Backport upstream changes to disallow images with invalid CAPI cipher.

Backport the cipher check also to cryptsetup-reencrypt and add test for
it.

- Resolves: #2212772

.gitignore

@@ -1,2 +1,3 @@
 SOURCES/cryptsetup-2.3.7.tar.xz
 /cryptsetup-2.3.7.tar.xz
+/tests.tar.xz

cryptsetup-2.7.0-Fix-activation-of-LUKS2-with-capi-format-cipher-and-.patch

@@ -22,11 +22,11 @@ Fixes: #820
  5 files changed, 25 insertions(+), 2 deletions(-)
  create mode 100644 tests/luks2_invalid_cipher.img.xz
 
-diff --git a/lib/luks2/luks2_json_metadata.c b/lib/luks2/luks2_json_metadata.c
+Index: cryptsetup-2.3.7/lib/luks2/luks2_json_metadata.c
-index 2fcc8aa6..b1d0c05d 100644
+===================================================================
---- a/lib/luks2/luks2_json_metadata.c
+--- cryptsetup-2.3.7.orig/lib/luks2/luks2_json_metadata.c
-+++ b/lib/luks2/luks2_json_metadata.c
++++ cryptsetup-2.3.7/lib/luks2/luks2_json_metadata.c
-@@ -2605,6 +2605,11 @@ int LUKS2_activate(struct crypt_device *cd,
+@@ -2324,6 +2324,11 @@ int LUKS2_activate(struct crypt_device *
  	if ((r = LUKS2_unmet_requirements(cd, hdr, 0, 0)))
  		return r;
  
@@ -38,33 +38,19 @@ index 2fcc8aa6..b1d0c05d 100644
  	r = dm_crypt_target_set(&dmd.segment, 0, dmd.size, crypt_data_device(cd),
  			vk, crypt_get_cipher_spec(cd), crypt_get_iv_offset(cd),
  			crypt_get_data_offset(cd), crypt_get_integrity(cd) ?: "none",
-diff --git a/tests/Makefile.am b/tests/Makefile.am
+Index: cryptsetup-2.3.7/tests/compat-test2
-index c8a46a85..6feaef3b 100644
+===================================================================
---- a/tests/Makefile.am
+--- cryptsetup-2.3.7.orig/tests/compat-test2
-+++ b/tests/Makefile.am
++++ cryptsetup-2.3.7/tests/compat-test2
-@@ -68,6 +68,7 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
+@@ -3,6 +3,7 @@
- 	luks2_valid_hdr.img.xz \
+ PS4='$LINENO:'
- 	luks2_header_requirements.tar.xz \
+ [ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
- 	luks2_mda_images.tar.xz \
+ CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
-+	luks2_invalid_cipher.img.xz \
++CRYPTSETUP_REENCRYPT=$CRYPTSETUP_PATH/cryptsetup-reencrypt
- 	evil_hdr-payload_overwrite.xz \
- 	evil_hdr-stripes_payload_dmg.xz \
- 	evil_hdr-luks_hdr_damage.xz \
-@@ -110,7 +111,8 @@ EXTRA_DIST = compatimage.img.xz compatv10image.img.xz \
  
