#!/bin/bash
# Measure all of the LUKS Disk Encryption headers into
# a PCR so that we can detect disk swap attacks.
. /etc/functions.sh

TRACE_FUNC
DEBUG "Arguments passed to qubes-measure-luks.sh: $@"

# Measure the LUKS headers into PCR 6
for dev in "$@"; do
	DEBUG "Storing LUKS header for $dev into /tmp/lukshdr-$(echo "$dev" | sed 's/\//_/g')"
	cryptsetup luksHeaderBackup $dev \
		--header-backup-file /tmp/lukshdr-$(echo "$dev" | sed 's/\//_/g') ||
		DIE "$dev: Unable to read LUKS header"
done

DEBUG "Hashing LUKS headers into /tmp/luksDump.txt"
sha256sum /tmp/lukshdr-* >/tmp/luksDump.txt || DIE "Unable to hash LUKS headers"
DEBUG "Removing /tmp/lukshdr-*"
rm /tmp/lukshdr-*

TRACE_FUNC
INFO "TPM: Extending PCR[6] with content of /tmp/luksDump.txt (hash of TPM Disk Unlock Key headers)"
tpmr.sh extend -ix 6 -if /tmp/luksDump.txt ||
	DIE "Unable to extend PCR"
