 1024 * 1024])
295248
.unwrap();
296249
let path = bin_file.path().to_str().unwrap();
297-
let header_path = header_path.to_str().unwrap();
250+
let header_path = prepare_luks_header_file(None, path).unwrap();
298251

299252
let passphrase = Zeroizing::new(TEST_PASSPHRASE.to_vec());
300253
let luks2_formatter = Luks2Formatter { integrity: true };
301254
luks2_formatter
302-
.encrypt_device(path, Some(header_path), passphrase.clone())
255+
.encrypt_device(path, Some(&header_path), passphrase.clone())
303256
.unwrap();
304257

305258
luks2_formatter
306-
.open_device(path, Some(header_path), NAME, passphrase)
259+
.open_device(path, Some(&header_path), NAME, passphrase)
307260
.unwrap();
308261

309262
luks2_formatter.close_device(NAME).unwrap();
263+
std::fs::remove_file(&header_path).unwrap();
310264
}
311265

312266
#[test]
313267
#[serial]
314268
fn encrypt_with_existing_header_file() {
315269
let mut bin_file = tempfile::NamedTempFile::new().unwrap();
316-
let header_dir = tempfile::tempdir().unwrap();
317-
let header_path = header_dir.path().join("luks-header");
318-
std::fs::write(&header_path, b"").unwrap();
319-
320270
bin_file
321271
.as_file_mut()
322272
.write_all(&vec![0; 20 * 1024 * 1024])
323273
.unwrap();
324274
let path = bin_file.path().to_str().unwrap();
325-
let header_path = header_path.to_str().unwrap();
275+
let header_path = prepare_luks_header_file(None, path).unwrap();
326276

327277
let passphrase = Zeroizing::new(TEST_PASSPHRASE.to_vec());
328278
let luks2_formatter = Luks2Formatter { integrity: false };
329-
luks2_formatter
330-
.encrypt_device(path, Some(header_path), passphrase)
331-
.unwrap();
279+
let result = luks2_formatter.encrypt_device(path, Some(&header_path), passphrase);
280+
assert!(result.is_ok());
281+
std::fs::remove_file(&header_path).unwrap();
332282
}
333283

334284
#[test]
335285
#[serial]
336286
fn open_device_missing_header_file_fails() {
337287
let mut bin_file = tempfile::NamedTempFile::new().unwrap();
338-
let header_dir = tempfile::tempdir().unwrap();
339-
let header_path = header_dir.path().join("luks-header");
340-
341288
bin_file
342289
.as_file_mut()
343290
.write_all(&vec![0; 20 * 1024 * 1024])
344291
.unwrap();
345292
let path = bin_file.path().to_str().unwrap();
346-
let header_path = header_path.to_str().unwrap();
293+
let header_path = prepare_luks_header_file(None, path).unwrap();
347294

348295
let passphrase = Zeroizing::new(TEST_PASSPHRASE.to_vec());
349296
let luks2_formatter = Luks2Formatter { integrity: false };
350297
luks2_formatter
351-
.encrypt_device(path, Some(header_path), passphrase.clone())
298+
.encrypt_device(path, Some(&header_path), passphrase.clone())
352299
.unwrap();
353300

354-
std::fs::remove_file(header_path).unwrap();
301+
std::fs::remove_file(&header_path).unwrap();
355302

356-
let result = luks2_formatter.open_device(path, Some(header_path), NAME, passphrase);
303+
let result = luks2_formatter.open_device(path, Some(&header_path), NAME, passphrase);
357304
assert!(result.is_err());
358305
}
359306

‎confidential-data-hub/hub/src/storage/volume_type/blockdevice/error.rs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ pub enum BlockDeviceError {
2929
#[error("The scheme of the key uri should be `kbs`, `file` or `sealed`")]
3030
IllegalKeyScheme,
3131

32+
#[error("Providing a key is not supported when formatting empty LUKS2 devices with detached headers")]
33+
KeyNotAllowedForEphemeralLuksHeader,
34+
3235
#[error("Failed to get key: {source}")]
3336
GetKeyFailed {
3437
#[source]

0 commit comments

Comments
 (0)