- CLEANFILES = cryptsetup-tst* valglog* *-fail-*.log test-symbols-list.h fake_token_path.so fake_systemd_tpm_path.so
+ CRYPTSETUP_VALGRIND=../.libs/cryptsetup
- clean-local:
+ CRYPTSETUP_LIB_VALGRIND=../.libs
--	-rm -rf tcrypt-images luks1-images luks2-images bitlk-images fvault2-images conversion_imgs luks2_valid_hdr.img blkid-luks2-pv-img blkid-luks2-pv-img.bcp external-tokens
+@@ -16,6 +17,7 @@ IMG10=luks-test-v10
-+	-rm -rf tcrypt-images luks1-images luks2-images bitlk-images fvault2-images conversion_imgs \
-+	luks2_valid_hdr.img blkid-luks2-pv-img blkid-luks2-pv-img.bcp external-tokens luks2_invalid_cipher.img
- 
- differ_SOURCES = differ.c
- differ_CFLAGS = $(AM_CFLAGS) -Wall -O2
-diff --git a/tests/compat-test2 b/tests/compat-test2
-index c54dc7ea..8b6bb073 100755
---- a/tests/compat-test2
-+++ b/tests/compat-test2
-@@ -16,6 +16,7 @@ IMG10=luks-test-v10
  HEADER_IMG=luks-header
  HEADER_KEYU=luks2_keyslot_unassigned.img
  HEADER_LUKS2_PV=blkid-luks2-pv.img
@@ -72,7 +58,7 @@ index c54dc7ea..8b6bb073 100755
  KEY1=key1
  KEY2=key2
  KEY5=key5
-@@ -50,7 +51,9 @@ function remove_mapping()
+@@ -50,7 +52,9 @@ function remove_mapping()
  	[ -b /dev/mapper/$DEV_NAME2 ] && dmsetup remove --retry $DEV_NAME2
  	[ -b /dev/mapper/$DEV_NAME ] && dmsetup remove --retry $DEV_NAME
  	losetup -d $LOOPDEV >/dev/null 2>&1
@@ -83,9 +69,9 @@ index c54dc7ea..8b6bb073 100755
  
  	# unlink whole test keyring
  	[ -n "$TEST_KEYRING" ] && keyctl unlink $TEST_KEYRING "@u" >/dev/null
-@@ -1200,5 +1203,17 @@ if [ $HAVE_KEYRING -gt 0 -a -d /proc/sys/kernel/keys ]; then
+@@ -1049,5 +1053,19 @@ for cipher in $CIPHERS ; do
- 	$CRYPTSETUP open -q --test-passphrase --token-only --token-id 0 -q $IMG || fail
+ done
- fi
+ echo
  
 +prepare "[44] LUKS2 invalid cipher (kernel cipher driver name)" wipe
 +xz -dk $HEADER_LUKS2_INV.xz
@@ -94,6 +80,8 @@ index c54dc7ea..8b6bb073 100755
 +echo $PWD1 | $CRYPTSETUP open $LOOPDEV --test-passphrase || fail
 +echo $PWD1 | $CRYPTSETUP open $LOOPDEV $DEV_NAME 2>&1 | grep -q "No known cipher specification pattern" || fail
 +echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV >/dev/null 2>&1 && fail
++echo $PWD1 | $CRYPTSETUP reencrypt $LOOPDEV 2>&1 | grep -q "No known cipher specification pattern" || fail
++echo $PWD1 | $CRYPTSETUP_REENCRYPT $LOOPDEV 2>&1 | grep -q "No known cipher specification pattern" || fail
 +dmsetup create $DEV_NAME --uuid CRYPT-LUKS2-3d20686f551748cb89911ad32379821b-test --table \
 +  "0 8 crypt capi:xts(ecb(aes-generic))-plain64 edaa40709797973715e572bf7d86fcbb9cfe2051083c33c28d58fe4e1e7ff642 0 $LOOPDEV 32768"
 +$CRYPTSETUP status $DEV_NAME | grep -q "n/a" || fail
@@ -101,18 +89,15 @@ index c54dc7ea..8b6bb073 100755
 +
  remove_mapping
  exit 0
-diff --git a/tests/meson.build b/tests/meson.build
+Index: cryptsetup-2.3.7/src/cryptsetup.h
-index 00f629f5..7bb3f406 100644
+===================================================================
---- a/tests/meson.build
+--- cryptsetup-2.3.7.orig/src/cryptsetup.h
-+++ b/tests/meson.build
++++ cryptsetup-2.3.7/src/cryptsetup.h
-@@ -21,6 +21,7 @@ test_files_to_copy = [
+@@ -103,6 +103,7 @@ void tools_clear_line(void);
-     'luks2_keyslot_unassigned.img.xz',
+ int tools_wipe_progress(uint64_t size, uint64_t offset, void *usrptr);
-     'luks2_mda_images.tar.xz',
+ int tools_reencrypt_progress(uint64_t size, uint64_t offset, void *usrptr);
-     'luks2_valid_hdr.img.xz',
+ int reencrypt_is_header_detached(const char *header_device, const char *data_device);
-+    'luks2_invalid_cipher.img.xz',
++bool luks2_reencrypt_eligible(struct crypt_device *cd);
-     'tcrypt-images.tar.xz',
+ 
-     'valid_header_file.xz',
+ int tools_read_mk(const char *file, char **key, int keysize);
-     'xfs_512_block_size.img.xz',
+ int tools_write_mk(const char *file, const char *key, int keysize);
--- 
-2.40.1
-

