|
 |
ef20f4 |
From a128130755bcd893ccf1d70b52c13fbaf29613c9 Mon Sep 17 00:00:00 2001
|
|
|
ef20f4 |
From: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
Date: Sat, 30 Nov 2019 14:26:59 -0500
|
|
|
ef20f4 |
Subject: [PATCH] Add clevis luks list command
|
|
|
ef20f4 |
|
|
|
ef20f4 |
Usage:
|
|
|
ef20f4 |
clevis luks list -d DEV [-s SLT]
|
|
|
ef20f4 |
|
|
|
ef20f4 |
Examples:
|
|
|
ef20f4 |
|
|
|
ef20f4 |
clevis luks list -d device
|
|
|
ef20f4 |
1: sss '{"t":1,"pins":{"tang":[{"url":"addr1"},{"url":"addr2"}],"tpm2":[{"hash":"sha256","key":"ecc"}],"sss":{"t":1,"pins":{"tang":[{"url":"addr3"}]}}}}'
|
|
|
ef20f4 |
2: tang '{"url":"addr"}'
|
|
|
ef20f4 |
3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
|
|
|
ef20f4 |
|
|
|
ef20f4 |
clevis luks list -d device -s 3
|
|
|
ef20f4 |
3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
|
|
|
ef20f4 |
---
|
|
|
ef20f4 |
src/luks/clevis-luks-common-functions | 173 ++++++++++++++++++++++++++
|
|
|
ef20f4 |
src/luks/clevis-luks-list | 77 ++++++++++++
|
|
|
ef20f4 |
src/luks/clevis-luks-list.1.adoc | 58 +++++++++
|
|
|
ef20f4 |
src/luks/meson.build | 8 +-
|
|
|
ef20f4 |
src/luks/tests/list-recursive-luks1 | 85 +++++++++++++
|
|
|
ef20f4 |
src/luks/tests/list-recursive-luks2 | 85 +++++++++++++
|
|
|
ef20f4 |
src/luks/tests/list-sss-tang-luks1 | 77 ++++++++++++
|
|
|
ef20f4 |
src/luks/tests/list-sss-tang-luks2 | 77 ++++++++++++
|
|
|
ef20f4 |
src/luks/tests/list-tang-luks1 | 64 ++++++++++
|
|
|
ef20f4 |
src/luks/tests/list-tang-luks2 | 64 ++++++++++
|
|
|
ef20f4 |
src/luks/tests/meson.build | 36 ++++++
|
|
|
ef20f4 |
src/luks/tests/tests-common-functions | 76 +++++++++++
|
|
|
ef20f4 |
12 files changed, 879 insertions(+), 1 deletion(-)
|
|
|
ef20f4 |
create mode 100755 src/luks/clevis-luks-list
|
|
|
ef20f4 |
create mode 100644 src/luks/clevis-luks-list.1.adoc
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-recursive-luks1
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-recursive-luks2
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-sss-tang-luks1
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-sss-tang-luks2
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-tang-luks1
|
|
|
ef20f4 |
create mode 100755 src/luks/tests/list-tang-luks2
|
|
|
ef20f4 |
create mode 100644 src/luks/tests/meson.build
|
|
|
ef20f4 |
create mode 100644 src/luks/tests/tests-common-functions
|
|
|
ef20f4 |
|
|
|
ef20f4 |
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
|
|
ef20f4 |
index d676253..9ba1812 100644
|
|
|
ef20f4 |
--- a/src/luks/clevis-luks-common-functions
|
|
|
ef20f4 |
+++ b/src/luks/clevis-luks-common-functions
|
|
|
ef20f4 |
@@ -141,3 +141,176 @@ findexe() {
|
|
|
ef20f4 |
return 1
|
|
|
ef20f4 |
}
|
|
|
ef20f4 |
|
|
|
ef20f4 |
+# clevis_luks_used_slots() will return the list of used slots for a given LUKS
|
|
|
ef20f4 |
+# device.
