[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 05/11] crypto: strengthen the check for key slots overlapping wit
From: |
Daniel P . Berrangé |
Subject: |
[PATCH 05/11] crypto: strengthen the check for key slots overlapping with LUKS header |
Date: |
Tue, 6 Sep 2022 09:41:41 +0100 |
The LUKS header data on disk is a fixed size, however, there's expected
to be a gap between the end of the header and the first key slot to get
alignment with the 2nd sector on 4k drives. This wasn't originally part
of the LUKS spec, but was always part of the reference implementation,
so it is worth validating this.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
crypto/block-luks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index f22bc63e54..e6ee8506b2 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -602,7 +602,7 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS
*luks, Error **errp)
return -1;
}
- if (start1 < DIV_ROUND_UP(sizeof(QCryptoBlockLUKSHeader),
+ if (start1 < DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET,
QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) {
error_setg(errp,
"Keyslot %zu is overlapping with the LUKS header",
--
2.37.2
- [PATCH 00/11] crypto: improve robustness of LUKS metadata validation, Daniel P . Berrangé, 2022/09/06
- [PATCH 02/11] crypto: enforce that LUKS stripes is always a fixed value, Daniel P . Berrangé, 2022/09/06
- [PATCH 11/11] crypto: add test cases for many malformed LUKS header scenarios, Daniel P . Berrangé, 2022/09/06
- [PATCH 04/11] crypto: validate that LUKS payload doesn't overlap with header, Daniel P . Berrangé, 2022/09/06
- [PATCH 09/11] crypto: quote algorithm names in error messages, Daniel P . Berrangé, 2022/09/06
- [PATCH 05/11] crypto: strengthen the check for key slots overlapping with LUKS header,
Daniel P . Berrangé <=
- [PATCH 06/11] crypto: check that LUKS PBKDF2 iterations count is non-zero, Daniel P . Berrangé, 2022/09/06
- [PATCH 03/11] crypto: enforce that key material doesn't overlap with LUKS header, Daniel P . Berrangé, 2022/09/06
- [PATCH 10/11] crypto: ensure LUKS tests run with GNUTLS crypto provider, Daniel P . Berrangé, 2022/09/06
- [PATCH 01/11] crypto: sanity check that LUKS header strings are NUL-terminated, Daniel P . Berrangé, 2022/09/06
- [PATCH 07/11] crypto: split LUKS header definitions off into file, Daniel P . Berrangé, 2022/09/06
- [PATCH 08/11] crypto: split off helpers for converting LUKS header endianess, Daniel P . Berrangé, 2022/09/06
- Re: [PATCH 00/11] crypto: improve robustness of LUKS metadata validation, Richard W.M. Jones, 2022/09/06