cryptsetup-2.7.0-Fix-reencryption-to-fail-properly-for-unknown-cipher.patch

@@ -9,23 +9,73 @@ check it in advance.
  src/utils_reencrypt.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
-diff --git a/src/utils_reencrypt.c b/src/utils_reencrypt.c
+Index: cryptsetup-2.3.7/src/cryptsetup.c
-index a78557cb..8ffceb36 100644
+===================================================================
---- a/src/utils_reencrypt.c
+--- cryptsetup-2.3.7.orig/src/cryptsetup.c
-+++ b/src/utils_reencrypt.c
++++ cryptsetup-2.3.7/src/cryptsetup.c
-@@ -419,6 +419,12 @@ static bool luks2_reencrypt_eligible(struct crypt_device *cd)
+@@ -2999,6 +2999,12 @@ static int action_encrypt_luks2(struct c
- 		return false;
+ 	if (r < 0)
- 	}
+ 		goto err;
  
-+	/* Check that cipher is in compatible format */
++	if (!crypt_get_cipher(*cd)) {
-+	if (!crypt_get_cipher(cd)) {
 +		log_err(_("No known cipher specification pattern detected in LUKS2 header."));
-+		return false;
++		r = -EINVAL;
++		goto err;
 +	}
 +
- 	return true;
+ 	if (opt_data_shift) {
- }
+ 		params.data_shift = imaxabs(opt_data_shift) / SECTOR_SIZE,
+ 		params.resilience = "datashift";
+@@ -3068,6 +3074,11 @@ static int action_decrypt_luks2(struct c
+ 	};
+ 	size_t passwordLen;
  
--- 
++	if (!crypt_get_cipher(cd)) {
-2.40.1
++		log_err(_("No known cipher specification pattern detected in LUKS2 header."));
-
++		return -EINVAL;
++	}
++
+ 	if (!crypt_get_metadata_device_name(cd) || !crypt_get_device_name(cd) ||
+ 	    !strcmp(crypt_get_metadata_device_name(cd), crypt_get_device_name(cd))) {
+ 		log_err(_("LUKS2 decryption is supported with detached header device only."));
+@@ -3289,6 +3300,11 @@ static int action_reencrypt_luks2(struct
+ 		.luks2 = &luks2_params,
+ 	};
+ 
++	if (!crypt_get_cipher(cd)) {
++		log_err(_("No known cipher specification pattern detected in LUKS2 header."));
++		return -EINVAL;
++	}
++
+ 	_set_reencryption_flags(&params.flags);
+ 
+ 	if (!opt_cipher && crypt_is_cipher_null(crypt_get_cipher(cd))) {
+Index: cryptsetup-2.3.7/src/cryptsetup_reencrypt.c
+===================================================================
+--- cryptsetup-2.3.7.orig/src/cryptsetup_reencrypt.c
++++ cryptsetup-2.3.7/src/cryptsetup_reencrypt.c
+@@ -185,6 +185,11 @@ static int set_reencrypt_requirement(con
+ 	    crypt_persistent_flags_get(cd, CRYPT_FLAGS_REQUIREMENTS, &reqs))
+ 		goto out;
+ 
++	if (!crypt_get_cipher(cd)) {
++		log_err(_("No known cipher specification pattern detected in LUKS2 header."));
++		goto out;
++	}
++
+ 	/* reencrypt already in-progress */
+ 	if (reqs & CRYPT_REQUIREMENT_OFFLINE_REENCRYPT) {
+ 		log_err(_("Reencryption already in-progress."));
+@@ -709,6 +714,12 @@ static int backup_luks_headers(struct re
+ 	    (r = crypt_load(cd, CRYPT_LUKS, NULL)))
+ 		goto out;
+ 
++	if (!crypt_get_cipher(cd)) {
++		log_err(_("No known cipher specification pattern detected in LUKS2 header."));
++		r = -EINVAL;
++		goto out;
++	}
++
+ 	if ((r = crypt_header_backup(cd, CRYPT_LUKS, rc->header_file_org)))
+ 		goto out;
+ 	if (isLUKS2(rc->type)) {