|
|
|
ef20f4 |
+clevis_luks_used_slots() {
|
|
|
ef20f4 |
+ local DEV="${1}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local slots
|
|
|
ef20f4 |
+ if cryptsetup isLuks --type luks1 "${DEV}"; then
|
|
|
ef20f4 |
+ readarray -t slots < <(cryptsetup luksDump "${DEV}" \
|
|
|
ef20f4 |
+ | sed -rn 's|^Key Slot ([0-7]): ENABLED$|\1|p')
|
|
|
ef20f4 |
+ elif cryptsetup isLuks --type luks2 "${DEV}"; then
|
|
|
ef20f4 |
+ readarray -t slots < <(cryptsetup luksDump "${DEV}" \
|
|
|
ef20f4 |
+ | sed -rn 's|^\s+([0-9]+): luks2$|\1|p')
|
|
|
ef20f4 |
+ else
|
|
|
ef20f4 |
+ echo "${DEV} is not a supported LUKS device!" >&2
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+ echo "${slots[@]}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_decode_jwe() will decode a given JWE.
|
|
|
ef20f4 |
+clevis_luks_decode_jwe() {
|
|
|
ef20f4 |
+ local jwe="${1}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local coded
|
|
|
ef20f4 |
+ if ! coded=$(jose jwe fmt -i- <<< "${jwe}"); then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ coded=$(jose fmt -j- -g protected -u- <<< "${coded}" | tr -d '"')
|
|
|
ef20f4 |
+ jose b64 dec -i- <<< "${coded}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_print_pin_config() will print the config of a given pin; i.e.
|
|
|
ef20f4 |
+# for tang it will display the associated url address, and for tpm2, the
|
|
|
ef20f4 |
+# properties in place, like the hash, for instance.
|
|
|
ef20f4 |
+clevis_luks_print_pin_config() {
|
|
|
ef20f4 |
+ local P="${1}"
|
|
|
ef20f4 |
+ local decoded="${2}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local content
|
|
|
ef20f4 |
+ if ! content="$(jose fmt -j- -g clevis -g "${P}" -o- <<< "${decoded}")" \
|
|
|
ef20f4 |
+ || [[ -z "${content}" ]]; then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local pin=
|
|
|
ef20f4 |
+ case "${P}" in
|
|
|
ef20f4 |
+ tang)
|
|
|
ef20f4 |
+ local url
|
|
|
ef20f4 |
+ url="$(jose fmt -j- -g url -u- <<< "${content}")"
|
|
|
ef20f4 |
+ pin=$(printf '{"url":"%s"}' "${url}")
|
|
|
ef20f4 |
+ printf "tang '%s'" "${pin}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ tpm2)
|
|
|
ef20f4 |
+ # Valid properties for tpm2 pin are the following:
|
|
|
ef20f4 |
+ # hash, key, pcr_bank, pcr_ids, pcr_digest.
|
|
|
ef20f4 |
+ local key
|
|
|
ef20f4 |
+ local value
|
|
|
ef20f4 |
+ for key in 'hash' 'key' 'pcr_bank' 'pcr_ids' 'pcr_digest'; do
|
|
|
ef20f4 |
+ if value=$(jose fmt -j- -g "${key}" -u- <<< "${content}"); then
|
|
|
ef20f4 |
+ pin=$(printf '%s,"%s":"%s"' "${pin}" "${key}" "${value}")
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+ done
|
|
|
ef20f4 |
+ # Remove possible leading comma.
|
|
|
ef20f4 |
+ pin=${pin/#,/}
|
|
|
ef20f4 |
+ printf "tpm2 '{%s}'" "${pin}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ sss)
|
|
|
ef20f4 |
+ local threshold
|
|
|
ef20f4 |
+ threshold=$(jose fmt -j- -Og t -o- <<< "${content}")
|
|
|
ef20f4 |
+ clevis_luks_process_sss_pin "${content}" "${threshold}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ *)
|
|
|
ef20f4 |
+ printf "unknown pin '%s'" "${P}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ esac
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_decode_pin_config() will receive a JWE and extract a pin config
|
|
|
ef20f4 |
+# from it.
