Compare commits
No commits in common. 'c9' and 'i8c' have entirely different histories.
@ -1 +1 @@
|
|||||||
dc2e95d0c0ce9118bc01b3872869657b0d43f1bc SOURCES/clevis-18.tar.xz
|
ce825a10c5aa885e001c963be4cc4a8dea2137b0 SOURCES/clevis-15.tar.xz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
SOURCES/clevis-18.tar.xz
|
SOURCES/clevis-15.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,176 @@
|
|||||||
|
From 16f667d9f3d649e33ca762afa1a8a7f909b953a8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sergio Correia <scorreia@redhat.com>
|
||||||
|
Date: Sun, 25 Oct 2020 11:15:46 -0300
|
||||||
|
Subject: [PATCH] Fixes for dealing with newer tang without tangd-update
|
||||||
|
|
||||||
|
---
|
||||||
|
src/luks/tests/meson.build | 11 +----------
|
||||||
|
src/luks/tests/tests-common-functions.in | 19 +++++++++++--------
|
||||||
|
src/pins/tang/meson.build | 11 +----------
|
||||||
|
src/pins/tang/pin-tang | 11 ++++++++---
|
||||||
|
4 files changed, 21 insertions(+), 31 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
||||||
|
index ba5f6a2..c0f9dc3 100644
|
||||||
|
--- a/src/luks/tests/meson.build
|
||||||
|
+++ b/src/luks/tests/meson.build
|
||||||
|
@@ -17,14 +17,6 @@ kgen = find_program(
|
||||||
|
join_paths('/', 'usr', get_option('libexecdir'), 'tangd-keygen'),
|
||||||
|
required: false
|
||||||
|
)
|
||||||
|
-updt = find_program(
|
||||||
|
- join_paths(libexecdir, 'tangd-update'),
|
||||||
|
- join_paths(get_option('prefix'), get_option('libdir'), 'tangd-update'),
|
||||||
|
- join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd-update'),
|
||||||
|
- join_paths('/', 'usr', get_option('libdir'), 'tangd-update'),
|
||||||
|
- join_paths('/', 'usr', get_option('libexecdir'), 'tangd-update'),
|
||||||
|
- required: false
|
||||||
|
-)
|
||||||
|
tang = find_program(
|
||||||
|
join_paths(libexecdir, 'tangd'),
|
||||||
|
join_paths(get_option('prefix'), get_option('libdir'), 'tangd'),
|
||||||
|
@@ -58,11 +50,10 @@ env.prepend('PATH',
|
||||||
|
)
|
||||||
|
|
||||||
|
has_tang = false
|
||||||
|
-if actv.found() and kgen.found() and updt.found() and tang.found()
|
||||||
|
+if actv.found() and kgen.found() and tang.found()
|
||||||
|
has_tang = true
|
||||||
|
env.set('SD_ACTIVATE', actv.path())
|
||||||
|
env.set('TANGD_KEYGEN', kgen.path())
|
||||||
|
- env.set('TANGD_UPDATE', updt.path())
|
||||||
|
env.set('TANGD', tang.path())
|
||||||
|
endif
|
||||||
|
|
||||||
|
diff --git a/src/luks/tests/tests-common-functions.in b/src/luks/tests/tests-common-functions.in
|
||||||
|
index 8520715..318d007 100755
|
||||||
|
--- a/src/luks/tests/tests-common-functions.in
|
||||||
|
+++ b/src/luks/tests/tests-common-functions.in
|
||||||
|
@@ -251,18 +251,19 @@ tang_remove_rotated_keys() {
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
- [ -z "${TANGD_UPDATE}" ] && skip_test "WARNING: TANGD_UPDATE is not defined."
|
||||||
|
-
|
||||||
|
local db="${basedir}/db"
|
||||||
|
- local cache="${basedir}/cache"
|
||||||
|
mkdir -p "${db}"
|
||||||
|
- mkdir -p "${cache}"
|
||||||
|
+
|
||||||
|
+ if [ -n "${TANGD_UPDATE}" ]; then
|
||||||
|
+ local cache="${basedir}/cache"
|
||||||
|
+ mkdir -p "${cache}"
|
||||||
|
+ fi
|
||||||
|
|
||||||
|
pushd "${db}"
|
||||||
|
find . -name ".*.jwk" -exec rm -f {} \;
|
||||||
|
popd
|
||||||
|
|
||||||
|
- "${TANGD_UPDATE}" "${db}" "${cache}"
|
||||||
|
+ [ -n "${TANGD_UPDATE}" ] && "${TANGD_UPDATE}" "${db}" "${cache}"
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -277,12 +278,12 @@ tang_new_keys() {
|
||||||
|
fi
|
||||||
|
|
||||||
|
[ -z "${TANGD_KEYGEN}" ] && skip_test "WARNING: TANGD_KEYGEN is not defined."
|
||||||
|
- [ -z "${TANGD_UPDATE}" ] && skip_test "WARNING: TANGD_UPDATE is not defined."
|
||||||
|
|
||||||
|
local db="${basedir}/db"
|
||||||
|
- local cache="${basedir}/cache"
|
||||||
|
mkdir -p "${db}"
|
||||||
|
|
||||||
|
+ [ -n "${TANGD_UPDATE}" ] && local cache="${basedir}/cache"
|
||||||
|
+
|
||||||
|
if [ -n "${rotate}" ]; then
|
||||||
|
pushd "${db}"
|
||||||
|
local k
|
||||||
|
@@ -296,7 +297,7 @@ tang_new_keys() {
|
||||||
|
fi
|
||||||
|
|
||||||
|
"${TANGD_KEYGEN}" "${db}"
|
||||||
|
- "${TANGD_UPDATE}" "${db}" "${cache}"
|
||||||
|
+ [ -n "${TANGD_UPDATE}" ] && "${TANGD_UPDATE}" "${db}" "${cache}"
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
@@ -322,6 +323,8 @@ tang_run() {
|
||||||
|
fi
|
||||||
|
|
||||||
|
local KEYS="${basedir}/cache"
|
||||||
|
+ [ -z "${TANGD_UPDATE}" ] && KEYS="${basedir}/db"
|
||||||
|
+
|
||||||
|
local inetd='--inetd'
|
||||||
|
[ "${SD_ACTIVATE##*/}" = "systemd-activate" ] && inetd=
|
||||||
|
|
||||||
|
diff --git a/src/pins/tang/meson.build b/src/pins/tang/meson.build
|
||||||
|
index f7d8226..ebcdd4a 100644
|
||||||
|
--- a/src/pins/tang/meson.build
|
||||||
|
+++ b/src/pins/tang/meson.build
|
||||||
|
@@ -12,14 +12,6 @@ kgen = find_program(
|
||||||
|
join_paths('/', 'usr', get_option('libexecdir'), 'tangd-keygen'),
|
||||||
|
required: false
|
||||||
|
)
|
||||||
|
-updt = find_program(
|
||||||
|
- join_paths(libexecdir, 'tangd-update'),
|
||||||
|
- join_paths(get_option('prefix'), get_option('libdir'), 'tangd-update'),
|
||||||
|
- join_paths(get_option('prefix'), get_option('libexecdir'), 'tangd-update'),
|
||||||
|
- join_paths('/', 'usr', get_option('libdir'), 'tangd-update'),
|
||||||
|
- join_paths('/', 'usr', get_option('libexecdir'), 'tangd-update'),
|
||||||
|
- required: false
|
||||||
|
-)
|
||||||
|
tang = find_program(
|
||||||
|
join_paths(libexecdir, 'tangd'),
|
||||||
|
join_paths(get_option('prefix'), get_option('libdir'), 'tangd'),
|
||||||
|
@@ -35,11 +27,10 @@ if curl.found()
|
||||||
|
bins += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang')
|
||||||
|
mans += join_paths(meson.current_source_dir(), 'clevis-encrypt-tang.1')
|
||||||
|
|
||||||
|
- if actv.found() and kgen.found() and updt.found() and tang.found()
|
||||||
|
+ if actv.found() and kgen.found() and tang.found()
|
||||||
|
env = environment()
|
||||||
|
env.set('SD_ACTIVATE', actv.path())
|
||||||
|
env.set('TANGD_KEYGEN', kgen.path())
|
||||||
|
- env.set('TANGD_UPDATE', updt.path())
|
||||||
|
env.set('TANGD', tang.path())
|
||||||
|
env.prepend('PATH',
|
||||||
|
join_paths(meson.source_root(), 'src'),
|
||||||
|
diff --git a/src/pins/tang/pin-tang b/src/pins/tang/pin-tang
|
||||||
|
index 98e5e4d..a63d0a2 100755
|
||||||
|
--- a/src/pins/tang/pin-tang
|
||||||
|
+++ b/src/pins/tang/pin-tang
|
||||||
|
@@ -31,8 +31,12 @@ mkdir -p "$TMP"/db
|
||||||
|
mkdir -p "$TMP"/cache
|
||||||
|
|
||||||
|
# Generate the server keys
|
||||||
|
+KEYS="$TMP"/db
|
||||||
|
"${TANGD_KEYGEN}" "$TMP"/db sig exc
|
||||||
|
-"${TANGD_UPDATE}" "$TMP"/db "$TMP"/cache
|
||||||
|
+if which tangd-update; then
|
||||||
|
+ tangd-update "$TMP"/db "$TMP"/cache
|
||||||
|
+ KEYS="$TMP"/cache
|
||||||
|
+fi
|
||||||
|
|
||||||
|
# Start the server
|
||||||
|
port="$(shuf -i 1024-65536 -n 1)"
|
||||||
|
@@ -40,13 +44,14 @@ port="$(shuf -i 1024-65536 -n 1)"
|
||||||
|
inetd='--inetd'
|
||||||
|
[ "${SD_ACTIVATE##*/}" = "systemd-activate" ] && inetd=
|
||||||
|
|
||||||
|
-"$SD_ACTIVATE" $inetd -l 127.0.0.1:"$port" -a "$TANGD" "$TMP"/cache &
|
||||||
|
+"$SD_ACTIVATE" $inetd -l 127.0.0.1:"$port" -a "$TANGD" "$KEYS" &
|
||||||
|
PID=$!
|
||||||
|
sleep 0.25
|
||||||
|
|
||||||
|
thp="$(jose jwk thp -i "$TMP/db/sig.jwk")"
|
||||||
|
-adv="$TMP/cache/default.jws"
|
||||||
|
url="http://localhost:${port}"
|
||||||
|
+adv="$TMP/adv"
|
||||||
|
+curl "$url/adv" -o "$adv"
|
||||||
|
|
||||||
|
cfg="$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")"
|
||||||
|
enc="$(echo -n "hi" | clevis encrypt tang "$cfg")"
|
||||||
|
--
|
||||||
|
2.18.4
|
||||||
|
|
||||||
@ -1,47 +0,0 @@
|
|||||||
From 95f25c355fc13727410ccacaa618caf6af5d5eba Mon Sep 17 00:00:00 2001
|
|
||||||
From: Sergio Correia <scorreia@redhat.com>
|
|
||||||
Date: Mon, 3 May 2021 22:36:36 -0300
|
|
||||||
Subject: [PATCH] sss: use BN_set_word(x, 0) instead of BN_zero()
|
|
||||||
|
|
||||||
Different OpenSSL versions define BN_zero() differently -- sometimes
|
|
||||||
returning an integer, sometimes as void --, so let's use instead
|
|
||||||
BN_set_word() instead, not to have issues when building with these
|
|
||||||
different versions.
