From b82eaf14f7a01cfd542cb95fe97b8d3a22d5ba8f Mon Sep 17 00:00:00 2001
From: Ondrej Kozina <okozina@redhat.com>
Date: Thu, 28 Jun 2018 15:48:13 +0200
Subject: [PATCH 3/6] Allow LUKS2 repair to override blkid checks.

Allow user to run cryptsetup repair command and explicitly do
repair on corrupted LUKS2 headers where blkid decides it's no longer
a LUKS2 device.
---
 lib/luks2/luks2.h               |  2 +-
 lib/luks2/luks2_json_metadata.c | 13 +++++++------
 lib/setup.c                     | 10 +++++-----
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/luks2/luks2.h b/lib/luks2/luks2.h
index ee57b41..c431e8f 100644
--- a/lib/luks2/luks2.h
+++ b/lib/luks2/luks2.h
@@ -131,7 +131,7 @@ struct luks2_keyslot_params {
 int LUKS2_hdr_version_unlocked(struct crypt_device *cd,
 	const char *backup_file);
 
-int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr);
+int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, int repair);
 int LUKS2_hdr_write(struct crypt_device *cd, struct luks2_hdr *hdr);
 int LUKS2_hdr_dump(struct crypt_device *cd, struct luks2_hdr *hdr);
 
diff --git a/lib/luks2/luks2_json_metadata.c b/lib/luks2/luks2_json_metadata.c
index 125cad9..0fd6340 100644
--- a/lib/luks2/luks2_json_metadata.c
+++ b/lib/luks2/luks2_json_metadata.c
@@ -842,7 +842,8 @@ int LUKS2_hdr_validate(json_object *hdr_jobj)
 	return 0;
 }
 
-int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr)
+/* FIXME: should we expose do_recovery parameter explicitly? */
+int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr, int repair)
 {
 	int r;
 
@@ -853,7 +854,7 @@ int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr)
 		return r;
 	}
 
-	r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, 1);
+	r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, !repair);
 	if (r == -EAGAIN) {
 		/* unlikely: auto-recovery is required and failed due to read lock being held */
 		device_read_unlock(crypt_metadata_device(cd));
@@ -865,7 +866,7 @@ int LUKS2_hdr_read(struct crypt_device *cd, struct luks2_hdr *hdr)
 			return r;
 		}
 
-		r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, 1);
+		r = LUKS2_disk_hdr_read(cd, hdr, crypt_metadata_device(cd), 1, !repair);
 
 		device_write_unlock(crypt_metadata_device(cd));
 	} else
@@ -1050,7 +1051,7 @@ int LUKS2_hdr_restore(struct crypt_device *cd, struct luks2_hdr *hdr,
 		return r;
 	}
 
-	r = LUKS2_disk_hdr_read(cd, &hdr_file, backup_device, 0);
+	r = LUKS2_disk_hdr_read(cd, &hdr_file, backup_device, 0, 0);
 	device_read_unlock(backup_device);
 	device_free(backup_device);
 
@@ -1089,7 +1090,7 @@ int LUKS2_hdr_restore(struct crypt_device *cd, struct luks2_hdr *hdr,
 	close(devfd);
 	devfd = -1;
 
-	r = LUKS2_hdr_read(cd, &tmp_hdr);
+	r = LUKS2_hdr_read(cd, &tmp_hdr, 0);
 	if (r == 0) {
 		log_dbg("Device %s already contains LUKS2 header, checking UUID and requirements.", device_path(device));
 		r = LUKS2_config_get_requirements(cd, &tmp_hdr, &reqs);
@@ -1176,7 +1177,7 @@ out:
 
 	if (!r) {
 		LUKS2_hdr_free(hdr);
-		r = LUKS2_hdr_read(cd, hdr);
+		r = LUKS2_hdr_read(cd, hdr, 1);
 	}
 
 	return r;
diff --git a/lib/setup.c b/lib/setup.c
index fddbe7e..a9b2eba 100644
--- a/lib/setup.c
+++ b/lib/setup.c
@@ -644,16 +644,16 @@ struct crypt_pbkdf_type *crypt_get_pbkdf(struct crypt_device *cd)
 /*
  * crypt_load() helpers
  */
-static int _crypt_load_luks2(struct crypt_device *cd, int reload)
+static int _crypt_load_luks2(struct crypt_device *cd, int reload, int repair)
 {
 	int r;
 	char tmp_cipher[MAX_CIPHER_LEN], tmp_cipher_mode[MAX_CIPHER_LEN],
 	     *cipher = NULL, *cipher_mode = NULL, *type = NULL;
 	struct luks2_hdr hdr2 = {};
 
-	log_dbg("%soading LUKS2 header.", reload ? "Rel" : "L");
+	log_dbg("%soading LUKS2 header (repair %sabled).", reload ? "Rel" : "L", repair ? "en" : "dis");
 
-	r = LUKS2_hdr_read(cd, &hdr2);
+	r = LUKS2_hdr_read(cd, &hdr2, repair);
 	if (r)
 		return r;
 
@@ -713,7 +713,7 @@ static void _luks2_reload(struct crypt_device *cd)
 	if (!cd || !isLUKS2(cd->type))
 		return;
 
-	(void) _crypt_load_luks2(cd, 1);
+	(void) _crypt_load_luks2(cd, 1, 0);
 }
 
 static int _crypt_load_luks(struct crypt_device *cd, const char *requested_type,
@@ -768,7 +768,7 @@ static int _crypt_load_luks(struct crypt_device *cd, const char *requested_type,
 			return -EINVAL;
 		}
 
-		r =  _crypt_load_luks2(cd, cd->type != NULL);
+		r =  _crypt_load_luks2(cd, cd->type != NULL, repair);
 	} else
 		r = -EINVAL;
 out:
-- 
1.8.3.1