|
|
|
ef20f4 |
+clevis_luks_decode_pin_config() {
|
|
|
ef20f4 |
+ local jwe="${1}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local decoded
|
|
|
ef20f4 |
+ if ! decoded=$(clevis_luks_decode_jwe "${jwe}"); then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local P
|
|
|
ef20f4 |
+ if ! P=$(jose fmt -j- -Og clevis -g pin -u- <<< "${decoded}"); then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ clevis_luks_print_pin_config "${P}" "${decoded}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_join_sss_cfg() will receive a list of configurations for a given
|
|
|
ef20f4 |
+# pin and returns it as list, in the format PIN [cfg1, cfg2, ..., cfgN].
|
|
|
ef20f4 |
+clevis_luks_join_sss_cfg() {
|
|
|
ef20f4 |
+ local pin="${1}"
|
|
|
ef20f4 |
+ local cfg="${2}"
|
|
|
ef20f4 |
+ cfg=$(echo "${cfg}" | tr -d "'" | sed -e 's/^,//')
|
|
|
ef20f4 |
+ printf '"%s":[%s]' "${pin}" "${cfg}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_process_sss_pin() will receive a JWE with information on the sss
|
|
|
ef20f4 |
+# pin config, and also its associated threshold, and will extract the info.
|
|
|
ef20f4 |
+clevis_luks_process_sss_pin() {
|
|
|
ef20f4 |
+ local jwe="${1}"
|
|
|
ef20f4 |
+ local threshold="${2}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local sss_tang
|
|
|
ef20f4 |
+ local sss_tpm2
|
|
|
ef20f4 |
+ local sss
|
|
|
ef20f4 |
+ local pin_cfg
|
|
|
ef20f4 |
+ local pin
|
|
|
ef20f4 |
+ local cfg
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local coded
|
|
|
ef20f4 |
+ for coded in $(jose fmt -j- -Og jwe -Af- <<< "${jwe}"| tr -d '"'); do
|
|
|
ef20f4 |
+ if ! pin_cfg="$(clevis_luks_decode_pin_config "${coded}")"; then
|
|
|
ef20f4 |
+ continue
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+ read -r pin cfg <<< "${pin_cfg}"
|
|
|
ef20f4 |
+ case "${pin}" in
|
|
|
ef20f4 |
+ tang)
|
|
|
ef20f4 |
+ sss_tang="${sss_tang},${cfg}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ tpm2)
|
|
|
ef20f4 |
+ sss_tpm2="${sss_tpm2},${cfg}"
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ sss)
|
|
|
ef20f4 |
+ sss=$(echo "${cfg}" | tr -d "'")
|
|
|
ef20f4 |
+ ;;
|
|
|
ef20f4 |
+ esac
|
|
|
ef20f4 |
+ done
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ cfg=
|
|
|
ef20f4 |
+ if [[ -n "${sss_tang}" ]]; then
|
|
|
ef20f4 |
+ cfg=$(clevis_luks_join_sss_cfg "tang" "${sss_tang}")
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ if [[ -n "${sss_tpm2}" ]]; then
|
|
|
ef20f4 |
+ cfg="${cfg},"$(clevis_luks_join_sss_cfg "tpm2" "${sss_tpm2}")
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ if [[ -n "${sss}" ]]; then
|
|
|
ef20f4 |
+ cfg=$(printf '%s,"sss":%s' "${cfg}" "${sss}")
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ # Remove possible leading comma.
|
|
|
ef20f4 |
+ cfg=${cfg/#,/}
|
|
|
ef20f4 |
+ pin=$(printf '{"t":%d,"pins":{%s}}' "${threshold}" "${cfg}")
|
|
|
ef20f4 |
+ printf "sss '%s'" "${pin}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# clevis_luks_read_pins_from_slot() will receive a given device and slot and
|
|
|
ef20f4 |
+# will then output its associated policy configuration.