|
|
||||||
---
|
|
||||||
src/pins/sss/sss.c | 6 +++---
|
|
||||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/pins/sss/sss.c b/src/pins/sss/sss.c
|
|
||||||
index a37215d..7486d6c 100644
|
|
||||||
--- a/src/pins/sss/sss.c
|
|
||||||
+++ b/src/pins/sss/sss.c
|
|
||||||
@@ -214,7 +214,7 @@ sss_point(const json_t *sss, size_t *len)
|
|
||||||
if (BN_rand_range(xx, pp) <= 0)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
- if (BN_zero(yy) <= 0)
|
|
||||||
+ if (BN_set_word(yy, 0) <= 0)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
for (size_t i = 0; i < json_array_size(e); i++) {
|
|
||||||
@@ -272,7 +272,7 @@ sss_recover(const json_t *p, size_t npnts, const uint8_t *pnts[])
|
|
||||||
if (!ctx || !pp || !acc || !tmp || !k)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
- if (BN_zero(k) <= 0)
|
|
||||||
+ if (BN_set_word(k, 0) <= 0)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
len = jose_b64_dec(p, NULL, 0);
|
|
||||||
@@ -303,7 +303,7 @@ sss_recover(const json_t *p, size_t npnts, const uint8_t *pnts[])
|
|
||||||
|
|
||||||
/* acc *= (0 - xi) / (xo - xi) */
|
|
||||||
|
|
||||||
- if (BN_zero(tmp) <= 0)
|
|
||||||
+ if (BN_set_word(tmp, 0) <= 0)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
if (BN_mod_sub(tmp, tmp, xi, pp, ctx) <= 0)
|
|
||||||
--
|
|
||||||
2.31.1
|
|
||||||
|
|
||||||
@ -0,0 +1,309 @@
|
|||||||
|
From aa52396c35e76aabd085a819b08167d559042a20 Mon Sep 17 00:00:00 2001
|
||||||
|
From: rpm-build <rpm-build>
|
||||||
|
Date: Tue, 3 Nov 2020 08:42:48 -0300
|
||||||
|
Subject: [PATCH 2/2] Add the option to extract luks passphrase used for
|
||||||
|
binding
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
|
||||||
|
clevis luks pass -d /dev/sda1 -s 1
|
||||||
|
<passphrase here>
|
||||||
|
---
|
||||||
|
src/luks/clevis-luks-pass | 64 ++++++++++++++++++++++++++++++++
|
||||||
|
src/luks/clevis-luks-pass.1.adoc | 43 +++++++++++++++++++++
|
||||||
|
src/luks/meson.build | 3 ++
|
||||||
|
src/luks/tests/meson.build | 2 +
|
||||||
|
src/luks/tests/pass-tang-luks1 | 59 +++++++++++++++++++++++++++++
|
||||||
|
src/luks/tests/pass-tang-luks2 | 59 +++++++++++++++++++++++++++++
|
||||||
|
6 files changed, 230 insertions(+)
|
||||||
|
create mode 100755 src/luks/clevis-luks-pass
|
||||||
|
create mode 100644 src/luks/clevis-luks-pass.1.adoc
|
||||||
|
create mode 100755 src/luks/tests/pass-tang-luks1
|
||||||
|
create mode 100755 src/luks/tests/pass-tang-luks2
|
||||||
|
|
||||||
|
diff --git a/src/luks/clevis-luks-pass b/src/luks/clevis-luks-pass
|
||||||
|
new file mode 100755
|
||||||
|
index 0000000..1f59b39
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/luks/clevis-luks-pass
|
||||||
|
@@ -0,0 +1,64 @@
|
||||||
|
+#!/bin/bash -e
|
||||||
|
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2019 Red Hat, Inc.
|
||||||
|
+# Author: Sergio Correia <scorreia@redhat.com> - LUKS2 support.
|
||||||
|
+#
|
||||||
|
+# This program is free software: you can redistribute it and/or modify
|
||||||
|
+# it under the terms of the GNU General Public License as published by
|
||||||
|
+# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
+# (at your option) any later version.
|
||||||
|
+#
|
||||||
|
+# This program is distributed in the hope that it will be useful,
|
||||||
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+# GNU General Public License for more details.
|
||||||
|
+#
|
||||||
|
+# You should have received a copy of the GNU General Public License
|
||||||
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+. clevis-luks-common-functions
|
||||||
|
+
|
||||||
|
+SUMMARY="Returns the LUKS passphrase used for binding a particular slot."
|
||||||
|
+
|
||||||
|
+usage() {
|
||||||
|
+ exec >&2
|
||||||
|
+ echo "Usage: clevis luks pass -d DEV -s SLT"
|
||||||
|
+ echo
|
||||||
|
+ echo "$SUMMARY"
|
||||||
|
+ echo
|
||||||
|
+ echo " -d DEV The LUKS device to extract the LUKS passphrase used for binding"
|
||||||
|
+ echo
|
||||||
|
+ echo " -s SLOT The slot number to extract the LUKS passphrase"
|
||||||
|
+ echo
|
||||||
|
+ exit 1
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+if [ ${#} -eq 1 ] && [ "${1}" = "--summary" ]; then
|
||||||
|
+ echo "${SUMMARY}"
|
||||||
|
+ exit 0
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+while getopts ":d:s:" o; do
|
||||||
|
+ case "$o" in
|
||||||
|
+ d) DEV=${OPTARG};;
|
||||||
|
+ s) SLT=${OPTARG};;
|
||||||
|
+ *) usage;;
|
||||||
|
+ esac
|
||||||
|
+done
|
||||||
|
+
|
||||||
|
+if [ -z "${DEV}" ]; then
|
||||||
|
+ echo "Did not specify a device!" >&2
|
||||||
|
+ usage
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+if [ -z "${SLT}" ]; then
|
||||||
|
+ echo "Did not specify a slot!" >&2
|
||||||
|
+ usage
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+if ! clevis_luks_unlock_device_by_slot "${DEV}" "${SLT}"; then
|
||||||
|
+ echo "It was not possible to decrypt the passphrase associated to slot ${SLT} in ${DEV}!" >&2
|
||||||
|
+ exit 1
|
||||||
|
+fi
|
||||||
|
diff --git a/src/luks/clevis-luks-pass.1.adoc b/src/luks/clevis-luks-pass.1.adoc
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..fa9526a
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/luks/clevis-luks-pass.1.adoc
|
||||||
|
@@ -0,0 +1,43 @@
|
||||||
|
+CLEVIS-LUKS-PASS(1)
|
||||||
|
+===================
|
||||||
|
+:doctype: manpage
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+== NAME
|
||||||
|
+
|
||||||
|
+clevis-luks-pass - Extracts the passphrase used for binding a particular slot in a LUKS device
|
||||||
|
+
|
||||||
|
+== SYNOPSIS
|
||||||
|
+
|
||||||
|
+*clevis luks pass* -d DEV -s SLT
|
||||||
|
+
|
||||||
|
+== OVERVIEW
|
||||||
|
+
|
||||||
|
+The *clevis luks pass* command extracts the passphrase used for binding a particular slot in a LUKS device.
|
||||||
|
+For example:
|
||||||
|
+
|
||||||
|
+ clevis luks pass -d /dev/sda1 -s 1
|
||||||
|
+
|
||||||
|
+== OPTIONS
|
||||||
|
+
|
||||||
|
+* *-d* _DEV_ :
|
||||||
|
+ The LUKS device on which to extract a passphrase from
|
||||||
|
+
|
||||||
|
+* *-s* _SLT_ :
|
||||||
|
+ The slot to use for extracting the passphrase
|
||||||
|
+
|
||||||
|
+== EXAMPLE
|
||||||
|
+
|
||||||
|
+ clevis luks pass -d /dev/sda1 -s 1
|
||||||
|
+ <passphrase here>
|
||||||
|
+
|
||||||
|
+Note that the output of *clevis luks pass* might be non-printable, in which case it would be better to redirect its output to a file and use it as a key
|
||||||
|
+file together with cryptsetup. For instance:
|
||||||
|
+
|
||||||
|
+ clevis luks pass -d /dev/sda1 -s 1 > slot1-passphrase
|
||||||
|
+
|
||||||
|
+And the file slot1-passphrase will contain the passphrase associated with slot #1 in /dev/sda1.
|
||||||
|
+
|
||||||
|
+== SEE ALSO
|
||||||
|
+
|
||||||
|
+link:clevis-luks-unlock.1.adoc[*clevis-luks-unlock*(1)],
|
||||||
|
diff --git a/src/luks/meson.build b/src/luks/meson.build
|
||||||
|
index 12f5a0d..008736e 100644
|
||||||
|
--- a/src/luks/meson.build
|
||||||
|
+++ b/src/luks/meson.build
|
||||||
|
@@ -50,6 +50,9 @@ if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
||||||
|
|
||||||
|
bins += join_paths(meson.current_source_dir(), 'clevis-luks-edit')
|
||||||
|
mans += join_paths(meson.current_source_dir(), 'clevis-luks-edit.1')
|
||||||
|
+
|
||||||
|
+ bins += join_paths(meson.current_source_dir(), 'clevis-luks-pass')
|
||||||
|
+ mans += join_paths(meson.current_source_dir(), 'clevis-luks-pass.1')
|
||||||
|
else
|
||||||
|
warning('Will not install LUKS support due to missing dependencies!')
|
||||||
|
endif
|
||||||
|
diff --git a/src/luks/tests/meson.build b/src/luks/tests/meson.build
|
||||||
|
index c22a069..f4584aa 100644
|
||||||
|
--- a/src/luks/tests/meson.build
|
||||||
|
+++ b/src/luks/tests/meson.build
|
||||||
|
@@ -84,6 +84,7 @@ if has_tang
|
||||||
|
test('report-tang-luks1', find_program('report-tang-luks1'), env: env, timeout: 90)
|
||||||
|
test('report-sss-luks1', find_program('report-sss-luks1'), env: env, timeout: 90)
|
||||||
|
test('edit-tang-luks1', find_program('edit-tang-luks1'), env: env, timeout: 150)
|
||||||
|
+ test('pass-tang-luks1', find_program('pass-tang-luks1'), env: env, timeout: 60)
|
||||||
|
endif
|
||||||
|
|
||||||
|
test('backup-restore-luks1', find_program('backup-restore-luks1'), env: env, timeout: 60)
|
||||||
|
@@ -111,6 +112,7 @@ if luksmeta_data.get('OLD_CRYPTSETUP') == '0'
|
||||||
|
test('report-tang-luks2', find_program('report-tang-luks2'), env: env, timeout: 120)
|
||||||
|
test('report-sss-luks2', find_program('report-sss-luks2'), env: env, timeout: 120)
|
||||||
|
test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 210)
|
||||||
|
+ test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
|
||||||
|
endif
|
||||||
|
|
||||||
|
test('backup-restore-luks2', find_program('backup-restore-luks2'), env: env, timeout: 120)
|
||||||
|
diff --git a/src/luks/tests/pass-tang-luks1 b/src/luks/tests/pass-tang-luks1
|
||||||
|
new file mode 100755
|
||||||
|
index 0000000..0d91e6c
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/luks/tests/pass-tang-luks1
|
||||||
|
@@ -0,0 +1,59 @@
|
||||||
|
+#!/bin/bash -x
|
||||||
|
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2019 Red Hat, Inc.
|
||||||
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
||||||
|
+#
|
||||||
|
+# This program is free software: you can redistribute it and/or modify
|
||||||
|
+# it under the terms of the GNU General Public License as published by
|
||||||
|
+# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
+# (at your option) any later version.
|
||||||
|
+#
|
||||||
|
+# This program is distributed in the hope that it will be useful,
|
||||||
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+# GNU General Public License for more details.
|
||||||
|
+#
|
||||||
|
+# You should have received a copy of the GNU General Public License
|
||||||
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+TEST="${0}"
|
||||||
|
+. tests-common-functions
|
||||||
|
+. clevis-luks-common-functions
|
||||||
|
+
|
||||||
|
+function on_exit() {
|
||||||
|
+ [ ! -d "${TMP}" ] && return 0
|
||||||
|
+ tang_stop "${TMP}"
|
||||||
|
+ rm -rf "${TMP}"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+trap 'on_exit' EXIT
|
||||||
|
+
|
||||||
|
+TMP=$(mktemp -d)
|
||||||
|
+
|
||||||
|
+port=$(get_random_port)
|
||||||
|
+tang_run "${TMP}" "${port}" &
|
||||||
|
+tang_wait_until_ready "${port}"
|
||||||
|
+
|
||||||
|
+url="http://localhost:${port}"
|
||||||
|
+adv="${TMP}/adv"
|
||||||
|
+tang_get_adv "${port}" "${adv}"
|
||||||
|
+
|
||||||
|
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
||||||
|
+
|
||||||
|
+# LUKS1.
|
||||||
|
+DEV="${TMP}/luks1-device"
|
||||||
|
+new_device "luks1" "${DEV}"
|
||||||
|
+
|
||||||
|
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
||||||
|
+ error "${TEST}: Bind should have succeeded."
