feedback confidential-containers#1 (to squash)

Author: manuelh-dev

confidential-data-hub/hub/src/storage/drivers/luks2.rs

@@ -10,10 +10,7 @@
 //!
 //! It requires to install dependency `libcryptsetup-dev` for ubuntu.
 
-use std::{
-    fs::{self, OpenOptions},
-    path::Path,
-};
+use std::path::Path;
 
 use anyhow::{bail, Context};
 use libcryptsetup_rs::consts::flags::{CryptActivate, CryptDeactivate, CryptVolumeKey};
@@ -32,7 +29,6 @@ const LUKS2_VOLUME_KEY_SIZE_BIT_WITH_INTEGRITY: usize = 768;
 const LUKS2_VOLUME_KEY_SIZE_BIT_WITHOUT_INTEGRITY: usize = 256;
 
 const SECTOR_SIZE: u32 = 4096;
-const LUKS2_HEADER_MIN_SIZE_BYTES: u64 = 16 * 1024 * 1024;
 
 #[derive(Default)]
 pub struct Luks2Formatter {
@@ -51,7 +47,7 @@ impl Luks2Formatter {
         header_path: Option<&str>,
         passphrase: Zeroizing<Vec<u8>>,
     ) -> anyhow::Result<()> {
-        let mut device = init_device(device_path, header_path, true)?;
+        let mut device = init_device(device_path, header_path)?;
         let mut volume_key_length = LUKS2_VOLUME_KEY_SIZE_BIT_WITHOUT_INTEGRITY / 8;
         let mut params = CryptParamsLuks2 {
             pbkdf: None,
@@ -90,7 +86,7 @@ impl Luks2Formatter {
         name: &str,
         passphrase: Zeroizing<Vec<u8>>,
     ) -> anyhow::Result<()> {
-        let mut device = init_device(device_path, header_path, false)?;
+        let mut device = init_device(device_path, header_path)?;
 
         let mut params = CryptParamsLuks2 {
             pbkdf: None,
@@ -137,15 +133,12 @@ impl Luks2Formatter {
 fn init_device(
     device_path: &str,
     header_path: Option<&str>,
-    create_header: bool,
 ) -> anyhow::Result<libcryptsetup_rs::CryptDevice> {
     let data_path = Path::new(device_path);
     let device_paths = match header_path {
         Some(header_path) => {
             let header_path = Path::new(header_path);
-            if create_header {
-                ensure_header_file(header_path)?;
-            } else if !header_path.exists() {
+            if !header_path.exists() {
                 bail!(
                     "LUKS header file not found: {}",
                     header_path.display()
@@ -159,54 +152,28 @@ fn init_device(
     Ok(CryptInit::init_with_data_device(device_paths)?)
 }
 
-fn ensure_header_file(header_path: &Path) -> anyhow::Result<()> {
-    if header_path.exists() {
-        let size = fs::metadata(header_path)
-            .with_context(|| format!("Failed to read header file {}", header_path.display()))?
-            .len();
-        if size < LUKS2_HEADER_MIN_SIZE_BYTES {
-            bail!(
-                "LUKS header file too small: {} ({} bytes, need at least {} bytes)",
-                header_path.display(),
-                size,
-                LUKS2_HEADER_MIN_SIZE_BYTES
-            );
-        }
-        return Ok(());
-    }
-
-    if let Some(parent) = header_path.parent() {
-        std::fs::create_dir_all(parent)
-            .with_context(|| format!("Failed to create header directory {}", parent.display()))?;
-    }
-
-    let file = OpenOptions::new()
-        .create(true)
-        .write(true)
-        .open(header_path)
-        .with_context(|| format!("Failed to create header file {}", header_path.display()))?;
-    file.set_len(LUKS2_HEADER_MIN_SIZE_BYTES).with_context(|| {
-        format!(
-            "Failed to size header file {} to {} bytes",
-            header_path.display(),
-            LUKS2_HEADER_MIN_SIZE_BYTES
-        )
-    })?;
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
-    use std::io::Write;
+    use std::{fs::OpenOptions, io::Write, path::Path};
 
     use serial_test::serial;
     use zeroize::Zeroizing;
 
     use crate::storage::drivers::luks2::Luks2Formatter;
 
+    const HEADER_SIZE_BYTES: u64 = 16 * 1024 * 1024;
     const TEST_PASSPHRASE: &[u8] = b"test";
     const NAME: &str = "test";
 
+    fn create_header_file(path: &Path) {
+        let file = OpenOptions::new()
+            .create(true)
+            .write(true)
+            .open(path)
+            .unwrap();
+        file.set_len(HEADER_SIZE_BYTES).unwrap();
+    }
+
     #[test]
     #[serial]
     fn encrypt_open_device_no_integrity() {
@@ -261,6 +228,7 @@ mod tests {
         let mut bin_file = tempfile::NamedTempFile::new().unwrap();
         let header_dir = tempfile::tempdir().unwrap();
         let header_path = header_dir.path().join("luks-header");
+        create_header_file(&header_path);
 
         bin_file
             .as_file_mut()
@@ -288,6 +256,7 @@ mod tests {
         let mut bin_file = tempfile::NamedTempFile::new().unwrap();
         let header_dir = tempfile::tempdir().unwrap();
         let header_path = header_dir.path().join("luks-header");
+        create_header_file(&header_path);
 
         bin_file
             .as_file_mut()
@@ -315,7 +284,7 @@ mod tests {
         let mut bin_file = tempfile::NamedTempFile::new().unwrap();
         let header_dir = tempfile::tempdir().unwrap();
         let header_path = header_dir.path().join("luks-header");
-        std::fs::write(&header_path, b"").unwrap();
+        create_header_file(&header_path);
 
         bin_file
             .as_file_mut()
@@ -337,6 +306,7 @@ mod tests {
         let mut bin_file = tempfile::NamedTempFile::new().unwrap();
         let header_dir = tempfile::tempdir().unwrap();
         let header_path = header_dir.path().join("luks-header");
+        create_header_file(&header_path);
 
         bin_file
             .as_file_mut()

confidential-data-hub/hub/src/storage/volume_type/blockdevice/error.rs

@@ -29,6 +29,9 @@ pub enum BlockDeviceError {
     #[error("The scheme of the key uri should be `kbs`, `file` or `sealed`")]
     IllegalKeyScheme,
 
+    #[error("Providing a key is not supported when formatting empty LUKS2 devices with detached headers")]
+    KeyNotAllowedForEphemeralLuksHeader,
+
     #[error("Failed to get key: {source}")]
     GetKeyFailed {
         #[source]