|
|
|
ef20f4 |
+clevis_luks_read_pins_from_slot() {
|
|
|
ef20f4 |
+ local DEV="${1}"
|
|
|
ef20f4 |
+ local SLOT="${2}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local jwe
|
|
|
ef20f4 |
+ if ! jwe=$(clevis_luks_read_slot "${DEV}" "${SLOT}" 2>/dev/null); then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local cfg
|
|
|
ef20f4 |
+ if ! cfg="$(clevis_luks_decode_pin_config "${jwe}")"; then
|
|
|
ef20f4 |
+ return 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+ printf "%s: %s\n" "${SLOT}" "${cfg}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
diff --git a/src/luks/clevis-luks-list b/src/luks/clevis-luks-list
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..58678c4
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/clevis-luks-list
|
|
|
ef20f4 |
@@ -0,0 +1,77 @@
|
|
|
ef20f4 |
+#!/bin/bash -e
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2017-2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com> - LUKS2 support.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+. clevis-luks-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SUMMARY="Lists pins bound to a LUKSv1 or LUKSv2 device"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+function usage() {
|
|
|
ef20f4 |
+ echo >&2
|
|
|
ef20f4 |
+ echo "Usage: clevis luks list -d DEV [-s SLT]" >&2
|
|
|
ef20f4 |
+ echo >&2
|
|
|
ef20f4 |
+ echo "$SUMMARY": >&2
|
|
|
ef20f4 |
+ echo >&2
|
|
|
ef20f4 |
+ echo " -d DEV The LUKS device to list bound pins" >&2
|
|
|
ef20f4 |
+ echo >&2
|
|
|
ef20f4 |
+ echo " -s SLOT The slot number to list" >&2
|
|
|
ef20f4 |
+ echo >&2
|
|
|
ef20f4 |
+ exit 1
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then
|
|
|
ef20f4 |
+ echo "${SUMMARY}"
|
|
|
ef20f4 |
+ exit 0
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+while getopts ":d:s:" o; do
|
|
|
ef20f4 |
+ case "$o" in
|
|
|
ef20f4 |
+ d) DEV=${OPTARG};;
|
|
|
ef20f4 |
+ s) SLT=${OPTARG};;
|
|
|
ef20f4 |
+ *) usage;;
|
|
|
ef20f4 |
+ esac
|
|
|
ef20f4 |
+done
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [ -z "${DEV}" ]; then
|
|
|
ef20f4 |
+ echo "Did not specify a device!" >&2
|
|
|
ef20f4 |
+ usage
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if cryptsetup isLuks --type luks1 "${DEV}"; then
|
|
|
ef20f4 |
+ if ! luksmeta test -d "${DEV}" 2>/dev/null; then
|
|
|
ef20f4 |
+ echo "The ${DEV} device is not valid!" >&2
|
|
|
ef20f4 |
+ exit 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [ -n "${SLT}" ]; then
|
|
|
ef20f4 |
+ clevis_luks_read_pins_from_slot "${DEV}" "${SLT}"
|
|
|
ef20f4 |
+else
|
|
|
ef20f4 |
+ if ! slots=$(clevis_luks_used_slots "${DEV}"); then
|
|
|
ef20f4 |
+ echo "No used slots detected for device ${DEV}!" >&2
|
|
|
ef20f4 |
+ exit 1
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ for s in ${slots}; do
|
|
|
ef20f4 |
+ if ! clevis_luks_read_pins_from_slot "${DEV}" "${s}"; then
|
|
|
ef20f4 |
+ continue
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+ done
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/clevis-luks-list.1.adoc b/src/luks/clevis-luks-list.1.adoc
|
|
|
ef20f4 |
new file mode 100644
|
|
|
ef20f4 |
index 0000000..2e84f05
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/clevis-luks-list.1.adoc
|
|
|
ef20f4 |
@@ -0,0 +1,58 @@
|
|
|
ef20f4 |
+CLEVIS-LUKS-LIST(1)
|
|
|
ef20f4 |
+===================
|
|
|
ef20f4 |
+:doctype: manpage
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== NAME
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+clevis-luks-list - Lists pins bound to a LUKS device
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== SYNOPSIS
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+*clevis luks list* -d DEV [-s SLT]
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== OVERVIEW
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+The *clevis luks list* command list the pins bound to LUKS device.
