geli: split the initalization of HMAC

GELI allows to read a user key from a standard input.
However if user initialize multiple providers at once, the standard
input will be empty for the second and

geli: split the initalization of HMAC

GELI allows to read a user key from a standard input.
However if user initialize multiple providers at once, the standard
input will be empty for the second and next providers.
This caused GELI to encrypt a master key with an empty key file.

This commits initialize the HMAC with the key file, and then reuse the
finalized structure to generate different encryption keys for different
providers.

Reported by: Nathan Dorfman
Tested by: philip
Approved by: so
Security: FreeBSD-SA-23:01.geli
Security: CVE-2023-0751

(cherry picked from commit 5fff09660e06a66bed6482da9c70df328e16bbb6)
(cherry picked from commit 88bb08452ee3bbf67ad701a4909bbee6e8b200a6)

show more ...