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+# Now let's test the passphrase.
|
||||||
|
+SLT=1
|
||||||
|
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
||||||
|
+echo $PASS >&2
|
||||||
|
+if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" "${PASS}" "" "${SLT}"; then
|
||||||
|
+ error "Passphrase obtained from clevis luks pass failed."
|
||||||
|
+fi
|
||||||
|
diff --git a/src/luks/tests/pass-tang-luks2 b/src/luks/tests/pass-tang-luks2
|
||||||
|
new file mode 100755
|
||||||
|
index 0000000..2d50413
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/luks/tests/pass-tang-luks2
|
||||||
|
@@ -0,0 +1,59 @@
|
||||||
|
+#!/bin/bash -x
|
||||||
|
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2019 Red Hat, Inc.
|
||||||
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
||||||
|
+#
|
||||||
|
+# This program is free software: you can redistribute it and/or modify
|
||||||
|
+# it under the terms of the GNU General Public License as published by
|
||||||
|
+# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
+# (at your option) any later version.
|
||||||
|
+#
|
||||||
|
+# This program is distributed in the hope that it will be useful,
|
||||||
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+# GNU General Public License for more details.
|
||||||
|
+#
|
||||||
|
+# You should have received a copy of the GNU General Public License
|
||||||
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+#
|
||||||
|
+
|
||||||
|
+TEST="${0}"
|
||||||
|
+. tests-common-functions
|
||||||
|
+. clevis-luks-common-functions
|
||||||
|
+
|
||||||
|
+function on_exit() {
|
||||||
|
+ [ ! -d "${TMP}" ] && return 0
|
||||||
|
+ tang_stop "${TMP}"
|
||||||
|
+ rm -rf "${TMP}"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+trap 'on_exit' EXIT
|
||||||
|
+
|
||||||
|
+TMP=$(mktemp -d)
|
||||||
|
+
|
||||||
|
+port=$(get_random_port)
|
||||||
|
+tang_run "${TMP}" "${port}" &
|
||||||
|
+tang_wait_until_ready "${port}"
|
||||||
|
+
|
||||||
|
+url="http://localhost:${port}"
|
||||||
|
+adv="${TMP}/adv"
|
||||||
|
+tang_get_adv "${port}" "${adv}"
|
||||||
|
+
|
||||||
|
+cfg=$(printf '{"url":"%s","adv":"%s"}' "$url" "$adv")
|
||||||
|
+
|
||||||
|
+# LUKS2.
|
||||||
|
+DEV="${TMP}/luks2-device"
|
||||||
|
+new_device "luks2" "${DEV}"
|
||||||
|
+
|
||||||
|
+if ! clevis luks bind -f -d "${DEV}" tang "${cfg}" <<< "${DEFAULT_PASS}"; then
|
||||||
|
+ error "${TEST}: Bind should have succeeded."
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
+# Now let's test the passphrase.
|
||||||
|
+SLT=1
|
||||||
|
+PASS=$(clevis luks pass -d "${DEV}" -s "${SLT}")
|
||||||
|
+echo $PASS >&2
|
||||||
|
+if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" "${PASS}" "" "${SLT}"; then
|
||||||
|
+ error "Passphrase obtained from clevis luks pass failed."
|
||||||
|
+fi
|
||||||
|
--
|
||||||
|
2.29.2
|
||||||
|
|
||||||
@ -1,49 +0,0 @@
|
|||||||
From 76ad9b21b61627a728bc9499821cf8e09446725d Mon Sep 17 00:00:00 2001
|
|
||||||
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
|
|
||||||
Date: Thu, 21 Oct 2021 13:58:52 +0200
|
|
||||||
Subject: [PATCH 4/4] luks: explicitly specify pbkdf iterations to cryptsetup
|
|
||||||
|
|
||||||
This fixes an Out of memory error when the system has not much memory,
|
|
||||||
such as a VM configured with 2GB currently being installed through the
|
|
||||||
network (hence having ~1GB free memory only).
|
|
||||||
See RHBZ #1979256 (https://bugzilla.redhat.com/show_bug.cgi?id=1979256).
|
|
||||||
---
|
|
||||||
src/luks/clevis-luks-common-functions.in | 7 ++++++-
|
|
||||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/src/luks/clevis-luks-common-functions.in b/src/luks/clevis-luks-common-functions.in
|
|
||||||
index d53d2ab..360eb7e 100644
|
|
||||||
--- a/src/luks/clevis-luks-common-functions.in
|
|
||||||
+++ b/src/luks/clevis-luks-common-functions.in
|
|
||||||
@@ -760,10 +760,12 @@ clevis_luks_add_key() {
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
|
||||||
--key-slot "${SLT}" \
|
|
||||||
"${DEV}" \
|
|
||||||
+ ${pbkdf_args} \
|
|
||||||
${extra_args}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -792,11 +794,14 @@ clevis_luks_update_key() {
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
if [ -n "${in_place}" ]; then
|
|
||||||
printf '%s' "${input}" | cryptsetup luksChangeKey "${DEV}" \
|
|
||||||
--key-slot "${SLT}" \
|
|
||||||
- --batch-mode ${extra_args}
|
|
||||||
+ --batch-mode \
|
|
||||||
+ ${pbkdf_args} \
|
|
||||||
+ ${extra_args}
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
|
|
||||||
--
|
|
||||||
2.33.1
|
|
||||||
|
|
||||||
@ -0,0 +1,101 @@
|
|||||||
|
From 8f0fcf2e7384ad757042e7e6a0850f655eb70b7e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sergio Correia <scorreia@redhat.com>
|
||||||
|
Date: Thu, 18 Nov 2021 16:45:58 -0300
|
||||||
|
Subject: [PATCH 4/4] systemd: drop ncat dependency
|
||||||
|
|
||||||
|
When using systemd, i.e., clevis-luks-askpass, we use ncat to send
|
||||||
|
the decrypted password to the systemd socket as per systemd's password
|
||||||
|
agents specification [1].
|
||||||
|
|
||||||
|
However, systemd itself has a utility that does exactly that,
|
||||||
|
systemd-reply-password.
|
||||||
|
|
||||||
|
In this commit we drop the ncat dependency and instead use
|
||||||
|
systemd-reply-password in clevis-luks-askpass.
|
||||||
|
|
||||||
|
[1] https://systemd.io/PASSWORD_AGENTS/
|
||||||
|
---
|
||||||
|
...is-luks-askpass => clevis-luks-askpass.in} | 2 +-
|
||||||
|
.../systemd/dracut/clevis/module-setup.sh.in | 4 ++--
|
||||||
|
src/luks/systemd/meson.build | 19 +++++++++++++++++--
|
||||||
|
3 files changed, 20 insertions(+), 5 deletions(-)
|
||||||
|
rename src/luks/systemd/{clevis-luks-askpass => clevis-luks-askpass.in} (97%)
|
||||||
|
|
||||||
|
diff --git a/src/luks/systemd/clevis-luks-askpass b/src/luks/systemd/clevis-luks-askpass.in
|
||||||
|
similarity index 97%
|
||||||
|
rename from src/luks/systemd/clevis-luks-askpass
|
||||||
|
rename to src/luks/systemd/clevis-luks-askpass.in
|
||||||
|
index f19671f..a6699c9 100755
|
||||||
|
--- a/src/luks/systemd/clevis-luks-askpass
|
||||||
|
+++ b/src/luks/systemd/clevis-luks-askpass.in
|
||||||
|
@@ -58,7 +58,7 @@ while true; do
|
||||||
|
fi
|
||||||
|
|
||||||
|
uuid="$(cryptsetup luksUUID "${d}")"
|
||||||
|
- if ! printf '+%s' "${pt}" | ncat -U -u --send-only "${s}"; then
|
||||||
|
+ if ! printf '%s' "${pt}" | @SYSTEMD_REPLY_PASS@ 1 "${s}"; then
|
||||||
|
echo "Unable to unlock ${d} (UUID=${uuid}) with recovered passphrase" >&2
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
diff --git a/src/luks/systemd/dracut/clevis/module-setup.sh.in b/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
||||||
|
index ebf969f..d46c6e2 100755
|
||||||
|
--- a/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
||||||
|
+++ b/src/luks/systemd/dracut/clevis/module-setup.sh.in
|
||||||
|
@@ -36,6 +36,7 @@ install() {
|
||||||
|
|
||||||
|
inst_multiple \
|
||||||
|
/etc/services \
|
||||||
|
+ @SYSTEMD_REPLY_PASS@ \
|
||||||
|
@libexecdir@/clevis-luks-askpass \
|
||||||
|
clevis-luks-common-functions \
|
||||||
|
grep sed cut \
|
||||||
|
@@ -45,8 +46,7 @@ install() {
|
||||||
|
luksmeta \
|
||||||
|
clevis \
|
||||||
|
mktemp \
|
||||||
|
- jose \
|
||||||
|
- ncat
|
||||||
|
+ jose
|
||||||
|
|
||||||
|
dracut_need_initqueue
|
||||||
|
}
|
||||||
|
diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build
|
||||||
|
index 369e7f7..e3b3d91 100644
|
||||||
|
--- a/src/luks/systemd/meson.build
|
||||||
|
+++ b/src/luks/systemd/meson.build
|
||||||
|
@@ -1,6 +1,15 @@
|
||||||
|
systemd = dependency('systemd', required: false)
|
||||||
|
|
||||||
|
-if systemd.found()
|
||||||
|
+sd_reply_pass = find_program(
|
||||||
|
+ join_paths(get_option('prefix'), get_option('libdir'), 'systemd', 'systemd-reply-password'),
|
||||||
|
+ join_paths(get_option('prefix'), 'lib', 'systemd', 'systemd-reply-password'),
|
||||||
|
+ join_paths('/', 'usr', get_option('libdir'), 'systemd', 'systemd-reply-password'),
|
||||||
|
+ join_paths('/', 'usr', 'lib', 'systemd', 'systemd-reply-password'),
|
||||||
|
+ required: false
|
||||||
|
+)
|
||||||
|
+
|
||||||
|
+if systemd.found() and sd_reply_pass.found()
|
||||||
|
+ data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path())
|
||||||
|
subdir('dracut')
|
||||||
|
|
||||||
|
unitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir')
|
||||||
|
@@ -12,8 +21,14 @@ if systemd.found()
|
||||||
|
configuration: data,
|
||||||
|
)
|
||||||
|
|
||||||
|
+ configure_file(
|
||||||
|
+ input: 'clevis-luks-askpass.in',
|
||||||
|
+ output: 'clevis-luks-askpass',
|
||||||
|
+ install_dir: libexecdir,
|
||||||
|
+ configuration: data
|
||||||
|
+ )
|
||||||
|
+
|
||||||
|
install_data('clevis-luks-askpass.path', install_dir: unitdir)
|
||||||
|
- install_data('clevis-luks-askpass', install_dir: libexecdir)
|
||||||
|
else
|
||||||
|
warning('Will not install systemd support due to missing dependencies!')