|
|
|
ef20f4 |
+For example:
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ clevis luks list -d /dev/sda1
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== OPTIONS
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+* *-d* _DEV_ :
|
|
|
ef20f4 |
+ The LUKS device on which to list bound pins
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+* *-s* _SLT_ :
|
|
|
ef20f4 |
+ The slot to use for listing the pin from
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== EXAMPLES
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ clevis luks list -d /dev/sda1
|
|
|
ef20f4 |
+ 1: sss '{"t":1,"pins":{"tang":[{"url":"addr1"},{"url":"addr2"}],"tpm2":[{"hash":"sha256","key":"ecc"}],"sss":{"t":1,"pins":{"tang":[{"url":"addr3"}]}}}}'
|
|
|
ef20f4 |
+ 2: tang '{"url":"addr"}'
|
|
|
ef20f4 |
+ 3: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+As we can see in the example above, */dev/sda1* has three slots bound each with a different pin.
|
|
|
ef20f4 |
+- Slot #1 is bound with the _sss_ pin, and uses also tang and tpm2 pins in its policy.
|
|
|
ef20f4 |
+- Slot #2 is bound using the _tang_ pin
|
|
|
ef20f4 |
+- Slot #3 is bound with the _tpm2_ pin
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+Note that the output of *clevis luks list* can be used with the *clevis luks bind* command, such as:
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ clevis luks bind -d /dev/sda1 tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha1","pcr_ids":"7"}'
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+And we will bind another slot with a policy similar to the one we have in slot #3.
|
|
|
ef20f4 |
+Also note that if you are interested in a particular slot, you can pass the _-s SLT_ argument to *clevis luks list*:
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ clevis luks list -d /dev/sda1 -s 2
|
|
|
ef20f4 |
+ 2: tang '{"url":"addr"}'
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+In the above example, we listed only the pin bound to slot #2.
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+== SEE ALSO
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+link:clevis-luks-bind.1.adoc[*clevis-luks-bind*(1)],
|
|
|
ef20f4 |
+link:clevis-encrypt-tang.1.adoc[*clevis-encrypt-tang*(1)],
|
|
|
ef20f4 |
+link:clevis-encrypt-tpm2.1.adoc[*clevis-encrypt-tpm2*(1)],
|
|
|
ef20f4 |
+link:clevis-encrypt-sss.1.adoc[*clevis-encrypt-sss*(1)],
|
|
|
ef20f4 |
diff --git a/src/luks/meson.build b/src/luks/meson.build
|
|
|
ef20f4 |
index 7c045c4..51d82fb 100644
|
|
|
ef20f4 |
--- a/src/luks/meson.build
|
|
|
ef20f4 |
+++ b/src/luks/meson.build
|
|
|
ef20f4 |
@@ -20,6 +20,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
|
|
ef20f4 |
bins += join_paths(meson.current_source_dir(), 'clevis-luks-regen')
|
|
|
ef20f4 |
mans += join_paths(meson.current_source_dir(), 'clevis-luks-regen.1')
|
|
|
ef20f4 |
|
|
|
ef20f4 |
+ bins += join_paths(meson.current_source_dir(), 'clevis-luks-list')
|
|
|
ef20f4 |
+ mans += join_paths(meson.current_source_dir(), 'clevis-luks-list.1')
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
bins += join_paths(meson.current_source_dir(), 'clevis-luks-report')
|
|
|
ef20f4 |
bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-compare')
|
|
|
ef20f4 |
bins += join_paths(meson.current_source_dir(), 'clevis-luks-report-decode')
|
|
|
ef20f4 |
@@ -30,4 +33,7 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
|
|
ef20f4 |
mans += join_paths(meson.current_source_dir(), 'clevis-luks-unlockers.7')
|
|
|
ef20f4 |
else
|
|
|
ef20f4 |
warning('Will not install LUKS support due to missing dependencies!')
|
|
|
ef20f4 |
-endif
|
|
|
ef20f4 |
\ No newline at end of file
|
|
|
ef20f4 |
+endif
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# Tests.
