luks2: need to check the availability of a JSON area

luks2: need to check the availability of a JSON area

[Vitalii Hordii]

Hello,

I had some problems with restoring a luks2 partition after using, for 
example, mkfs.ntfs because it only leaves a 2nd JSON area without a 
secondary binary header, which I had to create myself. What if there was 
a function in libblkid that allows one to determine if there is a 2nd 
JSON and if there is a chance of recovery? Because as I see here, 
automatically repairing 
https://gitlab.com/cryptsetup/cryptsetup/-/issues/750 is apparently 
missing due to the lack of checking if there is an area here in 
libblkid. Also this seems to be a pretty popular problem on the internet 
when it comes to installing other operating systems. Would it be okay to 
add such a feature?

Best regards, Vitalii

Re: luks2: need to check the availability of a JSON area

[Milan Broz]

On 5/8/24 6:07 PM, Vitalii Hordii wrote:
> Hello,
> 
> I had some problems with restoring a luks2 partition after using, for
> example, mkfs.ntfs because it only leaves a 2nd JSON area without a
> secondary binary header, which I had to create myself. What if there was
> a function in libblkid that allows one to determine if there is a 2nd
> JSON and if there is a chance of recovery? Because as I see here,
> automatically repairing
> https://gitlab.com/cryptsetup/cryptsetup/-/issues/750 is apparently
> missing due to the lack of checking if there is an area here in
> libblkid. Also this seems to be a pretty popular problem on the internet
> when it comes to installing other operating systems. Would it be okay to
> add such a feature?

Hi,

Blkid already scans for *valid* 2nd LUKS2 header.

If the binary area for LUKS2 is missing, the header corrupted. Blkid
should not touch JSON metadata at all (JSON on-disk follows binary area).
Binary area was specifically designed for blkid use to be fast and do
not require any advanced metadata parsing.
So there is nothing to fix in blkid.

What we can add to cryptsetup repair command is to check
for specific case when wipefs marks LUKS2 binary area unusable
(this case can be easily recovered as it overwrites magic string only).

But I doubt mkfs format will touch only magic string, if the keyslot area
is (even partially) overwritten, the LUKS2 header is unusable anyway.

You should have a backup to recover data, not rely on a magic recovery.

Milan