|
||||||
|
endif
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
From da17589f0706b27690a11484165fd58dea1a5eb1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Sergio Correia <scorreia@redhat.com>
|
||||||
|
Date: Thu, 25 Nov 2021 19:18:03 -0300
|
||||||
|
Subject: [PATCH 5/5] Stop sending stderr to the void when decryption doesn't
|
||||||
|
happen
|
||||||
|
|
||||||
|
---
|
||||||
|
src/luks/clevis-luks-common-functions | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
||||||
|
index 879ca4c..df8e16d 100644
|
||||||
|
--- a/src/luks/clevis-luks-common-functions
|
||||||
|
+++ b/src/luks/clevis-luks-common-functions
|
||||||
|
@@ -323,7 +323,7 @@ clevis_luks_unlock_device_by_slot() {
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
- if ! passphrase="$(printf '%s' "${jwe}" | clevis decrypt 2>/dev/null)" \
|
||||||
|
+ if ! passphrase="$(printf '%s' "${jwe}" | clevis decrypt)" \
|
||||||
|
|| [ -z "${passphrase}" ]; then
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -0,0 +1,83 @@
|
|||||||
|
From ea5db9fdfaa92d2a3ec2446313dcaa00db57a0cc Mon Sep 17 00:00:00 2001
|
||||||
|
From: Renaud Metrich <rmetrich@redhat.com>
|
||||||
|
Date: Fri, 7 Jan 2022 12:13:03 -0300
|
||||||
|
Subject: [PATCH 7/7] luks: explicitly specify pbkdf iterations to cryptsetup
|
||||||
|
|
||||||
|
This fixes an Out of memory error when the system has not much memory,
|
||||||
|
such as a VM configured with 2GB currently being installed through the
|
||||||
|
network (hence having ~1GB free memory only).
|
||||||
|
See RHBZ #1979256 (https://bugzilla.redhat.com/show_bug.cgi?id=1979256).
|
||||||
|
---
|
||||||
|
src/luks/clevis-luks-bind.in | 7 +++++--
|
||||||
|
src/luks/clevis-luks-common-functions | 7 ++++++-
|
||||||
|
2 files changed, 11 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/luks/clevis-luks-bind.in b/src/luks/clevis-luks-bind.in
|
||||||
|
index 4748c08..017f762 100755
|
||||||
|
--- a/src/luks/clevis-luks-bind.in
|
||||||
|
+++ b/src/luks/clevis-luks-bind.in
|
||||||
|
@@ -169,7 +169,9 @@ if ! cryptsetup luksOpen --test-passphrase "${DEV}" \
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
+pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
if [ "$luks_type" == "luks1" ]; then
|
||||||
|
+ pbkdf_args=
|
||||||
|
# In certain circumstances, we may have LUKSMeta slots "not in sync" with
|
||||||
|
# cryptsetup, which means we will try to save LUKSMeta metadata over an
|
||||||
|
# already used or partially used slot -- github issue #70.
|
||||||
|
@@ -184,7 +186,7 @@ fi
|
||||||
|
|
||||||
|
# Add the new key.
|
||||||
|
if [ -n "$SLT" ]; then
|
||||||
|
- cryptsetup luksAddKey --key-slot "$SLT" --key-file \
|
||||||
|
+ cryptsetup luksAddKey ${pbkdf_args} --key-slot "$SLT" --key-file \
|
||||||
|
<(echo -n "$existing_key") "$DEV"
|
||||||
|
else
|
||||||
|
if [ $luks_type == "luks2" ]; then
|
||||||
|
@@ -194,7 +196,8 @@ else
|
||||||
|
readarray -t usedSlotsBeforeAddKey < <(cryptsetup luksDump "${DEV}" \
|
||||||
|
| sed -rn 's|^Key Slot ([0-7]): ENABLED$|\1|p')
|
||||||
|
fi
|
||||||
|
- cryptsetup luksAddKey --key-file <(echo -n "${existing_key}") "$DEV"
|
||||||
|
+ cryptsetup luksAddKey ${pbkdf_args} \
|
||||||
|
+ --key-file <(echo -n "${existing_key}") "$DEV"
|
||||||
|
fi < <(echo -n "${key}")
|
||||||
|
if [ $? -ne 0 ]; then
|
||||||
|
echo "Error while adding new key to LUKS header!" >&2
|
||||||
|
diff --git a/src/luks/clevis-luks-common-functions b/src/luks/clevis-luks-common-functions
|
||||||
|
index 67ece72..038cc37 100644
|
||||||
|
--- a/src/luks/clevis-luks-common-functions
|
||||||
|
+++ b/src/luks/clevis-luks-common-functions
|
||||||
|
@@ -760,10 +760,12 @@ clevis_luks_add_key() {
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
||||||
|
--key-slot "${SLT}" \
|
||||||
|
"${DEV}" \
|
||||||
|
+ ${pbkdf_args} \
|
||||||
|
${extra_args}
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -792,11 +794,14 @@ clevis_luks_update_key() {
|
||||||
|
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
||||||
|
input="$(printf '%s' "${NEWKEY}")"
|
||||||
|
fi
|
||||||
|
+ local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
||||||
|
|
||||||
|
if [ -n "${in_place}" ]; then
|
||||||
|
printf '%s' "${input}" | cryptsetup luksChangeKey "${DEV}" \
|
||||||
|
--key-slot "${SLT}" \
|
||||||
|
- --batch-mode ${extra_args}
|
||||||
|
+ --batch-mode \
|
||||||
|
+ ${pbkdf_args} \
|
||||||
|
+ ${extra_args}
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
--
|
||||||
|
2.33.1
|
||||||
|
|
||||||
@ -1,6 +1,6 @@
|
|||||||
--- clevis-18.ori/src/pins/tang/clevis-decrypt-tang 2021-04-15 13:00:19.969067600 +0200
|
--- clevis-15-ori/src/pins/tang/clevis-decrypt-tang 2020-10-28 19:55:47.673228700 +0100
|
||||||
+++ clevis-18/src/pins/tang/clevis-decrypt-tang 2022-01-20 17:29:21.859897964 +0100
|
+++ clevis-15/src/pins/tang/clevis-decrypt-tang 2022-01-21 10:37:40.327825491 +0100
|
||||||
@@ -99,10 +99,10 @@
|
@@ -73,10 +73,10 @@
|
||||||
|
|
||||||
xfr="$(jose jwk exc -i '{"alg":"ECMR"}' -l- -r- <<< "$clt$eph")"
|
xfr="$(jose jwk exc -i '{"alg":"ECMR"}' -l- -r- <<< "$clt$eph")"
|
||||||
|
|
||||||
@ -1,15 +1,14 @@
|
|||||||
--- clevis-18.ori/src/clevis 2021-04-15 13:00:19.965065700 +0200
|
--- clevis-15.ori/src/clevis 2020-10-28 19:55:47.663228800 +0100
|
||||||
+++ clevis-18/src/clevis 2022-06-20 14:29:50.148261656 +0200
|
+++ clevis-15/src/clevis 2022-06-22 11:06:27.061230653 +0200
|
||||||
@@ -27,6 +27,8 @@
|
@@ -27,6 +27,7 @@
|
||||||
}
|
}
|
||||||
|
|
||||||
cmd=clevis
|
cmd=clevis
|
||||||
+input_commands="$cmd $@"
|
+input_commands="$cmd $@"
|
||||||
+
|
|
||||||
while [ $# -gt 0 ]; do
|
while [ $# -gt 0 ]; do
|
||||||
[[ "$1" =~ ^- ]] && break
|
[[ "$1" =~ ^- ]] && break
|
||||||
cmd="$cmd-$1"
|
cmd="$cmd-$1"
|
||||||
@@ -36,8 +38,11 @@
|
@@ -36,8 +37,11 @@
|
||||||
done
|
done
|
||||||
|
|
||||||
exec >&2
|
exec >&2
|
||||||
@ -1,385 +0,0 @@
|
|||||||
--- clevis-18.ori/src/luks/clevis-luks-bind 2021-04-15 13:00:19.965065700 +0200
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-bind 2022-11-24 12:53:59.613676320 +0100
|
|
||||||
@@ -25,7 +25,7 @@
|
|
||||||
usage() {
|
|
||||||
exec >&2
|
|
||||||
echo
|
|
||||||
- echo "Usage: clevis luks bind [-y] [-f] [-s SLT] [-k KEY] [-t TOKEN_ID] -d DEV PIN CFG"
|
|
||||||
+ echo "Usage: clevis luks bind [-y] [-f] [-s SLT] [-k KEY] [-t TOKEN_ID] [-e EXISTING_TOKEN_ID] -d DEV PIN CFG"
|
|
||||||
echo
|
|
||||||
echo "$SUMMARY":
|
|
||||||
echo
|
|
||||||
@@ -42,6 +42,8 @@
|
|
||||||
echo " -k KEY Non-interactively read LUKS password from KEY file"
|
|
||||||
echo " -k - Non-interactively read LUKS password from standard input"
|
|
||||||
echo
|
|
||||||
+ echo " -e E_TKN_ID Existing LUKS token ID for existing passphrase; only available for LUKS2"
|
|
||||||
+ echo
|
|
||||||
exit 2
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -52,13 +54,14 @@
|
|
||||||
|
|
||||||
FRC=
|
|
||||||
YES=
|
|
||||||
-while getopts ":hfyd:s:k:t:" o; do
|
|
||||||
+while getopts ":hfyd:s:k:t:e:" o; do
|
|
||||||
case "$o" in
|
|
||||||
f) FRC='-f';;
|
|
||||||
d) DEV="$OPTARG";;
|
|
||||||
s) SLT="$OPTARG";;
|
|
||||||
k) KEY="$OPTARG";;
|
|
||||||
t) TOKEN_ID="$OPTARG";;
|
|
||||||
+ e) EXISTING_TOKEN_ID="$OPTARG";;
|
|
||||||
y) FRC='-f'
|
|
||||||
YES='-y';;
|
|
||||||
*) usage;;
|
|
||||||
@@ -99,11 +102,20 @@
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
+if [ -n "${EXISTING_TOKEN_ID}" ] && ! clevis_luks_luks2_existing_token_id_supported; then
|
|
||||||
+ echo "Existing token ID not supported in this cryptsetup version" >&2
|
|
||||||
+ exit 1
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
# Get the existing passphrase/keyfile.
|
|
||||||
existing_key=
|
|
||||||
keyfile=
|
|
||||||
case "${KEY}" in
|
|
||||||
-"") IFS= read -r -s -p "Enter existing LUKS password: " existing_key; echo >&2;;
|
|
||||||
+ "")
|
|
||||||
+ if [ -z "${EXISTING_TOKEN_ID}" ] ; then
|
|
||||||
+ IFS= read -r -s -p "Enter existing LUKS password: " existing_key; echo >&2
|
|
||||||
+ fi
|
|
||||||
+ ;;
|
|
||||||
-) IFS= read -r -s -p "" existing_key ||:
|
|
||||||
if [ "${luks_type}" = "luks1" ] && ! luksmeta test -d "${DEV}" \
|
|
||||||
&& [ -z "${FRC}" ]; then
|
|
||||||
@@ -119,6 +131,13 @@
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
+# Check if existing token id for keyring read is provided
|
|
||||||
+# If so, keyfile is not allowed
|
|
||||||
+if [ -n "${EXISTING_TOKEN_ID}" ] && [ -n "${keyfile}" ] ; then
|
|
||||||
+ echo "Cannot specify kernel keyring description together with key file" >&2
|
|
||||||
+ exit 1
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
# If necessary, initialize the LUKS volume.
|
|
||||||
if [ "${luks_type}" = "luks1" ] && ! luksmeta test -d "${DEV}"; then
|
|
||||||
luksmeta init -d "${DEV}" ${FRC}
|
|
||||||
@@ -127,7 +146,7 @@
|
|
||||||
if ! clevis_luks_do_bind "${DEV}" "${SLT}" "${TOKEN_ID}" \
|
|
||||||
"${PIN}" "${CFG}" \
|
|
||||||
"${YES}" "" \
|
|
||||||
- "${existing_key}" "${keyfile}"; then
|
|
||||||
+ "${existing_key}" "${keyfile}" "${EXISTING_TOKEN_ID}"; then
|
|
||||||
echo "Error adding new binding to ${DEV}" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
--- clevis-18.ori/src/luks/clevis-luks-bind.1.adoc 2021-04-15 13:00:19.965065700 +0200
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-bind.1.adoc 2022-11-24 12:54:48.476829197 +0100
|
|
||||||
@@ -9,7 +9,7 @@
|
|
||||||
|
|
||||||
== SYNOPSIS
|
|
||||||
|
|
||||||
-*clevis luks bind* [-f] [-y] -d DEV [-t TKN_ID] [-s SLT] [-k KEY] PIN CFG
|
|
||||||
+*clevis luks bind* [-f] [-y] -d DEV [-t TKN_ID] [-s SLT] [-k KEY] [-e EXISTING_TOKEN_ID] PIN CFG
|
|
||||||
|
|
||||||
== OVERVIEW
|
|
||||||
|
|
||||||
@@ -54,6 +54,12 @@
|
|
||||||
* *-k* - :
|
|
||||||
Non-interactively read LUKS password from standard input
|
|
||||||
|
|
||||||
+* *-e* _E_TKN_ID_ :
|
|
||||||
+ LUKS token ID for existing passphrase; only available for LUKS2.
|
|
||||||
+ This parameter allows providing a configured token ID in LUKS2
|
|
||||||
+ containing the existing passphrase for this device, so that
|
|
||||||
+ existing passphrase is not prompted by clevis
|
|
||||||
+
|
|
||||||
== CAVEATS
|
|
||||||
|
|
||||||
This command does not change the LUKS master key. This implies that if you
|
|
||||||
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2022-11-24 12:46:09.130204312 +0100
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2022-11-24 13:01:57.087170193 +0100
|
|
||||||
@@ -307,9 +307,10 @@
|
|
||||||
local KEY="${2:-}"
|
|
||||||
local KEYFILE="${3:-}"
|
|
||||||
local SLT="${4:-}"
|
|
||||||
+ local EXISTING_TOKEN_ID="${5:-}"
|
|
||||||
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
- [ -z "${KEYFILE}" ] && [ -z "${KEY}" ] && return 1
|
|
||||||
+ [ -z "${EXISTING_TOKEN_ID}" ] && [ -z "${KEYFILE}" ] && [ -z "${KEY}" ] && return 1
|
|
||||||
|
|
||||||
local extra_args
|
|
||||||
extra_args="$([ -n "${SLT}" ] && printf -- '--key-slot %s' "${SLT}")"
|
|
||||||
@@ -318,6 +319,11 @@
|
|
||||||
${extra_args}
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
|
||||||
+ cryptsetup open --test-passphrase "${DEV}" --token-id "${EXISTING_TOKEN_ID}" \
|
|
||||||
+ ${extra_args}
|
|
||||||
+ return
|
|
||||||
+ fi
|
|
||||||
|
|
||||||
printf '%s' "${KEY}" | cryptsetup open --test-passphrase "${DEV}" \
|
|
||||||
${extra_args}
|
|
||||||
@@ -753,10 +759,11 @@
|
|
||||||
local NEWKEY="${3}"
|
|
||||||
local KEY="${4}"
|
|
||||||
local KEYFILE="${5:-}"
|
|
||||||
+ local EXISTING_TOKEN_ID="${6:-}"
|
|
||||||
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
[ -z "${NEWKEY}" ] && return 1
|
|
||||||
- [ -z "${KEY}" ] && [ -z "${KEYFILE}" ] && return 1
|
|
||||||
+ [ -z "${EXISTING_TOKEN_ID}" ] && [ -z "${KEY}" ] && [ -z "${KEYFILE}" ] && return 1
|
|
||||||
|
|
||||||
local extra_args='' input
|
|
||||||
input="$(printf '%s\n%s' "${KEY}" "${NEWKEY}")"
|
|
||||||
@@ -764,6 +771,10 @@
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
|
||||||
+ extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
|
||||||
+ input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
+ fi
|
|
||||||
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
|
||||||
@@ -780,6 +791,7 @@
|
|
||||||
local NEWKEY="${3}"
|
|
||||||
local KEY="${4}"
|
|
||||||
local KEYFILE="${5:-}"
|
|
||||||
+ local EXISTING_TOKEN_ID="${6:-}"
|
|
||||||
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
[ -z "${NEWKEY}" ] && return 1
|
|
||||||
@@ -789,7 +801,7 @@
|
|
||||||
local in_place
|
|
||||||
clevis_luks_check_valid_key_or_keyfile "${DEV}" \
|
|
||||||
"${KEY}" "${KEYFILE}" \
|
|
||||||
- "${SLT}" 2>/dev/null \
|
|
||||||
+ "${SLT}" "${EXISTING_TOKEN_ID}" 2>/dev/null \
|
|
||||||
&& in_place=true
|
|
||||||
|
|
||||||
local input extra_args=
|
|
||||||
@@ -798,6 +810,10 @@
|
|
||||||
extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
+ if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
|
||||||
+ extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
|
||||||
+ input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
+ fi
|
|
||||||
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
if [ -n "${in_place}" ]; then
|
|
||||||
@@ -844,13 +860,13 @@
|
|
||||||
[ -n "${OVERWRITE}" ] || return 1
|
|
||||||
|
|
||||||
clevis_luks_update_key "${DEV}" "${SLT}" \
|
|
||||||
- "${NEWKEY}" "${KEY}" "${KEYFILE}"
|
|
||||||
+ "${NEWKEY}" "${KEY}" "${KEYFILE}" "${EXISTING_TOKEN_ID}"
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Add a new key.
|
|
||||||
clevis_luks_add_key "${DEV}" "${SLT}" \
|
|
||||||
- "${NEWKEY}" "${KEY}" "${KEYFILE}"
|
|
||||||
+ "${NEWKEY}" "${KEY}" "${KEYFILE}" "${EXISTING_TOKEN_ID}"
|
|
||||||
}
|
|
||||||
|
|
||||||
# clevis_luks_generate_key() generates a new key for use with clevis.
|
|
||||||
@@ -942,6 +958,7 @@
|
|
||||||
local OVERWRITE="${7:-}"
|
|
||||||
local KEY="${8:-}"
|
|
||||||
local KEYFILE="${9:-}"
|
|
||||||
+ local EXISTING_TOKEN_ID="${10:-}"
|
|
||||||
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
[ -z "${PIN}" ] && return 1
|
|
||||||
@@ -951,6 +968,8 @@
|
|
||||||
if ! clevis_luks_check_valid_key_or_keyfile "${DEV}" \
|
|
||||||
"${KEY}" \
|
|
||||||
"${KEYFILE}" \
|
|
||||||
+ "" \
|
|
||||||
+ "${EXISTING_TOKEN_ID}" \
|
|
||||||
&& ! KEY="$(clevis_luks_get_existing_key "${DEV}" \
|
|
||||||
"Enter existing LUKS password: " \
|
|
||||||
"recover")"; then
|
|
||||||
@@ -995,7 +1014,7 @@
|
|
||||||
|
|
||||||
if ! clevis_luks_save_key_to_slot "${DEV}" "${SLT}" \
|
|
||||||
"${newkey}" "${KEY}" "${KEYFILE}" \
|
|
||||||
- "${OVERWRITE}"; then
|
|
||||||
+ "${OVERWRITE}" "${EXISTING_TOKEN_ID}"; then
|
|
||||||
echo "Unable to save/update key slot; operation cancelled" >&2
|
|
||||||
clevis_luks_restore_dev "${CLEVIS_TMP_DIR}" || :
|
|
||||||
rm -rf "${CLEVIS_TMP_DIR}"
|
|
||||||
@@ -1016,12 +1035,19 @@
|
|
||||||
}
|
|
||||||
|
|
||||||
# clevis_luks_luks2_supported() indicates whether we support LUKS2 devices.
|
|
||||||
-# Suppor is determined at build time.
|
|
||||||
+# Support is determined at build time.
|
|
||||||
function clevis_luks_luks2_supported() {
|
|
||||||
# We require cryptsetup >= 2.0.4 to fully support LUKSv2.
|
|
||||||
return @OLD_CRYPTSETUP@
|
|
||||||
}
|
|
||||||
|
|
||||||
+# clevis_luks_luks2_existing_token_id_supported() indicates whether
|
|
||||||
+# cryptsetup allows token id for passphrase providing
|
|
||||||
+function clevis_luks_luks2_existing_token_id_supported() {
|
|
||||||
+ # We require cryptsetup >= 2.6.0 to fully support LUKSv2 addkey/open by token ID
|
|
||||||
+ return @OLD_CRYPTSETUP_EXISTING_TOKEN_ID@
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# clevis_luks_type() returns the LUKS type of a device, e.g. "luks1".
|
|
||||||
clevis_luks_type() {
|
|
||||||
local DEV="${1}"
|
|
||||||
--- clevis-18.ori/src/luks/meson.build 2021-04-15 13:00:19.965065700 +0200
|
|
||||||
+++ clevis-18/src/luks/meson.build 2022-11-24 13:02:39.118301695 +0100
|
|
||||||
@@ -14,6 +14,15 @@
|
|
||||||
endif
|
|
||||||
endif
|
|
||||||
|
|
||||||
+libcryptsetup_ext_token_id = dependency('libcryptsetup', version: '>=2.6.0', required: false)
|
|
||||||
+if libcryptsetup_ext_token_id.found()
|
|
||||||
+ luksmeta_data.set('OLD_CRYPTSETUP_EXISTING_TOKEN_ID', '0')
|
|
||||||
+ message('cryptsetup version supports existing token id')
|
|
||||||
+else
|
|
||||||
+ luksmeta_data.set('OLD_CRYPTSETUP_EXISTING_TOKEN_ID', '1')
|
|
||||||
+ warning('cryptsetup version does not support existing token id')
|
|
||||||
+endif
|
|
||||||
+
|
|
||||||
clevis_luks_common_functions = configure_file(
|
|
||||||
input: 'clevis-luks-common-functions.in',
|
|
||||||
output: 'clevis-luks-common-functions',
|
|
||||||
--- clevis-18.ori/src/luks/tests/bind-luks2-ext-token 1970-01-01 01:00:00.000000000 +0100
|
|
||||||
+++ clevis-18/src/luks/tests/bind-luks2-ext-token 2022-11-24 13:04:30.742650939 +0100
|
|
||||||
@@ -0,0 +1,74 @@
|
|
||||||
+#!/bin/bash -ex
|
|
||||||
+# vim: set tabstop=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
|
||||||
+#
|
|
||||||
+# Copyright (c) 2022 Red Hat, Inc.
|
|
||||||
+# Author: Sergio Arroutbi <sarroutb@redhat.com>
|
|
||||||
+#
|
|
||||||
+# This program is free software: you can redistribute it and/or modify
|
|
||||||
+# it under the terms of the GNU General Public License as published by
|
|
||||||
+# the Free Software Foundation, either version 3 of the License, or
|
|
||||||
+# (at your option) any later version.
|
|
||||||
+#
|
|
||||||
+# This program is distributed in the hope that it will be useful,
|
|
||||||
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
+# GNU General Public License for more details.
|
|
||||||
+#
|
|
||||||
+# You should have received a copy of the GNU General Public License
|
|
||||||
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
+#
|
|
||||||
+
|
|
||||||
+TEST=$(basename "${0}")
|
|
||||||
+. tests-common-functions
|
|
||||||
+
|
|
||||||
+on_exit() {
|
|
||||||
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+create_existing_token_id_from_keyring() {
|
|
||||||
+ local DEV="${1}"
|
|
||||||
+ local KEYDESC="${2}"
|
|
||||||
+ local TOKEN_ID="${3}"
|
|
||||||
+ local PASS="${4}"
|
|
||||||
+ if [[ -z "${DEV}" ]] || [[ -z "${KEYDESC}" ]] || [[ -z "${TOKEN_ID}" ]]; then
|
|
||||||
+ return 1
|
|
||||||
+ fi
|
|
||||||
+ KEYRING_ID=$(keyctl add user "${KEYDESC}" "${PASS}" @s)
|
|
||||||
+ keyctl print "${KEYRING_ID}" 2>/dev/null 1>/dev/null
|
|
||||||
+ cryptsetup token add --token-id "${TOKEN_ID}" --key-description "${KEYDESC}" "${DEV}"
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+if ! luks2_supported; then
|
|
||||||
+ skip_test "${TEST}: LUKS2 is not supported."