|
|
|
ef20f4 |
+subdir('tests')
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-recursive-luks1 b/src/luks/tests/list-recursive-luks1
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..d9eaa3a
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-recursive-luks1
|
|
|
ef20f4 |
@@ -0,0 +1,85 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="sss"
|
|
|
ef20f4 |
+CFG=$(printf '
|
|
|
ef20f4 |
+{
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "sss": {
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "sss": {
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "tang": [
|
|
|
ef20f4 |
+ {
|
|
|
ef20f4 |
+ "url": "ADDR","adv": "%s"
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ ]
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+' "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS1.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks1" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-recursive-luks2 b/src/luks/tests/list-recursive-luks2
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..80a8278
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-recursive-luks2
|
|
|
ef20f4 |
@@ -0,0 +1,85 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="sss"
|
|
|
ef20f4 |
+CFG=$(printf '
|
|
|
ef20f4 |
+{
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "sss": {
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "sss": {
|
|
|
ef20f4 |
+ "t": 1,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "tang": [
|
|
|
ef20f4 |
+ {
|
|
|
ef20f4 |
+ "url": "ADDR","adv": "%s"
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ ]
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+' "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS2.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks2" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-sss-tang-luks1 b/src/luks/tests/list-sss-tang-luks1
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..086fa35
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-sss-tang-luks1
|
|
|
ef20f4 |
@@ -0,0 +1,77 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="sss"
|
|
|
ef20f4 |
+CFG=$(printf '
|
|
|
ef20f4 |
+{
|
|
|
ef20f4 |
+ "t": 2,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "tang": [
|
|
|
ef20f4 |
+ {"url":"ADDR1","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR2","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR3","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR4","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR5","adv":"%s"}
|
|
|
ef20f4 |
+ ]
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS1.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks1" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" ${PIN} "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-sss-tang-luks2 b/src/luks/tests/list-sss-tang-luks2
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..ea4cfbb
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-sss-tang-luks2
|
|
|
ef20f4 |
@@ -0,0 +1,77 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="sss"
|
|
|
ef20f4 |
+CFG=$(printf '
|
|
|
ef20f4 |
+{
|
|
|
ef20f4 |
+ "t": 2,
|
|
|
ef20f4 |
+ "pins": {
|
|
|
ef20f4 |
+ "tang": [
|
|
|
ef20f4 |
+ {"url":"ADDR1","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR2","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR3","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR4","adv":"%s"},
|
|
|
ef20f4 |
+ {"url":"ADDR5","adv":"%s"}
|
|
|
ef20f4 |
+ ]
|
|
|
ef20f4 |
+ }
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+' "${ADV}" "${ADV}" "${ADV}" "${ADV}" "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS2.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks2" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" ${PIN} "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-tang-luks1 b/src/luks/tests/list-tang-luks1
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..c526693
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-tang-luks1
|
|
|
ef20f4 |
@@ -0,0 +1,64 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="tang"
|
|
|
ef20f4 |
+CFG=$(printf '{"url": "ADDR","adv": "%s"}' "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS1.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks1" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/list-tang-luks2 b/src/luks/tests/list-tang-luks2
|
|
|
ef20f4 |
new file mode 100755
|
|
|
ef20f4 |
index 0000000..d4d4849
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/list-tang-luks2
|
|
|
ef20f4 |
@@ -0,0 +1,64 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TEST=$(basename "${0}")
|
|
|
ef20f4 |
+. tests-common-functions
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+on_exit() {
|
|
|
ef20f4 |
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+trap 'on_exit' EXIT
|
|
|
ef20f4 |
+trap 'exit' ERR
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+TMP="$(mktemp -d)"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ADV="${TMP}/adv.jws"
|
|
|
ef20f4 |
+create_tang_adv "${ADV}"
|
|
|
ef20f4 |
+PIN="tang"
|
|
|
ef20f4 |
+CFG=$(printf '{"url": "ADDR","adv": "%s"}' "${ADV}")
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS2.
|
|
|
ef20f4 |
+DEV="${TMP}/luks1-device"
|
|
|
ef20f4 |
+UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
|
ef20f4 |
+new_device "luks2" "${DEV}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if ! clevis luks bind -f -d "${DEV}" "${PIN}" "${CFG}" <<< "${DEFAULT_PASS}"; then
|
|
|
ef20f4 |
+ error "${TEST}: Binding is expected to succeed when given a correct (${DEFAULT_PASS}) password."