cryptsetup.spec

@@ -5,7 +5,7 @@ Obsoletes: cryptsetup-python3
 Summary: A utility for setting up encrypted disks
 Name: cryptsetup
 Version: 2.3.7
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: GPLv2+ and LGPLv2+
 Group: Applications/System
 URL: https://gitlab.com/cryptsetup/cryptsetup
@@ -19,6 +19,9 @@ Requires: libpwquality >= 1.2.0
 
 %global upstream_version %{version}
 Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{upstream_version}.tar.xz
+# binary archive with updated tests/conversion_imgs.tar.xz and tests/luks2_header_requirements.tar.xz
+# for testing (can not be patched via rpmbuild)
+Source1: tests.tar.xz
 # Following patch has to applied last
 Patch0:  %{name}-add-system-library-paths.patch
 # Remove the patch when (if ever) osci infrastructure gets stable enough
@@ -39,6 +42,8 @@ Patch14: %{name}-2.6.1-Abort-encryption-when-header-and-data-devices-are-sa.patc
 Patch15: %{name}-2.7.0-Disallow-use-of-internal-kenrel-crypto-driver-names-.patch
 Patch16: %{name}-2.7.0-Also-disallow-active-devices-with-internal-kernel-na.patch
 Patch17: %{name}-2.7.0-Fix-init_by_name-to-allow-unknown-cipher-format-in-d.patch
+Patch18: %{name}-2.7.0-Fix-reencryption-to-fail-properly-for-unknown-cipher.patch
+Patch19: %{name}-2.7.0-Fix-activation-of-LUKS2-with-capi-format-cipher-and-.patch
 
 %description
 The cryptsetup package contains a utility for setting up
@@ -93,7 +98,7 @@ This package contains cryptsetup-reencrypt utility which
 can be used for offline reencryption of disk in situ.
 
 %prep
-%setup -q -n cryptsetup-%{upstream_version}
+%setup -q -n cryptsetup-%{upstream_version} -a 1
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
@@ -111,6 +116,8 @@ can be used for offline reencryption of disk in situ.
 %patch15 -p1
 %patch16 -p1
 %patch17 -p1
+%patch18 -p1
+%patch19 -p1
 %patch0 -p1
 chmod -x misc/dracut_90reencrypt/*
 
@@ -170,11 +177,13 @@ rm -rf %{buildroot}/%{_libdir}/*.la
 %clean
 
 %changelog
-* Thu Jun 22 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
+* Thu Jun 28 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
 - patch: Delegate FIPS mode detection to configured crypto backend
 - patch: Disallow use of internal kenrel crypto driver names in "capi"
 - patch: Also disallow active devices with internal kernel names
 - patch: Fix init_by_name to allow unknown cipher format in dm-crypt
+- patch: Fix reencryption to fail properly for unknown cipher
+- patch: Fix activation of LUKS2 with capi format cipher and kernel
 - Resolves: #2212772 #2193342
 
 * Tue Jan 10 2023 Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-5

sources

@@ -1 +1,2 @@
 SHA512 (cryptsetup-2.3.7.tar.xz) = d209225c6f195f54c513904b71637bdadd47f3efc6227c61c15434a1467ddb76fe14123683a3d5e943ffa203ef33611f51b7c67bc1aed67d019a6aa552ea15ab
+SHA512 (tests.tar.xz) = 3154668ad4e481bf4e98afade202fc302fb72c595eea1bd374de7570ab15a2a9888743db491b812c4ba6006371adaaa0452315027e4ce2a6e6922cc640f47cf0