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+if ! luks2_existing_token_id_supported; then
|
|
||||||
+ skip_test "${TEST}: Existing token ID not supported"
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+trap 'on_exit' EXIT
|
|
||||||
+trap 'exit' ERR
|
|
||||||
+
|
|
||||||
+TMP="$(mktemp -d)"
|
|
||||||
+
|
|
||||||
+ADV="${TMP}/adv.jws"
|
|
||||||
+tang_create_adv "${TMP}" "${ADV}"
|
|
||||||
+CFG="$(printf '{"url":"foobar","adv":"%s"}' "$ADV")"
|
|
||||||
+
|
|
||||||
+EXISTING_TOKEN_ID=5
|
|
||||||
+KEYDESC="testkey"
|
|
||||||
+PASS="123exttokenid_"
|
|
||||||
+DEV="${TMP}/luks2-device-ext-token"
|
|
||||||
+new_device "luks2" "${DEV}" "${PASS}"
|
|
||||||
+
|
|
||||||
+create_existing_token_id_from_keyring "${DEV}" "${KEYDESC}" "${EXISTING_TOKEN_ID}" "${PASS}"
|
|
||||||
+
|
|
||||||
+if ! clevis luks bind -y -d "${DEV}" -e "${EXISTING_TOKEN_ID}" tang "${CFG}"; then
|
|
||||||
+ error "${TEST}: Binding expected to succeed with existing token id:${EXISTING_TOKEN_ID}" >&2
|
|
||||||
+fi
|
|
||||||
+
|
|
||||||
+KEYFILE="${TMP}/keyfile.txt"
|
|
||||||
+touch "${KEYFILE}"
|
|
||||||
+if clevis luks bind -y -d "${DEV}" -e "${EXISTING_TOKEN_ID}" -k "${KEYFILE}" tang "${CFG}"; then
|
|
||||||
+ error "${TEST}: Using existing token id and keyfile should dump an error" >&2
|
|
||||||
+fi
|
|
||||||
--- clevis-18.ori/src/luks/tests/meson.build 2021-04-15 13:00:19.967066500 +0200
|
|
||||||
+++ clevis-18/src/luks/tests/meson.build 2022-11-24 13:06:36.096043131 +0100
|
|
||||||
@@ -5,6 +5,15 @@
|
|
||||||
# given token slot.
|
|
||||||
cryptsetup = find_program('cryptsetup', required: true)
|
|
||||||
|
|
||||||
+# Use keyctl to check an existing token id can be created from
|
|
||||||
+# kernel keyring password
|
|
||||||
+keyutils = find_program('keyctl', required: false)
|
|
||||||
+if keyutils.found()
|
|
||||||
+ message('keyutils installed')
|
|
||||||
+else
|
|
||||||
+ warning('keyutils not installed, unable to test existing token id binding')
|
|
||||||
+endif
|
|
||||||
+
|
|
||||||
common_functions = configure_file(input: 'tests-common-functions.in',
|
|
||||||
output: 'tests-common-functions',
|
|
||||||
configuration: luksmeta_data,
|
|
||||||
@@ -69,6 +78,10 @@
|
|
||||||
test('unbind-unbound-slot-luks2', find_program('unbind-unbound-slot-luks2'), env: env)
|
|
||||||
test('unbind-luks2', find_program('unbind-luks2'), env: env, timeout: 60)
|
|
||||||
|
|
||||||
+ if keyutils.found() and luksmeta_data.get('OLD_CRYPTSETUP_EXISTING_TOKEN_ID') == '0'
|
|
||||||
+ test('bind-luks2-ext-token', find_program('bind-luks2-ext-token'), env: env, timeout: 60)
|
|
||||||
+ endif
|
|
||||||
+
|
|
||||||
if jq.found()
|
|
||||||
test('list-recursive-luks2', find_program('list-recursive-luks2'), env: env, timeout: 60)
|
|
||||||
test('list-tang-luks2', find_program('list-tang-luks2'), env: env, timeout: 60)
|
|
||||||
--- clevis-18.ori/src/luks/tests/tests-common-functions.in 2021-04-15 13:00:19.967066500 +0200
|
|
||||||
+++ clevis-18/src/luks/tests/tests-common-functions.in 2022-11-24 13:06:24.376006462 +0100
|
|
||||||
@@ -36,6 +36,12 @@
|
|
||||||
return @OLD_CRYPTSETUP@
|
|
||||||
}
|
|
||||||
|
|
||||||
+# We require cryptsetup >= 2.6.0 to fully support LUKSv2 addkey/open by token ID
|
|
||||||
+# Support is determined at build time.
|
|
||||||
+luks2_existing_token_id_supported() {
|
|
||||||
+ return @OLD_CRYPTSETUP_EXISTING_TOKEN_ID@
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
# Creates a new LUKS1 or LUKS2 device to be used.
|
|
||||||
new_device() {
|
|
||||||
local LUKS="${1}"
|
|
||||||
@ -1,6 +1,6 @@
|
|||||||
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-01-12 11:00:00.927790464 +0100
|
--- clevis-15.ori/src/luks/clevis-luks-common-functions 2023-01-11 11:11:03.050262054 +0100
|
||||||
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-01-12 11:05:53.528590215 +0100
|
+++ clevis-15/src/luks/clevis-luks-common-functions 2023-01-11 11:19:16.004358405 +0100
|
||||||
@@ -418,7 +418,12 @@
|
@@ -413,7 +413,12 @@
|
||||||
clevis_devices=
|
clevis_devices=
|
||||||
|
|
||||||
# Build list of devices to unlock.
|
# Build list of devices to unlock.
|
||||||
@ -1,42 +0,0 @@
|
|||||||
--- clevis-18.ori/src/clevis.1.adoc 2021-04-15 13:00:19.965065700 +0200
|
|
||||||
+++ clevis-18/src/clevis.1.adoc 2023-01-13 12:08:31.162012856 +0100
|
|
||||||
@@ -101,7 +101,7 @@
|
|
||||||
|
|
||||||
This command performs four steps:
|
|
||||||
|
|
||||||
-1. Creates a new key with the same entropy as the LUKS master key.
|
|
||||||
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
|
||||||
2. Encrypts the new key with Clevis.
|
|
||||||
3. Stores the Clevis JWE in the LUKS header.
|
|
||||||
4. Enables the new key for use with LUKS.
|
|
||||||
--- clevis-18.ori/src/luks/clevis-luks-bind.1.adoc 2023-01-13 12:02:52.005243591 +0100
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-bind.1.adoc 2023-01-13 12:08:05.873955501 +0100
|
|
||||||
@@ -20,7 +20,7 @@
|
|
||||||
|
|
||||||
This command performs four steps:
|
|
||||||
|
|
||||||
-1. Creates a new key with the same entropy as the LUKS master key.
|
|
||||||
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
|
||||||
2. Encrypts the new key with Clevis.
|
|
||||||
3. Stores the Clevis JWE in the LUKS header.
|
|
||||||
4. Enables the new key for use with LUKS.
|
|
||||||
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-01-13 12:02:52.005243591 +0100
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-01-13 12:06:29.233736316 +0100
|
|
||||||
@@ -875,6 +875,7 @@
|
|
||||||
[ -z "${DEV}" ] && return 1
|
|
||||||
|
|
||||||
local dump filter bits
|
|
||||||
+ local MAX_ENTROPY_BITS=256 # Maximum allowed by pwmake.
|
|
||||||
dump=$(cryptsetup luksDump "${DEV}")
|
|
||||||
if cryptsetup isLuks --type luks1 "${DEV}"; then
|
|
||||||
filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
|
||||||
@@ -886,6 +887,9 @@
|
|
||||||
fi
|
|
||||||
|
|
||||||
bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
|
||||||
+ if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
|
||||||
+ bits="${MAX_ENTROPY_BITS}"
|
|
||||||
+ fi
|
|
||||||
pwmake "${bits}"
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -0,0 +1,73 @@
|
|||||||
|
--- clevis-15.ori/src/clevis.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
||||||
|
+++ clevis-15/src/clevis.1.adoc 2023-01-11 17:18:29.967295005 +0100
|
||||||
|
@@ -101,7 +101,7 @@
|
||||||
|
|
||||||
|
This command performs four steps:
|
||||||
|
|
||||||
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||||||
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||||||
|
2. Encrypts the new key with Clevis.
|
||||||
|
3. Stores the Clevis JWE in the LUKS header.
|
||||||
|
4. Enables the new key for use with LUKS.
|
||||||
|
--- clevis-15.ori/src/luks/clevis-luks-bind.1.adoc 2020-10-28 19:55:47.663228800 +0100
|
||||||
|
+++ clevis-15/src/luks/clevis-luks-bind.1.adoc 2023-01-11 17:18:55.239351209 +0100
|
||||||
|
@@ -20,7 +20,7 @@
|
||||||
|
|
||||||
|
This command performs four steps:
|
||||||
|
|
||||||
|
-1. Creates a new key with the same entropy as the LUKS master key.
|
||||||
|
+1. Creates a new key with the same entropy as the LUKS master key -- maximum entropy bits is 256.