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+SLT=1
|
|
|
ef20f4 |
+if ! read -r slot pin cfg < <(clevis luks list -d "${DEV}" -s "${SLT}"); then
|
|
|
ef20f4 |
+ error "${TEST}: clevis luks list is expected to succeed for device(${DEV}) and slot (${SLT})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${slot}" != "${SLT}:" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: slot (${slot}) is expected to be ${SLT}"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if [[ "${pin}" != "${PIN}" ]]; then
|
|
|
ef20f4 |
+ error "${TEST}: pin (${pin}) is expected to be '${PIN}'"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+to_remove_from_cfg=$(printf ',"adv": "%s"' "${ADV}")
|
|
|
ef20f4 |
+cfg_for_cmp=${cfg//"${to_remove_from_cfg}"/}
|
|
|
ef20f4 |
+if ! pin_cfg_equal "${cfg}" "${cfg_for_cmp}"; then
|
|
|
ef20f4 |
+ error "${TEST}: config obtained from clevis luks list (${cfg}) is expected to match the one used to bind the test (${cfg_for_cmp})"
|
|
|
ef20f4 |
+fi
|
|
|
ef20f4 |
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
|
|
ef20f4 |
new file mode 100644
|
|
|
ef20f4 |
index 0000000..6513eaa
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/meson.build
|
|
|
ef20f4 |
@@ -0,0 +1,36 @@
|
|
|
ef20f4 |
+# We use jq for comparing the pin config in the clevis luks list tests.
|
|
|
ef20f4 |
+jq = find_program('jq', required: false)
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+env = environment()
|
|
|
ef20f4 |
+env.prepend('PATH',
|
|
|
ef20f4 |
+ join_paths(meson.source_root(), 'src'),
|
|
|
ef20f4 |
+ join_paths(meson.source_root(), 'src', 'luks'),
|
|
|
ef20f4 |
+ join_paths(meson.source_root(), 'src', 'pins', 'sss'),
|
|
|
ef20f4 |
+ join_paths(meson.source_root(), 'src', 'pins', 'tang'),
|
|
|
ef20f4 |
+ join_paths(meson.source_root(), 'src', 'pins', 'tpm2'),
|
|
|
ef20f4 |
+ meson.current_source_dir(),
|
|
|
ef20f4 |
+ meson.current_build_dir(),
|
|
|
ef20f4 |
+ join_paths(meson.build_root(), 'src'),
|
|
|
ef20f4 |
+ join_paths(meson.build_root(), 'src', 'luks'),
|
|
|
ef20f4 |
+ join_paths(meson.build_root(), 'src', 'pins', 'sss'),
|
|
|
ef20f4 |
+ join_paths(meson.build_root(), 'src', 'pins', 'tang'),
|
|
|
ef20f4 |
+ join_paths(meson.build_root(), 'src', 'pins', 'tpm2'),
|
|
|
ef20f4 |
+ separator: ':'
|
|
|
ef20f4 |
+)
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+if jq.found()
|
|
|
ef20f4 |
+ test('list-recursive-luks1', find_program('list-recursive-luks1'), env: env)
|
|
|
ef20f4 |
+ test('list-tang-luks1', find_program('list-tang-luks1'), env: env)
|
|
|
ef20f4 |
+ test('list-sss-tang-luks1', find_program('list-sss-tang-luks1'), env: env)
|
|
|
ef20f4 |
+else
|
|
|
ef20f4 |
+ warning('Will not run "clevis luks list" tests due to missing jq dependency')
|
|
|
ef20f4 |
+endif
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# LUKS2 tests go here, and they get included if we get support for it, based
|
|
|
ef20f4 |
+# on the cryptsetup version.
|
|
|
ef20f4 |
+# Binding LUKS2 takes longer, so timeout is increased for a few tests.
|
|
|
ef20f4 |
+if jq.found()
|
|
|
ef20f4 |
+ test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
|
|
|
ef20f4 |
+ test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
|
|
|
ef20f4 |
+ test('list-sss-tang-luks2', find_program('list-sss-tang-luks2'), env: env, timeout: 60)
|
|
|
ef20f4 |
+endif
|
|
|
ef20f4 |
diff --git a/src/luks/tests/tests-common-functions b/src/luks/tests/tests-common-functions
|
|
|
ef20f4 |
new file mode 100644
|
|
|
ef20f4 |
index 0000000..b65a84a
|
|
|
ef20f4 |
--- /dev/null
|
|
|
ef20f4 |
+++ b/src/luks/tests/tests-common-functions
|
|
|
ef20f4 |
@@ -0,0 +1,76 @@
|
|
|
ef20f4 |
+#!/bin/bash -ex
|
|
|
ef20f4 |
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# Copyright (c) 2019 Red Hat, Inc.