|
||||||
|
2. Encrypts the new key with Clevis.
|
||||||
|
3. Stores the Clevis JWE in the LUKS header.
|
||||||
|
4. Enables the new key for use with LUKS.
|
||||||
|
--- clevis-15.ori/src/luks/clevis-luks-common-functions 2023-01-11 17:15:44.984928070 +0100
|
||||||
|
+++ clevis-15/src/luks/clevis-luks-common-functions 2023-01-11 17:20:53.238613637 +0100
|
||||||
|
@@ -865,6 +865,7 @@
|
||||||
|
[ -z "${DEV}" ] && return 1
|
||||||
|
|
||||||
|
local dump filter bits
|
||||||
|
+ local MAX_ENTROPY_BITS=256
|
||||||
|
dump=$(cryptsetup luksDump "${DEV}")
|
||||||
|
if cryptsetup isLuks --type luks1 "${DEV}"; then
|
||||||
|
filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
||||||
|
@@ -876,6 +877,9 @@
|
||||||
|
fi
|
||||||
|
|
||||||
|
bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
||||||
|
+ if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
||||||
|
+ bits="${MAX_ENTROPY_BITS}"
|
||||||
|
+ fi
|
||||||
|
pwmake "${bits}"
|
||||||
|
}
|
||||||
|
|
||||||
|
--- clevis-15.ori/src/luks/clevis-luks-bind.in 2023-01-11 17:15:44.815927694 +0100
|
||||||
|
+++ clevis-15/src/luks/clevis-luks-bind.in 2023-01-12 16:20:30.266404993 +0100
|
||||||
|
@@ -19,6 +19,8 @@
|
||||||
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
#
|
||||||
|
|
||||||
|
+. clevis-luks-common-functions
|
||||||
|
+
|
||||||
|
SUMMARY="Binds a LUKS device using the specified policy"
|
||||||
|
UUID=cb6e8904-81ff-40da-a84a-07ab9ab5715e
|
||||||
|
|
||||||
|
@@ -139,14 +141,11 @@
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Generate a key with the same entropy as the LUKS Master Key
|
||||||
|
-key="$(pwmake "$(
|
||||||
|
-cryptsetup luksDump "$DEV" \
|
||||||
|
- | if [ "$luks_type" == "luks1" ]; then
|
||||||
|
- sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p'
|
||||||
|
- else
|
||||||
|
- sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p'
|
||||||
|
- fi | sort -n | tail -n 1
|
||||||
|
-)")"
|
||||||
|
+if ! key="$(clevis_luks_generate_key "${DEV}")" \
|
||||||
|
+ || [ -z "${key}" ]; then
|
||||||
|
+ echo "Unable to generate key for ${DEV}" >&2
|
||||||
|
+ return 1
|
||||||
|
+fi
|
||||||
|
|
||||||
|
# Encrypt the new key
|
||||||
|
jwe="$(echo -n "$key" | clevis encrypt "$PIN" "$CFG" "${YES}")"
|
||||||
@ -1,5 +1,5 @@
|
|||||||
--- clevis-18.ori/src/luks/clevis-luks-edit 2021-04-15 13:00:19.965065700 +0200
|
--- clevis-15.ori/src/luks/clevis-luks-edit 2020-10-28 19:55:47.663228800 +0100
|
||||||
+++ clevis-18/src/luks/clevis-luks-edit 2023-01-16 10:24:18.555971552 +0100
|
+++ clevis-15/src/luks/clevis-luks-edit 2023-01-16 12:03:14.006998399 +0100
|
||||||
@@ -173,7 +173,7 @@
|
@@ -173,7 +173,7 @@
|
||||||
|
|
||||||
echo "Updating binding..."
|
echo "Updating binding..."
|
||||||
@ -1,98 +0,0 @@
|
|||||||
--- clevis-18.ori/src/luks/meson.build 2023-06-01 15:28:51.615436832 +0200
|
|
||||||
+++ clevis-18/src/luks/meson.build 2023-06-01 15:31:02.420366592 +0200
|
|
||||||
@@ -1,7 +1,6 @@
|
|
||||||
|
|
||||||
luksmeta_data = configuration_data()
|
|
||||||
luksmeta = dependency('luksmeta', version: '>=8', required: false)
|
|
||||||
-pwmake = find_program('pwmake', required: false)
|
|
||||||
|
|
||||||
libcryptsetup = dependency('libcryptsetup', version: '>=2.0.4', required: false)
|
|
||||||
if libcryptsetup.found()
|
|
||||||
@@ -33,7 +32,7 @@
|
|
||||||
output: 'clevis-luks-unbind',
|
|
||||||
configuration: luksmeta_data)
|
|
||||||
|
|
||||||
-if libcryptsetup.found() and luksmeta.found() and pwmake.found()
|
|
||||||
+if libcryptsetup.found() and luksmeta.found()
|
|
||||||
subdir('systemd')
|
|
||||||
subdir('udisks2')
|
|
||||||
|
|
||||||
--- clevis-18.ori/src/luks/clevis-luks-common-functions.in 2023-06-01 15:28:51.656437123 +0200
|
|
||||||
+++ clevis-18/src/luks/clevis-luks-common-functions.in 2023-06-02 17:31:52.430534483 +0200
|
|
||||||
@@ -20,6 +20,11 @@
|
|
||||||
|
|
||||||
CLEVIS_UUID="cb6e8904-81ff-40da-a84a-07ab9ab5715e"
|
|
||||||
|
|
||||||
+# Length, in bytes, used for password generated for LUKS key
|
|
||||||
+# This value corresponds to an entropy of 256 bits if the password
|
|
||||||
+# was generated by pwmake or similar tool
|
|
||||||
+JOSE_PASSWORD_LENGTH=40
|
|
||||||
+
|
|
||||||
enable_debugging() {
|
|
||||||
# Automatically enable debugging if in initramfs phase and rd.debug
|
|
||||||
if [ -e /usr/lib/dracut-lib.sh ]; then
|
|
||||||
@@ -782,7 +787,7 @@
|
|
||||||
fi
|
|
||||||
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
|
|
||||||
- printf '%s' "${input}" | cryptsetup luksAddKey --batch-mode \
|
|
||||||
+ printf '%s' "${input}" | cryptsetup luksAddKey --force-password --batch-mode \
|
|
||||||
--key-slot "${SLT}" \
|
|
||||||
"${DEV}" \
|
|
||||||
${pbkdf_args} \
|
|
||||||
@@ -812,11 +817,11 @@
|
|
||||||
local input extra_args=
|
|
||||||
input="$(printf '%s\n%s' "${KEY}" "${NEWKEY}")"
|
|
||||||
if [ -n "${KEYFILE}" ]; then
|
|
||||||
- extra_args="$(printf -- '--key-file %s' "${KEYFILE}")"
|
|
||||||
+ extra_args="$(printf -- '--key-file %s --force-password' "${KEYFILE}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
if [ -n "${EXISTING_TOKEN_ID}" ]; then
|
|
||||||
- extra_args="$(printf -- '--token-id %s' "${EXISTING_TOKEN_ID}")"
|
|
||||||
+ extra_args="$(printf -- '--token-id %s --force-password' "${EXISTING_TOKEN_ID}")"
|
|
||||||
input="$(printf '%s' "${NEWKEY}")"
|
|
||||||
fi
|
|
||||||
local pbkdf_args="--pbkdf pbkdf2 --pbkdf-force-iterations 1000"
|
|
||||||
@@ -876,26 +881,10 @@
|
|
||||||
|
|
||||||
# clevis_luks_generate_key() generates a new key for use with clevis.
|
|
||||||
clevis_luks_generate_key() {
|
|
||||||
- local DEV="${1}"
|
|
||||||
- [ -z "${DEV}" ] && return 1
|
|
||||||
-
|
|
||||||
- local dump filter bits
|
|
||||||
- local MAX_ENTROPY_BITS=256 # Maximum allowed by pwmake.
|
|
||||||
- dump=$(cryptsetup luksDump "${DEV}")
|
|
||||||
- if cryptsetup isLuks --type luks1 "${DEV}"; then
|
|
||||||
- filter="$(echo "${dump}" | sed -rn 's|MK bits:[ \t]*([0-9]+)|\1|p')"
|
|
||||||
- elif cryptsetup isLuks --type luks2 "${DEV}"; then
|
|
||||||
- filter="$(echo -n "${dump}" | \
|
|
||||||
- sed -rn 's|^\s+Key:\s+([0-9]+) bits\s*$|\1|p')"
|
|
||||||
- else
|
|
||||||
- return 1
|
|
||||||
- fi
|
|
||||||
-
|
|
||||||
- bits="$(echo -n "${filter}" | sort -n | tail -n 1)"
|
|
||||||
- if [ "${bits}" -gt "${MAX_ENTROPY_BITS}" ]; then
|
|
||||||
- bits="${MAX_ENTROPY_BITS}"
|
|
||||||
- fi
|
|
||||||
- pwmake "${bits}"
|
|
||||||
+ local input
|
|
||||||
+ input=$(printf '{"kty":"oct","bytes":%s}' "${JOSE_PASSWORD_LENGTH}")
|
|
||||||
+ jose jwk gen --input="${input}" --output=- \
|
|
||||||
+ | jose fmt --json=- --object --get k --unquote=-
|
|
||||||
}
|
|
||||||
|
|
||||||
# clevis_luks_token_id_by_slot() returns the token ID linked to a
|
|
||||||
@@ -986,8 +975,8 @@
|
|
||||||
fi
|
|
||||||
|
|
||||||
local newkey jwe
|
|
||||||
- if ! newkey="$(clevis_luks_generate_key "${DEV}")" \
|
|
||||||
- || [ -z "${newkey}" ]; then
|
|
||||||
+
|
|
||||||
+ if ! newkey="$(clevis_luks_generate_key)" || [ -z "${newkey}" ]; then
|
|
||||||
echo "Unable to generate a new key" >&2
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
@ -0,0 +1,219 @@
|
|||||||
|
--- clevis-15.ori/src/pins/tang/clevis-decrypt-tang 2023-05-23 11:29:59.717465656 +0200
|
||||||
|
+++ clevis-15/src/pins/tang/clevis-decrypt-tang 2023-05-23 11:49:02.950511503 +0200
|
||||||
|
@@ -50,12 +50,30 @@
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
-if ! srv="$(jose fmt -j- -Og clevis -g tang -g adv -Oo- <<< "$jhd" \
|
||||||
|
- | jose jwk thp -i- -f "$kid")"; then
|
||||||
|
+if ! keys="$(jose fmt -j- -Og clevis -g tang -g adv -Oo- <<< "${jhd}")"; then
|
||||||
|
echo "JWE missing required 'clevis.tang.adv' header parameter!" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
+# Check if the thumbprint we have in `kid' is in the advertised keys.
|
||||||
|
+CLEVIS_DEFAULT_THP_ALG=S1 # SHA-1
|
||||||
|
+CLEVIS_ALTERNATIVE_THP_ALGS=S256 # SHA-256
|
||||||
|
+
|
||||||
|
+if ! srv="$(jose jwk thp -i- -f "${kid}" -a "${CLEVIS_DEFAULT_THP_ALG}" \
|
||||||
|
+ <<< "${keys}")"; then
|
||||||
|
+ # `kid' thumprint not in the advertised keys, but it's possible it was
|
||||||
|
+ # generated using a different algorithm than the default one.
|
||||||
|
+ # Let us try the alternative supported algorithms to make sure `kid'
|
||||||
|
+ # really is not part of the advertised keys.