|
|
|
ef20f4 |
+# Author: Sergio Correia <scorreia@redhat.com>
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is free software: you can redistribute it and/or modify
|
|
|
ef20f4 |
+# it under the terms of the GNU General Public License as published by
|
|
|
ef20f4 |
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
ef20f4 |
+# (at your option) any later version.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# This program is distributed in the hope that it will be useful,
|
|
|
ef20f4 |
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
ef20f4 |
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
ef20f4 |
+# GNU General Public License for more details.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+# You should have received a copy of the GNU General Public License
|
|
|
ef20f4 |
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
ef20f4 |
+#
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# We require cryptsetup >= 2.0.4 to fully support LUKSv2.
|
|
|
ef20f4 |
+# Support is determined at build time.
|
|
|
ef20f4 |
+luks2_supported() {
|
|
|
ef20f4 |
+ # In RHEL8 we support LUKS2.
|
|
|
ef20f4 |
+ return 0
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# Creates a tang adv to be used in the test.
|
|
|
ef20f4 |
+create_tang_adv() {
|
|
|
ef20f4 |
+ local adv="${1}"
|
|
|
ef20f4 |
+ local SIG="${TMP}/sig.jwk"
|
|
|
ef20f4 |
+ jose jwk gen -i '{"alg":"ES512"}' > "${SIG}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local EXC="${TMP}/exc.jwk"
|
|
|
ef20f4 |
+ jose jwk gen -i '{"alg":"ECMR"}' > "${EXC}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local TEMPLATE='{"protected":{"cty":"jwk-set+json"}}'
|
|
|
ef20f4 |
+ jose jwk pub -s -i "${SIG}" -i "${EXC}" \
|
|
|
ef20f4 |
+ | jose jws sig -I- -s "${TEMPLATE}" -k "${SIG}" -o "${adv}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+# Creates a new LUKS1 or LUKS2 device to be used.
|
|
|
ef20f4 |
+new_device() {
|
|
|
ef20f4 |
+ local LUKS="${1}"
|
|
|
ef20f4 |
+ local DEV="${2}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ local DEV_CACHED="${TMP}/${LUKS}.cached"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ # Let's reuse an existing device, if there is one.
|
|
|
ef20f4 |
+ if [ -f "${DEV_CACHED}" ]; then
|
|
|
ef20f4 |
+ echo "Reusing cached ${LUKS} device..."
|
|
|
ef20f4 |
+ cp -f "${DEV_CACHED}" "${DEV}"
|
|
|
ef20f4 |
+ return 0
|
|
|
ef20f4 |
+ fi
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ fallocate -l16M "${DEV}"
|
|
|
ef20f4 |
+ cryptsetup luksFormat --type "${LUKS}" --batch-mode --force-password "${DEV}" <<< "${DEFAULT_PASS}"
|
|
|
ef20f4 |
+ # Caching the just-formatted device for possible reuse.
|
|
|
ef20f4 |
+ cp -f "${DEV}" "${DEV_CACHED}"
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+error() {
|
|
|
ef20f4 |
+ echo "${1}" >&2
|
|
|
ef20f4 |
+ exit 1
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+pin_cfg_equal() {
|
|
|
ef20f4 |
+ local cfg1="${1}"
|
|
|
ef20f4 |
+ local cfg2="${1}"
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+ diff <(jq -S . < <(echo -n "${cfg1}")) \
|
|
|
ef20f4 |
+ <(jq -S . < <(echo -n "${cfg2}"))
|
|
|
ef20f4 |
+}
|
|
|
ef20f4 |
+
|
|
|
ef20f4 |
+export DEFAULT_PASS='just-some-test-password-here'
|
|
|
ef20f4 |
--
|
|
|
ef20f4 |
2.18.1
|
|
|
ef20f4 |
|