|
||||||
|
+ for alg in ${CLEVIS_ALTERNATIVE_THP_ALGS}; do
|
||||||
|
+ srv="$(jose jwk thp -i- -f "$kid" -a "${alg}" <<< "${keys}")" && break
|
||||||
|
+ done
|
||||||
|
+ if [ -z "${srv}" ]; then
|
||||||
|
+ echo "JWE header validation of 'clevis.tang.adv' failed: key thumbprint does not match" >&2
|
||||||
|
+ exit 1
|
||||||
|
+ fi
|
||||||
|
+fi
|
||||||
|
+
|
||||||
|
if ! url="$(jose fmt -j- -Og clevis -g tang -g url -Su- <<< "$jhd")"; then
|
||||||
|
echo "JWE missing required 'clevis.tang.url' header parameter!" >&2
|
||||||
|
exit 1
|
||||||
|
--- clevis-15.ori/src/pins/tang/clevis-encrypt-tang 2020-10-28 19:55:47.673228700 +0100
|
||||||
|
+++ clevis-15/src/pins/tang/clevis-encrypt-tang 2023-05-23 15:15:18.440099403 +0200
|
||||||
|
@@ -64,6 +64,9 @@
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
+CLEVIS_DEFAULT_THP_ALG=S1 # SHA-1
|
||||||
|
+CLEVIS_ALTERNATIVE_THP_ALGS=S256 # SHA-256
|
||||||
|
+
|
||||||
|
trust=
|
||||||
|
[ -n "${2}" ] && [ "${2}" == "-y" ] && trust=yes
|
||||||
|
|
||||||
|
@@ -111,15 +114,24 @@
|
||||||
|
if [ -z "$thp" ]; then
|
||||||
|
echo "The advertisement contains the following signing keys:" >&2
|
||||||
|
echo >&2
|
||||||
|
- jose jwk thp -i- <<< "$ver" >&2
|
||||||
|
+ jose jwk thp -i- -a "${CLEVIS_DEFAULT_THP_ALG}" <<< "$ver" >&2
|
||||||
|
echo >&2
|
||||||
|
read -r -p "Do you wish to trust these keys? [ynYN] " ans < /dev/tty
|
||||||
|
[[ "$ans" =~ ^[yY]$ ]] || exit 1
|
||||||
|
-
|
||||||
|
elif [ "$thp" != "any" ] && \
|
||||||
|
- ! jose jwk thp -i- -f "$thp" -o /dev/null <<< "$ver"; then
|
||||||
|
- echo "Trusted JWK '$thp' did not sign the advertisement!" >&2
|
||||||
|
- exit 1
|
||||||
|
+ ! jose jwk thp -i- -f "${thp}" -o /dev/null -a "${CLEVIS_DEFAULT_THP_ALG}" \
|
||||||
|
+ <<< "$ver"; then
|
||||||
|
+ # Thumbprint of trusted JWK did not match the signature. Let's check
|
||||||
|
+ # alternative thumbprints generated with clevis supported hash
|
||||||
|
+ # algorithms to be sure.
|
||||||
|
+ for alg in ${CLEVIS_ALTERNATIVE_THP_ALGS}; do
|
||||||
|
+ srv="$(jose jwk thp -i- -f "${thp}" -a "${alg}" <<< "${ver}")" \
|
||||||
|
+ && break
|
||||||
|
+ done
|
||||||
|
+ if [ -z "${srv}" ]; then
|
||||||
|
+ echo "Trusted JWK '$thp' did not sign the advertisement!" >&2
|
||||||
|
+ exit 1
|
||||||
|
+ fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
@@ -138,7 +150,7 @@
|
||||||
|
|
||||||
|
jwk="$(jose fmt -j- -Od key_ops -o- <<< "$jwk")"
|
||||||
|
jwk="$(jose fmt -j- -Od alg -o- <<< "$jwk")"
|
||||||
|
-kid="$(jose jwk thp -i- <<< "$jwk")"
|
||||||
|
+kid="$(jose jwk thp -i- -a "${CLEVIS_DEFAULT_THP_ALG}" <<< "$jwk")"
|
||||||
|
jwe='{"protected":{"alg":"ECDH-ES","enc":"A256GCM","clevis":{"pin":"tang","tang":{}}}}'
|
||||||
|
jwe="$(jose fmt -j "$jwe" -g protected -q "$kid" -s kid -UUo-)"
|
||||||
|
jwe="$(jose fmt -j "$jwe" -g protected -g clevis -g tang -q "$url" -s url -UUUUo-)"
|
||||||
|
--- clevis-15.ori/src/luks/tests/meson.build 2023-05-23 11:29:59.594464890 +0200
|
||||||
|
+++ clevis-15/src/luks/tests/meson.build 2023-05-23 12:00:10.811482757 +0200
|
||||||
|
@@ -113,6 +113,7 @@
|
||||||
|
test('report-sss-luks2', find_program('report-sss-luks2'), env: env, timeout: 120)
|
||||||
|
test('edit-tang-luks2', find_program('edit-tang-luks2'), env: env, timeout: 210)
|
||||||
|
test('pass-tang-luks2', find_program('pass-tang-luks2'), env: env, timeout: 60)
|
||||||
|
+ test('default-thp-alg', find_program('default-thp-alg'), env: env)
|
||||||
|
endif
|
||||||
|
|
||||||
|
test('backup-restore-luks2', find_program('backup-restore-luks2'), env: env, timeout: 120)
|
||||||
|
--- clevis-15.ori/src/luks/tests/default-thp-alg 1970-01-01 01:00:00.000000000 +0100
|
||||||
|
+++ clevis-15/src/luks/tests/default-thp-alg 2023-05-23 16:09:21.920385994 +0200
|
||||||
|
@@ -0,0 +1,120 @@
|
||||||
|
+#!/bin/bash
|
||||||
|
+set -exo pipefail
|
||||||
|
+# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80:
|
||||||
|
+#
|
||||||
|
+# Copyright (c) 2020 Red Hat, Inc.
|
||||||
|
+# Author: Sergio Correia <scorreia@redhat.com>
|
||||||
|
+#
|
||||||
|
+# This program is free software: you can redistribute it and/or modify
|
||||||
|
+# it under the terms of the GNU General Public License as published by
|
||||||
|
+# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
+# (at your option) any later version.
|
||||||
|
+#
|
||||||
|
+# This program is distributed in the hope that it will be useful,
|
||||||
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
+# GNU General Public License for more details.
|
||||||
|
+#
|
||||||
|
+# You should have received a copy of the GNU General Public License
|
||||||
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+. tests-common-functions
|
||||||
|
+
|
||||||
|
+TEST=$(basename "${0}")
|
||||||
|
+
|
||||||
|
+on_exit() {
|
||||||
|
+ exit_status=$?
|
||||||
|
+ tang_stop "${TMP}"
|
||||||
|
+ [ -d "${TMP}" ] && rm -rf "${TMP}"
|
||||||
|
+ exit "${exit_status}"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+trap 'on_exit' EXIT
|
||||||
|
+
|
||||||
|
+TMP="$(mktemp -d)"
|
||||||
|
+
|
||||||
|
+port=$(get_random_port)
|
||||||
|
+tang_run "${TMP}" "${port}"
|
||||||
|
+
|
||||||
|
+url="http://localhost:${port}"
|
||||||
|
+data="just a sample text"
|
||||||
|
+
|
||||||
|
+adv="${TMP}/adv"
|
||||||
|
+# Get the advertisement and extract the keys.
|
||||||
|
+tang_get_adv "${port}" "${adv}"
|
||||||
|
+
|
||||||
|
+jwks="$(jose fmt --json="${adv}" --get payload --b64load --output=-)"
|
||||||
|
+enc="$(printf '%s' "${jwks}" | jose jwk use --input=- --required \
|
||||||
|
+ --use deriveKey --output=-)"
|
||||||
|
+
|
||||||
|
+jose fmt --json="${enc}" --get keys --array \
|
||||||
|
+ || enc="$(printf '{"keys": [%s]}' "${enc}")"
|
||||||
|
+
|
||||||
|
+jwk="$(jose fmt --json="${enc}" --get keys --array --foreach=- \
|
||||||
|
+ | jose fmt --json=- --delete key_ops --delete alg --output=-)"
|
||||||
|
+
|
||||||
|
+jwe_t='{"protected":{"alg":"ECDH-ES","enc":"A256GCM","clevis":{"pin":"tang","tang":{}}}}'
|
||||||
|
+jwe_t="$(jose fmt --json="${jwe_t}" --get protected --get clevis --get tang --quote "${url}" --set url -UUUUo-)"
|
||||||
|
+jwe_t="$(printf '%s' "${jwks}" | jose fmt --json="${jwe_t}" --get protected --get clevis --get tang --json=- --set adv -UUUUo-)"
|
||||||
|
+
|
||||||
|
+# We currently support SHA-1 (legacy) and SHA-256.
|
||||||
|
+CLEVIS_SUPPORTED_THP_ALGS="S1 S256"
|
||||||
|
+# Now we will use every hash algorithm supported by jose to create a thumbprint
|
||||||
|
+# for `kid', then we do the encoding and verify clevis decrypt can decode it
|
||||||
|
+# correctly.
|
||||||
|
+for alg in ${CLEVIS_SUPPORTED_THP_ALGS}; do
|
||||||
|
+ kid="$(printf '%s' "${jwk}" | jose jwk thp -a "${alg}" --input=-)"
|
||||||
|
+ jwe="$(jose fmt --json="${jwe_t}" --get protected --quote "${kid}" -s kid -UUo-)"
|
||||||
|
+
|
||||||
|
+ encoded=$(printf '%s%s' "${jwk}" "${data}" \
|
||||||
|
+ | jose jwe enc --input="${jwe}" --key=- --detached=- --compact)
|
||||||
|
+
|
||||||
|
+ if ! decoded="$(printf '%s' "${encoded}" | clevis decrypt)"; then
|
||||||
|
+ tang_error "${TEST}: decoding is expected to work (alg = ${alg})"
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ if [ "${decoded}" != "${data}" ]; then
|
||||||
|
+ tang_error "${TEST}: tang decrypt should have succeeded decoded[${decoded}] data[${data}] (alg = ${alg})"
|
||||||
|
+ fi
|
||||||
|
+done
|
||||||
|
+
|
||||||
|
+# Now let's test encryption providing the thp in the configuration.
|
||||||
|
+data="just another test"
|
||||||
|
+for alg in ${CLEVIS_SUPPORTED_THP_ALGS}; do
|
||||||
|
+ thp="$(jose fmt --json="${adv}" -g payload -y -o- \
|
||||||
|
+ | jose jwk use -i- -r -u verify -o- \
|
||||||
|
+ | jose jwk thp -i- -a "${alg}")"
|
||||||
|
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
||||||
|
+ if ! encoded=$(printf '%s' "${data}" | clevis encrypt tang "${cfg}"); then
|
||||||
|
+ tang_error "${TEST}: tang encryption should have succeeded when providing the thp (${thp}) with any supported algorithm (${alg})"
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ if ! decoded="$(printf '%s' "${encoded}" | clevis decrypt)"; then
|
||||||
|
+ tang_error "${TEST}: decoding is expected to work (thp alg = ${alg})"
|
||||||
|
+ fi
|
||||||
|
+
|
||||||
|
+ if [ "${decoded}" != "${data}" ]; then
|
||||||
|
+ tang_error "${TEST}: tang decrypt should have succeeded decoded[${decoded}] data[${data}] (alg = ${alg})"
|
||||||
|
+ fi
|
||||||
|
+done
|
||||||
|
+
|
||||||
|
+# Let's also try some unsupported thp hash algorithms.
|
||||||
|
+UNSUPPORTED="S224 S384 S512" # SHA-224, SHA-384, SHA-512.
|
||||||
|
+for alg in ${UNSUPPORTED}; do
|
||||||
|
+ thp="$(jose fmt --json="${adv}" -g payload -y -o- \
|
||||||
|
+ | jose jwk use -i- -r -u verify -o- \
|
||||||
|
+ | jose jwk thp -i- -a "${alg}")"
|
||||||
|
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
||||||
|
+ if echo foo | clevis encrypt tang "${cfg}" >/dev/null; then
|
||||||
|
+ tang_error "${TEST}: tang encryption should have failed when providing the thp (${thp}) with an unsupported algorithm (${alg})"
|
||||||
|
+ fi
|
||||||
|
+done
|
||||||
|
+
|
||||||
|
+# Now let's try some bad values for thp.
|
||||||
|
+for thp in "" "foo" "invalid"; do
|
||||||
|
+ cfg="$(printf '{"url":"%s", "thp":"%s"}' "${url}" "${thp}")"
|
||||||
|
+ if echo foo | clevis encrypt tang "${cfg}" >/dev/null; then
|
||||||
|
+ tang_error "${TEST}: tang encryption expected to fail when providing a bad thp"
|
||||||
|
+ fi
|
||||||
|
+done
|
||||||
@ -1 +0,0 @@
|
|||||||
u clevis - "Clevis Decryption Framework unprivileged user" /var/cache/clevis /usr/sbin/nologin
|
|
||||||
Loading…
Reference in new issue